@bravemobile/react-native-code-push 13.1.0-beta.1 → 13.1.0-beta.3

package/cli/functions/makeAssetDiffBundle.test.ts

@@ -0,0 +1,283 @@
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterAll, beforeAll, describe, expect, it } from "@jest/globals";
+import {
+    ASSET_DIFF_ARCHIVE_INFIX,
+    ASSET_DIFF_MANIFEST_NAME,
+    assetDiffArchiveName,
+    makeAssetDiffBundle,
+} from "./makeAssetDiffBundle.js";
+import { BINARY_PATCH_MANIFEST_NAME, makeBinaryPatchBundle } from "./makeBinaryPatchBundle.js";
+import { makeCodePushBundle } from "./makeCodePushBundle.js";
+import { applyPatch } from "../utils/binaryPatch.js";
+import { generatePackageHashFromDirectory } from "../utils/hash-utils.js";
+import { walk } from "../utils/promisfied-fs.js";
+import { unzip } from "../utils/unzip.js";
+
+/**
+ * Exercises the diff artifact against real archives, real hdiffz output and real hashes.
+ * A diff is only worth shipping if a client that owns the base package can rebuild the
+ * exact contents of the new full archive from it, and only real bytes prove that.
+ */
+
+/** The directory a CodePush archive keeps its contents in, for legacy reasons. */
+const CONTENTS_DIR_NAME = 'CodePush';
+
+const BUNDLE_NAME = 'index.android.bundle';
+
+function findRepoRoot(): string {
+    let dir = process.cwd();
+    for (;;) {
+        if (fs.existsSync(path.join(dir, "scripts", "binary-patch", "build-hdiffpatch.sh"))) {
+            return dir;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            throw new Error(`cannot locate the repository root from ${process.cwd()}`);
+        }
+        dir = parent;
+    }
+}
+
+const repoRoot = findRepoRoot();
+const fixtureDir = path.join(repoRoot, "cli", "fixtures", "binary-patch");
+const baseFixture = path.join(fixtureDir, "base.bundle");
+const targetFixture = path.join(fixtureDir, "target.bundle");
+
+/**
+ * The asset both releases hold. Sized like a real asset rather than a few bytes, because
+ * the builder only ships a diff that is smaller than the patch archive: dropping a
+ * four-byte file would save less than the deletion manifest costs, and the builder would
+ * rightly report the diff as not worth shipping.
+ */
+const unchangedAsset = crypto.randomBytes(4096);
+
+let workDir: string;
+
+/** A unique directory per test so a failed run never leaks state into the next one. */
+function makeCaseDir(name: string): string {
+    return fs.mkdtempSync(path.join(workDir, `${name}-`));
+}
+
+/** Writes an update contents directory shaped like the one the bundler produces. */
+function writeUpdateContents(parentDir: string, files: Record<string, Buffer | string>): string {
+    const contentsPath = path.join(parentDir, CONTENTS_DIR_NAME);
+    for (const [relativePath, content] of Object.entries(files)) {
+        const filePath = path.join(contentsPath, relativePath);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, content);
+    }
+    return contentsPath;
+}
+
+function baseContentFiles(): Record<string, Buffer | string> {
+    return {
+        [BUNDLE_NAME]: fs.readFileSync(baseFixture),
+        'assets/keep.png': unchangedAsset,
+        'assets/change.png': 'OLD',
+        'assets/gone.png': 'GONE',
+    };
+}
+
+function updateContentFiles(): Record<string, Buffer | string> {
+    return {
+        [BUNDLE_NAME]: fs.readFileSync(targetFixture),
+        'assets/keep.png': unchangedAsset,
+        'assets/change.png': 'NEW',
+        'assets/new.png': 'ADDED',
+    };
+}
+
+type Release = {
+    caseDir: string;
+    bundleDirectory: string;
+    packageHash: string;
+    basePackageHash: string;
+    baseBundleFilePath: string;
+    patchBundleFilePath: string;
+};
+
+/**
+ * Releases a base package and then the update, exactly the way the CLI does: a full
+ * archive for each, plus the patch archive the diff is derived from.
+ */
+async function stageRelease(name: string, baseFiles: Record<string, Buffer | string>): Promise<Release> {
+    const caseDir = makeCaseDir(name);
+    const bundleDirectory = path.join(caseDir, 'bundleOutput');
+
+    const baseContents = writeUpdateContents(path.join(caseDir, 'base'), baseFiles);
+    const { bundleFileName: basePackageHash } = await makeCodePushBundle(baseContents, bundleDirectory);
+
+    const updateContents = writeUpdateContents(path.join(caseDir, 'update'), updateContentFiles());
+    const { bundleFileName: packageHash } = await makeCodePushBundle(updateContents, bundleDirectory);
+
+    const { patchBundleFilePath } = await makeBinaryPatchBundle({
+        contentsPath: updateContents,
+        baseBundlePath: baseFixture,
+        bundleRelativePath: BUNDLE_NAME,
+        bundleDirectory,
+        packageHash,
+    });
+
+    return {
+        caseDir,
+        bundleDirectory,
+        packageHash,
+        basePackageHash,
+        baseBundleFilePath: path.join(bundleDirectory, basePackageHash),
+        patchBundleFilePath,
+    };
+}
+
+async function extractTo(archivePath: string, destination: string): Promise<string> {
+    fs.mkdirSync(destination, { recursive: true });
+    await unzip(archivePath, destination);
+    return destination;
+}
+
+/** Every file in an archive, as the archive names it. */
+async function listArchiveFiles(archivePath: string, destination: string): Promise<string[]> {
+    await extractTo(archivePath, destination);
+    const files = await walk(destination);
+    return files.map((filePath) => path.relative(destination, filePath).split(path.sep).join('/')).sort();
+}
+
+beforeAll(() => {
+    // hdiffz/hpatchz are provisioned for the whole run by the jest global setup.
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "codepush-asset-diff-"));
+});
+
+afterAll(() => {
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+
+describe("makeAssetDiffBundle", () => {
+    it("ships only the files the base does not already hold", async () => {
+        const release = await stageRelease("ships", baseContentFiles());
+
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+
+        expect(diff).not.toBeNull();
+        expect(path.basename(diff!.diffBundleFilePath)).toBe(
+            `${release.packageHash}${ASSET_DIFF_ARCHIVE_INFIX}${release.basePackageHash}.zip`,
+        );
+        expect(await listArchiveFiles(diff!.diffBundleFilePath, path.join(release.caseDir, "extracted"))).toEqual(
+            [
+                ASSET_DIFF_MANIFEST_NAME,
+                `${CONTENTS_DIR_NAME}/${BINARY_PATCH_MANIFEST_NAME}`,
+                `${CONTENTS_DIR_NAME}/${BUNDLE_NAME}.patch`,
+                `${CONTENTS_DIR_NAME}/assets/change.png`,
+                `${CONTENTS_DIR_NAME}/assets/new.png`,
+            ].sort(),
+        );
+    });
+
+    it("lists files the base holds but the update dropped, with the contents prefix", async () => {
+        const release = await stageRelease("deletions", baseContentFiles());
+
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+
+        const extracted = await extractTo(diff!.diffBundleFilePath, path.join(release.caseDir, "extracted"));
+        const manifest = JSON.parse(fs.readFileSync(path.join(extracted, ASSET_DIFF_MANIFEST_NAME), 'utf8'));
+
+        expect(manifest.deletedFiles).toEqual([`${CONTENTS_DIR_NAME}/assets/gone.png`]);
+    });
+
+    it("reproduces the full package hash when merged the way the client merges", async () => {
+        const release = await stageRelease("round-trip", baseContentFiles());
+
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+
+        // The installed base package, which is what a client merges the diff onto.
+        const packageDir = await extractTo(release.baseBundleFilePath, path.join(release.caseDir, "package"));
+        const diffDir = await extractTo(diff!.diffBundleFilePath, path.join(release.caseDir, "downloaded"));
+        const diffContents = path.join(diffDir, CONTENTS_DIR_NAME);
+
+        // Rebuild the bundle from its patch, then drop the two patch-only files.
+        const patchManifest = JSON.parse(fs.readFileSync(path.join(diffContents, BINARY_PATCH_MANIFEST_NAME), 'utf8'));
+        applyPatch(
+            baseFixture,
+            path.join(diffContents, patchManifest.patchFile),
+            path.join(diffContents, patchManifest.bundlePath),
+        );
+        fs.rmSync(path.join(diffContents, patchManifest.patchFile));
+        fs.rmSync(path.join(diffContents, BINARY_PATCH_MANIFEST_NAME));
+
+        // Apply the deletions to the base package, then drop the deletion manifest.
+        const diffManifestPath = path.join(diffDir, ASSET_DIFF_MANIFEST_NAME);
+        const { deletedFiles } = JSON.parse(fs.readFileSync(diffManifestPath, 'utf8'));
+        for (const deletedFile of deletedFiles) {
+            fs.rmSync(path.join(packageDir, deletedFile));
+        }
+        fs.rmSync(diffManifestPath);
+
+        // Overlay what the diff shipped onto the base package.
+        fs.cpSync(diffDir, packageDir, { recursive: true });
+
+        expect(await generatePackageHashFromDirectory(path.join(packageDir, CONTENTS_DIR_NAME), packageDir)).toBe(
+            release.packageHash,
+        );
+    });
+
+    it("skips the diff when it would not be smaller than the patch archive", async () => {
+        // A base that shares no bytes with the update leaves nothing to prune, so the diff
+        // is the patch archive plus a deletion manifest.
+        const release = await stageRelease("oversized", {
+            [BUNDLE_NAME]: fs.readFileSync(baseFixture),
+            'assets/keep.png': crypto.randomBytes(4096),
+            'assets/change.png': 'OLD',
+        });
+        const archivesBefore = fs.readdirSync(release.bundleDirectory).sort();
+
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+
+        expect(diff).toBeNull();
+        expect(
+            fs.existsSync(
+                path.join(release.bundleDirectory, assetDiffArchiveName(release.packageHash, release.basePackageHash)),
+            ),
+        ).toBe(false);
+        expect(fs.readdirSync(release.bundleDirectory).sort()).toEqual(archivesBefore);
+    });
+
+    it("leaves no working directory behind", async () => {
+        const release = await stageRelease("cleanup", baseContentFiles());
+        const entriesBefore = fs.readdirSync(release.caseDir).sort();
+
+        await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+
+        expect(fs.readdirSync(release.caseDir).sort()).toEqual(entriesBefore);
+    });
+});

package/cli/functions/makeAssetDiffBundle.ts

@@ -0,0 +1,166 @@
+/**
+ * Builds the diff artifact a client can install on top of one particular base package.
+ *
+ * A diff archive is the patch archive of this release with every file the base package
+ * already holds byte for byte taken out, plus a manifest naming the files the base holds
+ * that the update dropped. A client copies its installed base package, applies the
+ * deletions, rebuilds the JS bundle from the patch and overlays what the diff shipped -
+ * which leaves it holding exactly the contents of the full archive, and therefore the
+ * same `packageHash`. One release can serve a diff per base it was built against.
+ *
+ * The diff is derived from the artifacts the release already produced rather than from
+ * the bundler, so it costs no extra bundling and cannot drift from what was published.
+ */
+
+import fs from "fs";
+import path from "path";
+import shell from "shelljs";
+import { normalizePath } from "../utils/file-utils.js";
+import { walk } from "../utils/promisfied-fs.js";
+import { zipDirectoryContents } from "../utils/zip.js";
+import {
+    BINARY_PATCH_MANIFEST_NAME,
+    type BinaryPatchManifest,
+    extractCodePushBundleContents,
+} from "./makeBinaryPatchBundle.js";
+
+/**
+ * Manifest listing what a client must delete from its copy of the base package. It sits
+ * at the archive root, outside the contents directory, because that is where the native
+ * clients look for it - and because a file inside the contents would change the package
+ * hash the merged folder has to reproduce.
+ */
+export const ASSET_DIFF_MANIFEST_NAME = 'hotcodepush.json';
+
+/** Separates the two hashes, so a diff archive names both the update and the base it needs. */
+export const ASSET_DIFF_ARCHIVE_INFIX = '-diff-';
+
+const TEMP_ASSET_DIFF_DIR_NAME = 'temp_contents_for_asset_diff';
+
+export type AssetDiffManifest = {
+    /** Paths relative to the package folder root, so with the contents directory prefix. */
+    deletedFiles: string[];
+};
+
+export function assetDiffArchiveName(packageHash: string, basePackageHash: string): string {
+    return `${packageHash}${ASSET_DIFF_ARCHIVE_INFIX}${basePackageHash}.zip`;
+}
+
+/**
+ * Creates the diff archive for a release against one base package.
+ *
+ * @param patchBundleFilePath {string} Patch archive this release already built
+ * @param baseBundleFilePath {string} Full archive of the base release, downloaded locally
+ * @param bundleDirectory {string} Directory the release artifacts are written to
+ * @param packageHash {string} Package hash of this release
+ * @param basePackageHash {string} Package hash of the base release
+ * @return The diff archive, or `null` when it is not smaller than the patch archive it
+ * was derived from, in which case there is nothing to gain from publishing it.
+ */
+export async function makeAssetDiffBundle({
+    patchBundleFilePath,
+    baseBundleFilePath,
+    bundleDirectory,
+    packageHash,
+    basePackageHash,
+}: {
+    patchBundleFilePath: string;
+    baseBundleFilePath: string;
+    bundleDirectory: string;
+    packageHash: string;
+    basePackageHash: string;
+}): Promise<{ diffBundleFilePath: string } | null> {
+    // Kept next to the release output rather than in the system temp directory so a crash
+    // leaves the leftovers where the rest of the build output is cleaned up. Named after
+    // the base so building the diffs of one release against several bases at once cannot
+    // have two of them share a working directory.
+    const tempRoot = path.join(
+        path.dirname(path.resolve(bundleDirectory)),
+        `${TEMP_ASSET_DIFF_DIR_NAME}_${basePackageHash}`,
+    );
+    const stagingRoot = path.join(tempRoot, 'archive');
+
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+
+    try {
+        // Extracted into separate parents: `extractCodePushBundleContents` reuses one
+        // directory name, so a shared parent would have the second unpack wipe the first.
+        const { contentsPath: patchContents } = await extractCodePushBundleContents(
+            patchBundleFilePath,
+            path.join(tempRoot, 'patch-archive'),
+        );
+        const { contentsPath: baseContents } = await extractCodePushBundleContents(
+            baseBundleFilePath,
+            path.join(tempRoot, 'base-archive'),
+        );
+
+        const patchManifest: BinaryPatchManifest = JSON.parse(
+            fs.readFileSync(path.join(patchContents, BINARY_PATCH_MANIFEST_NAME), 'utf8'),
+        );
+        // Manifest paths are compared against archive-relative paths, which are POSIX.
+        const patchFile = normalizePath(patchManifest.patchFile);
+        const bundlePath = normalizePath(patchManifest.bundlePath);
+
+        // What the full archive of this release holds: the patch archive without its two
+        // patch-only files, plus the bundle the patch rebuilds. Deletions are worked out
+        // against that set, not against the subset the diff happens to ship.
+        const patchFiles = await listFilesRelative(patchContents);
+        const updateFiles = new Set(
+            patchFiles.filter(
+                (relativePath) => relativePath !== BINARY_PATCH_MANIFEST_NAME && relativePath !== patchFile,
+            ),
+        );
+        updateFiles.add(bundlePath);
+
+        // The archive root directory name is part of the contents layout, so the diff
+        // archive has to reuse the name the full archive used.
+        const contentsDirName = path.basename(patchContents);
+        const stagedContents = path.join(stagingRoot, contentsDirName);
+        fs.cpSync(patchContents, stagedContents, { recursive: true });
+        for (const relativePath of patchFiles) {
+            const baseFile = path.join(baseContents, relativePath);
+            if (fs.existsSync(baseFile) && sameBytes(path.join(patchContents, relativePath), baseFile)) {
+                fs.rmSync(path.join(stagedContents, relativePath));
+            }
+        }
+
+        const manifest: AssetDiffManifest = {
+            deletedFiles: (await listFilesRelative(baseContents))
+                .filter((relativePath) => !updateFiles.has(relativePath))
+                .map((relativePath) => `${contentsDirName}/${relativePath}`),
+        };
+        fs.writeFileSync(path.join(stagingRoot, ASSET_DIFF_MANIFEST_NAME), JSON.stringify(manifest, null, 2));
+
+        const diffArchiveZipPath = await zipDirectoryContents(stagingRoot);
+        if (fs.statSync(diffArchiveZipPath).size >= fs.statSync(patchBundleFilePath).size) {
+            // A diff that costs a client as much as the patch archive is never the better
+            // artifact of the two, and the release still publishes that patch archive.
+            fs.rmSync(diffArchiveZipPath);
+            return null;
+        }
+
+        const diffBundleFilePath = path.join(bundleDirectory, assetDiffArchiveName(packageHash, basePackageHash));
+        shell.mkdir('-p', bundleDirectory);
+        shell.mv(diffArchiveZipPath, diffBundleFilePath);
+
+        return { diffBundleFilePath };
+    } finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+}
+
+/** Every file below `directoryPath`, as POSIX paths relative to it. */
+async function listFilesRelative(directoryPath: string): Promise<string[]> {
+    const files = await walk(directoryPath);
+    return files.map((filePath) => normalizePath(path.relative(directoryPath, filePath)));
+}
+
+function sameBytes(left: string, right: string): boolean {
+    // A base that holds a directory where the update holds a file has nothing the update
+    // can be spared from downloading, so the file ships.
+    const rightStats = fs.statSync(right);
+    if (!rightStats.isFile() || fs.statSync(left).size !== rightStats.size) {
+        return false;
+    }
+    return fs.readFileSync(left).equals(fs.readFileSync(right));
+}

package/cli/functions/resolveAssetDiffBases.test.ts

@@ -0,0 +1,220 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterAll, afterEach, beforeAll, describe, expect, it, jest } from "@jest/globals";
+import { makeCodePushBundle } from "./makeCodePushBundle.js";
+import { resolveAssetDiffBases } from "./resolveAssetDiffBases.js";
+import type { CliConfigInterface, ReleaseHistoryInterface } from "../../typings/react-native-code-push.d.ts";
+
+/**
+ * Exercises base acquisition against real archives and real hashes: a base is only usable
+ * if the bytes that came back are the ones the release history recorded, and only real
+ * archives prove that the verification accepts a good download and rejects a wrong one.
+ */
+
+/** The directory a CodePush archive keeps its contents in, for legacy reasons. */
+const CONTENTS_DIR_NAME = 'CodePush';
+
+/** Where the resolver unpacks a base for verification, so leftovers are recognizable. */
+const TEMP_DIR_PREFIX = 'codepush-asset-diff-base-';
+
+type StagedRelease = {
+    version: string;
+    downloadUrl: string;
+    packageHash: string;
+    archivePath: string;
+};
+
+let workDir: string;
+let bundleDirectory: string;
+
+/** Releases one full archive the way the CLI does, and returns what the history records. */
+async function stageRelease(version: string): Promise<StagedRelease> {
+    const contentsPath = path.join(workDir, version, CONTENTS_DIR_NAME);
+    fs.mkdirSync(contentsPath, { recursive: true });
+    fs.writeFileSync(path.join(contentsPath, 'index.android.bundle'), `bundle bytes of ${version}`);
+
+    const { bundleFileName } = await makeCodePushBundle(contentsPath, bundleDirectory);
+
+    return {
+        version,
+        downloadUrl: `https://downloads.test/${version}.zip`,
+        packageHash: bundleFileName,
+        archivePath: path.join(bundleDirectory, bundleFileName),
+    };
+}
+
+async function stageReleases(versions: string[]): Promise<StagedRelease[]> {
+    const releases: StagedRelease[] = [];
+    for (const version of versions) {
+        releases.push(await stageRelease(version));
+    }
+    return releases;
+}
+
+function releaseHistoryOf(releases: StagedRelease[]): ReleaseHistoryInterface {
+    return Object.fromEntries(
+        releases.map((release) => [
+            release.version,
+            {
+                enabled: true,
+                mandatory: false,
+                downloadUrl: release.downloadUrl,
+                packageHash: release.packageHash,
+            },
+        ]),
+    );
+}
+
+/** Stands in for the consumer's downloader: hands back a local archive per download url. */
+function fakeDownloader(archives: Record<string, string | Error>) {
+    const calls: Array<[string, string, string | undefined]> = [];
+    const download: NonNullable<CliConfigInterface['bundleDownloader']> = async (
+        downloadUrl,
+        platform,
+        identifier,
+    ) => {
+        calls.push([downloadUrl, platform, identifier]);
+
+        const archive = archives[downloadUrl];
+        if (archive instanceof Error) {
+            throw archive;
+        }
+        if (!archive) {
+            throw new Error(`the downloader was called with an unexpected url: ${downloadUrl}`);
+        }
+        return { downloadedFilePath: archive };
+    };
+    return { download, calls };
+}
+
+function leftoverTempDirs(): string[] {
+    return fs.readdirSync(os.tmpdir()).filter((entry) => entry.startsWith(TEMP_DIR_PREFIX));
+}
+
+beforeAll(() => {
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "codepush-base-resolution-"));
+    bundleDirectory = path.join(workDir, 'bundleOutput');
+});
+
+afterEach(() => {
+    jest.restoreAllMocks();
+});
+
+afterAll(() => {
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+
+describe("resolveAssetDiffBases", () => {
+    it("takes the newest releases first, up to the requested count", async () => {
+        const releases = await stageReleases(['1.0.0', '1.0.1', '1.0.2', '1.0.9', '1.0.10']);
+        const [newest, second] = [releases[4], releases[3]];
+        const { download, calls } = fakeDownloader(
+            Object.fromEntries(releases.map((release) => [release.downloadUrl, release.archivePath])),
+        );
+
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: releaseHistoryOf(releases),
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'android',
+            identifier: 'my-app',
+        });
+
+        expect(bases).toEqual([
+            { basePackageHash: newest.packageHash, baseBundleFilePath: newest.archivePath },
+            { basePackageHash: second.packageHash, baseBundleFilePath: second.archivePath },
+        ]);
+        expect(calls).toEqual([
+            [newest.downloadUrl, 'android', 'my-app'],
+            [second.downloadUrl, 'android', 'my-app'],
+        ]);
+    });
+
+    it("skips history entries that lack a download url or a package hash", async () => {
+        const [released] = await stageReleases(['1.1.0']);
+        const { download, calls } = fakeDownloader({ [released.downloadUrl]: released.archivePath });
+
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: {
+                ...releaseHistoryOf([released]),
+                // What `create-history` seeds for the update inside the app binary.
+                '1.1.1': { enabled: true, mandatory: false, downloadUrl: "", packageHash: "" },
+                '1.1.2': { enabled: true, mandatory: false, downloadUrl: released.downloadUrl, packageHash: "" },
+            },
+            diffBaseCount: 1,
+            bundleDownloader: download,
+            platform: 'ios',
+        });
+
+        expect(bases).toEqual([
+            { basePackageHash: released.packageHash, baseBundleFilePath: released.archivePath },
+        ]);
+        expect(calls).toEqual([[released.downloadUrl, 'ios', undefined]]);
+    });
+
+    it("ignores a history entry whose key is not a version, and resolves the rest", async () => {
+        const [released] = await stageReleases(['1.4.0']);
+        const { download, calls } = fakeDownloader({ [released.downloadUrl]: released.archivePath });
+
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: {
+                ...releaseHistoryOf([released]),
+                'not-a-version': {
+                    enabled: true,
+                    mandatory: false,
+                    downloadUrl: released.downloadUrl,
+                    packageHash: released.packageHash,
+                },
+            },
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'ios',
+        });
+
+        expect(bases).toEqual([
+            { basePackageHash: released.packageHash, baseBundleFilePath: released.archivePath },
+        ]);
+        expect(calls).toEqual([[released.downloadUrl, 'ios', undefined]]);
+    });
+
+    it("drops a base whose downloaded bytes do not match its recorded package hash", async () => {
+        const [older, newer] = await stageReleases(['1.2.0', '1.2.1']);
+        // The newest base comes back as some other release's archive.
+        const { download } = fakeDownloader({
+            [newer.downloadUrl]: older.archivePath,
+            [older.downloadUrl]: older.archivePath,
+        });
+        const warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: releaseHistoryOf([older, newer]),
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'android',
+        });
+
+        expect(bases).toEqual([{ basePackageHash: older.packageHash, baseBundleFilePath: older.archivePath }]);
+        expect(warn.mock.calls.join('\n')).toMatch(/1\.2\.1/);
+        expect(leftoverTempDirs()).toEqual([]);
+    });
+
+    it("drops a base whose download fails instead of failing the release", async () => {
+        const [older, newer] = await stageReleases(['1.3.0', '1.3.1']);
+        const { download } = fakeDownloader({
+            [newer.downloadUrl]: new Error('the network is down'),
+            [older.downloadUrl]: older.archivePath,
+        });
+        const warn = jest.spyOn(console, 'warn').mockImplementation(() => {});
+
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: releaseHistoryOf([older, newer]),
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'android',
+        });
+
+        expect(bases).toEqual([{ basePackageHash: older.packageHash, baseBundleFilePath: older.archivePath }]);
+        expect(warn.mock.calls.join('\n')).toMatch(/1\.3\.1.*the network is down/s);
+    });
+});