ruby_everywhere 0.7.0 → 0.8.0

data/lib/everywhere/commands/platform/runner.rb

@@ -8,7 +8,10 @@ require "base64"
 require "json"
 require "open3"
 require "securerandom"
+require "rubygems/package"
+require "zlib"
 require_relative "../../ui"
+require_relative "../../host"
 require_relative "../../paths"
 require_relative "../../platform/client"
 
@@ -47,6 +50,8 @@ module Everywhere
         "~/Library/Developer/Xcode/UserData/Provisioning Profiles"
       ].freeze
 
+      PROFILE_UUID = /\A[0-9a-f-]+\z/i
+
       desc "Run a Platform build on this machine (used by the hosted runner)"
 
       option :artifact,  required: true, desc: "Artifact public id (art_…)"
@@ -103,16 +108,48 @@ module Everywhere
         @client.download(job["snapshot_url"], tarball)
         src = File.join(work, "src")
         FileUtils.mkdir_p(src)
-        UI.die!("failed to extract snapshot") unless system("tar", "-xzf", tarball, "-C", src)
+        extract_snapshot(tarball, src)
         src
       end
 
+      # Read with the same pure-Ruby tar the snapshot was WRITTEN with
+      # (Platform::Snapshot uses Gem::Package::TarWriter) instead of shelling
+      # out: `tar -xzf` follows "../" members and symlink members straight out
+      # of the extraction dir, and this archive arrives over the network.
+      def extract_snapshot(tarball, dest)
+        Zlib::GzipReader.open(tarball) do |gz|
+          Gem::Package::TarReader.new(gz) do |tar|
+            tar.each { |entry| extract_entry(entry, dest) }
+          end
+        end
+      rescue Zlib::Error, Gem::Package::TarInvalidError => e
+        UI.die!("failed to extract snapshot (#{e.class.name.split("::").last})")
+      end
+
+      def extract_entry(entry, dest)
+        name = entry.full_name
+        UI.die!("the snapshot contains an unsafe path (#{name})") if unsafe_entry?(name)
+        # Snapshot only ever writes regular files; anything else in the archive
+        # didn't come from us.
+        return unless entry.file? && !entry.symlink?
+
+        path = File.join(dest, name)
+        FileUtils.mkdir_p(File.dirname(path))
+        File.open(path, "wb") { |out| out.write(entry.read(1 << 20)) until entry.eof? }
+        mode = entry.header.mode & 0o777
+        File.chmod(mode.zero? ? 0o644 : mode, path)
+      end
+
+      def unsafe_entry?(name)
+        name.empty? || name.start_with?("/") || name.split("/").include?("..")
+      end
+
       def pull_credentials(work)
         remote_log("pulling signing credentials")
         creds = get!("/runner/artifacts/#{@artifact}/credentials")["credentials"] || []
         env = {}
         creds.each do |cred|
-          path = File.join(work, cred["filename"])
+          path = credential_path(work, cred["filename"])
           File.binwrite(path, Base64.strict_decode64(cred["data_base64"]))
           File.chmod(0o600, path)
           meta = cred["metadata"] || {}
@@ -122,7 +159,7 @@ module Everywhere
             # An android job runs on Linux, where there's no keychain to import
             # into. A stray apple credential there is the Platform's mistake, not
             # a reason to lose the build.
-            if darwin?
+            if Host.darwin?
               env["APPLE_SIGNING_IDENTITY"] = install_certificate(path, meta, work)
             else
               remote_log("skipping #{cred["kind"]} — keychain import needs macOS")
@@ -146,6 +183,16 @@ module Everywhere
         env.compact
       end
 
+      # Credential filenames come from the Platform API, so they're untrusted
+      # input: a "../../.ssh/authorized_keys" would write outside the job's
+      # tmpdir. Only ever a basename, inside work.
+      def credential_path(work, filename)
+        name = File.basename(filename.to_s)
+        UI.die!("the Platform delivered a credential with no usable filename") if name.empty? || [".", ".."].include?(name)
+
+        File.join(work, name)
+      end
+
       # A .mobileprovision is a CMS-signed DER blob wrapped around a plain XML
       # plist. Scanning for the plist reads it identically on Linux, where
       # `security cms -D` doesn't exist.
@@ -157,9 +204,12 @@ module Everywhere
         name = plist[%r{<key>Name</key>\s*<string>([^<]+)</string>}m, 1]
         # TeamIdentifier is an <array> of one — the first <string> after the key.
         team = plist[%r{<key>TeamIdentifier</key>.*?<string>([^<]+)</string>}m, 1]
-        UI.die!("the delivered provisioning profile has no UUID") unless uuid
+        # The UUID becomes a filename in the user's Provisioning Profiles dirs,
+        # and it's read out of a blob we didn't author — a "../" one would land
+        # anywhere. Shape-check it before it's ever a path segment.
+        UI.die!("the delivered provisioning profile has no usable UUID") unless uuid&.match?(PROFILE_UUID)
 
-        if darwin?
+        if Host.darwin?
           profile_dirs.each do |dir|
             FileUtils.mkdir_p(dir)
             FileUtils.cp(path, File.join(dir, "#{uuid}.mobileprovision"))
@@ -171,10 +221,15 @@ module Everywhere
 
       def profile_dirs = PROFILE_DIRS.map { |dir| File.expand_path(dir) }
 
-      def darwin? = RUBY_PLATFORM.include?("darwin")
 
       # Import the .p12 into a throwaway keychain and add it to the search list so
       # codesign finds the identity. Returns the identity name for notarize.sh.
+      #
+      # ACCEPTED RISK: `security` takes its passwords on argv, where `ps` can see
+      # them — it has no stdin form (a bare unlock-keychain prompts on the tty,
+      # which is no use in a headless job). What's exposed is this keychain's
+      # random single-use password and the .p12's own, on an ephemeral
+      # single-tenant runner that is destroyed after the build.
       def install_certificate(p12, metadata, work)
         @keychain = File.join(work, "runner.keychain-db")
         password = SecureRandom.hex(12)
@@ -329,7 +384,7 @@ module Everywhere
       end
 
       def restore_keychains
-        return unless darwin?
+        return unless Host.darwin?
 
         run_security("list-keychains", "-d", "user", "-s", *@saved_keychains) if @saved_keychains
         run_security("delete-keychain", @keychain) if @keychain && File.exist?(@keychain)

data/lib/everywhere/commands/preview.rb

@@ -9,7 +9,7 @@ require "uri"
 require_relative "../shellout"
 require_relative "../console"
 require_relative "../child_processes"
-require_relative "../relay"
+require_relative "../child_supervision"
 require_relative "../framework"
 require_relative "../config"
 require_relative "../jump"
@@ -30,6 +30,8 @@ module Everywhere
     #                  that hostname is — cloudflared doesn't know its own DNS)
     #   --lan          no tunnel: the LAN address, for offline use
     class Preview < Dry::CLI::Command
+      include ChildSupervision
+
       desc "Run the dev server behind a shareable tunnel for the Jump app"
 
       option :port,        default: "3000", desc: "Dev server port"
@@ -41,10 +43,11 @@ module Everywhere
       TUNNEL_BOOT_TIMEOUT = 30
 
       def call(port: "3000", lan: false, tunnel_name: nil, tunnel_host: nil, **)
-        port = @port = validate_port!(port)
-        @pids = {}
-        @relays = {}
-        @children = Mutex.new
+        port = validate_port!(port)
+        # An Integer, because @port is interpolated into the cloudflared command
+        # strings — nothing that reaches a shell should be a free-form String.
+        @port = Integer(port, 10)
+        init_children!
         @framework = detect_local_framework
         @config = Everywhere::Config.load(@framework.root)
         # Multi-use on purpose: a forwarded link must work for a second
@@ -72,7 +75,7 @@ module Everywhere
       rescue Interrupt
         nil
       ensure
-        teardown
+        teardown_children
       end
 
       private
@@ -136,8 +139,11 @@ module Everywhere
         end
       end
 
+      # quiet drops the child's routine chatter but always lets errors
+      # through — a quick tunnel that can't connect must say why.
       def spawn_tunnel(cmd, on_line: nil, quiet: false)
-        supervise(:tunnel, {}, cmd, chdir: Dir.pwd, on_line: on_line, quiet: quiet)
+        filter = quiet ? ->(line) { line.match?(/\bERR\b|error/i) ? line : :drop } : nil
+        supervise(:tunnel, {}, cmd, chdir: Dir.pwd, filter: filter, on_line: on_line)
       end
 
       # Rails' puma template binds 0.0.0.0, but a rackup-style bin/dev often
@@ -263,96 +269,17 @@ module Everywhere
 
       # --- child supervision (dev.rb's pattern, without the dock) ---------------
 
-      # quiet drops the child's routine chatter but always lets errors
-      # through — a quick tunnel that can't connect must say why.
-      def supervise(key, env, cmd, chdir:, on_line: nil, quiet: false)
-        filter = quiet ? ->(line) { line.match?(/\bERR\b|error/i) ? line : :drop } : nil
-        if Shellout.pty?
-          io, pid = Shellout.spawn_pty(env, cmd, chdir: chdir)
-        else
-          # No pty (Windows): a plain pipe loses colors but keeps the output —
-          # and the quick tunnel's URL parsing, which reads it.
-          io, writer = IO.pipe
-          pid = Process.spawn(env, cmd, chdir: chdir, %i[out err] => writer)
-          writer.close
-        end
-        thread = Thread.new do
-          Thread.current.name = "relay-#{key}"
-          Thread.current.report_on_exception = false
-          begin
-            Relay.new(io, source: key, filter: filter, on_line: on_line).run
-          rescue StandardError => e
-            Kernel.warn("#{key} output relay stopped: #{e.class}: #{e.message}")
-          end
-        end
-        Process.detach(pid)
-        @children.synchronize do
-          @pids[key] = pid
-          @relays[key] = thread
-        end
-        pid
-      end
-
-      def stop_child(key, grace: 5)
-        pid, thread = @children.synchronize { [@pids.delete(key), @relays.delete(key)] }
-        return unless pid
-
-        reap([pid], grace: grace)
-        thread&.join(1)
-      end
-
-      def reap(pids, grace: 5)
-        live = pids.compact.select { |pid| ChildProcesses.alive?(pid) }
-        return if live.empty?
-
-        live.each { |pid| ChildProcesses.signal(pid, "TERM") }
-        deadline = monotonic + grace
-        sleep(0.1) while live.any? { |pid| ChildProcesses.alive?(pid) } && monotonic < deadline
-        live.select { |pid| ChildProcesses.alive?(pid) }.each { |pid| ChildProcesses.signal(pid, "KILL") }
-      end
-
-      def teardown
-        pids, relays = @children ? @children.synchronize { [@pids.values, @relays.values] } : [[], []]
-        [
-          -> { reap(pids, grace: 2) },
-          -> { relays.each { |thread| thread.join(1) } }
-        ].each do |step|
-          step.call
-        rescue StandardError => e
-          Kernel.warn("teardown: #{e.class}: #{e.message}")
-        end
-      end
-
-      # --- helpers --------------------------------------------------------------
-
-      def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-
-      def validate_port!(port)
-        number = begin
-          Integer(port.to_s, 10)
-        rescue ArgumentError, TypeError
-          UI.die!("--port must be a number (got #{port.inspect})")
-        end
-        UI.die!("--port must be between 1 and 65535 (got #{number})") unless (1..65_535).cover?(number)
-        number.to_s
-      end
-
-      def port_open?(port)
-        TCPSocket.new("127.0.0.1", Integer(port)).close
-        true
-      rescue SystemCallError
-        false
-      end
-
-      def wait_for_port(port, pid: nil, timeout: 60)
-        deadline = monotonic + timeout
-        until port_open?(port)
-          if pid && !ChildProcesses.alive?(pid)
-            UI.die!("the dev server exited before it finished booting — scroll up for its output")
-          end
-          UI.die!("dev server never came up on port #{port} after #{timeout}s") if monotonic > deadline
-          sleep 0.25
-        end
+      def spawn_child(env, cmd, chdir:)
+        return Shellout.spawn_pty(env, cmd, chdir: chdir) if Shellout.pty?
+
+        # No pty (Windows): a plain pipe loses colors but keeps the output —
+        # and the quick tunnel's URL parsing, which reads it. child_env for
+        # the same reason spawn_pty uses it: the CLI's own BUNDLE_* must not
+        # follow the app's server into its child.
+        io, writer = IO.pipe
+        pid = Process.spawn(Shellout.child_env(env), cmd, chdir: chdir, %i[out err] => writer)
+        writer.close
+        [io, pid]
       end
     end
   end

data/lib/everywhere/commands/publish.rb

@@ -173,6 +173,8 @@ module Everywhere
       def preflight!
         UI.die!("no updates.url in everywhere.yml — add an updates: section (see `every updates keygen`)") unless @config.updates_url
         UI.die!("no updates.public_key in everywhere.yml — run `every updates keygen`") unless @config.updates_public_key
+        updates_errors = @config.updates_errors
+        UI.die!("updates: in config/everywhere.yml:\n#{updates_errors.join("\n")}") unless updates_errors.empty?
         UI.die!("no updates.s3.bucket in everywhere.yml") if s3_config["bucket"].to_s.empty?
         UI.die!("missing bucket credentials — set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY") if
           ENV["AWS_ACCESS_KEY_ID"].to_s.empty? || ENV["AWS_SECRET_ACCESS_KEY"].to_s.empty?

data/lib/everywhere/commands/release.rb

@@ -4,6 +4,7 @@ require "dry/cli"
 require "digest"
 require "json"
 require_relative "../shellout"
+require_relative "../host"
 require_relative "../log_filter"
 require_relative "../receipt"
 require_relative "../paths"
@@ -84,10 +85,10 @@ module Everywhere
       def preflight!(target, os)
         case os
         when "macos"
-          UI.die!("`every release --target #{target}` runs on macOS only") unless darwin?
+          UI.die!("`every release --target #{target}` runs on macOS only") unless Host.darwin?
           UI.die!("signing engine missing at #{NOTARIZE}") unless File.exist?(NOTARIZE)
         when "ios"
-          UI.die!("iOS releases need Xcode — `every release --target #{target}` runs on macOS only") unless darwin?
+          UI.die!("iOS releases need Xcode — `every release --target #{target}` runs on macOS only") unless Host.darwin?
         when "android"
           nil # Gradle signs and builds anywhere the Android SDK does — Linux included.
         else
@@ -95,7 +96,6 @@ module Everywhere
         end
       end
 
-      def darwin? = RUBY_PLATFORM.include?("darwin")
 
       # Only the flag that belongs to this os: `every build` rejects the other.
       # iOS also needs the channel: a testflight/app_store release uploads to App
@@ -117,7 +117,11 @@ module Everywhere
         env_file ||= discover_env_file(root_path)
         env = env_file ? { "ENV_FILE" => env_file } : {}
         UI.phase("Signing & notarizing #{File.basename(app_dir)}")
-        UI.step("preparing #{File.basename(app_dir)}#{env_file ? " #{UI.dim("(env: #{rel(env_file, root_path)})")}" : ""}")
+        UI.step("preparing #{File.basename(app_dir)}")
+        # Named in full: these are the Apple credentials the notarization runs
+        # with, and "which file did that come from" is the first thing you ask
+        # when a build signs as the wrong team.
+        UI.detail("signing env: #{UI.short_path(File.expand_path(env_file))}") if env_file
         UI.warn("no signing env found — set APPLE_* or pass --env-file (notarize.sh will fail without it)") unless env_file || ENV["APPLE_SIGNING_IDENTITY"]
         log = "#{app_dir}.notarize.log"
         Shellout.run_logged!(env, ["/bin/bash", NOTARIZE, app_dir], log: log, filter: LogFilter.for(:notarize))
@@ -202,10 +206,11 @@ module Everywhere
         dashed
       end
 
-      # A .env.release next to the app, then at the repo root above it.
+      # A .env.release next to the app — and nowhere else. The parent directory
+      # used to be searched too, which meant a release could silently pick up
+      # Apple credentials from outside the project it was building.
       def discover_env_file(root_path)
-        [ENV["ENV_FILE"], File.join(root_path, ".env.release"), File.join(root_path, "..", ".env.release")]
-          .compact.find { |p| File.exist?(p) }
+        [ENV["ENV_FILE"], File.join(root_path, ".env.release")].compact.find { |p| File.exist?(p) }
       end
 
       def resolve_shell_dir(given)
@@ -243,10 +248,10 @@ module Everywhere
 
       def summarize(out, artifact, signing, root_path)
         UI.phase("Release ready 🎉")
-        UI.success("#{rel(artifact, root_path)} #{UI.dim("(#{(File.size(artifact) / 1024.0 / 1024.0).round}MB — send this to your friends)")}")
+        UI.success("#{UI.rel_path(artifact, root_path)} #{UI.dim("(#{(File.size(artifact) / 1024.0 / 1024.0).round}MB — send this to your friends)")}")
         UI.substep("signed by #{UI.bold(signing["signed_by"] || "?")}")
         UI.substep(signing_line(signing["platform"] || {}, signing))
-        UI.substep("receipt #{UI.dim(rel(out, root_path))}")
+        UI.substep("receipt #{UI.dim(UI.rel_path(out, root_path))}")
       end
 
       def signing_line(platform, signing)
@@ -262,8 +267,6 @@ module Everywhere
           "signing scheme #{UI.bold(platform["signing_scheme"] || "?")}"
         end
       end
-
-      def rel(path, root_path) = UI.short_path(path.sub("#{root_path}/", "").sub("#{Dir.pwd}/", ""))
     end
   end
 end

data/lib/everywhere/commands/shell_dir.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require "dry/cli"
+require_relative "../config"
+require_relative "../paths"
 
 module Everywhere
   module Commands

data/lib/everywhere/commands/updates_keygen.rb

@@ -31,14 +31,22 @@ module Everywhere
         end
 
         UI.phase("Generating update signing key for #{bundle_id}")
-        pair = Minisign.keygen(passphrase: passphrase ? prompt_passphrase : "")
+        secret = resolve_passphrase(passphrase)
+        pair = Minisign.keygen(passphrase: secret)
 
         require "fileutils"
         FileUtils.mkdir_p(keys_dir, mode: 0o700)
         File.write(sk_path, pair.secret_key, perm: 0o600)
         File.write(pub_path, pair.public_key, perm: 0o644)
+        # perm: only applies when the file is created — an overwrite (--force,
+        # or a key from an older version) keeps whatever mode it had.
+        File.chmod(0o600, sk_path)
 
         UI.ok("secret key #{UI.short_path(sk_path)} #{UI.dim("(key id #{pair.key_id_hex})")}")
+        if secret.empty?
+          UI.warn("this secret key is stored UNENCRYPTED — anyone who can read " \
+                  "#{UI.short_path(sk_path)} can sign updates your users will install")
+        end
         UI.ok("public key #{UI.short_path(pub_path)}")
 
         UI.phase("Add the public key to config/everywhere.yml")
@@ -54,6 +62,22 @@ module Everywhere
 
       private
 
+      # --passphrase insists on one. Without the flag we still ask whenever
+      # there's a terminal to ask on — an unencrypted signing key is a real
+      # choice (CI has to have one), but it shouldn't be what you get by
+      # forgetting a flag. Empty answer = unencrypted, and it's warned about.
+      def resolve_passphrase(flag)
+        return prompt_passphrase if flag
+        return "" unless $stdin.tty?
+
+        require "io/console"
+        pass = $stdin.getpass("Passphrase (empty for an unencrypted key): ")
+        return "" if pass.empty?
+
+        UI.die!("passphrases didn't match") unless pass == $stdin.getpass("Passphrase (again): ")
+        pass
+      end
+
       def prompt_passphrase
         require "io/console"
         UI.die!("--passphrase needs an interactive terminal") unless $stdin.tty?

data/lib/everywhere/config/app.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+module Everywhere
+  class Config
+    module App
+      def name(target: nil)
+        resolved(target)["name"] || File.basename(File.expand_path(root)).split(/[-_]/).map(&:capitalize).join(" ")
+      end
+
+      # Reverse-DNS identifier: macOS bundle id, and the name of the per-user
+      # app-data directory on every platform. Set it explicitly and never change
+      # it — renaming moves users' data. A platform may override it (e.g. the App
+      # Store often wants `com.example.app.ios`).
+      def bundle_id(target: nil)
+        resolved(target)["bundle_id"] ||
+          "com.rubyeverywhere.#{name(target: target).downcase.gsub(/[^a-z0-9]+/, "-").gsub(/\A-|-\z/, "")}"
+      end
+
+      # A bundle id isn't only an identifier: it's a path segment (Paths.*_work_dir,
+      # which the builders rm_rf, and the update-signing key on disk). The derived
+      # default is safe by construction; an explicit one is whatever the app repo
+      # says, so it's held to reverse-DNS characters and nothing else.
+      BUNDLE_ID = /\A[A-Za-z0-9][A-Za-z0-9.-]*\z/
+
+      def identity_errors
+        sections = [["app", app]] + platforms.map { |os, override| ["platforms.#{os}", override] }
+        sections.filter_map do |at, section|
+          next unless section.is_a?(Hash)
+
+          value = section["bundle_id"].to_s
+          next if value.empty? || (value.match?(BUNDLE_ID) && !value.include?(".."))
+
+          "#{at}.bundle_id #{value.inspect} is not a bundle id — reverse-DNS, " \
+            "letters/digits/./- only (like com.example.app)"
+        end
+      end
+
+      # App icon source: a PNG (ideally square, 1024px+). Explicit `app.icon`
+      # path relative to the app root, or icon.png at the root by convention.
+      def icon
+        if (explicit = app["icon"])
+          File.expand_path(explicit, root)
+        else
+          default = File.join(root, "icon.png")
+          File.exist?(default) ? default : nil
+        end
+      end
+
+      # Optional custom splash page (HTML file, path relative to the app root).
+      # Shown while the packaged server boots; the shell injects
+      # window.__EVERYWHERE_CONFIG__ so it can use the app's name and colors.
+      def splash
+        path = app["splash"]
+        File.expand_path(path, root) if path
+      end
+
+      def entry_path
+        path = app["entry_path"] || "/"
+        path.start_with?("/") ? path : "/#{path}"
+      end
+
+      # Marketing/display version of the app (CFBundleShortVersionString, and the
+      # `version` recorded in the build receipt). One shared `app.version` is the
+      # default for every target; a platform may override it when a store forces a
+      # different number. Defaults conservatively.
+      def version(target: nil)
+        resolved(target)["version"] || "0.1.0"
+      end
+
+      # The `build:` section — durable build knobs that were once `every build`
+      # flags (ruby, targets, capabilities). CLI flags still override per-run.
+      # See platform/docs/build-engine.md §2.
+      def build = @data.fetch("build", nil) || {}
+
+      # Ruby version to package. nil here means "let the CLI decide its default".
+      def build_ruby = build["ruby"]
+
+      # Desktop OS-integration capabilities the app declares (`build.capabilities`),
+      # as a plain list. Deliberately not called permissions: the top-level
+      # `permissions:` below is the mobile prompt declaration — a different shape
+      # for a different consumer — and while both were spelled "permissions" this
+      # accessor was silently redefined by that one and could never be read.
+      def build_capabilities = Array(build["capabilities"])
+
+      # Build targets as BARE os-arch strings — any ":<channel>" suffix is
+      # stripped. Callers treat these as filesystem/URL-safe identifiers
+      # (`every publish` derives S3 update-manifest key paths from the first one),
+      # so a suffix leaking through here would poison those paths. Use
+      # #build_target_specs when the channel matters.
+      def targets = build_target_specs.map { |t| t.to_s.split(":", 2).first }
+
+      # The raw `build.targets` entries, suffixes intact ("ios-arm64:testflight").
+      def build_target_specs = Array(build["targets"])
+
+      # "local"  — the app is tebako-pressed and runs on-device (default)
+      # "remote" — thin shell around an already-deployed app: no press, no sidecar
+      def mode
+        app["mode"] || (remote_url ? "remote" : "local")
+      end
+
+      def remote? = mode == "remote"
+
+      def remote_url
+        @data.dig("remote", "url")&.chomp("/")
+      end
+
+      # Multi-instance apps (`remote.instances: true`): the mobile shell boots
+      # into remote.url — a hosted instance-picker page — and lets that page
+      # re-root the app onto a chosen instance via Everywhere.instance.set,
+      # persisted across launches until Everywhere.instance.clear. Opt-in
+      # because it lets page JS repoint the whole app: apps that aren't
+      # multi-instance shouldn't carry that surface.
+      def remote_instances?
+        @data.dig("remote", "instances") == true
+      end
+
+      def tint_color
+        normalize_color(appearance["tint_color"])
+      end
+
+      def background_color
+        normalize_color(appearance["background_color"])
+      end
+    end
+  end
+end