canopus 0.4.0 → 0.5.0

data/tools/package.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require "digest"
 require "optparse"
 require "rbconfig"
 require "cgi"
@@ -10,8 +11,7 @@ require "shellwords"
 module CanopusPackage
   module_function
 
-  # Packages the source distribution; never downloads or bundles Ruby or gems.
-  def build(platform:, output:, ruby: nil, source: File.expand_path("..", __dir__))
+  def build(platform:, output:, ruby: nil, ruby_root: nil, source: File.expand_path("..", __dir__))
     raise ArgumentError, "platform must be mac, linux, or windows" unless %w[mac linux windows].include?(platform)
     output, source = File.expand_path(output), File.realpath(source)
     raise ArgumentError, "output cannot contain control characters" if output.match?(/[\x00-\x1f\x7f]/)
@@ -30,13 +30,14 @@ module CanopusPackage
       candidates = [path, *Dir.glob(File.join(path, "**", "*"), File::FNM_DOTMATCH)]
       raise ArgumentError, "source distribution contains symlinks" if candidates.any? { |candidate| File.symlink?(candidate) }
     end
-    runtime = File.join(output, platform == "mac" ? "Contents/Resources/canopus" : "share/canopus")
-    FileUtils.mkdir_p(runtime)
-    entries.each { |entry| FileUtils.cp_r(entry, runtime, preserve: true) }
+    application_root = File.join(output, platform == "mac" ? "Contents/Resources/canopus" : "share/canopus")
+    FileUtils.mkdir_p(application_root)
+    entries.each { |entry| FileUtils.cp_r(entry, application_root, preserve: true) }
+    bundled_ruby = ruby_root && bundle_ruby(ruby_root, output)
     case platform
     when "mac"
       executable = File.join(output, "Contents", "MacOS", "canopus")
-      shell_launcher(executable, ruby, "../Resources/canopus/exe/canopus")
+      shell_launcher(executable, ruby, "../Resources/canopus/exe/canopus", bundled_ruby && "../Resources/runtime/#{bundled_ruby}")
       File.write(File.join(output, "Contents", "Info.plist"), <<~PLIST)
         <?xml version="1.0" encoding="UTF-8"?>
         <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -50,11 +51,20 @@ module CanopusPackage
           <key>CFBundleVersion</key><string>#{CGI.escapeHTML(version)}</string>
           <key>NSHighResolutionCapable</key><true/>
           <key>NSSupportsAutomaticGraphicsSwitching</key><true/>
+          <key>CFBundleDocumentTypes</key>
+          <array><dict>
+            <key>CFBundleTypeName</key><string>Text Document</string>
+            <key>CFBundleTypeRole</key><string>Editor</string>
+            <key>CFBundleTypeExtensions</key>
+            <array><string>txt</string><string>md</string><string>markdown</string><string>rb</string><string>json</string><string>xml</string></array>
+            <key>LSItemContentTypes</key>
+            <array><string>public.plain-text</string><string>net.daringfireball.markdown</string><string>public.json</string><string>public.xml</string></array>
+          </dict></array>
         </dict></plist>
       PLIST
     when "linux"
       executable = File.join(output, "bin", "canopus")
-      shell_launcher(executable, ruby, "../share/canopus/exe/canopus")
+      shell_launcher(executable, ruby, "../share/canopus/exe/canopus", bundled_ruby && "../runtime/#{bundled_ruby}")
       desktop = File.join(output, "share", "applications", "canopus.desktop")
       FileUtils.mkdir_p(File.dirname(desktop))
       quoted = executable.gsub(/[\\"`$%]/) { |character| character == "%" ? "%%" : character == "\\" ? "\\" * 4 : "\\" * 2 + character }
@@ -66,12 +76,14 @@ module CanopusPackage
         Exec="#{quoted}" %F
         Terminal=false
         Categories=Development;TextEditor;
-        MimeType=text/plain;
+        MimeType=text/plain;text/markdown;application/json;application/xml;text/x-ruby;
         StartupNotify=true
       DESKTOP
+      write_linux_installers(output)
     when "windows"
       executable = File.join(output, "canopus.cmd")
-      File.write(executable, "@echo off\r\nsetlocal DisableDelayedExpansion\r\n\"#{ruby.gsub('%', '%%')}\" \"%~dp0share\\canopus\\exe\\canopus\" %*\r\nexit /b %errorlevel%\r\n")
+      command = bundled_ruby ? "%~dp0runtime\\#{bundled_ruby.tr('/', '\\')}" : ruby.gsub('%', '%%')
+      File.write(executable, "@echo off\r\nsetlocal DisableDelayedExpansion\r\n\"#{command}\" \"%~dp0share\\canopus\\exe\\canopus\" %*\r\nexit /b %errorlevel%\r\n")
       File.write(File.join(output, "Create-Shortcut.ps1"), <<~POWERSHELL.gsub("\n", "\r\n"))
         param([string]$Destination = [Environment]::GetFolderPath('Desktop'))
         $ErrorActionPreference = 'Stop'
@@ -82,30 +94,176 @@ module CanopusPackage
         $shortcut.Description = 'Canopus text editor (requires CRuby 3.1+)'
         $shortcut.Save()
       POWERSHELL
+      write_windows_installers(output, version)
     end
-    File.write(File.join(output, "package.json"), JSON.pretty_generate({name: "canopus", version: version, platform: platform, ruby: ruby, bundled_ruby: false}) + "\n")
+    metadata = {name: "canopus", version: version, platform: platform, ruby: bundled_ruby ? "runtime/#{bundled_ruby}" : ruby, bundled_ruby: !bundled_ruby.nil?}
+    File.write(File.join(output, "package.json"), JSON.pretty_generate(metadata) + "\n")
+    write_manifest(output, version)
     executable
   end
 
-  def shell_launcher(path, ruby, relative)
+  def bundle_ruby(root, output)
+    root = File.realpath(root)
+    raise ArgumentError, "ruby root must be a directory" unless File.directory?(root)
+    raise ArgumentError, "package output cannot be inside ruby root" if output.start_with?(root + File::SEPARATOR)
+    files = Dir.glob(File.join(root, "**", "*"), File::FNM_DOTMATCH).reject { |path| [".", ".."].include?(File.basename(path)) }
+    raise ArgumentError, "ruby root contains symlinks" if files.any? { |path| File.symlink?(path) }
+    relative = if File.file?(File.join(root, "bin", "ruby"))
+      "bin/ruby"
+    elsif File.file?(File.join(root, "bin", "ruby.exe"))
+      "bin/ruby.exe"
+    else
+      raise ArgumentError, "ruby root must contain bin/ruby or bin/ruby.exe"
+    end
+    destination = File.join(output, "runtime")
+    FileUtils.mkdir_p(destination)
+    Dir.children(root).each { |entry| FileUtils.cp_r(File.join(root, entry), destination, preserve: true) }
+    relative
+  end
+
+  def write_manifest(output, version)
+    files = Dir.glob(File.join(output, "**", "*"), File::FNM_DOTMATCH).filter_map do |path|
+      next unless File.file?(path) && !File.symlink?(path)
+
+      [path.delete_prefix(output + File::SEPARATOR), Digest::SHA256.file(path).hexdigest]
+    end.to_h
+    File.write(File.join(output, "manifest.json"), JSON.pretty_generate(version: version, algorithm: "SHA-256", files: files) + "\n")
+  end
+
+  def shell_launcher(path, ruby, relative, bundled = nil)
     FileUtils.mkdir_p(File.dirname(path))
+    command = bundled ? '"$here/' + bundled + '"' : Shellwords.escape(ruby)
     File.write(path, <<~SH)
       #!/bin/sh
       set -eu
       here=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-      exec #{Shellwords.escape(ruby)} --yjit "$here/#{relative}" "$@"
+      exec #{command} --yjit "$here/#{relative}" "$@"
     SH
     File.chmod(0o755, path)
   end
+
+  def write_linux_installers(output)
+    File.write(File.join(output, "Install.sh"), <<~SH)
+      #!/bin/sh
+      set -eu
+      package=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+      root=${XDG_DATA_HOME:-"$HOME/.local/share"}/canopus
+      applications=${XDG_DATA_HOME:-"$HOME/.local/share"}/applications
+      desktop="$applications/canopus.desktop"
+      marker="$root/.canopus-installed"
+      if [ -e "$root" ]; then
+        printf '%s\n' "Canopus is already installed in $root; run Uninstall.sh first" >&2
+        exit 1
+      fi
+      if [ -e "$desktop" ] && ! grep -q '^# canopus-managed$' "$desktop"; then
+        printf '%s\n' "Refusing to replace existing desktop entry: $desktop" >&2
+        exit 1
+      fi
+      mkdir -p "$root" "$applications"
+      cp -R "$package/." "$root/"
+      printf '%s\n' canopus-installed > "$marker"
+      cat > "$desktop" <<DESKTOP
+      # canopus-managed
+      [Desktop Entry]
+      Type=Application
+      Name=Canopus
+      Comment=Pure Ruby text editor
+      Exec="$root/bin/canopus" %F
+      Terminal=false
+      Categories=Development;TextEditor;
+      MimeType=text/plain;text/markdown;application/json;application/xml;text/x-ruby;
+      StartupNotify=true
+      DESKTOP
+      command -v update-desktop-database >/dev/null 2>&1 && update-desktop-database "$applications" || true
+      printf '%s\n' "Installed Canopus in $root"
+    SH
+    File.chmod(0o755, File.join(output, "Install.sh"))
+    File.write(File.join(output, "Uninstall.sh"), <<~SH)
+      #!/bin/sh
+      set -eu
+      root=${XDG_DATA_HOME:-"$HOME/.local/share"}/canopus
+      applications=${XDG_DATA_HOME:-"$HOME/.local/share"}/applications
+      marker="$root/.canopus-installed"
+      [ -f "$marker" ] && grep -qx canopus-installed "$marker" || {
+        printf '%s\n' "Canopus install marker is missing: $root" >&2
+        exit 1
+      }
+      rm -rf -- "$root"
+      desktop="$applications/canopus.desktop"
+      if [ -f "$desktop" ] && grep -q '^# canopus-managed$' "$desktop"; then
+        rm -f -- "$desktop"
+      fi
+      command -v update-desktop-database >/dev/null 2>&1 && update-desktop-database "$applications" || true
+      printf '%s\n' "Uninstalled Canopus"
+    SH
+    File.chmod(0o755, File.join(output, "Uninstall.sh"))
+  end
+
+  def write_windows_installers(output, version)
+    installers = {
+      "Install.ps1" => <<~POWERSHELL,
+        param([string]$Destination = (Join-Path $env:LOCALAPPDATA 'Canopus'))
+        $ErrorActionPreference = 'Stop'
+        $package = Split-Path -Parent $MyInvocation.MyCommand.Path
+        if (Test-Path -LiteralPath $Destination) { throw "Destination already exists: $Destination" }
+        $progId = 'Canopus.Document'
+        $class = "Registry::HKEY_CURRENT_USER\\Software\\Classes\\$progId"
+        if (Test-Path -LiteralPath $class) { throw "ProgID already exists; uninstall first: $progId" }
+        New-Item -ItemType Directory -Force -Path $Destination | Out-Null
+        Copy-Item -Path (Join-Path $package '*') -Destination $Destination -Recurse -Force
+        New-Item -Force -Path "$class\\shell\\open\\command" | Out-Null
+        Set-ItemProperty -Path $class -Name '(Default)' -Value 'Canopus document'
+        Set-ItemProperty -Path "$class\\shell\\open\\command" -Name '(Default)' -Value ('"' + $Destination + '\\canopus.cmd" "%1"')
+        Set-ItemProperty -Path $class -Name 'FriendlyTypeName' -Value 'Canopus document'
+        Set-ItemProperty -Path $class -Name CanopusManaged -Value 1
+        foreach ($extension in @('.txt', '.md', '.markdown', '.rb', '.json', '.xml')) {
+          $openWith = "Registry::HKEY_CURRENT_USER\\Software\\Classes\\$extension\\OpenWithProgids"
+          New-Item -Force -Path $openWith | Out-Null
+          New-ItemProperty -Force -Path $openWith -Name $progId -Value '' | Out-Null
+        }
+        $uninstall = 'Registry::HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Canopus'
+        New-Item -Force -Path $uninstall | Out-Null
+        Set-ItemProperty -Path $uninstall -Name DisplayName -Value 'Canopus'
+        Set-ItemProperty -Path $uninstall -Name DisplayVersion -Value '#{version}'
+        Set-ItemProperty -Path $uninstall -Name InstallLocation -Value $Destination
+        Set-ItemProperty -Path $uninstall -Name UninstallString -Value ('powershell.exe -ExecutionPolicy Bypass -File "' + $Destination + '\\Uninstall.ps1"')
+        Write-Output "Installed Canopus in $Destination"
+      POWERSHELL
+      "Uninstall.ps1" => <<~POWERSHELL
+        param([string]$Destination = $PSScriptRoot)
+        $ErrorActionPreference = 'Stop'
+        $progId = 'Canopus.Document'
+        $uninstall = 'Registry::HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Canopus'
+        $record = Get-ItemProperty -Path $uninstall -ErrorAction SilentlyContinue
+        if (!$record -or $record.InstallLocation -ne $Destination) { throw "Canopus install record does not match: $Destination" }
+        $class = "Registry::HKEY_CURRENT_USER\\Software\\Classes\\$progId"
+        $owner = Get-ItemProperty -Path $class -Name CanopusManaged -ErrorAction SilentlyContinue
+        if ($owner.CanopusManaged -ne 1) { throw "Canopus ProgID is not managed by this installer" }
+        foreach ($extension in @('.txt', '.md', '.markdown', '.rb', '.json', '.xml')) {
+          $openWith = "Registry::HKEY_CURRENT_USER\\Software\\Classes\\$extension\\OpenWithProgids"
+          Remove-ItemProperty -Path $openWith -Name $progId -ErrorAction SilentlyContinue
+        }
+        Remove-Item -LiteralPath $class -Recurse -Force -ErrorAction SilentlyContinue
+        Remove-Item -LiteralPath $uninstall -Recurse -Force -ErrorAction SilentlyContinue
+        if (Test-Path -LiteralPath $Destination) { Remove-Item -LiteralPath $Destination -Recurse -Force }
+        Write-Output 'Uninstalled Canopus'
+      POWERSHELL
+    }
+    installers.each do |name, contents|
+      path = File.join(output, name)
+      File.write(path, contents.gsub("\n", "\r\n"))
+    end
+  end
 end
 
 if $PROGRAM_NAME == __FILE__
   options = {}
   parser = OptionParser.new do |flags|
-    flags.banner = "Usage: ruby tools/package.rb --platform mac|linux|windows --output PATH [--ruby PATH]"
+    flags.banner = "Usage: ruby tools/package.rb --platform mac|linux|windows --output PATH [--ruby PATH|--ruby-root DIRECTORY]"
     flags.on("--platform NAME") { |value| options[:platform] = value }
     flags.on("--output PATH") { |value| options[:output] = value }
-    flags.on("--ruby PATH", "System Ruby executable; no runtime is bundled") { |value| options[:ruby] = value }
+    flags.on("--ruby PATH", "System Ruby executable when no runtime is bundled") { |value| options[:ruby] = value }
+    flags.on("--ruby-root DIRECTORY", "Relocatable Ruby root containing bin/ruby") { |value| options[:ruby_root] = value }
   end
   parser.parse!
   abort parser.to_s unless options[:platform] && options[:output]

data/tools/package_signature_test.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+require "openssl"
+require "tmpdir"
+require_relative "sign_package"
+
+Dir.mktmpdir("canopus-signature-") do |directory|
+  package = File.join(directory, "package")
+  FileUtils.mkdir_p(package)
+  File.write(File.join(package, "canopus.txt"), "package\n")
+  manifest = {"version" => "0.0.0", "algorithm" => "SHA-256", "files" => {"canopus.txt" => Digest::SHA256.file(File.join(package, "canopus.txt")).hexdigest}}
+  File.write(File.join(package, "manifest.json"), JSON.pretty_generate(manifest) + "\n")
+
+  key = OpenSSL::PKey::RSA.new(2048)
+  private_key = File.join(directory, "private.pem")
+  public_key = File.join(directory, "public.pem")
+  File.open(private_key, "w", 0o600) { |file| file.write(key.to_pem) }
+  File.write(public_key, key.public_key.to_pem)
+
+  CanopusPackageSignature.sign(package, private_key)
+  raise "signature did not verify" unless CanopusPackageSignature.verify(package, public_key)
+
+  File.open(File.join(package, "canopus.txt"), "a") { |file| file << "tampered\n" }
+  begin
+    CanopusPackageSignature.verify(package, public_key)
+    raise "tampered package was accepted"
+  rescue CanopusPackageSignature::Error => error
+    raise unless error.message.include?("manifest hash mismatch")
+  end
+end
+puts "Package signing and verification passed."

data/tools/package_test.rb

@@ -3,6 +3,7 @@
 require "tmpdir"
 require "open3"
 require_relative "package"
+require "fileutils"
 
 Dir.mktmpdir("canopus-package-") do |directory|
   %w[mac linux windows].each do |platform|
@@ -10,6 +11,24 @@ Dir.mktmpdir("canopus-package-") do |directory|
     launcher = CanopusPackage.build(platform: platform, output: output)
     metadata = JSON.parse(File.read(File.join(output, "package.json")))
     raise "runtime must not be bundled" unless metadata["bundled_ruby"] == false
+    manifest = JSON.parse(File.read(File.join(output, "manifest.json")))
+    raise "manifest algorithm" unless manifest["algorithm"] == "SHA-256"
+    raise "manifest missing package metadata" unless manifest["files"].key?("package.json")
+    case platform
+    when "mac"
+      raise "missing mac document types" unless File.read(File.join(output, "Contents", "Info.plist")).include?("CFBundleDocumentTypes")
+    when "linux"
+      raise "missing Linux installer" unless File.executable?(File.join(output, "Install.sh")) && File.executable?(File.join(output, "Uninstall.sh"))
+      raise "missing Linux MIME associations" unless File.read(File.join(output, "share", "applications", "canopus.desktop")).include?("text/markdown")
+      raise "Linux installer missing ownership marker" unless File.read(File.join(output, "Install.sh")).include?("canopus-installed")
+      raise "Linux installer missing manifest entry" unless manifest["files"].key?("Install.sh")
+    when "windows"
+      raise "missing Windows installer" unless File.file?(File.join(output, "Install.ps1")) && File.file?(File.join(output, "Uninstall.ps1"))
+      installer = File.read(File.join(output, "Install.ps1"))
+      raise "missing Windows ProgID" unless installer.include?("Canopus.Document") && installer.include?("Copy-Item -Path")
+      raise "Windows installer missing ownership marker" unless installer.include?("CanopusManaged")
+      raise "Windows installer missing manifest entry" unless manifest["files"].key?("Install.ps1")
+    end
     if platform == "windows"
       raise "missing shortcut installer" unless File.file?(File.join(output, "Create-Shortcut.ps1"))
       raise "unsafe launcher argument forwarding" unless File.read(launcher).include?("%*")
@@ -29,4 +48,14 @@ Dir.mktmpdir("canopus-package-") do |directory|
     end
   end
 end
+Dir.mktmpdir("canopus-ruby-root-") do |directory|
+  root = File.join(directory, "ruby")
+  FileUtils.mkdir_p(File.join(root, "bin"))
+  FileUtils.cp(RbConfig.ruby, File.join(root, "bin", "ruby"))
+  output = File.join(directory, "bundled")
+  CanopusPackage.build(platform: "linux", output: output, ruby_root: root)
+  metadata = JSON.parse(File.read(File.join(output, "package.json")))
+  raise "bundled runtime metadata" unless metadata["bundled_ruby"] && metadata["ruby"] == "runtime/bin/ruby"
+  raise "bundled launcher path" unless File.read(File.join(output, "bin", "canopus")).include?("../runtime/bin/ruby")
+end
 puts "Package layouts, launchers, and headless rendering passed (Windows runtime not executed)."

data/tools/sign_package.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "base64"
+require "digest"
+require "json"
+require "openssl"
+require "optparse"
+require "tempfile"
+
+module CanopusPackageSignature
+  ALGORITHM = "RSA-SHA256"
+  SIGNATURE_FILE = "signature.json"
+  MANIFEST_FILE = "manifest.json"
+
+  class Error < StandardError; end
+
+  module_function
+
+  def sign(package, private_key_path)
+    package = package_directory(package)
+    key = OpenSSL::PKey.read(File.binread(private_key_path))
+    raise Error, "an RSA private key is required" unless key.is_a?(OpenSSL::PKey::RSA) && key.private?
+
+    payload = File.binread(File.join(package, MANIFEST_FILE))
+    signature = {
+      "version" => 1,
+      "algorithm" => ALGORITHM,
+      "manifest" => MANIFEST_FILE,
+      "key_id" => Digest::SHA256.hexdigest(key.public_key.to_der),
+      "signature" => Base64.strict_encode64(key.sign(OpenSSL::Digest::SHA256.new, payload))
+    }
+    atomic_write(File.join(package, SIGNATURE_FILE), JSON.pretty_generate(signature) + "\n")
+    signature
+  rescue Errno::ENOENT => error
+    raise Error, error.message
+  rescue ArgumentError, OpenSSL::OpenSSLError, JSON::ParserError => error
+    raise Error, "cannot sign package: #{error.message}"
+  end
+
+  def verify(package, public_key_path)
+    package = package_directory(package)
+    metadata = JSON.parse(File.read(File.join(package, SIGNATURE_FILE)))
+    raise Error, "unsupported package signature" unless metadata["version"] == 1 && metadata["algorithm"] == ALGORITHM && metadata["manifest"] == MANIFEST_FILE
+
+    key = OpenSSL::PKey.read(File.binread(public_key_path)).public_key
+    raise Error, "an RSA public key is required" unless key.is_a?(OpenSSL::PKey::RSA)
+    raise Error, "package signature key does not match" unless metadata["key_id"] == Digest::SHA256.hexdigest(key.to_der)
+
+    payload = File.binread(File.join(package, MANIFEST_FILE))
+    signature = Base64.strict_decode64(metadata.fetch("signature"))
+    valid = key.verify(OpenSSL::Digest::SHA256.new, signature, payload)
+    raise Error, "package signature is invalid" unless valid
+
+    verify_manifest(package, JSON.parse(payload))
+    true
+  rescue Errno::ENOENT, JSON::ParserError, ArgumentError => error
+    raise Error, "cannot verify package: #{error.message}"
+  rescue OpenSSL::OpenSSLError => error
+    raise Error, "cannot verify package: #{error.message}"
+  end
+
+  def package_directory(package)
+    package = File.realpath(package)
+    raise Error, "package must be a directory" unless File.directory?(package)
+
+    package
+  rescue Errno::ENOENT => error
+    raise Error, error.message
+  end
+  private_class_method :package_directory
+
+  def verify_manifest(package, manifest)
+    raise Error, "invalid package manifest" unless manifest["algorithm"] == "SHA-256" && manifest["files"].is_a?(Hash)
+
+    manifest["files"].each do |relative, digest|
+      raise Error, "invalid manifest entry" unless relative.is_a?(String) && digest.is_a?(String) && digest.match?(/\A[0-9a-f]{64}\z/)
+      path = File.expand_path(relative, package)
+      raise Error, "manifest path escapes package" unless path.start_with?(package + File::SEPARATOR) && !File.symlink?(path)
+      raise Error, "manifest file is missing: #{relative}" unless File.file?(path)
+      raise Error, "manifest hash mismatch: #{relative}" unless Digest::SHA256.file(path).hexdigest == digest
+    end
+  end
+  private_class_method :verify_manifest
+
+  def atomic_write(path, content)
+    Tempfile.create([".signature-", ".json"], File.dirname(path)) do |file|
+      file.write(content)
+      file.flush
+      file.fsync
+      file.close
+      File.rename(file.path, path)
+    end
+  rescue SystemCallError => error
+    raise Error, "cannot write package signature: #{error.message}"
+  end
+  private_class_method :atomic_write
+end
+
+if $PROGRAM_NAME == __FILE__
+  options = {}
+  parser = OptionParser.new do |flags|
+    flags.banner = "Usage: ruby tools/sign_package.rb --package PATH --private-key PATH | --verify --public-key PATH"
+    flags.on("--package PATH", "Package directory") { |value| options[:package] = value }
+    flags.on("--private-key PATH", "RSA private key used for signing") { |value| options[:private_key] = value }
+    flags.on("--public-key PATH", "RSA public key used for verification") { |value| options[:public_key] = value }
+    flags.on("--verify", "Verify the package signature and manifest") { options[:verify] = true }
+  end
+  parser.parse!
+  abort parser.to_s unless options[:package] && (options[:private_key] || (options[:verify] && options[:public_key]))
+
+  begin
+    if options[:verify]
+      CanopusPackageSignature.verify(options[:package], options[:public_key])
+      puts "Package signature and manifest verified."
+    else
+      CanopusPackageSignature.sign(options[:package], options[:private_key])
+      puts "Package signature written to #{File.join(options[:package], CanopusPackageSignature::SIGNATURE_FILE)}."
+    end
+  rescue CanopusPackageSignature::Error, OpenSSL::OpenSSLError, Errno::ENOENT => error
+    warn "package signature: #{error.message}"
+    exit 1
+  end
+end

data/tools/update.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+require "base64"
+require "digest"
+require "fileutils"
+require "json"
+require "net/http"
+require "openssl"
+require "optparse"
+require "open-uri"
+require "rubygems/package"
+require "rubygems/version"
+require "securerandom"
+require "tmpdir"
+require "uri"
+require "zlib"
+
+module CanopusUpdater
+  FIELDS = %w[channel platform version url size sha256].freeze
+  ALGORITHM = "RSA-SHA256"
+  MAX_DOWNLOAD = 512 * 1024 * 1024
+  MAX_EXTRACTED = 1 * 1024 * 1024 * 1024
+
+  class Error < StandardError; end
+
+  module_function
+
+  def signed_payload(feed)
+    JSON.generate(FIELDS.to_h { |field| [field, feed.fetch(field)] })
+  end
+
+  def check(feed, public_key:, channel:, platform:, current_version:)
+    feed = feed.is_a?(String) ? JSON.parse(feed) : feed
+    raise Error, "update feed must be an object" unless feed.is_a?(Hash)
+    raise Error, "unsupported update channel" unless feed["channel"] == channel
+    raise Error, "unsupported update platform" unless feed["platform"] == platform
+    validate_feed!(feed)
+    verify_signature!(feed, public_key)
+    raise Error, "update version is invalid" unless Gem::Version.new(feed["version"]) > Gem::Version.new(current_version)
+
+    feed
+  rescue JSON::ParserError, ArgumentError => error
+    raise Error, "invalid update feed: #{error.message}"
+  end
+
+  def apply(feed:, public_key:, channel:, platform:, current_version:, install_dir:)
+    release = check(feed, public_key: public_key, channel: channel, platform: platform, current_version: current_version)
+    install_dir = File.realpath(install_dir)
+    raise Error, "install directory must be a directory" unless File.directory?(install_dir)
+
+    Dir.mktmpdir(".canopus-update-", File.dirname(install_dir)) do |directory|
+      archive = File.join(directory, "package.tar.gz")
+      download(release.fetch("url"), archive, expected_size: release.fetch("size"))
+      raise Error, "update archive hash mismatch" unless Digest::SHA256.file(archive).hexdigest == release.fetch("sha256")
+      staged = File.join(directory, "package")
+      extract(archive, staged)
+      replace(install_dir, staged)
+    end
+    release
+  rescue Errno::ENOENT, Errno::EACCES, SystemCallError => error
+    raise Error, "update failed: #{error.message}"
+  end
+
+  def validate_feed!(feed)
+    raise Error, "update feed is missing fields" unless FIELDS.all? { |field| feed.key?(field) }
+    uri = feed["url"].is_a?(String) ? URI(feed.fetch("url")) : nil
+    raise Error, "update URL must use HTTPS" unless uri&.scheme == "https" && uri.host && !uri.user
+    raise Error, "invalid update size" unless feed["size"].is_a?(Integer) && feed["size"].between?(1, MAX_DOWNLOAD)
+    raise Error, "invalid update hash" unless feed["sha256"].is_a?(String) && feed["sha256"].match?(/\A[0-9a-f]{64}\z/)
+    raise Error, "invalid update signature" unless feed["signature"].is_a?(String) && feed["key_id"].is_a?(String)
+    Gem::Version.new(feed.fetch("version"))
+    true
+  rescue URI::InvalidURIError => error
+    raise Error, "invalid update URL: #{error.message}"
+  end
+  private_class_method :validate_feed!
+
+  def verify_signature!(feed, public_key)
+    key = OpenSSL::PKey.read(File.binread(public_key)).public_key
+    raise Error, "an RSA public key is required" unless key.is_a?(OpenSSL::PKey::RSA)
+    raise Error, "update signing key does not match" unless feed["key_id"] == Digest::SHA256.hexdigest(key.to_der)
+
+    signature = Base64.strict_decode64(feed.fetch("signature"))
+    raise Error, "update signature is invalid" unless key.verify(OpenSSL::Digest::SHA256.new, signature, signed_payload(feed))
+  rescue OpenSSL::OpenSSLError, ArgumentError => error
+    raise Error, "invalid update signature: #{error.message}"
+  end
+  private_class_method :verify_signature!
+
+  def download(url, destination, expected_size:)
+    uri = URI(url)
+    raise Error, "update URL must use HTTPS" unless uri.scheme == "https"
+    request = Net::HTTP::Get.new(uri.request_uri)
+    bytes = 0
+    File.open(destination, "wb", 0o600) do |file|
+      Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
+        response = http.request(request) do |body|
+          raise Error, "update download failed: #{body.code}" unless body.is_a?(Net::HTTPSuccess)
+          if body["content-length"] && body["content-length"].to_i != expected_size
+            raise Error, "update size does not match feed"
+          end
+          body.read_body do |chunk|
+            bytes += chunk.bytesize
+            raise Error, "update download is too large" if bytes > expected_size || bytes > MAX_DOWNLOAD
+            file.write(chunk)
+          end
+        end
+        raise Error, "update download failed: #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+      end
+    end
+    raise Error, "update size does not match feed" unless bytes == expected_size
+  rescue URI::InvalidURIError, SocketError, IOError, OpenSSL::OpenSSLError, Net::OpenTimeout, Net::ReadTimeout => error
+    raise Error, "update download failed: #{error.message}"
+  end
+  private_class_method :download
+
+  def extract(archive, destination)
+    FileUtils.mkdir_p(destination)
+    seen, total = {}, 0
+    Zlib::GzipReader.open(archive) do |gzip|
+      Gem::Package::TarReader.new(gzip).each do |entry|
+        name = entry.full_name.to_s
+        raise Error, "unsafe update archive path" if name.empty? || name.include?("\0") || name.start_with?("/") || name.split("/").include?("..")
+        raise Error, "duplicate update archive path" if seen[name]
+        seen[name] = true
+        path = File.expand_path(name, destination)
+        raise Error, "unsafe update archive path" unless path == destination || path.start_with?(destination + File::SEPARATOR)
+        if entry.directory?
+          FileUtils.mkdir_p(path)
+        elsif entry.file?
+          total += entry.size
+          raise Error, "update archive is too large" if total > MAX_EXTRACTED
+          FileUtils.mkdir_p(File.dirname(path))
+          mode = entry.header.mode.to_i & 0o777
+          mode = 0o644 if mode.zero?
+          File.open(path, "wb", mode) { |file| IO.copy_stream(entry, file) }
+        else
+          raise Error, "unsupported update archive entry"
+        end
+      end
+    end
+    raise Error, "update archive is missing package metadata" unless File.file?(File.join(destination, "package.json")) && File.file?(File.join(destination, "manifest.json"))
+    destination
+  rescue Zlib::GzipFile::Error, Gem::Package::TarInvalidError, EOFError => error
+    raise Error, "invalid update archive: #{error.message}"
+  end
+  private_class_method :extract
+
+  def replace(install_dir, staged)
+    backup = "#{install_dir}.backup-#{Process.pid}-#{SecureRandom.hex(4)}"
+    File.rename(install_dir, backup)
+    begin
+      File.rename(staged, install_dir)
+    rescue SystemCallError => error
+      File.rename(backup, install_dir) rescue nil
+      raise Error, "cannot activate update: #{error.message}"
+    end
+    FileUtils.rm_rf(backup)
+  end
+  private_class_method :replace
+end
+
+if $PROGRAM_NAME == __FILE__
+  platform = RUBY_PLATFORM.match?(/darwin/) ? "mac" : RUBY_PLATFORM.match?(/mswin|mingw/) ? "windows" : "linux"
+  options = {channel: "stable", platform: platform}
+  parser = OptionParser.new do |flags|
+    flags.banner = "Usage: ruby tools/update.rb --feed URL --public-key PATH --install-dir PATH --current-version VERSION"
+    flags.on("--feed URL", "Signed update feed URL") { |value| options[:feed] = value }
+    flags.on("--public-key PATH", "RSA public key used to verify the feed") { |value| options[:public_key] = value }
+    flags.on("--install-dir PATH", "Existing package directory") { |value| options[:install_dir] = value }
+    flags.on("--current-version VERSION", "Installed package version") { |value| options[:current_version] = value }
+    flags.on("--channel NAME", "Update channel (default: stable)") { |value| options[:channel] = value }
+    flags.on("--platform NAME", "Package platform") { |value| options[:platform] = value }
+  end
+  parser.parse!
+  abort parser.to_s unless %i[feed public_key install_dir current_version].all? { |key| options[key] }
+
+  begin
+    feed_uri = URI(options.fetch(:feed))
+    raise CanopusUpdater::Error, "feed URL must use HTTPS" unless feed_uri.scheme == "https" && feed_uri.host && !feed_uri.user
+    feed = feed_uri.open(allow_redirections: false, &:read)
+    release = CanopusUpdater.apply(feed: feed, public_key: options.fetch(:public_key), channel: options.fetch(:channel),
+      platform: options.fetch(:platform), current_version: options.fetch(:current_version), install_dir: options.fetch(:install_dir))
+    puts "Updated Canopus to #{release.fetch("version")}."
+  rescue CanopusUpdater::Error, OpenSSL::OpenSSLError, Errno::ENOENT, URI::InvalidURIError => error
+    warn "update: #{error.message}"
+    exit 1
+  end
+end