From 6aba82edb19e1e3d8278c0595060b33a89a4845c Mon Sep 17 00:00:00 2001
From: Enginex0 <enginex0@users.noreply.github.com>
Date: Mon, 9 Mar 2026 16:46:32 +0100
Subject: [PATCH] build(native-certgen): wire Rust crate into Gradle pipeline

cargo-ndk builds libcertgen.so for arm64-v8a during prepareModuleFiles.
AGP mergeJniLibFolders picks up jniLibs/ and routes through
stripped_native_libs into the module ZIP. customize.sh extracts the .so
on device install. ProGuard keeps NativeCertGen JNI class and
CertGenConfig fields for runtime JNI field access.
---
 app/build.gradle.kts   | 32 +++++++++++++++++++++++++++++++-
 app/proguard-rules.pro |  6 ++++++
 module/customize.sh    |  1 +
 3 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 06bef23..2271c6c 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -71,6 +71,35 @@ dependencies {
     implementation(libs.bcpkix)
 }
 
+// --- Rust native cert gen build task ---
+val buildRustCertgen by tasks.registering(Exec::class) {
+    group = "TEESimulator Native Build"
+    description = "Builds libcertgen.so via cargo-ndk for arm64-v8a."
+
+    workingDir = rootProject.projectDir.resolve("native-certgen")
+
+    commandLine(
+        "cargo", "ndk",
+        "-t", "arm64-v8a",
+        "-o", rootProject.projectDir.resolve("app/src/main/jniLibs").absolutePath,
+        "build", "--release"
+    )
+
+    inputs.dir(rootProject.projectDir.resolve("native-certgen/src"))
+    inputs.file(rootProject.projectDir.resolve("native-certgen/Cargo.toml"))
+    inputs.file(rootProject.projectDir.resolve("native-certgen/Cargo.lock"))
+    outputs.dir(rootProject.projectDir.resolve("app/src/main/jniLibs"))
+
+    environment("ANDROID_NDK_HOME", android.ndkDirectory.absolutePath)
+}
+
+// AGP auto-detects jniLibs/ as an input to mergeJniLibFolders — wire the dependency
+tasks.configureEach {
+    if (name.endsWith("JniLibFolders") && name.startsWith("merge")) {
+        dependsOn(buildRustCertgen)
+    }
+}
+
 androidComponents {
     onVariants(selector().all()) { variant ->
         val capitalized = variant.name.replaceFirstChar { it.uppercase() }
@@ -94,6 +123,7 @@ androidComponents {
                     dependsOn("minify${capitalized}WithR8")
                 }
                 dependsOn("strip${capitalized}DebugSymbols")
+                dependsOn(buildRustCertgen)
 
                 if (isDebug) {
                     from(variant.artifacts.get(SingleArtifact.APK)) {
@@ -116,7 +146,7 @@ androidComponents {
                     )
                 ) {
                     into("lib") // Place them in the 'lib' subfolder of the staging directory.
-                    include("**/libinject.so", "**/libTEESimulator.so", "**/libsupervisor.so")
+                    include("**/libinject.so", "**/libTEESimulator.so", "**/libsupervisor.so", "**/libcertgen.so")
                 }
 
                 // Now, copy and process the files from 'module' directory.
diff --git a/app/proguard-rules.pro b/app/proguard-rules.pro
index d4a7073..f2bd4d9 100644
--- a/app/proguard-rules.pro
+++ b/app/proguard-rules.pro
@@ -7,3 +7,9 @@
 -keepclasseswithmembers class org.matrix.TEESimulator.App {
     public static void main(java.lang.String[]);
 }
+
+-keepclasseswithmembers class org.matrix.TEESimulator.pki.NativeCertGen {
+    native <methods>;
+    *;
+}
+-keep class org.matrix.TEESimulator.pki.CertGenConfig { *; }
diff --git a/module/customize.sh b/module/customize.sh
index 5009546..169868d 100644
--- a/module/customize.sh
+++ b/module/customize.sh
@@ -68,6 +68,7 @@ ui_print "- Extracting $ARCH libraries"
 install_file "lib/$ABI_DIR/libTEESimulator.so" "$MODPATH"
 install_file "lib/$ABI_DIR/libinject.so" "$MODPATH"
 install_file "lib/$ABI_DIR/libsupervisor.so" "$MODPATH"
+install_file "lib/$ABI_DIR/libcertgen.so" "$MODPATH"
 ui_print ""
 
 mv "$MODPATH/libinject.so" "$MODPATH/inject"