@awak-app/simy-cli 0.5.7 → 0.5.10

package/src/install-update.js

@@ -0,0 +1,494 @@
+import { createHash, randomBytes } from "node:crypto";
+import {
+  lstat,
+  mkdir,
+  open,
+  readFile,
+  readdir,
+  readlink,
+  rename,
+  rm,
+  symlink,
+} from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { execFile } from "node:child_process";
+
+const execFileAsync = promisify(execFile);
+const APP_NAME = "SIMY CLI.app";
+const MAX_ARCHIVE_ENTRIES = 100_000;
+const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
+const MAX_UNCOMPRESSED_BYTES = 2 * 1024 * 1024 * 1024;
+const MH_MAGIC_64 = 0xfeedfacf;
+const CPU_TYPE_ARM64 = 0x0100000c;
+
+export async function installMacosInstallerRelease({
+  version,
+  release,
+  marker,
+  stateRoot,
+  fetchImpl = fetch,
+  execFileCommand = execFileAsync,
+} = {}) {
+  if (!marker?.teamId) {
+    throw new Error("Automatic installer updates require a signed production installation.");
+  }
+  const updater = release?.artifact?.updater;
+  if (!updater) throw new Error("This release requires a manual installer download.");
+
+  const installerRoot = path.join(stateRoot, "installer");
+  const stagingRoot = path.join(installerRoot, "staging");
+  const releasesRoot = path.join(installerRoot, "releases");
+  const nonce = randomBytes(16).toString("hex");
+  const staging = path.join(stagingRoot, `${version}-${nonce}`);
+  const archivePath = path.join(staging, "update.zip");
+  const extractedRoot = path.join(staging, "extracted");
+  const candidateApp = path.join(extractedRoot, APP_NAME);
+  const releaseDirectory = path.join(releasesRoot, version);
+  const releaseApp = path.join(releaseDirectory, APP_NAME);
+  const currentLink = path.join(installerRoot, "current");
+
+  await mkdir(installerRoot, { recursive: true, mode: 0o700 });
+  await requirePlainDirectory(installerRoot);
+  await mkdir(stagingRoot, { recursive: true, mode: 0o700 });
+  await requirePlainDirectory(stagingRoot);
+  await mkdir(extractedRoot, { recursive: true, mode: 0o700 });
+  try {
+    await downloadVerifiedArchive(updater, archivePath, fetchImpl);
+    await inspectArchive(archivePath);
+    await execFileCommand("/usr/bin/tar", ["-xf", archivePath, "-C", extractedRoot, "--no-same-owner"], {
+      timeout: 5 * 60_000,
+      encoding: "utf8",
+    });
+    await rejectLinks(candidateApp);
+    await verifyCandidateApp(candidateApp, {
+      version,
+      marker,
+      execFileCommand,
+    });
+
+    await mkdir(releasesRoot, { recursive: true, mode: 0o700 });
+    await requirePlainDirectory(installerRoot);
+    await requirePlainDirectory(releasesRoot);
+    let releaseExists = false;
+    try {
+      const releaseDetails = await lstat(releaseDirectory);
+      if (!releaseDetails.isDirectory() || releaseDetails.isSymbolicLink()) {
+        throw new Error("Existing installer release path is not a plain directory.");
+      }
+      releaseExists = true;
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+    }
+    if (releaseExists) {
+      await rejectLinks(releaseApp);
+      await verifyCandidateApp(releaseApp, { version, marker, execFileCommand });
+      await rm(staging, { recursive: true, force: true });
+    } else {
+      await rename(extractedRoot, releaseDirectory);
+      await rm(staging, { recursive: true, force: true });
+    }
+
+    const previousTarget = await readCurrentTarget(currentLink, installerRoot);
+    await switchCurrentLink({ installerRoot, currentLink, target: releaseApp, nonce });
+    return {
+      entryPath: path.join(releaseApp, "Contents", "Resources", "cli", "src", "index.js"),
+      executablePath: path.join(releaseApp, "Contents", "Resources", "runtime", "bin", "node"),
+      appPath: releaseApp,
+      rollback: async () => {
+        if (previousTarget) {
+          await switchCurrentLink({ installerRoot, currentLink, target: previousTarget, nonce: `${nonce}-rollback` });
+        } else {
+          await rm(currentLink, { force: true });
+        }
+      },
+    };
+  } catch (error) {
+    await rm(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+export async function readCurrentInstallerVersion({ stateRoot } = {}) {
+  const packagePath = path.join(
+    stateRoot,
+    "installer",
+    "current",
+    "Contents",
+    "Resources",
+    "cli",
+    "package.json",
+  );
+  const payload = JSON.parse(await readFile(packagePath, "utf8"));
+  return String(payload.version || "").trim();
+}
+
+export async function downloadVerifiedArchive(updater, destination, fetchImpl = fetch) {
+  if (new URL(updater.url).protocol !== "https:") {
+    throw new Error("Installer update download must use HTTPS.");
+  }
+  if (updater.size > MAX_ARCHIVE_BYTES) {
+    throw new Error("Installer update archive exceeds the download safety limit.");
+  }
+  const response = await fetchImpl(updater.url, {
+    headers: { Accept: "application/zip, application/octet-stream" },
+    signal: AbortSignal.timeout(5 * 60_000),
+  });
+  if (!response.ok || !response.body) {
+    throw new Error(`Installer update download returned HTTP ${response.status}.`);
+  }
+  if (response.url && new URL(response.url).protocol !== "https:") {
+    throw new Error("Installer update download redirected to an insecure URL.");
+  }
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength && Number(declaredLength) !== updater.size) {
+    throw new Error("Installer update download size does not match the release manifest.");
+  }
+  const handle = await open(destination, "wx", 0o600);
+  const hash = createHash("sha256");
+  let size = 0;
+  try {
+    for await (const value of response.body) {
+      const chunk = Buffer.from(value);
+      size += chunk.length;
+      if (size > updater.size) throw new Error("Installer update download exceeds its declared size.");
+      hash.update(chunk);
+      await handle.write(chunk);
+    }
+  } finally {
+    await handle.close();
+  }
+  if (size !== updater.size || hash.digest("hex") !== updater.sha256) {
+    throw new Error("Installer update download failed size or SHA-256 verification.");
+  }
+}
+
+export async function inspectArchive(archivePath) {
+  const bytes = await readFile(archivePath);
+  const minimumEocd = Math.max(0, bytes.length - 65_557);
+  let eocd = -1;
+  for (let offset = bytes.length - 22; offset >= minimumEocd; offset -= 1) {
+    if (bytes.readUInt32LE(offset) === 0x06054b50) {
+      eocd = offset;
+      break;
+    }
+  }
+  if (eocd < 0 || eocd + 22 + bytes.readUInt16LE(eocd + 20) !== bytes.length) {
+    throw new Error("Installer update archive has an invalid central directory.");
+  }
+  const disk = bytes.readUInt16LE(eocd + 4);
+  const centralDisk = bytes.readUInt16LE(eocd + 6);
+  const diskEntries = bytes.readUInt16LE(eocd + 8);
+  const entryCount = bytes.readUInt16LE(eocd + 10);
+  const centralSize = bytes.readUInt32LE(eocd + 12);
+  const centralOffset = bytes.readUInt32LE(eocd + 16);
+  if (
+    disk !== 0 ||
+    centralDisk !== 0 ||
+    diskEntries !== entryCount ||
+    entryCount === 0 ||
+    entryCount > MAX_ARCHIVE_ENTRIES ||
+    centralSize === 0xffffffff ||
+    centralOffset === 0xffffffff ||
+    centralOffset + centralSize !== eocd
+  ) {
+    throw new Error("Installer update archive uses an unsupported ZIP structure.");
+  }
+  const entries = [];
+  const localRanges = [];
+  let totalBytes = 0;
+  let offset = centralOffset;
+  for (let index = 0; index < entryCount; index += 1) {
+    if (offset + 46 > eocd || bytes.readUInt32LE(offset) !== 0x02014b50) {
+      throw new Error("Installer update archive has a malformed central-directory entry.");
+    }
+    const versionMadeBy = bytes.readUInt16LE(offset + 4);
+    const flags = bytes.readUInt16LE(offset + 8);
+    const method = bytes.readUInt16LE(offset + 10);
+    const crc32 = bytes.readUInt32LE(offset + 16);
+    const compressedSize = bytes.readUInt32LE(offset + 20);
+    const uncompressedSize = bytes.readUInt32LE(offset + 24);
+    const nameLength = bytes.readUInt16LE(offset + 28);
+    const extraLength = bytes.readUInt16LE(offset + 30);
+    const commentLength = bytes.readUInt16LE(offset + 32);
+    const externalAttributes = bytes.readUInt32LE(offset + 38);
+    const localOffset = bytes.readUInt32LE(offset + 42);
+    const end = offset + 46 + nameLength + extraLength + commentLength;
+    if (
+      end > eocd ||
+      compressedSize === 0xffffffff ||
+      uncompressedSize === 0xffffffff ||
+      localOffset === 0xffffffff ||
+      (flags & 0x1) !== 0 ||
+      localOffset + 30 > centralOffset ||
+      bytes.readUInt32LE(localOffset) !== 0x04034b50
+    ) {
+      throw new Error("Installer update archive contains an unsupported entry.");
+    }
+    const nameBytes = bytes.subarray(offset + 46, offset + 46 + nameLength);
+    const centralExtra = bytes.subarray(
+      offset + 46 + nameLength,
+      offset + 46 + nameLength + extraLength,
+    );
+    rejectUnsafeExtraFields(centralExtra);
+    if ((flags & 0x800) === 0 && nameBytes.some((value) => value >= 0x80)) {
+      throw new Error("Installer update archive contains a non-UTF-8 path.");
+    }
+    let name;
+    try {
+      name = new TextDecoder("utf-8", { fatal: true }).decode(nameBytes);
+    } catch {
+      throw new Error("Installer update archive contains an invalid UTF-8 path.");
+    }
+    const localNameLength = bytes.readUInt16LE(localOffset + 26);
+    const localExtraLength = bytes.readUInt16LE(localOffset + 28);
+    const localFlags = bytes.readUInt16LE(localOffset + 6);
+    const localMethod = bytes.readUInt16LE(localOffset + 8);
+    const localName = bytes.subarray(localOffset + 30, localOffset + 30 + localNameLength);
+    const localExtra = bytes.subarray(
+      localOffset + 30 + localNameLength,
+      localOffset + 30 + localNameLength + localExtraLength,
+    );
+    rejectUnsafeExtraFields(localExtra);
+    const dataEnd = localOffset + 30 + localNameLength + localExtraLength + compressedSize;
+    if (
+      !nameBytes.equals(localName) ||
+      localFlags !== flags ||
+      localMethod !== method ||
+      dataEnd > centralOffset
+    ) {
+      throw new Error("Installer update archive entry names do not match.");
+    }
+    let entryEnd = dataEnd;
+    if ((flags & 0x08) !== 0) {
+      const hasSignature = dataEnd + 4 <= centralOffset && bytes.readUInt32LE(dataEnd) === 0x08074b50;
+      const descriptor = dataEnd + (hasSignature ? 4 : 0);
+      if (
+        descriptor + 12 > centralOffset ||
+        bytes.readUInt32LE(descriptor) !== crc32 ||
+        bytes.readUInt32LE(descriptor + 4) !== compressedSize ||
+        bytes.readUInt32LE(descriptor + 8) !== uncompressedSize
+      ) {
+        throw new Error("Installer update archive has an invalid data descriptor.");
+      }
+      entryEnd = descriptor + 12;
+    }
+    validateArchivePath(name);
+    const unixMode = (versionMadeBy >>> 8) === 3 ? externalAttributes >>> 16 : 0;
+    if ((unixMode & 0o170000) === 0o120000) {
+      throw new Error("Installer update archive contains a symbolic link.");
+    }
+    const fileType = unixMode & 0o170000;
+    if (fileType !== 0 && fileType !== 0o040000 && fileType !== 0o100000) {
+      throw new Error("Installer update archive contains an unsafe special file.");
+    }
+    if ((name.endsWith("/") && fileType === 0o100000) || (!name.endsWith("/") && fileType === 0o040000)) {
+      throw new Error("Installer update archive entry type does not match its path.");
+    }
+    totalBytes += uncompressedSize;
+    if (!Number.isSafeInteger(totalBytes) || totalBytes > MAX_UNCOMPRESSED_BYTES) {
+      throw new Error("Installer update archive expands beyond the safety limit.");
+    }
+    entries.push(name);
+    localRanges.push([localOffset, entryEnd]);
+    offset = end;
+  }
+  if (offset !== eocd) {
+    throw new Error("Installer update archive central-directory size does not match its entries.");
+  }
+  if (new Set(entries).size !== entries.length) {
+    throw new Error("Installer update archive contains duplicate paths.");
+  }
+  const normalizedEntries = entries.map((name) => name.normalize("NFD").toLowerCase());
+  if (new Set(normalizedEntries).size !== normalizedEntries.length) {
+    throw new Error("Installer update archive contains colliding paths.");
+  }
+  localRanges.sort((left, right) => left[0] - right[0]);
+  for (let index = 1; index < localRanges.length; index += 1) {
+    if (localRanges[index][0] < localRanges[index - 1][1]) {
+      throw new Error("Installer update archive contains overlapping entries.");
+    }
+  }
+  return entries;
+}
+
+function rejectUnsafeExtraFields(bytes) {
+  let offset = 0;
+  while (offset < bytes.length) {
+    if (offset + 4 > bytes.length) {
+      throw new Error("Installer update archive contains a malformed ZIP extra field.");
+    }
+    const id = bytes.readUInt16LE(offset);
+    const size = bytes.readUInt16LE(offset + 2);
+    if (offset + 4 + size > bytes.length) {
+      throw new Error("Installer update archive contains a malformed ZIP extra field.");
+    }
+    if (id === 0x0001 || id === 0x7075) {
+      throw new Error("Installer update archive contains an unsafe path override.");
+    }
+    offset += 4 + size;
+  }
+}
+
+export function validateArchivePath(name) {
+  if (
+    !name ||
+    name.includes("\\") ||
+    name.includes("\0") ||
+    /[\x00-\x1f\x7f]/.test(name) ||
+    path.posix.isAbsolute(name) ||
+    name.split("/").includes("..") ||
+    (name !== APP_NAME && !name.startsWith(`${APP_NAME}/`))
+  ) {
+    throw new Error("Installer update archive contains an unsafe path.");
+  }
+}
+
+export async function verifyCandidateApp(
+  appPath,
+  { version, marker, execFileCommand = execFileAsync } = {},
+) {
+  const resources = path.join(appPath, "Contents", "Resources");
+  const cliRoot = path.join(resources, "cli");
+  const runtimePath = path.join(resources, "runtime", "bin", "node");
+  const entryPath = path.join(cliRoot, "src", "index.js");
+  const appExecutable = path.join(appPath, "Contents", "MacOS", "simy");
+  for (const requiredPath of [runtimePath, entryPath, appExecutable]) await lstat(requiredPath);
+
+  const packageInfo = JSON.parse(await readFile(path.join(cliRoot, "package.json"), "utf8"));
+  const candidateMarker = JSON.parse(await readFile(path.join(cliRoot, "installation.json"), "utf8"));
+  if (packageInfo.version !== version || !sameMarker(candidateMarker, marker)) {
+    throw new Error("Installer update identity does not match the requested release.");
+  }
+
+  await execFileCommand("/usr/bin/codesign", ["--verify", "--deep", "--strict", appPath], {
+    timeout: 60_000,
+    encoding: "utf8",
+  });
+  await execFileCommand("/usr/bin/codesign", ["--verify", "--strict", runtimePath], {
+    timeout: 60_000,
+    encoding: "utf8",
+  });
+  const { stderr = "", stdout = "" } = await execFileCommand(
+    "/usr/bin/codesign",
+    ["-d", "--verbose=4", appPath],
+    { timeout: 60_000, encoding: "utf8" },
+  );
+  const signingDetails = `${stdout}\n${stderr}`;
+  if (
+    !signingDetails.split("\n").includes(`Identifier=${marker.bundleId}`) ||
+    !signingDetails.split("\n").includes(`TeamIdentifier=${marker.teamId}`)
+  ) {
+    throw new Error("Installer update signature identity does not match the installed SIMY release.");
+  }
+  const gatekeeper = await execFileCommand("/usr/sbin/spctl", [
+    "--assess",
+    "--type",
+    "execute",
+    "--verbose=4",
+    appPath,
+  ], {
+    timeout: 60_000,
+    encoding: "utf8",
+  });
+  if (!/source=Notarized Developer ID/i.test(`${gatekeeper.stdout || ""}\n${gatekeeper.stderr || ""}`)) {
+    throw new Error("Installer update did not pass the notarized Developer ID policy.");
+  }
+  await verifyArm64MachO(runtimePath);
+  await verifyArm64MachO(appExecutable);
+  const { stdout: bundleVersion } = await execFileCommand(
+    "/usr/bin/plutil",
+    ["-extract", "CFBundleShortVersionString", "raw", "-o", "-", path.join(appPath, "Contents", "Info.plist")],
+    { timeout: 30_000, encoding: "utf8" },
+  );
+  if (String(bundleVersion || "").trim() !== version) {
+    throw new Error("Installer update app version does not match the requested release.");
+  }
+  return { version, runtimePath, entryPath };
+}
+
+export async function verifyArm64MachO(executablePath) {
+  const handle = await open(executablePath, "r");
+  const header = Buffer.alloc(8);
+  try {
+    const { bytesRead } = await handle.read(header, 0, header.length, 0);
+    if (bytesRead !== header.length) {
+      throw new Error("Installer update contains a truncated executable.");
+    }
+  } finally {
+    await handle.close();
+  }
+  if (
+    header.readUInt32LE(0) !== MH_MAGIC_64 ||
+    header.readUInt32LE(4) !== CPU_TYPE_ARM64
+  ) {
+    throw new Error("Installer update contains a non-arm64 Mach-O executable.");
+  }
+  return true;
+}
+
+function sameMarker(left, right) {
+  return Boolean(
+    left &&
+      right &&
+      left.schemaVersion === 1 &&
+      left.channel === "macos-installer" &&
+      left.platform === "darwin" &&
+      left.arch === "arm64" &&
+      left.teamId === right.teamId &&
+      left.bundleId === right.bundleId &&
+      Object.keys(left).sort().join(",") ===
+        "arch,bundleId,channel,platform,schemaVersion,teamId"
+  );
+}
+
+async function rejectLinks(root) {
+  const details = await lstat(root);
+  if (details.isSymbolicLink()) throw new Error("Installer update contains an unsafe symbolic link.");
+  if (details.isFile()) return;
+  if (!details.isDirectory()) throw new Error("Installer update contains an unsafe special file.");
+  for (const child of await readdir(root)) await rejectLinks(path.join(root, child));
+}
+
+async function requirePlainDirectory(directory) {
+  const details = await lstat(directory);
+  if (!details.isDirectory() || details.isSymbolicLink()) {
+    throw new Error("Installer update storage is not a plain directory.");
+  }
+}
+
+async function readCurrentTarget(currentLink, installerRoot) {
+  try {
+    const details = await lstat(currentLink);
+    if (!details.isSymbolicLink()) {
+      throw new Error("The current installer release pointer is not a symbolic link.");
+    }
+    const target = await readlink(currentLink);
+    if (path.isAbsolute(target)) {
+      throw new Error("The current installer release pointer must be relative.");
+    }
+    const resolved = path.resolve(path.dirname(currentLink), target);
+    const relative = path.relative(installerRoot, resolved);
+    if (relative.startsWith("..") || !relative.startsWith(`releases${path.sep}`)) {
+      throw new Error("The current installer release pointer is outside the release directory.");
+    }
+    return resolved;
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+async function switchCurrentLink({ installerRoot, currentLink, target, nonce }) {
+  const temporaryLink = path.join(installerRoot, `.current-${nonce}`);
+  const relativeTarget = path.relative(installerRoot, target);
+  if (
+    path.isAbsolute(relativeTarget) ||
+    relativeTarget.startsWith("..") ||
+    !relativeTarget.startsWith(`releases${path.sep}`)
+  ) {
+    throw new Error("Refusing to select an installer release outside the release directory.");
+  }
+  await symlink(relativeTarget, temporaryLink);
+  await rename(temporaryLink, currentLink);
+}