android/docker: update makefile and dockerfile for build automation (#394)

android/docker: update makefile for build automation

Updates tailsale/corp#19670

Added a dockerfile to run the full release build in addition to the
shell environment.

The build will now look for JKS_PASSWORD in the environment for
completing the signing step without user interaction.

Several smaller recipes added to the makefile for building the
docker builder image, running and cleaning it up independently
to make debugging issues quicker.

Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>

Makefile

@@ -2,6 +2,9 @@
 # Use of this source code is governed by a BSD-style
 # license that can be found in the LICENSE file.
 
+## For signed release build JKS_PASSWORD must be set to the password for the jks keystore
+## and tailscale.jks must be present in the repo root.
+
 DEBUG_APK=tailscale-debug.apk
 RELEASE_AAB=tailscale-release.aab
 LIBTAILSCALE=android/libs/libtailscale.aar
@@ -82,7 +85,7 @@ tailscale-debug: $(DEBUG_APK) ## Build the debug APK
 
 .PHONY: release
 release: tailscale.jks $(RELEASE_AAB) ## Build the release AAB
-	jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -keystore tailscale.jks $(RELEASE_AAB) tailscale
+	jarsigner -sigalg SHA256withRSA -digestalg SHA-256 -keystore tailscale.jks -storepass $(JKS_PASSWORD) $(RELEASE_AAB) tailscale
 
 # gradle-dependencies groups together the android sources and libtailscale needed to assemble tests/debug/release builds.
 .PHONY: gradle-dependencies
@@ -196,13 +199,32 @@ install: $(DEBUG_APK) ## Install the debug APK on a connected device
 run: install ## Run the debug APK on a connected device
 	adb shell am start -n com.tailscale.ipn/com.tailscale.ipn.MainActivity
 
-.PHONY: dockershell
+.PHONY: docker-build-image
-dockershell: ## Run a shell in the Docker build container
+docker-build-image: ## Builds the docker image for the android build environment
-	docker build -t tailscale-android .
+	docker build  -f docker/DockerFile.amd64-build -t tailscale-android-build-amd64 .
-	docker run -v $(CURDIR):/build/tailscale-android -it --rm tailscale-android
+
+.PHONY: docker-run-build
+docker-run-build: tailscale.jks docker-build-image  ## Runs the docker image for the android build environment and builds release
+	@docker run -v $(CURDIR):/build/tailscale-android --env JKS_PASSWORD=$(JKS_PASSWORD) tailscale-android-build-amd64
+
+.PHONY: docker-remove-build-image
+docker-remove-build-image: ## Removes all docker build image
+	docker rmi --force tailscale-android-build-amd64
+
+.PHONY: docker-all ## Makes a fresh docker environment, builds docker and cleans up.  For CI.
+docker-all: docker-build-image docker-run-build docker-remove-build-image
+
+.PHONY: docker-shell
+docker-shell: ## Builds a docker image with the android build env and opens a shell
+	docker build  -f docker/DockerFile.amd64-shell -t tailscale-android-shell-amd64 .
+	docker run -v $(CURDIR):/build/tailscale-android -it tailscale-android-shell-amd64
+
+.PHONY: docker-remove-shell-image
+docker-remove-shell-image: ## Removes all docker shell image
+	docker rmi --force tailscale-android-shell-amd64
 
 .PHONY: clean
-clean: ## Remove build artifacts
+clean: ## Remove build artifacts.  Does not purge docker build envs.  Use dockerRemoveEnv for that.
 	-rm -rf android/build $(DEBUG_APK) $(RELEASE_AAB) $(LIBTAILSCALE) android/libs *.apk *.aab
 	-pkill -f gradle
 

docker/DockerFile.amd64-build

@@ -0,0 +1,47 @@
+# This is a Dockerfile for creating a build environment for
+# tailscale-android.
+
+FROM --platform=linux/amd64 eclipse-temurin:20-jdk
+
+# To enable running android tools such as aapt
+RUN apt-get update && apt-get -y upgrade
+RUN apt-get install -y libz1 libstdc++6 unzip
+# For Go:
+RUN apt-get -y --no-install-recommends install curl gcc
+RUN apt-get -y --no-install-recommends install ca-certificates libc6-dev git
+
+RUN apt-get -y install make
+
+RUN mkdir -p build
+ENV HOME /build
+
+# Make android sdk location, the later make step will populate it.
+RUN mkdir android-sdk
+ENV ANDROID_HOME $HOME/android-sdk
+ENV ANDROID_SDK_ROOT $ANDROID_HOME
+ENV PATH $PATH:$HOME/bin:$ANDROID_HOME/platform-tools
+
+# We need some version of Go new enough to support the "embed" package
+# to run "go run tailscale.com/cmd/printdep" to figure out which Tailscale Go
+# version we need later, but otherwise this toolchain isn't used:
+RUN curl -L https://go.dev/dl/go1.22.0.linux-amd64.tar.gz | tar -C /usr/local -zxv
+RUN ln -s /usr/local/go/bin/go /usr/bin
+
+RUN mkdir -p $HOME/tailscale-android
+RUN git config --global --add safe.directory $HOME/tailscale-android
+WORKDIR $HOME/tailscale-android
+
+COPY Makefile Makefile
+
+# Get android sdk, ndk, and rest of the stuff needed to build the android app.
+RUN make androidsdk
+
+# Preload Gradle
+COPY android/gradlew android/gradlew
+COPY android/gradle android/gradle
+RUN ./android/gradlew
+
+# Build the android app
+CMD make clean
+CMD make release
+

docker/DockerFile.amd64-shell

@@ -31,8 +31,8 @@ RUN mkdir -p $HOME/tailscale-android
 RUN git config --global --add safe.directory $HOME/tailscale-android
 WORKDIR $HOME/tailscale-android
 
-# Preload Android SDK
 COPY Makefile Makefile
+
 # Get android sdk, ndk, and rest of the stuff needed to build the android app.
 RUN make androidsdk
 
@@ -41,4 +41,7 @@ COPY android/gradlew android/gradlew
 COPY android/gradle android/gradle
 RUN ./android/gradlew
 
+# Run a shell
 CMD /bin/bash
+
+