@akanjs/devkit 3.1.1-rc.1 → 3.1.1-rc.11

package/mobile/desktopRelease.ts

@@ -0,0 +1,309 @@
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { isRecord, toError } from "akanjs/common";
+import type { UpdateManifest } from "akanjs/native/api";
+import { AkanAppConfig } from "../akanConfig";
+import type { DesktopArch } from "./desktopBin";
+import type { DesktopPlatform } from "./mobileTarget";
+import type { NativeBuildApiModule } from "./nativeApi";
+import { TarWriter } from "./tarWriter";
+import { UpdateUploader } from "./updateUploader";
+
+export type DesktopSigner = { teamId: string } | { subject: string } | null;
+
+/**
+ * `release.json`, the one file of a desktop release archive `publish-update` did not write. Schema 2: the archive holds
+ * the release's envelope, and its v1 pair only when that is the same release.
+ */
+export interface DesktopReleaseRecord {
+  schema: 2;
+  cli: string;
+  platform: DesktopPlatform;
+  arch: DesktopArch;
+  channel: string;
+  signer: DesktopSigner;
+  builtAt: string;
+}
+
+export type SignatureTool = (
+  cmd: string[],
+  options?: { env?: Record<string, string> },
+) => Promise<{ code: number; output: string }>;
+
+type DesktopManifest = Partial<UpdateManifest> &
+  Required<Pick<UpdateManifest, "archive" | "build" | "bundle" | "sequence">>;
+
+interface DesktopReleasePayload {
+  name: string;
+  size: number;
+  sha256: string;
+}
+
+interface DesktopReleaseManifestFile {
+  name: string;
+  bytes: Uint8Array<ArrayBuffer>;
+}
+
+//* One desktop channel's release as `publish-update` left it in `<updates>/<os>-<arch>/`: the signed envelope, the v1
+//* pair of the same release, and the files the manifest names, packed as they are, so the same folder uploaded anywhere
+//* else stays valid.
+export class DesktopRelease {
+  //? Constrained Language Mode (WDAC, AppLocker) refuses .NET type literals and method calls, so the script makes none.
+  //? Windows PowerShell writes its console in the OEM code page, which mangles a subject outside it; a file keeps UTF-8.
+  static readonly #authenticode = `$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$signature = Get-AuthenticodeSignature -LiteralPath $env:AKAN_RELEASE_EXE
+$subject = if ("$($signature.Status)" -ceq 'Valid') { "$($signature.SignerCertificate.Subject)" } else { '' }
+Set-Content -LiteralPath $env:AKAN_SIGNER_OUT -Value $subject -Encoding UTF8`;
+
+  private constructor(
+    readonly dir: string,
+    readonly manifest: DesktopManifest,
+    readonly payloads: DesktopReleasePayload[],
+    readonly platform: DesktopPlatform,
+    readonly arch: DesktopArch,
+    readonly channel: string,
+    readonly manifestFiles: DesktopReleaseManifestFile[],
+  ) {}
+
+  static async read(
+    updatesDir: string,
+    {
+      platform,
+      arch,
+      channel,
+      appId,
+      target,
+      publicKeys,
+      revokedKeys = [],
+      api,
+    }: {
+      platform: DesktopPlatform;
+      arch: DesktopArch;
+      channel: string;
+      appId: string;
+      target?: string;
+      publicKeys: readonly string[];
+      revokedKeys?: readonly string[];
+      api: Pick<NativeBuildApiModule, "openEnvelope" | "verifyManifest">;
+    },
+  ) {
+    const folder = `${platform}-${arch}`;
+    const dir = path.join(updatesDir, folder);
+    const envelopeName = `${channel}/app.json`;
+    const envelopePath = path.join(dir, channel, "app.json");
+    const envelope = await readFile(envelopePath).catch(() => null);
+    if (!envelope) throw new Error(`${envelopePath} is missing: run \`akan publish-update\` first.`);
+    const opened = DesktopRelease.#open(api, envelope, publicKeys, revokedKeys);
+    if (typeof opened === "string") throw new Error(`${envelopePath}: ${opened}; publish the release again.`);
+    const manifest = DesktopRelease.#parse(opened);
+    if (
+      manifest?.schema !== 2 ||
+      manifest.kind !== "app" ||
+      manifest.app !== appId ||
+      manifest.platform !== platform ||
+      manifest.arch !== arch ||
+      manifest.channel !== channel ||
+      manifest.target !== target ||
+      typeof manifest.bundle !== "string" ||
+      typeof manifest.sequence !== "number" ||
+      typeof manifest.build !== "number" ||
+      !manifest.archive
+    )
+      throw new Error(
+        `${envelopePath} is not a release of ${appId}${target ? ` target ${target}` : ""} for ${folder} on channel ${channel}.`,
+      );
+    const { archive, bundle, sequence, build } = manifest;
+    const legacy = await DesktopRelease.#legacyPair(api, dir, channel, publicKeys[0], manifest);
+    const keys = await UpdateUploader.releaseFiles(updatesDir, { dir, channel, bundle });
+    const expected = new Map(
+      [{ url: archive.url, size: archive.size, sha256: archive.gzSha256 }, ...(manifest.patches ?? [])].map(
+        ({ url, size, sha256 }) => [path.posix.normalize(url), { size, sha256 }],
+      ),
+    );
+    const payloads = keys.flatMap((key) => {
+      const name = key.slice(folder.length + 1);
+      const digest = expected.get(name);
+      return digest ? [{ name, ...digest }] : [];
+    });
+    return new DesktopRelease(
+      dir,
+      { ...manifest, archive, bundle, sequence, build },
+      payloads,
+      platform,
+      arch,
+      channel,
+      [{ name: envelopeName, bytes: envelope }, ...legacy],
+    );
+  }
+
+  //? An app built before protocol v2 reads the pair, signed with the first key only; a pair of an earlier release is
+  //? left out, since it would publish that release again to those apps.
+  static async #legacyPair(
+    api: Pick<NativeBuildApiModule, "verifyManifest">,
+    dir: string,
+    channel: string,
+    publicKey: string | undefined,
+    manifest: Partial<UpdateManifest>,
+  ): Promise<DesktopReleaseManifestFile[]> {
+    const [bytes, signature] = await Promise.all(
+      [`${channel}.json`, `${channel}.json.sig`].map((name) => readFile(path.join(dir, name)).catch(() => null)),
+    );
+    if (!bytes || !signature || !publicKey) return [];
+    const v1 = DesktopRelease.#parse(bytes);
+    if (v1?.schema !== 1 || v1.bundle !== manifest.bundle || v1.sequence !== manifest.sequence) return [];
+    if (!api.verifyManifest(bytes, new TextDecoder().decode(signature).trim(), publicKey)) return [];
+    return [
+      { name: `${channel}.json`, bytes },
+      { name: `${channel}.json.sig`, bytes: signature },
+    ];
+  }
+
+  record(signer: DesktopSigner): DesktopReleaseRecord {
+    const { platform, arch, channel } = this;
+    const builtAt = new Date(this.manifest.build * 1000).toISOString();
+    return { schema: 2, cli: AkanAppConfig.akanVersion, platform, arch, channel, signer, builtAt };
+  }
+
+  //* Akan Cloud refuses every push in any other shape: uncompressed, regular files under `./` names, no directory
+  //* entry, no ustar prefix, no GNU L/K, a pax 'x' holding `path` alone, and release.json, the envelope and the v1 pair
+  //* before any `app/` entry. What the manifest names is checked against it as it is copied.
+  async withArchive<T>(record: DesktopReleaseRecord, use: (archive: string) => Promise<T>): Promise<T> {
+    const tmp = await mkdtemp(path.join(os.tmpdir(), "akan-release-"));
+    try {
+      const archive = path.join(tmp, "release.tar");
+      const tar = await TarWriter.create(archive, { mtime: this.manifest.sequence });
+      try {
+        await tar.add("./release.json", new Blob([`${JSON.stringify(record, null, 2)}\n`]));
+        for (const { name, bytes } of this.manifestFiles) await tar.add(`./${name}`, new Blob([bytes]));
+        for (const { name, size, sha256 } of this.payloads) {
+          const file = Bun.file(path.join(this.dir, name));
+          const what = `${path.join(this.dir, name)} is not the file ${this.channel}/app.json names`;
+          if (!(await file.exists()) || file.size !== size) throw new Error(`${what}: publish the release again.`);
+          if ((await tar.add(`./${name}`, file)) !== sha256) throw new Error(`${what} (its sha256 differs).`);
+        }
+        await tar.close();
+      } catch (error) {
+        await tar.discard();
+        throw error;
+      }
+      return await use(archive);
+    } finally {
+      await rm(tmp, { recursive: true, force: true });
+    }
+  }
+
+  async signer({
+    exeName,
+    host = process.platform,
+    run = DesktopRelease.#run,
+  }: {
+    exeName: string;
+    host?: NodeJS.Platform;
+    run?: SignatureTool;
+  }): Promise<{ signer: DesktopSigner; unread: string | null }> {
+    if (this.platform === "linux") return { signer: null, unread: null };
+    const app = this.manifest.files?.[0]?.path;
+    if (!app || !/^[^/\\]+$/.test(app) || app === "." || app === "..")
+      return { signer: null, unread: `${this.channel}/app.json names no app folder` };
+    if (this.platform === "macos" && host !== "darwin")
+      return { signer: null, unread: "codesign reads a macOS app's signer on macOS only" };
+    if (this.platform === "windows" && host !== "win32")
+      return { signer: null, unread: "PowerShell reads a Windows app's Authenticode signer on Windows only" };
+    const tmp = await mkdtemp(path.join(os.tmpdir(), "akan-signer-"));
+    try {
+      const archive = path.join(this.dir, this.manifest.archive.url);
+      return this.platform === "macos"
+        ? await DesktopRelease.#teamOf(run, archive, tmp, app)
+        : await DesktopRelease.#subjectOf(run, archive, tmp, path.posix.join(app, `${exeName}.exe`));
+    } finally {
+      await rm(tmp, { recursive: true, force: true });
+    }
+  }
+
+  //? The signature lives in the executable and _CodeSignature; Info.plist names the executable. An app signed without
+  //? resources has no _CodeSignature, and bsdtar then exits 1 for the unmatched --include though it wrote the rest.
+  static async #teamOf(run: SignatureTool, archive: string, tmp: string, app: string) {
+    const contents = `${app}/Contents`;
+    await run([
+      "/usr/bin/tar",
+      "-xzf",
+      archive,
+      "-C",
+      tmp,
+      ...["Info.plist", "MacOS/*", "_CodeSignature/*"].flatMap((entry) => ["--include", `${contents}/${entry}`]),
+    ]);
+    if (!(await Bun.file(path.join(tmp, contents, "Info.plist")).exists()))
+      return { signer: null, unread: `the archive holds no ${contents}/Info.plist` };
+    const { output } = await run(["/usr/bin/codesign", "--display", "--verbose=2", path.join(tmp, app)]);
+    const teamId = /^TeamIdentifier=([A-Z0-9]{10})$/m.exec(output)?.[1];
+    if (teamId) return { signer: { teamId }, unread: null };
+    if (/^TeamIdentifier=not set$/m.test(output) || /code object is not signed at all/.test(output))
+      return { signer: null, unread: null };
+    return { signer: null, unread: `codesign could not read ${app}: ${output.trim().split("\n")[0] ?? ""}` };
+  }
+
+  static async #subjectOf(run: SignatureTool, archive: string, tmp: string, exe: string) {
+    //? Windows' own bsdtar: a GNU tar ahead of it on PATH (Git's) takes `C:` for a remote host.
+    const tar = path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe");
+    await run([tar, "-xzf", archive, "-C", tmp, exe]);
+    const extracted = path.join(tmp, exe);
+    if (!(await Bun.file(extracted).exists())) return { signer: null, unread: `the archive holds no ${exe}` };
+    const out = path.join(tmp, "signer.txt");
+    const { code } = await run(
+      [
+        path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(DesktopRelease.#authenticode, "utf16le").toString("base64"),
+      ],
+      { env: { AKAN_RELEASE_EXE: extracted, AKAN_SIGNER_OUT: out } },
+    );
+    if (code !== 0) return { signer: null, unread: `PowerShell could not read the Authenticode signature of ${exe}` };
+    const subject = (await readFile(out, "utf8").catch(() => "")).replace(/^\uFEFF/, "").trim();
+    return { signer: subject ? { subject } : null, unread: null };
+  }
+
+  static #open(
+    api: Pick<NativeBuildApiModule, "openEnvelope">,
+    envelope: Uint8Array,
+    publicKeys: readonly string[],
+    revokedKeys: readonly string[],
+  ): Uint8Array | string {
+    try {
+      return api.openEnvelope(new TextDecoder().decode(envelope), publicKeys, revokedKeys).manifest;
+    } catch (error) {
+      return toError(error).message;
+    }
+  }
+
+  static #parse(bytes: Uint8Array): Partial<UpdateManifest> | null {
+    try {
+      const value: unknown = JSON.parse(new TextDecoder().decode(bytes));
+      return isRecord(value) ? (value as Partial<UpdateManifest>) : null;
+    } catch {
+      return null;
+    }
+  }
+
+  static async #run(cmd: string[], { env }: { env?: Record<string, string> } = {}) {
+    try {
+      const proc = Bun.spawn(cmd, {
+        env: { ...process.env, ...env },
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [code, stdout, stderr] = await Promise.all([
+        proc.exited,
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
+      ]);
+      return { code, output: `${stdout}${stderr}` };
+    } catch (error) {
+      return { code: -1, output: toError(error).message };
+    }
+  }
+}

package/mobile/desktopServerStage.ts

@@ -24,11 +24,13 @@ export interface DesktopServerRun extends ServerPolicy {
 //* `bun install --production` does. It is staged outside dist: installing there would put host packages into the
 //* image's `COPY . .`.
 export class DesktopServerStage {
-  //? An API-only server starts neither the RSC worker nor the akan console and serves no CSR, public/ or SSR artifact,
-  //? and `install` wrote its own package.json. The rest of dist is the server's: its chunks, a `.node`, a `.wasm`.
+  //? An API-only server starts neither the RSC worker nor the akan console and serves no CSR, public/ or SSR
+  //? artifact, and `install` wrote its own package.json and bun.lock. The rest of dist is the server's: its chunks,
+  //? a `.node`, a `.wasm`.
   static readonly uncarried = new Set([
     "Dockerfile",
     "package.json",
+    "bun.lock",
     "rscWorker.js",
     "console.js",
     "console-runtime.js",

package/mobile/index.ts

@@ -1,4 +1,5 @@
 export * from "./desktopBin";
+export * from "./desktopRelease";
 export * from "./desktopServerStage";
 export * from "./mobileTarget";
 export * from "./nativeApi";
@@ -8,6 +9,7 @@ export * from "./nativePluginFolders";
 export * from "./nativePublicEnv";
 export * from "./nativeWebDir";
 export * from "./placeholderAppId";
+export * from "./tarWriter";
 export * from "./updatePackFolder";
 export * from "./updateUploader";
 export * from "./usageDescriptions";

package/mobile/nativeApi.test.ts

@@ -42,6 +42,9 @@ describe("NativeApi", () => {
   });
 
   test("refuses an API older than the one the build calls into, and another major, before anything builds", async () => {
+    await expect(NativeApi.load(await installVendoredApi("0.12.0"))).rejects.toThrow(
+      "install matching versions of akanjs and @akanjs/cli",
+    );
     await expect(NativeApi.load(await installVendoredApi("0.10.0"))).rejects.toThrow(
       "install matching versions of akanjs and @akanjs/cli",
     );
@@ -51,6 +54,6 @@ describe("NativeApi", () => {
     expect((await NativeApi.load(await installVendoredApi(NativeApi.minimumVersion))).API_VERSION).toBe(
       NativeApi.minimumVersion,
     );
-    expect((await NativeApi.load(await installVendoredApi("0.12.0"))).API_VERSION).toBe("0.12.0");
+    expect((await NativeApi.load(await installVendoredApi("0.13.4"))).API_VERSION).toBe("0.13.4");
   });
 });

package/mobile/nativeApi.ts

@@ -6,9 +6,9 @@ export type NativeBuildApiModule = typeof NativeBuildApi;
 export class NativeApi {
   //* The build API versions itself; a major this devkit was not written against is refused before anything builds.
   static readonly supportedMajor = 0;
-  //? An update release's `revoke` and `resetSequence` arrived in 0.12.0, and an older API would publish without them;
-  //? `requestedDistribution` in 0.11.0; akanjs 3.0.x vendors 0.10.0.
-  static readonly minimumVersion = "0.12.0";
+  //? A desktop release's envelope and `updates.target` arrived in 0.13.0, and an older API refuses the key; an update
+  //? release's `revoke` and `resetSequence` in 0.12.0; `requestedDistribution` in 0.11.0; akanjs 3.0.x vendors 0.10.0.
+  static readonly minimumVersion = "0.13.0";
 
   /** The API of the akanjs the app installed: the workspace package inside this repo, akanjs's vendored copy elsewhere. */
   static entryOf(appDir: string): string {

package/mobile/nativeApp.test.ts

@@ -341,8 +341,8 @@ describe("NativeApp", () => {
       (await new NativeApp(fakeApp(), target({ basePath: undefined, updates }), env).config({ platform: "android" }))
         .config.updates;
 
-    expect(await built("main")).toEqual({ ...updates, channel: "main" });
-    expect(await built("debug")).toEqual({ ...updates, channel: "debug" });
+    expect(await built("main")).toEqual({ ...updates, channel: "main", target: "default" });
+    expect(await built("debug")).toEqual({ ...updates, channel: "debug", target: "default" });
   });
 
   test("a desktop app is this computer's platform", () => {

package/mobile/nativeApp.ts

@@ -5,6 +5,7 @@ import type { AkanNativeConfig } from "akanjs/native/config";
 import type { App } from "../commandDecorators";
 import { Executor } from "../executors";
 import { type DesktopArch, DesktopBin } from "./desktopBin";
+import { DesktopRelease } from "./desktopRelease";
 import type { DesktopServerBundle } from "./desktopServerStage";
 import {
   type DesktopPlatform,
@@ -26,7 +27,7 @@ type TaskOptions = Parameters<NativeBuildApiModule["build"]>[0];
 type DeviceSelector = NonNullable<Parameters<NativeBuildApiModule["run"]>[0]["device"]>;
 type ReleaseOptions = Parameters<NativeBuildApiModule["release"]>[0];
 type AndroidSigning = Extract<ReleaseOptions, { platform: "android" }>["signing"];
-type PhoneRevocation = Pick<Parameters<NativeBuildApiModule["checkPublishUpdate"]>[0], "revoke" | "resetSequence">;
+type ReleaseRevocation = Pick<Parameters<NativeBuildApiModule["checkPublishUpdate"]>[0], "revoke" | "resetSequence">;
 
 export interface NativeRunOptions {
   device?: DeviceSelector;
@@ -311,6 +312,29 @@ export class NativeApp {
     return path.join(this.targetRoot, "updates");
   }
 
+  //? The channel falls back as publishUpdate's does, so a push with the flags of the publish finds what it wrote.
+  async publishedRelease(platform: DesktopPlatform, { arch, channel }: { arch: DesktopArch; channel?: string | null }) {
+    this.#assertUpdates();
+    const [api, { config }] = await Promise.all([
+      NativeApi.load(this.app.cwdPath),
+      this.config({ platform, stageBin: false }),
+    ]);
+    const { updates } = config;
+    const publicKeys = updates?.publicKeys ?? (updates?.publicKey ? [updates.publicKey] : []);
+    if (!updates || !publicKeys.length) throw new Error(`Native target '${this.target.name}' has no updates key.`);
+    const release = await DesktopRelease.read(this.updatesDir, {
+      platform,
+      arch,
+      channel: channel ?? updates.channel ?? "production",
+      appId: config.app.id,
+      ...(updates.target ? { target: updates.target } : {}),
+      publicKeys,
+      revokedKeys: updates.revokedKeys ?? [],
+      api,
+    });
+    return { release, url: updates.url, exeName: config.app.fileName ?? "" };
+  }
+
   /** A signed release installed apps take through the updates plugin, from a release build of this bundle. */
   async publishUpdate(
     platform: NativePlatform,
@@ -328,7 +352,7 @@ export class NativeApp {
       arch?: DesktopArch;
       sign?: boolean;
       notarize?: boolean;
-    } & PhoneRevocation = {},
+    } & ReleaseRevocation = {},
   ) {
     NativeApp.#assertServerPlatform(platform, server);
     this.#assertUpdates();
@@ -382,8 +406,8 @@ export class NativeApp {
 
   /**
    * What publishing refuses once the release is built: no updates settings, an invalid config, no signing key or
-   * another app's, a desktop release whose server presence is not its channel's previous release's, and a phone release
-   * whose revocations no phone would take.
+   * another app's, a desktop release whose server presence is not its channel's previous release's, and a release whose
+   * revocations no app would take.
    */
   async assertPublishable(
     platform: NativePlatform,
@@ -393,7 +417,7 @@ export class NativeApp {
       arch,
       revoke,
       resetSequence,
-    }: { channel?: string; server?: boolean; arch?: DesktopArch } & PhoneRevocation = {},
+    }: { channel?: string; server?: boolean; arch?: DesktopArch } & ReleaseRevocation = {},
   ) {
     this.#assertUpdates();
     const [api, { config }] = await Promise.all([

package/mobile/nativeConfig.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { generateKeyPairSync } from "node:crypto";
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import type { AkanNativeTarget } from "../akanConfig";
@@ -42,7 +43,9 @@ const adminTarget: AkanNativeTarget = {
   },
 };
 
-const updatesKey = Buffer.alloc(32, 7).toString("base64");
+const ed25519Key = () =>
+  generateKeyPairSync("ed25519").publicKey.export({ format: "der", type: "spki" }).subarray(12).toString("base64");
+const updatesKey = ed25519Key();
 
 describe("NativeConfig.build", () => {
   test("hands the dmg window over with its pictures resolved against the app folder", () => {
@@ -224,19 +227,22 @@ describe("NativeConfig.build", () => {
       url,
       publicKey: updatesKey,
       channel: "develop",
+      target: "admin",
     });
     expect(build({ url, publicKey: updatesKey, channel: "beta", readyTimeout: 15_000 }, "main").updates).toEqual({
       url,
       publicKey: updatesKey,
       channel: "beta",
       readyTimeout: 15_000,
+      target: "admin",
     });
-    expect(build({ url, publicKey: updatesKey }).updates).toEqual({ url, publicKey: updatesKey });
-    const spare = Buffer.alloc(32, 8).toString("base64");
+    expect(build({ url, publicKey: updatesKey }).updates).toEqual({ url, publicKey: updatesKey, target: "admin" });
+    const spare = ed25519Key();
     expect(build({ url, publicKeys: [updatesKey, spare] }, "main").updates).toEqual({
       url,
       publicKeys: [updatesKey, spare],
       channel: "main",
+      target: "admin",
     });
     const report = { url: "https://cloud.example.com/api/ota/report/abcdefghijklmnop" };
     expect(build({ url, publicKey: updatesKey, report }, "main").updates).toEqual({
@@ -244,6 +250,7 @@ describe("NativeConfig.build", () => {
       publicKey: updatesKey,
       channel: "main",
       report,
+      target: "admin",
     });
     expect(build({ url, publicKey: updatesKey }, "main").plugins).toContain("updates");
     expect(build(undefined, "main").plugins).not.toContain("updates");
@@ -457,7 +464,7 @@ describe("NativeConfig.build", () => {
     });
 
     expect(config.plugins).toEqual([...NativeConfig.basePlugins, "updates"]);
-    expect(config.updates).toEqual(updates);
+    expect(config.updates).toEqual({ ...updates, target: minimalTarget.name });
   });
 
   test("an updates channel left unnamed is the backend env the binary is built for", () => {
@@ -479,10 +486,11 @@ describe("NativeConfig.build", () => {
         ...(env ? { env } : {}),
       }).config.updates;
 
-    expect(build("debug")).toEqual({ ...updates, channel: "debug" });
-    expect(build("main")).toEqual({ ...updates, channel: "main" });
-    expect(build("debug", "pilot")).toEqual({ ...updates, channel: "pilot" });
-    expect(build()).toEqual(updates);
+    const target = minimalTarget.name;
+    expect(build("debug")).toEqual({ ...updates, channel: "debug", target });
+    expect(build("main")).toEqual({ ...updates, channel: "main", target });
+    expect(build("debug", "pilot")).toEqual({ ...updates, channel: "pilot", target });
+    expect(build()).toEqual({ ...updates, target });
   });
 
   test("keeps a file name the runtime accepts", () => {

package/mobile/nativeConfig.ts

@@ -267,7 +267,7 @@ export class NativeConfig {
   static #updates(target: AkanNativeTarget, env?: NativeEnv): NonNullable<AkanNativeConfig["updates"]> | undefined {
     const { url, publicKey, publicKeys, channel = env, ...rest } = target.updates ?? {};
     const keys = publicKeys ? { publicKeys: [...publicKeys] } : publicKey ? { publicKey } : null;
-    return url && keys ? { ...rest, url, ...keys, ...(channel ? { channel } : {}) } : undefined;
+    return url && keys ? { ...rest, url, ...keys, ...(channel ? { channel } : {}), target: target.name } : undefined;
   }
 
   /** Letters, digits, `.`, `_` and `-` only; the folder name of an akan app already is one almost always. */

package/mobile/tarWriter.test.ts

@@ -0,0 +1,89 @@
+import { describe, expect, test } from "bun:test";
+import { createHash } from "node:crypto";
+import { mkdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { tempDirs } from "../testHelpers";
+import { TarWriter } from "./tarWriter";
+
+const makeDir = tempDirs("akan-tar-writer-");
+const delta = `./app/${"a".repeat(64)}-${"b".repeat(64)}.delta.gz`;
+const sha256 = (bytes: string | Uint8Array) => createHash("sha256").update(bytes).digest("hex");
+
+const write = async (file: string, entries: [string, string][], mtime = 1_761_700_000) => {
+  const tar = await TarWriter.create(file, { mtime });
+  const digests: string[] = [];
+  for (const [name, body] of entries) digests.push(await tar.add(name, new Blob([body])));
+  await tar.close();
+  return digests;
+};
+
+describe("TarWriter", () => {
+  test("a system tar reads back every file under its name, a 144-byte one too, and lists nothing else", async () => {
+    const dir = await makeDir();
+    const file = path.join(dir, "release.tar");
+    const entries: [string, string][] = [
+      ["./release.json", '{"schema":1}\n'],
+      [delta, "x".repeat(1_000)],
+    ];
+
+    const digests = await write(file, entries);
+
+    expect(digests).toEqual(entries.map(([, body]) => sha256(body)));
+    const listed = Bun.spawnSync(["tar", "-tf", file]).stdout.toString().split(/\r?\n/).filter(Boolean);
+    expect(listed).toEqual(entries.map(([name]) => name));
+    const out = path.join(dir, "out");
+    await mkdir(out);
+    expect(Bun.spawnSync(["tar", "-xf", file, "-C", out]).exitCode).toBe(0);
+    for (const [name, body] of entries) expect(await readFile(path.join(out, name), "utf8")).toBe(body);
+  });
+
+  test("writes ustar headers of mode 0644, owner 0 and the given mtime, padded to 512-byte blocks", async () => {
+    const dir = await makeDir();
+    const file = path.join(dir, "release.tar");
+
+    await write(file, [["./a.json", "{}"]], 1_761_700_000);
+
+    const bytes = await readFile(file);
+    const field = (at: number, width: number) => bytes.subarray(at, at + width).toString("latin1");
+    expect(field(0, 9)).toBe("./a.json\0");
+    expect(field(100, 8)).toBe("0000644\0");
+    expect(field(108, 16)).toBe("0000000\x000000000\0");
+    expect(Number.parseInt(field(136, 11), 8)).toBe(1_761_700_000);
+    expect(field(156, 1)).toBe("0");
+    expect(field(257, 8)).toBe("ustar\x0000");
+    expect(bytes.length).toBe(512 + 512 + 1024);
+    expect(bytes.subarray(1024).every((byte) => byte === 0)).toBe(true);
+  });
+
+  test("the same files and mtime make the same archive", async () => {
+    const dir = await makeDir();
+    const entries: [string, string][] = [
+      ["./main.json", "{}\n"],
+      [delta, "patch"],
+    ];
+
+    await write(path.join(dir, "one.tar"), entries);
+    await write(path.join(dir, "two.tar"), entries);
+
+    expect(sha256(await readFile(path.join(dir, "one.tar")))).toBe(sha256(await readFile(path.join(dir, "two.tar"))));
+  });
+
+  test("refuses a file whose length is not the one it was announced with", async () => {
+    const dir = await makeDir();
+    const tar = await TarWriter.create(path.join(dir, "release.tar"));
+    const grown = { size: 3, stream: () => new Blob(["abcdef"]).stream() } as unknown as Blob;
+
+    await expect(tar.add("./app/x.tar.gz", grown)).rejects.toThrow(
+      "./app/x.tar.gz changed while it was archived: 6 bytes, not 3.",
+    );
+    await tar.discard();
+  });
+
+  test("never overwrites an existing file", async () => {
+    const file = path.join(await makeDir(), "release.tar");
+    await Bun.write(file, "kept");
+
+    await expect(TarWriter.create(file)).rejects.toThrow();
+    expect(await readFile(file, "utf8")).toBe("kept");
+  });
+});