@_nazmiforreal/flutter-ota 0.1.0 → 0.1.2

package/dart-src/packages/cli-tools/lib/src/operations.dart

@@ -0,0 +1,206 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:crypto/crypto.dart';
+import 'package:flutter_patcher_core/flutter_patcher_core.dart';
+import 'package:flutter_patcher_plugin_core/flutter_patcher_plugin_core.dart';
+
+import 'backend.dart';
+import 'sign.dart';
+import 'util.dart';
+
+/// Options for [deployBundle].
+class DeployOptions {
+  const DeployOptions({
+    required this.source,
+    required this.channel,
+    required this.platform,
+    this.message,
+    this.force = false,
+    this.targetAppVersion,
+    this.fingerprintHash,
+    this.signingKeyBase64,
+    this.gitCommitHash,
+    this.bundleId,
+    this.metadata,
+  });
+
+  final String source;
+  final String channel;
+  final String platform;
+  final String? message;
+  final bool force;
+  final String? targetAppVersion;
+  final String? fingerprintHash;
+  final String? signingKeyBase64;
+  final String? gitCommitHash;
+  final String? bundleId;
+  final BundleMetadata? metadata;
+}
+
+/// Options for [listBundles].
+class ListOptions {
+  const ListOptions({
+    this.channel,
+    this.platform,
+    this.enabled,
+    this.limit = 20,
+  });
+
+  final String? channel;
+  final String? platform;
+  final bool? enabled;
+  final int limit;
+}
+
+/// Build the zip, upload it, and register a [Bundle] via the backend.
+Future<Bundle> deployBundle(Backend backend, DeployOptions opts) async {
+  if (opts.targetAppVersion != null && opts.fingerprintHash != null) {
+    throw StateError(
+      'Use only one of target-app-version / fingerprint-hash (DB CHECK).',
+    );
+  }
+  // Resolve the artifact to upload. If the source is already a zip (e.g. the
+  // `patch.zip` produced by `flutter_patcher build`/`pack`), upload it directly.
+  // Otherwise, if the source directory contains a `patch.zip`, use that. As a
+  // fallback, zip the source directory (for pre-built bundle layouts).
+  final sourceFile = File(opts.source);
+  final bool sourceIsFile = sourceFile.existsSync() && sourceFile.statSync().type == FileSystemEntityType.file;
+  final String zipPath;
+  final bool shouldDelete;
+  if (sourceIsFile && opts.source.endsWith('.zip')) {
+    zipPath = opts.source;
+    shouldDelete = false;
+  } else {
+    final dir = Directory(opts.source);
+    final packaged = File('${dir.path}/patch.zip');
+    if (await packaged.exists()) {
+      zipPath = packaged.path;
+      shouldDelete = false;
+    } else {
+      zipPath = await zipDirectory(opts.source);
+      shouldDelete = true;
+    }
+  }
+
+  try {
+    final zipBytes = await File(zipPath).readAsBytes();
+    // Device SDK verifies the artifact against an MD5 hex of the whole file,
+    // so `fileHash` is always the MD5 hex (never a `sig:`-prefixed value).
+    final md5Hex = md5.convert(zipBytes).toString();
+    final signature = opts.signingKeyBase64 != null
+        ? await ed25519Sign(utf8.encode(md5Hex), opts.signingKeyBase64!)
+        : null;
+
+    final bundleId = opts.bundleId ?? uuidV7();
+    final key = backend.storageKeyFor(bundleId, 'patch.zip');
+    final uploaded = await backend.storage.upload(key, zipPath);
+    final storageUri = uploaded['storageUri'];
+    if (storageUri == null || storageUri.isEmpty) {
+      throw StateError('Storage upload returned no storageUri.');
+    }
+
+    final bundle = Bundle(
+      id: bundleId,
+      platform: Platform.fromValue(opts.platform),
+      shouldForceUpdate: opts.force,
+      enabled: true,
+      fileHash: md5Hex,
+      storageUri: storageUri,
+      channel: opts.channel,
+      message: opts.message,
+      gitCommitHash: opts.gitCommitHash,
+      targetAppVersion: opts.targetAppVersion,
+      fingerprintHash: opts.fingerprintHash,
+      metadata:
+          opts.metadata ?? (signature != null ? BundleMetadata(signature: signature) : null),
+      rolloutCohortCount: defaultRolloutCohortCount,
+    );
+
+    await backend.db.appendBundle(bundle);
+    await backend.db.commitBundle();
+    return bundle;
+  } finally {
+    if (shouldDelete) {
+      try {
+        await File(zipPath).delete();
+      } catch (_) {
+        // best effort cleanup.
+      }
+    }
+  }
+}
+
+/// List bundles, filtered by the supplied options.
+Future<Paginated<List<Bundle>>> listBundles(
+  Backend backend,
+  ListOptions opts,
+) async {
+  return backend.db.getBundles(
+    DatabaseBundleQueryOptions(
+      where: DatabaseBundleQueryWhere(
+        channel: opts.channel,
+        platform: opts.platform != null ? Platform.fromValue(opts.platform!) : null,
+        enabled: opts.enabled,
+      ),
+      limit: opts.limit,
+      orderBy: const DatabaseBundleQueryOrder(direction: 'desc'),
+    ),
+  );
+}
+
+/// Delete a bundle by id.
+Future<void> deleteBundle(Backend backend, String id) async {
+  final existing = await backend.db.getBundleById(id);
+  if (existing == null) {
+    throw StateError('Bundle "$id" not found.');
+  }
+  await backend.db.deleteBundle(existing);
+  await backend.db.commitBundle();
+}
+
+/// Promote a bundle to a channel (enable + assign channel).
+Future<void> promoteBundle(
+  Backend backend,
+  String id,
+  String channel,
+) async {
+  final existing = await backend.db.getBundleById(id);
+  if (existing == null) {
+    throw StateError('Bundle "$id" not found.');
+  }
+  await backend.db.updateBundle(id, {'enabled': true, 'channel': channel});
+  await backend.db.commitBundle();
+}
+
+/// Disable the latest enabled bundle on a channel (rollback).
+///
+/// Returns the id of the bundle that was disabled.
+Future<String> rollbackChannel(Backend backend, String channel) async {
+  final res = await backend.db.getBundles(
+    DatabaseBundleQueryOptions(
+      where: DatabaseBundleQueryWhere(channel: channel, enabled: true),
+      limit: 1,
+      orderBy: const DatabaseBundleQueryOrder(direction: 'desc'),
+    ),
+  );
+  if (res.data.isEmpty) {
+    throw StateError('No enabled bundle on channel "$channel" to roll back.');
+  }
+  final target = res.data.first;
+  await backend.db.updateBundle(target.id, {'enabled': false});
+  await backend.db.commitBundle();
+  return target.id;
+}
+
+/// List channels configured on the backend.
+Future<List<String>> listChannels(Backend backend) => backend.db.getChannels();
+
+/// Return the currently enabled (live) bundle for a channel, if any.
+Future<Bundle?> getChannel(Backend backend, String channel) async {
+  final res = await listBundles(
+    backend,
+    ListOptions(channel: channel, enabled: true, limit: 1),
+  );
+  return res.data.isEmpty ? null : res.data.first;
+}

package/dart-src/packages/cli-tools/lib/src/pack.dart

@@ -0,0 +1,417 @@
+import 'dart:convert';
+import 'dart:io';
+import 'dart:typed_data';
+
+import 'package:archive/archive.dart';
+import 'package:crypto/crypto.dart';
+
+const List<String> abiPriority = <String>['arm64-v8a', 'armeabi-v7a', 'x86_64'];
+const String flutterAssetsPrefix = 'assets/flutter_assets/';
+const String assetManifestPath = '${flutterAssetsPrefix}AssetManifest.bin';
+
+/// Result of a successful [packPatch] run.
+class PackResult {
+  const PackResult({
+    required this.payloadPath,
+    required this.manifestPath,
+    required this.abis,
+    required this.md5,
+    required this.version,
+    required this.targetVersionCode,
+    required this.assetCount,
+  });
+
+  final String payloadPath;
+  final String manifestPath;
+  final List<String> abis;
+  final String md5;
+  final String version;
+  final int targetVersionCode;
+  final int assetCount;
+}
+
+/// Pack a release APK into a device-compatible OTA patch (`patch.zip`).
+///
+/// Mirrors the standalone `bin/pack.dart` CLI, but as a library usable by the
+/// `flutter_patcher build` command. Includes **every** ABI found in the APK so
+/// a single bundle serves all device ABIs (the device SDK picks its ABI).
+Future<PackResult> packPatch({
+  required String apkPath,
+  required String version,
+  required int targetVersionCode,
+  String? abi,
+  List<String> requestedAssets = const [],
+  required String out,
+}) async {
+  final apkFile = File(apkPath);
+  if (!apkFile.existsSync()) {
+    throw PackException('APK not found: $apkPath');
+  }
+
+  final apkBytes = apkFile.readAsBytesSync();
+  final archive = ZipDecoder().decodeBytes(apkBytes);
+
+  final libs = _collectLibapps(archive);
+  if (libs.isEmpty) {
+    throw PackException(
+      'libapp.so not found in APK for any of $abiPriority '
+      '(or requested --abi $abi).',
+    );
+  }
+
+  if (abi != null && !libs.any((e) => e.$1 == abi)) {
+    throw PackException('requested --abi $abi not present in APK.');
+  }
+
+  final outDir = Directory(out);
+  outDir.createSync(recursive: true);
+  final result = _writePatchPackage(
+    outDir: outDir,
+    archive: archive,
+    libs: libs,
+    version: version,
+    targetVersionCode: targetVersionCode,
+    requestedAssets: requestedAssets,
+  );
+  return result;
+}
+
+PackResult _writePatchPackage({
+  required Directory outDir,
+  required Archive archive,
+  required List<(String, List<int>)> libs,
+  required String version,
+  required int targetVersionCode,
+  required List<String> requestedAssets,
+}) {
+  final patchFiles = <String, _PatchAssetFile>{};
+  final operations = <Map<String, dynamic>>[];
+  var baseManifestSize = 0;
+
+  if (requestedAssets.isNotEmpty) {
+    final manifestEntry = _findFile(archive, assetManifestPath);
+    if (manifestEntry == null) {
+      throw PackException(
+        'AssetManifest.bin not found in APK: $assetManifestPath',
+      );
+    }
+    final manifestBytes = _archiveFileBytes(manifestEntry);
+    baseManifestSize = manifestBytes.length;
+    final decoded = _FlutterStandardMessageCodec().decode(manifestBytes);
+    if (decoded is! Map) {
+      throw PackException('AssetManifest.bin must decode to a map.');
+    }
+    final assetManifest = Map<String, dynamic>.from(decoded);
+
+    for (final key in requestedAssets) {
+      final variantsRaw = assetManifest[key];
+      if (variantsRaw is! List) {
+        throw PackException(
+            'asset key not found in AssetManifest.bin: $key');
+      }
+      final variants = variantsRaw
+          .map((variant) => Map<String, dynamic>.from(variant as Map))
+          .toList(growable: false);
+      operations.add({
+        'op': 'upsert',
+        'key': key,
+        'variants': variants,
+      });
+      for (final variant in variants) {
+        final assetPath = variant['asset'];
+        if (assetPath is! String || assetPath.isEmpty) {
+          throw PackException('invalid variant asset for key $key');
+        }
+        _validateArchiveRelativePath(assetPath, 'asset path');
+        final apkPath = '$flutterAssetsPrefix$assetPath';
+        final entry = _findFile(archive, apkPath);
+        if (entry == null) {
+          throw PackException(
+            'variant file for $key not found in APK: $apkPath',
+          );
+        }
+        final bytes = _archiveFileBytes(entry);
+        patchFiles[assetPath] = _PatchAssetFile(
+          path: assetPath,
+          bytes: bytes,
+          md5Hex: md5.convert(bytes).toString(),
+        );
+      }
+    }
+  }
+
+  final libManifest = <String, dynamic>{
+    for (final (currentAbi, soBytes) in libs) currentAbi: {
+      'path': 'lib/$currentAbi/libapp.so',
+      'md5': md5.convert(soBytes).toString(),
+    },
+  };
+
+  final zipManifest = <String, dynamic>{
+    'schemaVersion': 2,
+    'version': version,
+    'targetVersionCode': targetVersionCode,
+    'lib': libManifest,
+    if (requestedAssets.isNotEmpty)
+      'assets': {
+        'mode': 'overlay',
+        'manifestPatch': 'manifest_patch.json',
+        'prefix': 'assets/',
+        'files': patchFiles.values
+            .map((file) => {
+                  'path': file.path,
+                  'md5': file.md5Hex,
+                  'size': file.bytes.length,
+                })
+            .toList(),
+      },
+  };
+
+  final package = Archive()
+    ..addFile(_jsonArchiveFile('manifest.json', zipManifest));
+  for (final (currentAbi, soBytes) in libs) {
+    package.addFile(
+        ArchiveFile('lib/$currentAbi/libapp.so', soBytes.length, soBytes));
+  }
+
+  if (requestedAssets.isNotEmpty) {
+    final manifestPatch = <String, dynamic>{
+      'schemaVersion': 1,
+      'manifestFormat': 'bin',
+      'baseManifestSize': baseManifestSize,
+      'operations': operations,
+    };
+    package.addFile(_jsonArchiveFile('manifest_patch.json', manifestPatch));
+    for (final file in patchFiles.values) {
+      package.addFile(
+        ArchiveFile('assets/${file.path}', file.bytes.length, file.bytes),
+      );
+    }
+  }
+
+  // archive 3.x returns List<int>?, 4.x returns List<int>; coerce to bytes.
+  // ignore: unnecessary_nullable_for_final_variable_declarations, dead_null_aware_expression
+  final List<int> packageBytes = ZipEncoder().encode(package) ?? const <int>[];
+  final outZip = File('${outDir.path}/patch.zip');
+  outZip.writeAsBytesSync(packageBytes);
+
+  final payloadMd5 = md5.convert(packageBytes).toString();
+  final outerManifest = <String, dynamic>{
+    'schemaVersion': 2,
+    'version': version,
+    'md5': payloadMd5,
+    'targetVersionCode': targetVersionCode,
+    'abis': libs.map((e) => e.$1).toList(),
+    'payload': 'patch.zip',
+  };
+  _writeJson(File('${outDir.path}/manifest.json'), outerManifest);
+
+  return PackResult(
+    payloadPath: outZip.path,
+    manifestPath: '${outDir.path}/manifest.json',
+    abis: libs.map((e) => e.$1).toList(),
+    md5: payloadMd5,
+    version: version,
+    targetVersionCode: targetVersionCode,
+    assetCount: patchFiles.length,
+  );
+}
+
+ArchiveFile _jsonArchiveFile(String name, Map<String, dynamic> json) {
+  final bytes =
+      utf8.encode('${const JsonEncoder.withIndent('  ').convert(json)}\n');
+  return ArchiveFile(name, bytes.length, bytes);
+}
+
+/// Collect every `lib/<abi>/libapp.so` present in the APK.
+List<(String, List<int>)> _collectLibapps(Archive archive) {
+  final found = <(String, List<int>)>[];
+  final seen = <String>{};
+  final regex = RegExp(r'^lib/([^/]+)/libapp\.so$');
+  for (final file in archive.files) {
+    final m = regex.firstMatch(file.name);
+    if (m != null && seen.add(m.group(1)!)) {
+      found.add((m.group(1)!, _archiveFileBytes(file)));
+    }
+  }
+  found.sort((a, b) {
+    final ia = abiPriority.indexOf(a.$1);
+    final ib = abiPriority.indexOf(b.$1);
+    final ra = ia < 0 ? _nonPriorityRank(a.$1) : ia;
+    final rb = ib < 0 ? _nonPriorityRank(b.$1) : ib;
+    return ra.compareTo(rb);
+  });
+  return found;
+}
+
+int _nonPriorityRank(String abi) => abiPriority.length;
+
+ArchiveFile? _findFile(Archive archive, String name) {
+  for (final file in archive.files) {
+    if (!file.isFile) continue;
+    if (file.name == name) return file;
+  }
+  return null;
+}
+
+void _writeJson(File file, Map<String, dynamic> json) {
+  file.writeAsStringSync(
+      '${const JsonEncoder.withIndent('  ').convert(json)}\n');
+}
+
+void _validateArchiveRelativePath(String path, String label) {
+  if (path.isEmpty ||
+      path.startsWith('/') ||
+      path.startsWith('\\') ||
+      path.contains('\u0000') ||
+      path.split('/').contains('..')) {
+    throw PackException('invalid $label: $path');
+  }
+}
+
+List<int> _archiveFileBytes(ArchiveFile file) {
+  final dynamic dynamicFile = file;
+  try {
+    return List<int>.from(dynamicFile.readBytes() as List<int>);
+  } on NoSuchMethodError {
+    return List<int>.from(dynamicFile.content as List<int>);
+  }
+}
+
+class _PatchAssetFile {
+  const _PatchAssetFile({
+    required this.path,
+    required this.bytes,
+    required this.md5Hex,
+  });
+
+  final String path;
+  final List<int> bytes;
+  final String md5Hex;
+}
+
+/// Error carrying a stable CLI exit code.
+class PackException implements Exception {
+  const PackException(this.message, [this.exitCode = 1]);
+
+  final String message;
+  final int exitCode;
+}
+
+class _FlutterStandardMessageCodec {
+  late ByteData _data;
+  late int _offset;
+
+  Object? decode(List<int> bytes) {
+    final list = Uint8List.fromList(bytes);
+    _data = ByteData.sublistView(list);
+    _offset = 0;
+    final value = _readValue();
+    if (_offset != _data.lengthInBytes) {
+      throw PackException('AssetManifest.bin has trailing bytes.');
+    }
+    return value;
+  }
+
+  Object? _readValue() {
+    final type = _readUint8();
+    switch (type) {
+      case 0:
+        return null;
+      case 1:
+        return true;
+      case 2:
+        return false;
+      case 3:
+        return _readInt32();
+      case 4:
+        return _readInt64();
+      case 6:
+        _alignTo(8);
+        return _readFloat64();
+      case 7:
+        final len = _readSize();
+        final bytes = _readBytes(len);
+        return utf8.decode(bytes);
+      case 12:
+        final len = _readSize();
+        return List<Object?>.generate(len, (_) => _readValue());
+      case 13:
+        final len = _readSize();
+        final map = <Object?, Object?>{};
+        for (var i = 0; i < len; i++) {
+          map[_readValue()] = _readValue();
+        }
+        return map;
+      default:
+        throw PackException(
+          'unsupported StandardMessageCodec type in AssetManifest.bin: $type',
+        );
+    }
+  }
+
+  int _readSize() {
+    final first = _readUint8();
+    if (first < 254) return first;
+    if (first == 254) return _readUint16();
+    return _readUint32();
+  }
+
+  int _readUint8() {
+    _ensure(1);
+    return _data.getUint8(_offset++);
+  }
+
+  int _readUint16() {
+    _ensure(2);
+    final value = _data.getUint16(_offset, Endian.little);
+    _offset += 2;
+    return value;
+  }
+
+  int _readUint32() {
+    _ensure(4);
+    final value = _data.getUint32(_offset, Endian.little);
+    _offset += 4;
+    return value;
+  }
+
+  int _readInt32() {
+    _ensure(4);
+    final value = _data.getInt32(_offset, Endian.little);
+    _offset += 4;
+    return value;
+  }
+
+  int _readInt64() {
+    _ensure(8);
+    final value = _data.getInt64(_offset, Endian.little);
+    _offset += 8;
+    return value;
+  }
+
+  double _readFloat64() {
+    _ensure(8);
+    final value = _data.getFloat64(_offset, Endian.little);
+    _offset += 8;
+    return value;
+  }
+
+  Uint8List _readBytes(int length) {
+    _ensure(length);
+    final start = _offset;
+    _offset += length;
+    return _data.buffer.asUint8List(start, length);
+  }
+
+  void _alignTo(int alignment) {
+    final mod = _offset % alignment;
+    if (mod != 0) _offset += alignment - mod;
+  }
+
+  void _ensure(int length) {
+    if (_offset + length > _data.lengthInBytes) {
+      throw PackException('truncated AssetManifest.bin');
+    }
+  }
+}

package/dart-src/packages/cli-tools/lib/src/sign.dart

@@ -0,0 +1,60 @@
+import 'dart:convert';
+
+import 'package:cryptography/cryptography.dart';
+
+/// Verify an Ed25519 signature over [message].
+///
+/// [publicKeyBase64] may be either a raw 32-byte Ed25519 public key or the
+/// X.509 SubjectPublicKeyInfo (SPKI) form expected by the Android device SDK.
+Future<bool> ed25519Verify(
+  List<int> message,
+  String signatureBase64,
+  String publicKeyBase64,
+) async {
+  var pkBytes = base64Decode(publicKeyBase64);
+  // Strip the X.509 SPKI prefix (12 bytes) if present so [SimplePublicKey]
+  // receives the raw 32-byte key.
+  if (pkBytes.length == 44 && _startsWith(pkBytes, _ed25519SpkiPrefix)) {
+    pkBytes = pkBytes.sublist(_ed25519SpkiPrefix.length);
+  }
+  final public = SimplePublicKey(pkBytes, type: KeyPairType.ed25519);
+  final sig = Signature(base64Decode(signatureBase64), publicKey: public);
+  return Ed25519().verify(message, signature: sig);
+}
+
+/// The 12-byte DER prefix of an Ed25519 X.509 SubjectPublicKeyInfo.
+const List<int> _ed25519SpkiPrefix = <int>[
+  0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+];
+
+bool _startsWith(List<int> bytes, List<int> prefix) {
+  if (bytes.length < prefix.length) return false;
+  for (var i = 0; i < prefix.length; i++) {
+    if (bytes[i] != prefix[i]) return false;
+  }
+  return true;
+}
+
+/// Generate a fresh Ed25519 keypair, returning (privateSeedB64, publicB64).
+///
+/// The returned public key is the X.509 SubjectPublicKeyInfo (SPKI) base64
+/// form, which is exactly what the Android device SDK expects
+/// (`SignatureVerifier.verifyEd25519` decodes X.509).
+Future<(String, String)> generateEd25519KeyPair() async {
+  final keyPair = await Ed25519().newKeyPair();
+  final private = await keyPair.extractPrivateKeyBytes();
+  final rawPublic = (await keyPair.extractPublicKey()).bytes;
+  final spki = <int>[
+    ..._ed25519SpkiPrefix,
+    ...rawPublic,
+  ];
+  return (base64Encode(private), base64Encode(spki));
+}
+
+/// Sign [message] with an Ed25519 private seed (base64, 32 bytes).
+Future<String> ed25519Sign(List<int> message, String privateKeyBase64) async {
+  final seed = base64Decode(privateKeyBase64);
+  final keyPair = await Ed25519().newKeyPairFromSeed(seed);
+  final signature = await Ed25519().sign(message, keyPair: keyPair);
+  return base64Encode(signature.bytes);
+}