@akanjs/devkit 3.1.1-rc.5 → 3.1.1-rc.7

package/mobile/desktopRelease.test.ts

@@ -0,0 +1,361 @@
+import { describe, expect, test } from "bun:test";
+import { createHash, generateKeyPairSync, sign } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { AkanAppConfig } from "../akanConfig";
+import { tempDirs } from "../testHelpers";
+import type { DesktopArch } from "./desktopBin";
+import { DesktopRelease, type SignatureTool } from "./desktopRelease";
+import type { DesktopPlatform } from "./mobileTarget";
+
+const makeDir = tempDirs("akan-desktop-release-");
+const sha256 = (bytes: string | Uint8Array) => createHash("sha256").update(bytes).digest("hex");
+
+const keyOf = () => {
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  return {
+    publicKey: publicKey.export({ format: "der", type: "spki" }).subarray(12).toString("base64"),
+    sign: (bytes: string) => `${sign(null, Buffer.from(bytes), privateKey).toString("base64")}\n`,
+  };
+};
+const key = keyOf();
+const appId = "com.akancad.app";
+
+interface Published {
+  updatesDir: string;
+  dir: string;
+  tarSha: string;
+  delta: string;
+  build: number;
+}
+
+const publish = async ({
+  platform = "macos",
+  arch = "arm64",
+  channel = "main",
+  app = platform === "macos" ? "Akancad.app" : "akancad",
+  gz = "the release's gzip tar",
+}: {
+  platform?: DesktopPlatform;
+  arch?: DesktopArch;
+  channel?: string;
+  app?: string;
+  gz?: string;
+} = {}) => {
+  const updatesDir = await makeDir();
+  const dir = path.join(updatesDir, `${platform}-${arch}`);
+  await mkdir(path.join(dir, "app"), { recursive: true });
+  const tarSha = sha256(`${channel} tar`);
+  const from = sha256("the previous tar");
+  const delta = `${from}-${tarSha}.delta.gz`;
+  await writeFile(path.join(dir, "app", `${tarSha}.tar.gz`), gz);
+  await writeFile(path.join(dir, "app", delta), "a delta");
+  const build = 1_761_699_000;
+  const manifest = {
+    schema: 1,
+    kind: "app",
+    app: appId,
+    platform,
+    channel,
+    sequence: 1_761_700_000,
+    bundle: "1.2.0-1761700000",
+    runtimeVersion: "0.12.0",
+    version: "1.2.0",
+    build,
+    arch,
+    files: [{ path: app, sha256: tarSha, size: 2048 }],
+    archive: { sha256: tarSha, url: `app/${tarSha}.tar.gz`, size: gz.length, gzSha256: sha256(gz) },
+    patches: [{ from, url: `app/${delta}`, sha256: sha256("a delta"), size: 7 }],
+    server: true,
+  };
+  const bytes = `${JSON.stringify(manifest, null, 2)}\n`;
+  await writeFile(path.join(dir, `${channel}.json`), bytes);
+  await writeFile(path.join(dir, `${channel}.json.sig`), key.sign(bytes));
+  return { updatesDir, dir, tarSha, delta, build } satisfies Published;
+};
+
+const read = (
+  { updatesDir }: Published,
+  {
+    platform = "macos",
+    arch = "arm64",
+    channel = "main",
+    publicKey = key.publicKey,
+    id = appId,
+  }: { platform?: DesktopPlatform; arch?: DesktopArch; channel?: string; publicKey?: string; id?: string } = {},
+) => DesktopRelease.read(updatesDir, { platform, arch, channel, appId: id, publicKey });
+
+const entriesOf = (archive: string) =>
+  Bun.spawnSync(["tar", "-tf", archive]).stdout.toString().split(/\r?\n/).filter(Boolean);
+
+const extract = async (archive: string) => {
+  const out = await makeDir();
+  expect(Bun.spawnSync(["tar", "-xf", archive, "-C", out]).exitCode).toBe(0);
+  return out;
+};
+
+describe("DesktopRelease", () => {
+  test("packs only what the channel's manifest names: no other channel, earlier archive or folder record", async () => {
+    const published = await publish();
+    const { dir, tarSha, delta } = published;
+    await publish({ channel: "develop" }).then(async (other) => {
+      for (const name of ["develop.json", "develop.json.sig"])
+        await writeFile(path.join(dir, name), await readFile(path.join(other.dir, name)));
+    });
+    await writeFile(path.join(dir, "app", `${sha256("an earlier tar")}.tar.gz`), "an earlier release");
+    await writeFile(path.join(dir, "mirror.txt"), "not part of the release");
+    const release = await read(published);
+
+    const entries = await release.withArchive(release.record(null), async (archive) => entriesOf(archive));
+
+    expect(entries).toEqual([
+      "./release.json",
+      "./main.json",
+      "./main.json.sig",
+      `./app/${tarSha}.tar.gz`,
+      `./app/${delta}`,
+    ]);
+  });
+
+  test("the manifest and its signature go in byte for byte, beside a release.json of the CLI and the build time", async () => {
+    const published = await publish();
+    const release = await read(published);
+    const record = release.record({ teamId: "ABCDE12345" });
+
+    const out = await release.withArchive(record, extract);
+
+    for (const name of ["main.json", "main.json.sig"])
+      expect(sha256(await readFile(path.join(out, name)))).toBe(sha256(await readFile(path.join(published.dir, name))));
+    expect(await readFile(path.join(out, "release.json"), "utf8")).toBe(`${JSON.stringify(record, null, 2)}\n`);
+    expect(record).toEqual({
+      schema: 1,
+      cli: AkanAppConfig.akanVersion,
+      platform: "macos",
+      arch: "arm64",
+      channel: "main",
+      signer: { teamId: "ABCDE12345" },
+      builtAt: new Date(published.build * 1000).toISOString(),
+    });
+  });
+
+  test("leaves no archive behind, also when the upload fails", async () => {
+    const release = await read(await publish());
+    let kept = "";
+
+    await expect(
+      release.withArchive(release.record(null), async (archive) => {
+        kept = archive;
+        throw new Error("upload failed");
+      }),
+    ).rejects.toThrow("upload failed");
+    expect(await Bun.file(kept).exists()).toBe(false);
+  });
+
+  test("refuses a manifest the target's first key did not sign, before reading anything it names", async () => {
+    const published = await publish();
+
+    await expect(read(published, { publicKey: keyOf().publicKey })).rejects.toThrow(
+      "main.json.sig does not verify with updates.publicKeys[0], the one key installed apps trust",
+    );
+  });
+
+  test("refuses a release of another app, and names a channel or CPU it holds none of", async () => {
+    const published = await publish();
+
+    await expect(read(published, { id: "com.other" })).rejects.toThrow(
+      "is not a release of com.other for macos-arm64 on channel main.",
+    );
+    await expect(read(published, { channel: "develop" })).rejects.toThrow(
+      `${path.join(published.dir, "develop.json")} is missing: run \`akan publish-update\` first.`,
+    );
+    await expect(read(published, { arch: "x64" })).rejects.toThrow("macos-x64");
+  });
+
+  test("refuses an archive that is not the file the manifest names, by its length or its digest", async () => {
+    const published = await publish();
+    const archive = path.join(published.dir, "app", `${published.tarSha}.tar.gz`);
+    const release = await read(published);
+    const send = () => release.withArchive(release.record(null), async () => "sent");
+
+    await writeFile(archive, "the release's gzip tar!");
+    await expect(send()).rejects.toThrow(`${archive} is not the file main.json names: publish the release again.`);
+    await writeFile(archive, "the release's gzip taR");
+    await expect(send()).rejects.toThrow(`${archive} is not the file main.json names (its sha256 differs).`);
+  });
+});
+
+const recordingTool = (
+  answer: (cmd: string[], env: Record<string, string>) => Promise<{ code: number; output: string }>,
+) => {
+  const calls: { cmd: string[]; env: Record<string, string> }[] = [];
+  const run: SignatureTool = async (cmd, { env = {} } = {}) => {
+    calls.push({ cmd, env });
+    return await answer(cmd, env);
+  };
+  return { calls, run };
+};
+const bom = String.fromCharCode(0xfeff);
+const extractedTo = (cmd: string[]) => cmd[cmd.indexOf("-C") + 1] ?? "";
+
+describe("DesktopRelease signer", () => {
+  const macTool = (codesign: { code: number; output: string }, { plist = true } = {}) =>
+    recordingTool(async (cmd) => {
+      if (cmd[0] === "/usr/bin/tar") {
+        if (plist) await Bun.write(path.join(extractedTo(cmd), "Akancad.app/Contents/Info.plist"), "<plist/>");
+        return { code: 1, output: "tar: _CodeSignature/*: Not found in archive" };
+      }
+      return codesign;
+    });
+
+  test("macOS: the TeamIdentifier codesign shows for the app in the archive", async () => {
+    const release = await read(await publish());
+    const { calls, run } = macTool({
+      code: 0,
+      output: "Executable=…\nTeamIdentifier=ABCDE12345\nSealed Resources=none\n",
+    });
+
+    expect(await release.signer({ exeName: "akancad", host: "darwin", run })).toEqual({
+      signer: { teamId: "ABCDE12345" },
+      unread: null,
+    });
+    const [extraction, display] = calls;
+    expect(extraction?.cmd.slice(0, 3)).toEqual([
+      "/usr/bin/tar",
+      "-xzf",
+      path.join(release.dir, release.manifest.archive.url),
+    ]);
+    expect(extraction?.cmd.filter((_, idx, cmd) => cmd[idx - 1] === "--include")).toEqual([
+      "Akancad.app/Contents/Info.plist",
+      "Akancad.app/Contents/MacOS/*",
+      "Akancad.app/Contents/_CodeSignature/*",
+    ]);
+    expect(display?.cmd).toEqual([
+      "/usr/bin/codesign",
+      "--display",
+      "--verbose=2",
+      path.join(extractedTo(extraction?.cmd ?? []), "Akancad.app"),
+    ]);
+  });
+
+  test("macOS: an app signed ad hoc or not at all has no signer, and nothing to warn about", async () => {
+    const release = await read(await publish());
+    const adHoc = macTool({ code: 0, output: "Signature=adhoc\nTeamIdentifier=not set\n" });
+    const unsigned = macTool({ code: 1, output: "/tmp/x/Akancad.app: code object is not signed at all\n" });
+
+    for (const { run } of [adHoc, unsigned])
+      expect(await release.signer({ exeName: "akancad", host: "darwin", run })).toEqual({ signer: null, unread: null });
+  });
+
+  test("macOS: says why when codesign or the archive cannot tell", async () => {
+    const release = await read(await publish());
+
+    expect(
+      await release.signer({ exeName: "akancad", host: "darwin", run: macTool({ code: 1, output: "boom\n" }).run }),
+    ).toEqual({ signer: null, unread: "codesign could not read Akancad.app: boom" });
+    expect(
+      await release.signer({
+        exeName: "akancad",
+        host: "darwin",
+        run: macTool({ code: 0, output: "" }, { plist: false }).run,
+      }),
+    ).toEqual({ signer: null, unread: "the archive holds no Akancad.app/Contents/Info.plist" });
+    const { calls, run } = macTool({ code: 0, output: "TeamIdentifier=ABCDE12345\n" });
+    expect(await release.signer({ exeName: "akancad", host: "linux", run })).toEqual({
+      signer: null,
+      unread: "codesign reads a macOS app's signer on macOS only",
+    });
+    expect(calls).toEqual([]);
+  });
+
+  const windowsTool = (powershell: (out: string) => Promise<number>) =>
+    recordingTool(async (cmd, env) => {
+      if (cmd[0] === "tar.exe") {
+        await Bun.write(path.join(extractedTo(cmd), cmd.at(-1) ?? ""), "MZ");
+        return { code: 0, output: "" };
+      }
+      return { code: await powershell(env.AKAN_SIGNER_OUT), output: "" };
+    });
+
+  test("Windows: the Authenticode subject of the app's executable, read as UTF-8", async () => {
+    const release = await read(await publish({ platform: "windows", arch: "x64" }), {
+      platform: "windows",
+      arch: "x64",
+    });
+    const subject = "CN=아칸 주식회사, O=아칸 주식회사, C=KR";
+    const { calls, run } = windowsTool(async (out) => {
+      await Bun.write(out, `${bom}${subject}\r\n`);
+      return 0;
+    });
+
+    expect(await release.signer({ exeName: "akancad", host: "win32", run })).toEqual({
+      signer: { subject },
+      unread: null,
+    });
+    const [extraction, check] = calls;
+    expect(extraction?.cmd.at(-1)).toBe("akancad/akancad.exe");
+    expect(check?.env.AKAN_RELEASE_EXE).toBe(path.join(extractedTo(extraction?.cmd ?? []), "akancad/akancad.exe"));
+    expect(check?.cmd.slice(1, 4)).toEqual(["-NoProfile", "-NonInteractive", "-EncodedCommand"]);
+    expect(Buffer.from(check?.cmd[4] ?? "", "base64").toString("utf16le")).toContain(
+      "Get-AuthenticodeSignature -LiteralPath $env:AKAN_RELEASE_EXE",
+    );
+  });
+
+  test("Windows: an executable without a valid signature has no signer; a PowerShell that fails says so", async () => {
+    const release = await read(await publish({ platform: "windows", arch: "x64" }), {
+      platform: "windows",
+      arch: "x64",
+    });
+    const unsigned = windowsTool(async (out) => {
+      await Bun.write(out, `${bom}\r\n`);
+      return 0;
+    });
+    const blocked = windowsTool(async () => 1);
+
+    expect(await release.signer({ exeName: "akancad", host: "win32", run: unsigned.run })).toEqual({
+      signer: null,
+      unread: null,
+    });
+    expect(await release.signer({ exeName: "akancad", host: "win32", run: blocked.run })).toEqual({
+      signer: null,
+      unread: "PowerShell could not read the Authenticode signature of akancad/akancad.exe",
+    });
+    expect(await release.signer({ exeName: "akancad", host: "darwin", run: unsigned.run })).toEqual({
+      signer: null,
+      unread: "PowerShell reads a Windows app's Authenticode signer on Windows only",
+    });
+  });
+
+  test("Linux: no signer, and nothing run", async () => {
+    const release = await read(await publish({ platform: "linux", arch: "x64" }), { platform: "linux", arch: "x64" });
+    const { calls, run } = recordingTool(async () => ({ code: 0, output: "" }));
+
+    expect(await release.signer({ exeName: "akancad", host: "linux", run })).toEqual({ signer: null, unread: null });
+    expect(calls).toEqual([]);
+  });
+
+  test.skipIf(process.platform !== "darwin")(
+    "macOS: reads an ad hoc signature from the archive itself with the system tar and codesign",
+    async () => {
+      const build = await makeDir();
+      const contents = path.join(build, "Akancad.app", "Contents");
+      await mkdir(path.join(contents, "MacOS"), { recursive: true });
+      await mkdir(path.join(contents, "Resources"), { recursive: true });
+      await writeFile(path.join(contents, "Resources", "server.json"), "{}");
+      await writeFile(
+        path.join(contents, "Info.plist"),
+        '<?xml version="1.0" encoding="UTF-8"?>\n<plist version="1.0"><dict><key>CFBundleExecutable</key><string>akancad</string><key>CFBundleIdentifier</key><string>com.akancad.app</string></dict></plist>\n',
+      );
+      await writeFile(path.join(contents, "MacOS", "akancad"), await readFile("/usr/bin/true"));
+      const signed = Bun.spawnSync(["/usr/bin/codesign", "--force", "--sign", "-", path.join(build, "Akancad.app")]);
+      expect(signed.exitCode).toBe(0);
+      const gz = path.join(build, "release.tar.gz");
+      const tarred = Bun.spawnSync(["/usr/bin/tar", "--no-mac-metadata", "-czf", gz, "-C", build, "Akancad.app"]);
+      expect(tarred.exitCode).toBe(0);
+      const published = await publish();
+      await writeFile(path.join(published.dir, "app", `${published.tarSha}.tar.gz`), await readFile(gz));
+      const release = await read(published);
+
+      expect(await release.signer({ exeName: "akancad" })).toEqual({ signer: null, unread: null });
+    },
+  );
+});

package/mobile/desktopRelease.ts

@@ -0,0 +1,270 @@
+import { createPublicKey, verify } from "node:crypto";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { isRecord, toError } from "akanjs/common";
+import type { UpdateManifest } from "akanjs/native/api";
+import { AkanAppConfig } from "../akanConfig";
+import type { DesktopArch } from "./desktopBin";
+import type { DesktopPlatform } from "./mobileTarget";
+import { TarWriter } from "./tarWriter";
+import { UpdateUploader } from "./updateUploader";
+
+export type DesktopSigner = { teamId: string } | { subject: string } | null;
+
+/** `release.json`, the one file of a desktop release archive `publish-update` did not write. */
+export interface DesktopReleaseRecord {
+  schema: 1;
+  cli: string;
+  platform: DesktopPlatform;
+  arch: DesktopArch;
+  channel: string;
+  signer: DesktopSigner;
+  builtAt: string;
+}
+
+export type SignatureTool = (
+  cmd: string[],
+  options?: { env?: Record<string, string> },
+) => Promise<{ code: number; output: string }>;
+
+type DesktopManifest = Partial<UpdateManifest> &
+  Required<Pick<UpdateManifest, "archive" | "build" | "bundle" | "sequence">>;
+
+interface DesktopReleasePayload {
+  name: string;
+  size: number;
+  sha256: string;
+}
+
+//* One desktop channel's release as `publish-update` left it in `<updates>/<os>-<arch>/`: the signed manifest and the
+//* files it names, packed as they are, so the same folder uploaded anywhere else stays valid.
+export class DesktopRelease {
+  static readonly #ed25519Spki = Buffer.from("302a300506032b6570032100", "hex");
+  //? Constrained Language Mode (WDAC, AppLocker) refuses .NET type literals and method calls, so the script makes none.
+  //? Windows PowerShell writes its console in the OEM code page, which mangles a subject outside it; a file keeps UTF-8.
+  static readonly #authenticode = `$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$signature = Get-AuthenticodeSignature -LiteralPath $env:AKAN_RELEASE_EXE
+$subject = if ("$($signature.Status)" -ceq 'Valid') { "$($signature.SignerCertificate.Subject)" } else { '' }
+Set-Content -LiteralPath $env:AKAN_SIGNER_OUT -Value $subject -Encoding UTF8`;
+
+  private constructor(
+    readonly dir: string,
+    readonly manifest: DesktopManifest,
+    readonly payloads: DesktopReleasePayload[],
+    readonly platform: DesktopPlatform,
+    readonly arch: DesktopArch,
+    readonly channel: string,
+    readonly manifestBytes: Uint8Array<ArrayBuffer>,
+    readonly signatureBytes: Uint8Array<ArrayBuffer>,
+  ) {}
+
+  static async read(
+    updatesDir: string,
+    {
+      platform,
+      arch,
+      channel,
+      appId,
+      publicKey,
+    }: { platform: DesktopPlatform; arch: DesktopArch; channel: string; appId: string; publicKey: string },
+  ) {
+    const folder = `${platform}-${arch}`;
+    const dir = path.join(updatesDir, folder);
+    const manifestPath = path.join(dir, `${channel}.json`);
+    const [manifestBytes, signatureBytes] = await Promise.all([
+      readFile(manifestPath).catch(() => null),
+      readFile(`${manifestPath}.sig`).catch(() => null),
+    ]);
+    if (!manifestBytes || !signatureBytes)
+      throw new Error(
+        `${manifestBytes ? `${manifestPath}.sig` : manifestPath} is missing: run \`akan publish-update\` first.`,
+      );
+    if (!DesktopRelease.#verifies(manifestBytes, signatureBytes, publicKey))
+      throw new Error(
+        `${manifestPath}.sig does not verify with updates.publicKeys[0], the one key installed apps trust: publish the release again.`,
+      );
+    const manifest = DesktopRelease.#parse(manifestBytes);
+    if (
+      manifest?.schema !== 1 ||
+      manifest.kind !== "app" ||
+      manifest.app !== appId ||
+      manifest.platform !== platform ||
+      manifest.arch !== arch ||
+      manifest.channel !== channel ||
+      typeof manifest.bundle !== "string" ||
+      typeof manifest.sequence !== "number" ||
+      typeof manifest.build !== "number" ||
+      !manifest.archive
+    )
+      throw new Error(`${manifestPath} is not a release of ${appId} for ${folder} on channel ${channel}.`);
+    const { archive, bundle, sequence, build } = manifest;
+    const keys = await UpdateUploader.releaseFiles(updatesDir, { dir, channel, bundle });
+    const expected = new Map(
+      [{ url: archive.url, size: archive.size, sha256: archive.gzSha256 }, ...(manifest.patches ?? [])].map(
+        ({ url, size, sha256 }) => [path.posix.normalize(url), { size, sha256 }],
+      ),
+    );
+    const payloads = keys.flatMap((key) => {
+      const name = key.slice(folder.length + 1);
+      const digest = expected.get(name);
+      return digest ? [{ name, ...digest }] : [];
+    });
+    return new DesktopRelease(
+      dir,
+      { ...manifest, archive, bundle, sequence, build },
+      payloads,
+      platform,
+      arch,
+      channel,
+      manifestBytes,
+      signatureBytes,
+    );
+  }
+
+  record(signer: DesktopSigner): DesktopReleaseRecord {
+    const { platform, arch, channel } = this;
+    const builtAt = new Date(this.manifest.build * 1000).toISOString();
+    return { schema: 1, cli: AkanAppConfig.akanVersion, platform, arch, channel, signer, builtAt };
+  }
+
+  //* Uncompressed, regular files only under `./` names, no directory entries; what the manifest names is checked
+  //* against it while it is copied, so the archive holds the bytes the manifest signs for.
+  async withArchive<T>(record: DesktopReleaseRecord, use: (archive: string) => Promise<T>): Promise<T> {
+    const tmp = await mkdtemp(path.join(os.tmpdir(), "akan-release-"));
+    try {
+      const archive = path.join(tmp, "release.tar");
+      const tar = await TarWriter.create(archive, { mtime: this.manifest.sequence });
+      try {
+        await tar.add("./release.json", new Blob([`${JSON.stringify(record, null, 2)}\n`]));
+        await tar.add(`./${this.channel}.json`, new Blob([this.manifestBytes]));
+        await tar.add(`./${this.channel}.json.sig`, new Blob([this.signatureBytes]));
+        for (const { name, size, sha256 } of this.payloads) {
+          const file = Bun.file(path.join(this.dir, name));
+          const what = `${path.join(this.dir, name)} is not the file ${this.channel}.json names`;
+          if (!(await file.exists()) || file.size !== size) throw new Error(`${what}: publish the release again.`);
+          if ((await tar.add(`./${name}`, file)) !== sha256) throw new Error(`${what} (its sha256 differs).`);
+        }
+        await tar.close();
+      } catch (error) {
+        await tar.discard();
+        throw error;
+      }
+      return await use(archive);
+    } finally {
+      await rm(tmp, { recursive: true, force: true });
+    }
+  }
+
+  async signer({
+    exeName,
+    host = process.platform,
+    run = DesktopRelease.#run,
+  }: {
+    exeName: string;
+    host?: NodeJS.Platform;
+    run?: SignatureTool;
+  }): Promise<{ signer: DesktopSigner; unread: string | null }> {
+    if (this.platform === "linux") return { signer: null, unread: null };
+    const app = this.manifest.files?.[0]?.path;
+    if (!app || !/^[^/\\]+$/.test(app) || app === "." || app === "..")
+      return { signer: null, unread: `${this.channel}.json names no app folder` };
+    if (this.platform === "macos" && host !== "darwin")
+      return { signer: null, unread: "codesign reads a macOS app's signer on macOS only" };
+    if (this.platform === "windows" && host !== "win32")
+      return { signer: null, unread: "PowerShell reads a Windows app's Authenticode signer on Windows only" };
+    const tmp = await mkdtemp(path.join(os.tmpdir(), "akan-signer-"));
+    try {
+      const archive = path.join(this.dir, this.manifest.archive.url);
+      return this.platform === "macos"
+        ? await DesktopRelease.#teamOf(run, archive, tmp, app)
+        : await DesktopRelease.#subjectOf(run, archive, tmp, path.posix.join(app, `${exeName}.exe`));
+    } finally {
+      await rm(tmp, { recursive: true, force: true });
+    }
+  }
+
+  //? The signature lives in the executable and _CodeSignature; Info.plist names the executable. An app signed without
+  //? resources has no _CodeSignature, and bsdtar then exits 1 for the unmatched --include though it wrote the rest.
+  static async #teamOf(run: SignatureTool, archive: string, tmp: string, app: string) {
+    const contents = `${app}/Contents`;
+    await run([
+      "/usr/bin/tar",
+      "-xzf",
+      archive,
+      "-C",
+      tmp,
+      ...["Info.plist", "MacOS/*", "_CodeSignature/*"].flatMap((entry) => ["--include", `${contents}/${entry}`]),
+    ]);
+    if (!(await Bun.file(path.join(tmp, contents, "Info.plist")).exists()))
+      return { signer: null, unread: `the archive holds no ${contents}/Info.plist` };
+    const { output } = await run(["/usr/bin/codesign", "--display", "--verbose=2", path.join(tmp, app)]);
+    const teamId = /^TeamIdentifier=([A-Z0-9]{10})$/m.exec(output)?.[1];
+    if (teamId) return { signer: { teamId }, unread: null };
+    if (/^TeamIdentifier=not set$/m.test(output) || /code object is not signed at all/.test(output))
+      return { signer: null, unread: null };
+    return { signer: null, unread: `codesign could not read ${app}: ${output.trim().split("\n")[0] ?? ""}` };
+  }
+
+  static async #subjectOf(run: SignatureTool, archive: string, tmp: string, exe: string) {
+    await run(["tar.exe", "-xzf", archive, "-C", tmp, exe]);
+    const extracted = path.join(tmp, exe);
+    if (!(await Bun.file(extracted).exists())) return { signer: null, unread: `the archive holds no ${exe}` };
+    const out = path.join(tmp, "signer.txt");
+    const { code } = await run(
+      [
+        path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(DesktopRelease.#authenticode, "utf16le").toString("base64"),
+      ],
+      { env: { AKAN_RELEASE_EXE: extracted, AKAN_SIGNER_OUT: out } },
+    );
+    if (code !== 0) return { signer: null, unread: `PowerShell could not read the Authenticode signature of ${exe}` };
+    const subject = (await readFile(out, "utf8").catch(() => "")).replace(/^\uFEFF/, "").trim();
+    return { signer: subject ? { subject } : null, unread: null };
+  }
+
+  static #verifies(manifest: Uint8Array, signature: Uint8Array, publicKey: string) {
+    try {
+      const key = createPublicKey({
+        key: Buffer.concat([DesktopRelease.#ed25519Spki, Buffer.from(publicKey, "base64")]),
+        format: "der",
+        type: "spki",
+      });
+      return verify(null, manifest, key, Buffer.from(new TextDecoder().decode(signature).trim(), "base64"));
+    } catch {
+      return false;
+    }
+  }
+
+  static #parse(bytes: Uint8Array): Partial<UpdateManifest> | null {
+    try {
+      const value: unknown = JSON.parse(new TextDecoder().decode(bytes));
+      return isRecord(value) ? (value as Partial<UpdateManifest>) : null;
+    } catch {
+      return null;
+    }
+  }
+
+  static async #run(cmd: string[], { env }: { env?: Record<string, string> } = {}) {
+    try {
+      const proc = Bun.spawn(cmd, {
+        env: { ...process.env, ...env },
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [code, stdout, stderr] = await Promise.all([
+        proc.exited,
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
+      ]);
+      return { code, output: `${stdout}${stderr}` };
+    } catch (error) {
+      return { code: -1, output: toError(error).message };
+    }
+  }
+}

package/mobile/desktopServerStage.ts

@@ -24,11 +24,13 @@ export interface DesktopServerRun extends ServerPolicy {
 //* `bun install --production` does. It is staged outside dist: installing there would put host packages into the
 //* image's `COPY . .`.
 export class DesktopServerStage {
-  //? An API-only server starts neither the RSC worker nor the akan console and serves no CSR, public/ or SSR artifact,
-  //? and `install` wrote its own package.json. The rest of dist is the server's: its chunks, a `.node`, a `.wasm`.
+  //? An API-only server starts neither the RSC worker nor the akan console and serves no CSR, public/ or SSR
+  //? artifact, and `install` wrote its own package.json and bun.lock. The rest of dist is the server's: its chunks,
+  //? a `.node`, a `.wasm`.
   static readonly uncarried = new Set([
     "Dockerfile",
     "package.json",
+    "bun.lock",
     "rscWorker.js",
     "console.js",
     "console-runtime.js",

package/mobile/index.ts

@@ -1,4 +1,5 @@
 export * from "./desktopBin";
+export * from "./desktopRelease";
 export * from "./desktopServerStage";
 export * from "./mobileTarget";
 export * from "./nativeApi";
@@ -8,6 +9,7 @@ export * from "./nativePluginFolders";
 export * from "./nativePublicEnv";
 export * from "./nativeWebDir";
 export * from "./placeholderAppId";
+export * from "./tarWriter";
 export * from "./updatePackFolder";
 export * from "./updateUploader";
 export * from "./usageDescriptions";