Build SQLCipher from configured version

Author: 0pen1

.github/workflows/build.yml

@@ -17,7 +17,6 @@ jobs:
       ANDROID_NDK_VERSION: 26.3.11579264
       ANDROID_NDK_HOME: ${{ github.workspace }}/android-sdk/ndk/26.3.11579264
       ANDROID_HOME: ${{ github.workspace }}/android-sdk
-      USE_GITHUB_TAG_AS_SQLCIPHER_REF: "1"
     steps:
       - uses: actions/checkout@v4
 
@@ -44,4 +43,4 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release create "${GITHUB_REF_NAME}" dist/* --title "${GITHUB_REF_NAME}" --notes "SQLCipher Android CLI build from sqlcipher/sqlcipher@${GITHUB_REF_NAME}."
+          gh release create "${GITHUB_REF_NAME}" dist/* --title "${GITHUB_REF_NAME}" --notes "SQLCipher Android CLI build from the SQLCipher version configured in config/versions.env."

README.md

@@ -80,30 +80,30 @@ SELECT * FROM t;
 
 ## Version Policy
 
-Edit `config/versions.env` to change upstream refs:
+Edit `config/versions.env` to change the upstream SQLCipher version:
 
 ```text
-SQLCIPHER_REF=refs/heads/master
+SQLCIPHER_REPO=sqlcipher/sqlcipher
+SQLCIPHER_VERSION=4.16.0
+SQLCIPHER_REF=
 LIBTOMCRYPT_REF=refs/tags/v1.18.2
 LIBTOMMATH_REF=refs/tags/v1.3.0
 ```
 
-For reproducible local builds, pin `SQLCIPHER_REF` to an upstream tag or commit ref instead of `refs/heads/master`.
+By default, `SQLCIPHER_VERSION=4.16.0` downloads:
 
-Release tags in this repository should match official SQLCipher tags. For example:
-
-```bash
-git tag v4.6.1
-git push origin v4.6.1
+```text
+sqlcipher/sqlcipher@refs/tags/v4.16.0
 ```
 
-When GitHub Actions runs from a tag, it ignores the default `SQLCIPHER_REF` value and downloads:
+Use `SQLCIPHER_REF` only for non-standard builds, such as a branch or a specific commit archive ref.
 
-```text
-sqlcipher/sqlcipher@refs/tags/<tag>
-```
+Release tags in this repository should normally match `SQLCIPHER_VERSION`. For example, when `SQLCIPHER_VERSION=4.16.0`:
 
-If the matching upstream SQLCipher tag does not exist, the release build fails instead of publishing a mismatched binary.
+```bash
+git tag v4.16.0
+git push origin v4.16.0
+```
 
 ## Compatibility Notes
 

config/versions.env

@@ -1,6 +1,9 @@
-# Official source refs. Use full refs so GitHub codeload resolves branches/tags consistently.
+# Official SQLCipher version. This maps to the upstream tag v${SQLCIPHER_VERSION}.
 SQLCIPHER_REPO=sqlcipher/sqlcipher
-SQLCIPHER_REF=refs/heads/master
+SQLCIPHER_VERSION=4.16.0
+
+# Optional override for non-release builds. Leave empty to use SQLCIPHER_VERSION.
+SQLCIPHER_REF=
 
 # SQLCipher crypto provider used by this builder.
 # LibTomCrypt is one of the providers supported by upstream SQLCipher and keeps

scripts/build.sh

@@ -28,6 +28,15 @@ SQLCIPHER_SRC="$SRC_DIR/sqlcipher"
 AMALGAMATION_DIR="$BUILD_DIR/amalgamation"
 
 prepare_sqlcipher_amalgamation() {
+  local marker="$AMALGAMATION_DIR/.builder-source"
+  local expected="${SQLCIPHER_REPO:-sqlcipher/sqlcipher}@$SQLCIPHER_REF"
+
+  if [[ -d "$AMALGAMATION_DIR" ]]; then
+    if [[ ! -f "$marker" || "$(cat "$marker")" != "$expected" ]]; then
+      rm -rf "$AMALGAMATION_DIR"
+    fi
+  fi
+
   if [[ -s "$AMALGAMATION_DIR/sqlite3.c" && -s "$AMALGAMATION_DIR/shell.c" ]]; then
     return
   fi
@@ -36,6 +45,7 @@ prepare_sqlcipher_amalgamation() {
   rm -rf "$AMALGAMATION_DIR"
   mkdir -p "$AMALGAMATION_DIR"
   cp -R "$SQLCIPHER_SRC/." "$AMALGAMATION_DIR/"
+  printf '%s\n' "$expected" > "$marker"
   (
     cd "$AMALGAMATION_DIR"
     ./configure --with-tempstore=yes \
@@ -134,4 +144,3 @@ done
 
 echo "Build outputs:"
 find "$BUILD_DIR/out" -type f -name sqlcipher -print
-

scripts/common.sh

@@ -9,8 +9,16 @@ if [[ -f "$CONFIG_FILE" ]]; then
   source "$CONFIG_FILE"
 fi
 
-if [[ "${USE_GITHUB_TAG_AS_SQLCIPHER_REF:-0}" == "1" && "${GITHUB_REF_TYPE:-}" == "tag" && -n "${GITHUB_REF_NAME:-}" ]]; then
-  SQLCIPHER_REF="refs/tags/$GITHUB_REF_NAME"
+if [[ -z "${SQLCIPHER_REF:-}" ]]; then
+  if [[ -n "${SQLCIPHER_VERSION:-}" ]]; then
+    if [[ "$SQLCIPHER_VERSION" == v* ]]; then
+      SQLCIPHER_REF="refs/tags/$SQLCIPHER_VERSION"
+    else
+      SQLCIPHER_REF="refs/tags/v$SQLCIPHER_VERSION"
+    fi
+  else
+    SQLCIPHER_REF="refs/heads/master"
+  fi
 fi
 
 BUILD_DIR="${BUILD_DIR:-$ROOT_DIR/build}"

scripts/fetch.sh

@@ -10,12 +10,21 @@ download_archive() {
   local repo="$1"
   local ref="$2"
   local name="$3"
-  local archive="$DOWNLOAD_DIR/$name.tar.gz"
+  local safe_ref="${ref//\//_}"
+  local archive="$DOWNLOAD_DIR/$name-$safe_ref.tar.gz"
   local target="$SRC_DIR/$name"
   local tmp="$SRC_DIR/.extract-$name"
+  local marker="$target/.builder-source"
+  local expected="$repo@$ref"
 
   mkdir -p "$DOWNLOAD_DIR" "$SRC_DIR"
 
+  if [[ -d "$target" ]]; then
+    if [[ ! -f "$marker" || "$(cat "$marker")" != "$expected" ]]; then
+      rm -rf "$target"
+    fi
+  fi
+
   if [[ ! -s "$archive" ]]; then
     echo "Downloading $repo@$ref"
     curl -L --fail --retry 3 --connect-timeout 30 \
@@ -34,6 +43,7 @@ download_archive() {
       exit 1
     fi
     mv "$extracted" "$target"
+    printf '%s\n' "$expected" > "$marker"
     rm -rf "$tmp"
   fi
 }
@@ -43,4 +53,3 @@ download_archive "${LIBTOMCRYPT_REPO:-libtom/libtomcrypt}" "${LIBTOMCRYPT_REF:-r
 download_archive "${LIBTOMMATH_REPO:-libtom/libtommath}" "${LIBTOMMATH_REF:-refs/tags/v1.3.0}" libtommath
 
 echo "Sources are ready under $SRC_DIR"
-

scripts/package.sh

@@ -8,7 +8,7 @@ require_cmd shasum
 
 mkdir -p "$DIST_DIR"
 
-version="${GITHUB_REF_NAME:-}"
+version=""
 if [[ -z "$version" && -f "$BUILD_DIR/amalgamation/sqlite3.c" ]]; then
   version="$(sed -n 's/^#define CIPHER_VERSION_NUMBER[[:space:]]\{1,\}\([0-9][0-9.]*\)$/v\1/p' "$BUILD_DIR/amalgamation/sqlite3.c" | head -1)"
 fi