@bravemobile/react-native-code-push 13.1.0-beta.2 → 13.1.0-beta.3

package/cli/dist/functions/makeAssetDiffBundle.test.js

@@ -0,0 +1,215 @@
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterAll, beforeAll, describe, expect, it } from "@jest/globals";
+import { ASSET_DIFF_ARCHIVE_INFIX, ASSET_DIFF_MANIFEST_NAME, assetDiffArchiveName, makeAssetDiffBundle, } from "./makeAssetDiffBundle.js";
+import { BINARY_PATCH_MANIFEST_NAME, makeBinaryPatchBundle } from "./makeBinaryPatchBundle.js";
+import { makeCodePushBundle } from "./makeCodePushBundle.js";
+import { applyPatch } from "../utils/binaryPatch.js";
+import { generatePackageHashFromDirectory } from "../utils/hash-utils.js";
+import { walk } from "../utils/promisfied-fs.js";
+import { unzip } from "../utils/unzip.js";
+/**
+ * Exercises the diff artifact against real archives, real hdiffz output and real hashes.
+ * A diff is only worth shipping if a client that owns the base package can rebuild the
+ * exact contents of the new full archive from it, and only real bytes prove that.
+ */
+/** The directory a CodePush archive keeps its contents in, for legacy reasons. */
+const CONTENTS_DIR_NAME = 'CodePush';
+const BUNDLE_NAME = 'index.android.bundle';
+function findRepoRoot() {
+    let dir = process.cwd();
+    for (;;) {
+        if (fs.existsSync(path.join(dir, "scripts", "binary-patch", "build-hdiffpatch.sh"))) {
+            return dir;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            throw new Error(`cannot locate the repository root from ${process.cwd()}`);
+        }
+        dir = parent;
+    }
+}
+const repoRoot = findRepoRoot();
+const fixtureDir = path.join(repoRoot, "cli", "fixtures", "binary-patch");
+const baseFixture = path.join(fixtureDir, "base.bundle");
+const targetFixture = path.join(fixtureDir, "target.bundle");
+/**
+ * The asset both releases hold. Sized like a real asset rather than a few bytes, because
+ * the builder only ships a diff that is smaller than the patch archive: dropping a
+ * four-byte file would save less than the deletion manifest costs, and the builder would
+ * rightly report the diff as not worth shipping.
+ */
+const unchangedAsset = crypto.randomBytes(4096);
+let workDir;
+/** A unique directory per test so a failed run never leaks state into the next one. */
+function makeCaseDir(name) {
+    return fs.mkdtempSync(path.join(workDir, `${name}-`));
+}
+/** Writes an update contents directory shaped like the one the bundler produces. */
+function writeUpdateContents(parentDir, files) {
+    const contentsPath = path.join(parentDir, CONTENTS_DIR_NAME);
+    for (const [relativePath, content] of Object.entries(files)) {
+        const filePath = path.join(contentsPath, relativePath);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, content);
+    }
+    return contentsPath;
+}
+function baseContentFiles() {
+    return {
+        [BUNDLE_NAME]: fs.readFileSync(baseFixture),
+        'assets/keep.png': unchangedAsset,
+        'assets/change.png': 'OLD',
+        'assets/gone.png': 'GONE',
+    };
+}
+function updateContentFiles() {
+    return {
+        [BUNDLE_NAME]: fs.readFileSync(targetFixture),
+        'assets/keep.png': unchangedAsset,
+        'assets/change.png': 'NEW',
+        'assets/new.png': 'ADDED',
+    };
+}
+/**
+ * Releases a base package and then the update, exactly the way the CLI does: a full
+ * archive for each, plus the patch archive the diff is derived from.
+ */
+async function stageRelease(name, baseFiles) {
+    const caseDir = makeCaseDir(name);
+    const bundleDirectory = path.join(caseDir, 'bundleOutput');
+    const baseContents = writeUpdateContents(path.join(caseDir, 'base'), baseFiles);
+    const { bundleFileName: basePackageHash } = await makeCodePushBundle(baseContents, bundleDirectory);
+    const updateContents = writeUpdateContents(path.join(caseDir, 'update'), updateContentFiles());
+    const { bundleFileName: packageHash } = await makeCodePushBundle(updateContents, bundleDirectory);
+    const { patchBundleFilePath } = await makeBinaryPatchBundle({
+        contentsPath: updateContents,
+        baseBundlePath: baseFixture,
+        bundleRelativePath: BUNDLE_NAME,
+        bundleDirectory,
+        packageHash,
+    });
+    return {
+        caseDir,
+        bundleDirectory,
+        packageHash,
+        basePackageHash,
+        baseBundleFilePath: path.join(bundleDirectory, basePackageHash),
+        patchBundleFilePath,
+    };
+}
+async function extractTo(archivePath, destination) {
+    fs.mkdirSync(destination, { recursive: true });
+    await unzip(archivePath, destination);
+    return destination;
+}
+/** Every file in an archive, as the archive names it. */
+async function listArchiveFiles(archivePath, destination) {
+    await extractTo(archivePath, destination);
+    const files = await walk(destination);
+    return files.map((filePath) => path.relative(destination, filePath).split(path.sep).join('/')).sort();
+}
+beforeAll(() => {
+    // hdiffz/hpatchz are provisioned for the whole run by the jest global setup.
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "codepush-asset-diff-"));
+});
+afterAll(() => {
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+describe("makeAssetDiffBundle", () => {
+    it("ships only the files the base does not already hold", async () => {
+        const release = await stageRelease("ships", baseContentFiles());
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+        expect(diff).not.toBeNull();
+        expect(path.basename(diff.diffBundleFilePath)).toBe(`${release.packageHash}${ASSET_DIFF_ARCHIVE_INFIX}${release.basePackageHash}.zip`);
+        expect(await listArchiveFiles(diff.diffBundleFilePath, path.join(release.caseDir, "extracted"))).toEqual([
+            ASSET_DIFF_MANIFEST_NAME,
+            `${CONTENTS_DIR_NAME}/${BINARY_PATCH_MANIFEST_NAME}`,
+            `${CONTENTS_DIR_NAME}/${BUNDLE_NAME}.patch`,
+            `${CONTENTS_DIR_NAME}/assets/change.png`,
+            `${CONTENTS_DIR_NAME}/assets/new.png`,
+        ].sort());
+    });
+    it("lists files the base holds but the update dropped, with the contents prefix", async () => {
+        const release = await stageRelease("deletions", baseContentFiles());
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+        const extracted = await extractTo(diff.diffBundleFilePath, path.join(release.caseDir, "extracted"));
+        const manifest = JSON.parse(fs.readFileSync(path.join(extracted, ASSET_DIFF_MANIFEST_NAME), 'utf8'));
+        expect(manifest.deletedFiles).toEqual([`${CONTENTS_DIR_NAME}/assets/gone.png`]);
+    });
+    it("reproduces the full package hash when merged the way the client merges", async () => {
+        const release = await stageRelease("round-trip", baseContentFiles());
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+        // The installed base package, which is what a client merges the diff onto.
+        const packageDir = await extractTo(release.baseBundleFilePath, path.join(release.caseDir, "package"));
+        const diffDir = await extractTo(diff.diffBundleFilePath, path.join(release.caseDir, "downloaded"));
+        const diffContents = path.join(diffDir, CONTENTS_DIR_NAME);
+        // Rebuild the bundle from its patch, then drop the two patch-only files.
+        const patchManifest = JSON.parse(fs.readFileSync(path.join(diffContents, BINARY_PATCH_MANIFEST_NAME), 'utf8'));
+        applyPatch(baseFixture, path.join(diffContents, patchManifest.patchFile), path.join(diffContents, patchManifest.bundlePath));
+        fs.rmSync(path.join(diffContents, patchManifest.patchFile));
+        fs.rmSync(path.join(diffContents, BINARY_PATCH_MANIFEST_NAME));
+        // Apply the deletions to the base package, then drop the deletion manifest.
+        const diffManifestPath = path.join(diffDir, ASSET_DIFF_MANIFEST_NAME);
+        const { deletedFiles } = JSON.parse(fs.readFileSync(diffManifestPath, 'utf8'));
+        for (const deletedFile of deletedFiles) {
+            fs.rmSync(path.join(packageDir, deletedFile));
+        }
+        fs.rmSync(diffManifestPath);
+        // Overlay what the diff shipped onto the base package.
+        fs.cpSync(diffDir, packageDir, { recursive: true });
+        expect(await generatePackageHashFromDirectory(path.join(packageDir, CONTENTS_DIR_NAME), packageDir)).toBe(release.packageHash);
+    });
+    it("skips the diff when it would not be smaller than the patch archive", async () => {
+        // A base that shares no bytes with the update leaves nothing to prune, so the diff
+        // is the patch archive plus a deletion manifest.
+        const release = await stageRelease("oversized", {
+            [BUNDLE_NAME]: fs.readFileSync(baseFixture),
+            'assets/keep.png': crypto.randomBytes(4096),
+            'assets/change.png': 'OLD',
+        });
+        const archivesBefore = fs.readdirSync(release.bundleDirectory).sort();
+        const diff = await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+        expect(diff).toBeNull();
+        expect(fs.existsSync(path.join(release.bundleDirectory, assetDiffArchiveName(release.packageHash, release.basePackageHash)))).toBe(false);
+        expect(fs.readdirSync(release.bundleDirectory).sort()).toEqual(archivesBefore);
+    });
+    it("leaves no working directory behind", async () => {
+        const release = await stageRelease("cleanup", baseContentFiles());
+        const entriesBefore = fs.readdirSync(release.caseDir).sort();
+        await makeAssetDiffBundle({
+            patchBundleFilePath: release.patchBundleFilePath,
+            baseBundleFilePath: release.baseBundleFilePath,
+            bundleDirectory: release.bundleDirectory,
+            packageHash: release.packageHash,
+            basePackageHash: release.basePackageHash,
+        });
+        expect(fs.readdirSync(release.caseDir).sort()).toEqual(entriesBefore);
+    });
+});

package/cli/dist/functions/resolveAssetDiffBases.js

@@ -0,0 +1,71 @@
+/**
+ * Picks the previously released packages a new release builds asset diffs against, and
+ * hands back a verified local copy of each.
+ *
+ * A diff is only installable by a client whose package is byte for byte the base it was
+ * built against, so the base has to be the exact archive the release history describes.
+ * Every download is therefore unpacked and hashed before it is accepted: a base that is
+ * not what the history recorded would produce a diff that sends every client holding
+ * that version into the full-download fallback.
+ *
+ * Bases are the most recent releases, because that is where the installed clients are.
+ * One base failing is never a reason to fail the release - the release still publishes
+ * its full and patch archives, and simply serves fewer diffs.
+ */
+import fs from "fs";
+import os from "os";
+import path from "path";
+import semver from "semver";
+import { generatePackageHashFromDirectory } from "../utils/hash-utils.js";
+import { extractCodePushBundleContents } from "./makeBinaryPatchBundle.js";
+const TEMP_DIR_PREFIX = 'codepush-asset-diff-base-';
+/**
+ * @param releaseHistory {ReleaseHistoryInterface} History of the binary version being released to
+ * @param diffBaseCount {number} How many of the most recent releases to build diffs against
+ * @param bundleDownloader Consumer-provided downloader for a released archive
+ * @return The bases that downloaded and verified, newest release first.
+ */
+export async function resolveAssetDiffBases({ releaseHistory, diffBaseCount, bundleDownloader, platform, identifier, }) {
+    // The seeded entry for the update inside the app binary has neither a url nor a hash,
+    // and nothing can be diffed against a package that was never published. A key that is
+    // not a version cannot be ordered against the others either, and ordering is what picks
+    // the recent releases, so it is not eligible.
+    const candidates = Object.entries(releaseHistory)
+        .filter(([version, releaseInfo]) => Boolean(semver.valid(version)) && Boolean(releaseInfo.downloadUrl) && Boolean(releaseInfo.packageHash))
+        .sort(([left], [right]) => semver.rcompare(left, right))
+        .slice(0, diffBaseCount);
+    const bases = [];
+    for (const [version, releaseInfo] of candidates) {
+        try {
+            const { downloadedFilePath } = await bundleDownloader(releaseInfo.downloadUrl, platform, identifier);
+            if (!(await matchesPackageHash(downloadedFilePath, releaseInfo.packageHash))) {
+                console.warn(`warn: Skipping the asset diff base v${version}: the downloaded archive does not hash to the ` +
+                    `package hash recorded for it (${releaseInfo.packageHash}).`);
+                continue;
+            }
+            bases.push({ basePackageHash: releaseInfo.packageHash, baseBundleFilePath: downloadedFilePath });
+        }
+        catch (error) {
+            console.warn(`warn: Skipping the asset diff base v${version}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return bases;
+}
+/**
+ * Whether an archive holds the contents the release history recorded for it.
+ *
+ * Unpacked into a working directory of its own: the extraction reuses one directory name,
+ * so bases sharing a parent would have the second unpack wipe the first.
+ */
+async function matchesPackageHash(bundleFilePath, packageHash) {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), TEMP_DIR_PREFIX));
+    try {
+        const { contentsPath } = await extractCodePushBundleContents(bundleFilePath, tempRoot);
+        // Hashed relative to the contents parent, the way the archive itself was hashed.
+        const actualHash = await generatePackageHashFromDirectory(contentsPath, path.join(contentsPath, '..'));
+        return actualHash === packageHash;
+    }
+    finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+}

package/cli/dist/functions/resolveAssetDiffBases.test.js

@@ -0,0 +1,174 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterAll, afterEach, beforeAll, describe, expect, it, jest } from "@jest/globals";
+import { makeCodePushBundle } from "./makeCodePushBundle.js";
+import { resolveAssetDiffBases } from "./resolveAssetDiffBases.js";
+/**
+ * Exercises base acquisition against real archives and real hashes: a base is only usable
+ * if the bytes that came back are the ones the release history recorded, and only real
+ * archives prove that the verification accepts a good download and rejects a wrong one.
+ */
+/** The directory a CodePush archive keeps its contents in, for legacy reasons. */
+const CONTENTS_DIR_NAME = 'CodePush';
+/** Where the resolver unpacks a base for verification, so leftovers are recognizable. */
+const TEMP_DIR_PREFIX = 'codepush-asset-diff-base-';
+let workDir;
+let bundleDirectory;
+/** Releases one full archive the way the CLI does, and returns what the history records. */
+async function stageRelease(version) {
+    const contentsPath = path.join(workDir, version, CONTENTS_DIR_NAME);
+    fs.mkdirSync(contentsPath, { recursive: true });
+    fs.writeFileSync(path.join(contentsPath, 'index.android.bundle'), `bundle bytes of ${version}`);
+    const { bundleFileName } = await makeCodePushBundle(contentsPath, bundleDirectory);
+    return {
+        version,
+        downloadUrl: `https://downloads.test/${version}.zip`,
+        packageHash: bundleFileName,
+        archivePath: path.join(bundleDirectory, bundleFileName),
+    };
+}
+async function stageReleases(versions) {
+    const releases = [];
+    for (const version of versions) {
+        releases.push(await stageRelease(version));
+    }
+    return releases;
+}
+function releaseHistoryOf(releases) {
+    return Object.fromEntries(releases.map((release) => [
+        release.version,
+        {
+            enabled: true,
+            mandatory: false,
+            downloadUrl: release.downloadUrl,
+            packageHash: release.packageHash,
+        },
+    ]));
+}
+/** Stands in for the consumer's downloader: hands back a local archive per download url. */
+function fakeDownloader(archives) {
+    const calls = [];
+    const download = async (downloadUrl, platform, identifier) => {
+        calls.push([downloadUrl, platform, identifier]);
+        const archive = archives[downloadUrl];
+        if (archive instanceof Error) {
+            throw archive;
+        }
+        if (!archive) {
+            throw new Error(`the downloader was called with an unexpected url: ${downloadUrl}`);
+        }
+        return { downloadedFilePath: archive };
+    };
+    return { download, calls };
+}
+function leftoverTempDirs() {
+    return fs.readdirSync(os.tmpdir()).filter((entry) => entry.startsWith(TEMP_DIR_PREFIX));
+}
+beforeAll(() => {
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "codepush-base-resolution-"));
+    bundleDirectory = path.join(workDir, 'bundleOutput');
+});
+afterEach(() => {
+    jest.restoreAllMocks();
+});
+afterAll(() => {
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+describe("resolveAssetDiffBases", () => {
+    it("takes the newest releases first, up to the requested count", async () => {
+        const releases = await stageReleases(['1.0.0', '1.0.1', '1.0.2', '1.0.9', '1.0.10']);
+        const [newest, second] = [releases[4], releases[3]];
+        const { download, calls } = fakeDownloader(Object.fromEntries(releases.map((release) => [release.downloadUrl, release.archivePath])));
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: releaseHistoryOf(releases),
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'android',
+            identifier: 'my-app',
+        });
+        expect(bases).toEqual([
+            { basePackageHash: newest.packageHash, baseBundleFilePath: newest.archivePath },
+            { basePackageHash: second.packageHash, baseBundleFilePath: second.archivePath },
+        ]);
+        expect(calls).toEqual([
+            [newest.downloadUrl, 'android', 'my-app'],
+            [second.downloadUrl, 'android', 'my-app'],
+        ]);
+    });
+    it("skips history entries that lack a download url or a package hash", async () => {
+        const [released] = await stageReleases(['1.1.0']);
+        const { download, calls } = fakeDownloader({ [released.downloadUrl]: released.archivePath });
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: {
+                ...releaseHistoryOf([released]),
+                // What `create-history` seeds for the update inside the app binary.
+                '1.1.1': { enabled: true, mandatory: false, downloadUrl: "", packageHash: "" },
+                '1.1.2': { enabled: true, mandatory: false, downloadUrl: released.downloadUrl, packageHash: "" },
+            },
+            diffBaseCount: 1,
+            bundleDownloader: download,
+            platform: 'ios',
+        });
+        expect(bases).toEqual([
+            { basePackageHash: released.packageHash, baseBundleFilePath: released.archivePath },
+        ]);
+        expect(calls).toEqual([[released.downloadUrl, 'ios', undefined]]);
+    });
+    it("ignores a history entry whose key is not a version, and resolves the rest", async () => {
+        const [released] = await stageReleases(['1.4.0']);
+        const { download, calls } = fakeDownloader({ [released.downloadUrl]: released.archivePath });
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: {
+                ...releaseHistoryOf([released]),
+                'not-a-version': {
+                    enabled: true,
+                    mandatory: false,
+                    downloadUrl: released.downloadUrl,
+                    packageHash: released.packageHash,
+                },
+            },
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'ios',
+        });
+        expect(bases).toEqual([
+            { basePackageHash: released.packageHash, baseBundleFilePath: released.archivePath },
+        ]);
+        expect(calls).toEqual([[released.downloadUrl, 'ios', undefined]]);
+    });
+    it("drops a base whose downloaded bytes do not match its recorded package hash", async () => {
+        const [older, newer] = await stageReleases(['1.2.0', '1.2.1']);
+        // The newest base comes back as some other release's archive.
+        const { download } = fakeDownloader({
+            [newer.downloadUrl]: older.archivePath,
+            [older.downloadUrl]: older.archivePath,
+        });
+        const warn = jest.spyOn(console, 'warn').mockImplementation(() => { });
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: releaseHistoryOf([older, newer]),
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'android',
+        });
+        expect(bases).toEqual([{ basePackageHash: older.packageHash, baseBundleFilePath: older.archivePath }]);
+        expect(warn.mock.calls.join('\n')).toMatch(/1\.2\.1/);
+        expect(leftoverTempDirs()).toEqual([]);
+    });
+    it("drops a base whose download fails instead of failing the release", async () => {
+        const [older, newer] = await stageReleases(['1.3.0', '1.3.1']);
+        const { download } = fakeDownloader({
+            [newer.downloadUrl]: new Error('the network is down'),
+            [older.downloadUrl]: older.archivePath,
+        });
+        const warn = jest.spyOn(console, 'warn').mockImplementation(() => { });
+        const bases = await resolveAssetDiffBases({
+            releaseHistory: releaseHistoryOf([older, newer]),
+            diffBaseCount: 2,
+            bundleDownloader: download,
+            platform: 'android',
+        });
+        expect(bases).toEqual([{ basePackageHash: older.packageHash, baseBundleFilePath: older.archivePath }]);
+        expect(warn.mock.calls.join('\n')).toMatch(/1\.3\.1.*the network is down/s);
+    });
+});

package/cli/dist/utils/zip.js

@@ -7,6 +7,18 @@ import yazl from "yazl";
 import { generateRandomFilename, normalizePath, isDirectory } from "./file-utils.js";
 import { walk } from "./promisfied-fs.js";
 export function zip(updateContentsPath) {
+    // For legacy reasons, put the root directory in the zip
+    return zipRelativeTo(updateContentsPath, path.join(updateContentsPath, '..'));
+}
+/**
+ * Zips the contents of `rootPath` with entries relative to the root itself, so a file
+ * placed directly under the root lands at the archive root rather than inside a wrapper
+ * directory.
+ */
+export function zipDirectoryContents(rootPath) {
+    return zipRelativeTo(rootPath, rootPath);
+}
+function zipRelativeTo(updateContentsPath, baseDirectoryPath) {
     // eslint-disable-next-line no-async-promise-executor
     return new Promise(async (resolve, reject) => {
         const releaseFiles = [];
@@ -24,8 +36,6 @@ export function zip(updateContentsPath) {
             }
             reject(error);
         }
-        const directoryPath = updateContentsPath;
-        const baseDirectoryPath = path.join(directoryPath, '..'); // For legacy reasons, put the root directory in the zip
         const files = await walk(updateContentsPath);
         files.forEach((filePath) => {
             const relativePath = path.relative(baseDirectoryPath, filePath);