@bravemobile/react-native-code-push 13.1.0-beta.4 → 13.1.0-beta.5

package/android/app/src/test/java/com/microsoft/codepush/react/CodePushUpdateManagerDownloadTest.java

@@ -2,9 +2,11 @@ package com.microsoft.codepush.react;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
+import org.json.JSONException;
 import org.json.JSONObject;
 import org.junit.After;
 import org.junit.Before;
@@ -90,7 +92,7 @@ public class CodePushUpdateManagerDownloadTest {
     }
 
     @Test
-    public void installsAnUpdateFromItsBinaryPatchArchive() throws IOException {
+    public void installsAnUpdateFromItsBinaryPatchArchive() throws IOException, JSONException {
         String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
         String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
 
@@ -102,7 +104,12 @@ public class CodePushUpdateManagerDownloadTest {
         assertInstalledContents();
         assertEquals("applied", patchResult.optString("status", null));
         assertFalse("an applied patch has nothing to report a reason for", patchResult.has("fallbackReason"));
-        assertTrue("the apply is timed", patchResult.optLong("applyDurationMs", -1) >= 0);
+        assertTrue("the whole path is timed", patchResult.optLong("totalDurationMs", -1) >= 0);
+        assertFalse("the result no longer carries a top level apply time", patchResult.has("applyDurationMs"));
+
+        JSONObject appliedAttempt = patchResult.getJSONArray("attempts").getJSONObject(0);
+        assertTrue("an applied attempt carries its apply time", appliedAttempt.has("applyDurationMs"));
+        assertTrue(appliedAttempt.optLong("applyDurationMs", -1) >= 0);
     }
 
     @Test
@@ -116,22 +123,73 @@ public class CodePushUpdateManagerDownloadTest {
 
         assertEquals(Arrays.asList("/patch.zip", "/full.zip"), mServer.requestedPaths());
         assertInstalledContents();
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_INVALID_MANIFEST);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_INVALID_MANIFEST);
     }
 
     @Test
     public void reportsAnInvalidManifestWhenThePatchUrlDoesNotServeAnArchive() throws IOException {
         String patchUrl = serve("/patch.zip", ERROR_PAGE);
 
-        BinaryPatchResult result = updateManager(applierWriting(TARGET_BUNDLE)).downloadAndInstallPackage(
+        ArchiveRestoreResult result = updateManager(applierWriting(TARGET_BUNDLE)).downloadAndInstallPackage(
                 updatePackage("https://example.test/unused.zip", patchUrl), BUNDLE_FILE_NAME, ignoreProgress(),
-                patchUrl, true, new BinaryPatchAttempt());
+                patchUrl, true, new ArchiveAttemptLog());
 
         assertFalse(result.succeeded());
-        assertEquals(BinaryPatchResult.REASON_INVALID_MANIFEST, result.getFailureReason());
+        assertEquals(ArchiveRestoreResult.REASON_INVALID_MANIFEST, result.getFailureReason());
         assertFalse("bytes that are not an update must not reach the package folder", mPackageFolder.exists());
     }
 
+    @Test
+    public void failsTheDownloadWhenTheServerAnswersTheArchiveWithAnErrorStatus() throws IOException {
+        // Nothing is served at this path, so the server answers it with a 404.
+        String fullUrl = mServer.urlOf("/missing-full.zip");
+
+        try {
+            updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                    fullUpdatePackage(mPackageHash, fullUrl), BUNDLE_FILE_NAME, ignoreProgress());
+            fail("a download the server refused must not be reported as installed");
+        } catch (CodePushHttpException e) {
+            assertEquals(404, e.getStatusCode());
+            assertTrue("the message names the status the server answered with",
+                    e.getMessage().contains("404"));
+        }
+
+        assertFalse("nothing the server refused reaches the package folder", mPackageFolder.exists());
+    }
+
+    @Test
+    public void givesUpTheDownloadWhenThePatchArchiveArrivesShort() throws IOException {
+        // The connection carried part of the body and stopped. The full archive is behind
+        // the same connection and is larger, so there is nothing to fall back to.
+        byte[] patchArchive = zipOf(patchArchiveContents());
+        String patchUrl = mServer.serveClaimingLength("/patch.zip", patchArchive, patchArchive.length + 1024);
+        String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
+
+        try {
+            updateManager(applierWriting(TARGET_BUNDLE))
+                    .downloadPackage(updatePackage(fullUrl, patchUrl), BUNDLE_FILE_NAME, ignoreProgress());
+            fail("a download that stopped short must not be reported as installed");
+        } catch (IOException e) {
+            assertEquals(CodePushErrorCode.NETWORK, CodePushErrorCode.of(e));
+        }
+
+        assertEquals("the full archive is behind the connection that just stopped",
+                Arrays.asList("/patch.zip"), mServer.requestedPaths());
+        assertFalse("nothing that arrived short reaches the package folder", mPackageFolder.exists());
+    }
+
+    @Test
+    public void installsAnUpdateTheServerSentWithoutDeclaringItsLength() throws IOException {
+        // `getContentLength()` answers -1 for a body sent with no `Content-Length`, which no
+        // read total matches - so a download checked against it anyway could never arrive.
+        String fullUrl = mServer.serveWithoutContentLength("/full.zip", zipOf(fullArchiveContents()));
+
+        updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                fullUpdatePackage(mPackageHash, fullUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertInstalledContents();
+    }
+
     @Test
     public void fallsBackToTheFullArchiveWhenApplyingThePatchRunsOutOfMemory() throws IOException {
         String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
@@ -167,7 +225,7 @@ public class CodePushUpdateManagerDownloadTest {
 
         assertEquals(Arrays.asList("/patch.zip", "/full.zip"), mServer.requestedPaths());
         assertInstalledContents();
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_PACKAGE_VERIFICATION_FAILED);
     }
 
     @Test
@@ -204,7 +262,7 @@ public class CodePushUpdateManagerDownloadTest {
                 .downloadPackage(updatePackage(updateHash, fullUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
 
         assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/full.zip"), mServer.requestedPaths());
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_PACKAGE_VERIFICATION_FAILED);
         assertInstalledContents(updateHash, updateContents);
     }
 
@@ -221,10 +279,177 @@ public class CodePushUpdateManagerDownloadTest {
                 .downloadPackage(updatePackage(updateHash, fullUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
 
         assertEquals(Arrays.asList("/diff.zip", "/full.zip"), mServer.requestedPaths());
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void fallsBackToThePatchArchiveWhenTheInstalledPackageIsGoneFromDisk() throws IOException {
+        // The metadata still names the installed update, but its files are gone: the merge
+        // has nothing to read, which is a failure of the merge itself rather than of its
+        // result - and the one failure the patch archive, carrying every asset, is not
+        // implicated in.
+        installBaseUpdate();
+        FileUtils.deleteDirectoryAtPath(new File(
+                new File(mDocumentsDirectory, CodePushConstants.CODE_PUSH_FOLDER_PREFIX),
+                packageHashOf(installedArchiveContents())).getAbsolutePath());
+
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip", zipOf(assetDiffArchiveContents(DROPPED_ASSET_PATH)));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(ArchiveRestoreResult.REASON_ASSET_MERGE_FAILED,
+                patchResult.optJSONArray("attempts").optJSONObject(0).optString("fallbackReason", null));
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void fallsBackToThePatchArchiveWhenTheAssetDiffManifestCannotBeParsed() throws IOException {
+        // Bytes that are not JSON leave nothing to read the deletions out of, so the merge
+        // has no way to know what it was supposed to delete - a failure of the merge itself.
+        installBaseUpdate();
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip",
+                zipOf(assetDiffArchiveContentsWithManifest(bytes("{\"deletedFiles\":"))));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(ArchiveRestoreResult.REASON_ASSET_MERGE_FAILED,
+                patchResult.optJSONArray("attempts").optJSONObject(0).optString("fallbackReason", null));
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void fallsBackToThePatchArchiveWhenTheAssetDiffManifestDoesNotNameTheFilesToDelete() throws IOException {
+        // A manifest without the key is not a manifest with nothing to delete: the CLI always
+        // writes it, an empty list included, so its absence says the manifest is not the one
+        // the release published - and merging past it would leave behind files the update
+        // dropped.
+        installBaseUpdate();
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip", zipOf(assetDiffArchiveContentsWithManifest(bytes("{}"))));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(ArchiveRestoreResult.REASON_ASSET_MERGE_FAILED,
+                patchResult.optJSONArray("attempts").optJSONObject(0).optString("fallbackReason", null));
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void triesThePatchArchiveWhenTheServerDoesNotServeTheAssetDiff() throws IOException {
+        // A 404 is a verdict on the URL it was asked of. Diffs are published one per recent
+        // version and are the first thing a retention policy clears out, while the patch
+        // archive at its own URL stays - so nothing about a diff that is gone says the patch
+        // archive is.
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = mServer.urlOf("/missing-diff.zip");
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals("the full archive is not downloaded when the patch archive installs",
+                Arrays.asList("/missing-diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(2, patchResult.optJSONArray("attempts").length());
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void skipsThePatchArchiveWhenTheAssetDiffFailsInItsBundlePatch() throws IOException {
+        // Both archives carry that patch byte for byte, so an applier that refused it here
+        // would refuse it there - and trying it would put a second doomed download in front
+        // of the full one.
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip", zipOf(assetDiffArchiveContents(DROPPED_ASSET_PATH)));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierRefusingThePatch()).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/diff.zip", "/full.zip"), mServer.requestedPaths());
+        assertEquals(1, patchResult.optJSONArray("attempts").length());
         assertInstalledContents(updateHash, updateContents);
     }
 
+    @Test
+    public void givesUpTheDownloadWhenTheNetworkCannotCarryTheAssetDiff() throws IOException {
+        // A refused connection is the network failing rather than a verdict on the archive,
+        // and the archives behind it are behind the same network - the full one only larger
+        // and started over from nothing.
+        String unreachableDiffUrl = "http://127.0.0.1:" + portNothingListensOn() + "/diff.zip";
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
+        String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
+
+        try {
+            updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                    updatePackageWithAssetDiff(mPackageHash, fullUrl, patchUrl, unreachableDiffUrl),
+                    BUNDLE_FILE_NAME, ignoreProgress());
+            fail("a network that carried nothing must not be reported as an installed update");
+        } catch (IOException e) {
+            assertEquals(CodePushErrorCode.NETWORK, CodePushErrorCode.of(e));
+        }
+
+        assertTrue("no archive behind the same network is asked for", mServer.requestedPaths().isEmpty());
+        assertFalse("nothing that never arrived reaches the package folder", mPackageFolder.exists());
+    }
+
+
+    /** A loopback port that is opened only to be closed, so connecting to it is refused. */
+    private static int portNothingListensOn() throws IOException {
+        ServerSocket socket = new ServerSocket(0, 0, InetAddress.getByName("127.0.0.1"));
+        int port = socket.getLocalPort();
+        socket.close();
+        return port;
+    }
+
+    @Test
+    public void installsFromThePatchArchiveWhenTheAssetDiffUrlIsAnEmptyString() throws IOException {
+        // An empty slot is not an archive on offer. Attempting it would fail for want of a
+        // URL and leave no verdict behind, which is what skips the patch archive - so the
+        // update would be downloaded in full with a perfectly good patch archive untried.
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
+        String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(mPackageHash, fullUrl, patchUrl, ""), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals("the empty diff slot is not downloaded and does not cost the patch archive its try",
+                Arrays.asList("/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(1, patchResult.optJSONArray("attempts").length());
+        assertInstalledContents();
+    }
+
     @Test
     public void leavesAFileOutsideThePackageFolderAloneWhenTheAssetDiffManifestNamesIt() throws IOException {
         // A manifest entry that climbs out of the package folder: the client is not the one
@@ -287,7 +512,8 @@ public class CodePushUpdateManagerDownloadTest {
     private static void assertFallbackResult(JSONObject patchResult, String expectedReason) {
         assertEquals("fallback", patchResult.optString("status", null));
         assertEquals(expectedReason, patchResult.optString("fallbackReason", null));
-        assertTrue("the attempt is timed", patchResult.optLong("applyDurationMs", -1) >= 0);
+        assertTrue("the whole path is timed", patchResult.optLong("totalDurationMs", -1) >= 0);
+        assertFalse("the result no longer carries a top level apply time", patchResult.has("applyDurationMs"));
     }
 
     /** The installed update is the full archive's contents, whichever archive it came from. */
@@ -307,7 +533,7 @@ public class CodePushUpdateManagerDownloadTest {
         // How the update was downloaded says nothing about the update, so it is not part of
         // what the update is installed from and outlives the download in no file.
         assertFalse("the patch attempt reached the stored metadata",
-                metadata.has(CodePushConstants.BINARY_PATCH_RESULT_KEY));
+                metadata.has(CodePushConstants.UPDATE_ARCHIVE_RESULT_KEY));
 
         File binaryPatchFolder = new File(
                 new File(mDocumentsDirectory, CodePushConstants.CODE_PUSH_FOLDER_PREFIX),
@@ -378,6 +604,16 @@ public class CodePushUpdateManagerDownloadTest {
         return new CodePushUpdateManager(mDocumentsDirectory, binaryPatch);
     }
 
+    /** An applier that refuses the bundle patch, which every archive of a release carries. */
+    private static CodePushBinaryPatch.PatchApplier applierRefusingThePatch() {
+        return new CodePushBinaryPatch.PatchApplier() {
+            @Override
+            public int apply(byte[] base, byte[] patch, String outputPath, long expectedTargetSize) {
+                return RESULT_APPLY_FAILED;
+            }
+        };
+    }
+
     private static CodePushBinaryPatch.PatchApplier applierWriting(final byte[] restoredBundle) {
         return new CodePushBinaryPatch.PatchApplier() {
             @Override
@@ -437,11 +673,16 @@ public class CodePushUpdateManagerDownloadTest {
      * holds unchanged is not shipped at all - the client copies it over.
      */
     private Map<String, byte[]> assetDiffArchiveContents(String deletedAssetPath) {
+        return assetDiffArchiveContentsWithManifest(
+                bytes("{\"deletedFiles\":[\"" + CONTENTS_DIR_NAME + "/" + deletedAssetPath + "\"]}"));
+    }
+
+    /** The same archive carrying a manifest of its own, which is how one the CLI did not write arrives. */
+    private Map<String, byte[]> assetDiffArchiveContentsWithManifest(byte[] manifest) {
         Map<String, byte[]> contents = patchArchiveContents();
         contents.remove(CONTENTS_DIR_NAME + "/" + ASSET_PATH);
         contents.put(CONTENTS_DIR_NAME + "/" + ADDED_ASSET_PATH, ADDED_ASSET);
-        contents.put(CodePushConstants.DIFF_MANIFEST_FILE_NAME,
-                bytes("{\"deletedFiles\":[\"" + CONTENTS_DIR_NAME + "/" + deletedAssetPath + "\"]}"));
+        contents.put(CodePushConstants.DIFF_MANIFEST_FILE_NAME, manifest);
         return contents;
     }
 
@@ -453,6 +694,13 @@ public class CodePushUpdateManagerDownloadTest {
         return contents;
     }
 
+    /** The patch archive of the release the asset diff belongs to: every asset, no merge. */
+    private Map<String, byte[]> patchArchiveContentsForAssetDiffTarget() {
+        Map<String, byte[]> contents = patchArchiveContents();
+        contents.put(CONTENTS_DIR_NAME + "/" + ADDED_ASSET_PATH, ADDED_ASSET);
+        return contents;
+    }
+
     /** What an asset diff has to add up to: the contents of the update's full archive. */
     private Map<String, byte[]> assetDiffTargetContents() {
         Map<String, byte[]> contents = fullArchiveContents();
@@ -470,6 +718,14 @@ public class CodePushUpdateManagerDownloadTest {
         return updatePackage;
     }
 
+    /** A release offering all three archives, the diff in the slot of its own the JS fills. */
+    private JSONObject updatePackageWithAssetDiff(String packageHash, String downloadUrl,
+                                                  String binaryPatchDownloadUrl, String assetDiffDownloadUrl) {
+        JSONObject updatePackage = updatePackage(packageHash, downloadUrl, binaryPatchDownloadUrl);
+        CodePushUtils.setJSONValueForKey(updatePackage, CodePushConstants.ASSET_DIFF_DOWNLOAD_URL_KEY, assetDiffDownloadUrl);
+        return updatePackage;
+    }
+
     /** A release with no second archive to try, so it is downloaded in full. */
     private JSONObject fullUpdatePackage(String packageHash, String downloadUrl) {
         JSONObject updatePackage = new JSONObject();
@@ -491,7 +747,10 @@ public class CodePushUpdateManagerDownloadTest {
     private static class TestArchiveServer {
 
         private final ServerSocket mSocket;
+        private static final long NO_CONTENT_LENGTH = -1;
+
         private final Map<String, byte[]> mBodies = new HashMap<>();
+        private final Map<String, Long> mDeclaredLengths = new HashMap<>();
         private final List<String> mRequestedPaths = Collections.synchronizedList(new ArrayList<String>());
 
         TestArchiveServer() throws IOException {
@@ -508,6 +767,23 @@ public class CodePushUpdateManagerDownloadTest {
 
         synchronized String serve(String path, byte[] body) {
             mBodies.put(path, body);
+            return urlOf(path);
+        }
+
+        /** Serves a body under a `Content-Length` of the server's choosing rather than its own. */
+        synchronized String serveClaimingLength(String path, byte[] body, long declaredLength) {
+            mBodies.put(path, body);
+            mDeclaredLengths.put(path, declaredLength);
+            return urlOf(path);
+        }
+
+        /** Serves a body with no `Content-Length` at all, which the client reads until it closes. */
+        synchronized String serveWithoutContentLength(String path, byte[] body) {
+            return serveClaimingLength(path, body, NO_CONTENT_LENGTH);
+        }
+
+        /** The URL of a path this server answers - with a 404, when nothing is served there. */
+        String urlOf(String path) {
             return "http://127.0.0.1:" + mSocket.getLocalPort() + path;
         }
 
@@ -557,8 +833,17 @@ public class CodePushUpdateManagerDownloadTest {
             if (body == null) {
                 response.write(bytes("HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"));
             } else {
-                response.write(bytes("HTTP/1.1 200 OK\r\nContent-Length: " + body.length
-                        + "\r\nConnection: close\r\n\r\n"));
+                Long declaredLength = declaredLengthFor(path);
+                if (declaredLength == null) {
+                    response.write(bytes("HTTP/1.1 200 OK\r\nContent-Length: " + body.length
+                            + "\r\nConnection: close\r\n\r\n"));
+                } else if (declaredLength == NO_CONTENT_LENGTH) {
+                    response.write(bytes("HTTP/1.1 200 OK\r\nConnection: close\r\n\r\n"));
+                } else {
+                    response.write(bytes("HTTP/1.1 200 OK\r\nContent-Length: " + declaredLength
+                            + "\r\nConnection: close\r\n\r\n"));
+                }
+
                 response.write(body);
             }
             response.flush();
@@ -573,6 +858,10 @@ public class CodePushUpdateManagerDownloadTest {
         private synchronized byte[] bodyFor(String path) {
             return mBodies.get(path);
         }
+
+        private synchronized Long declaredLengthFor(String path) {
+            return mDeclaredLengths.get(path);
+        }
     }
 
     private static byte[] zipOf(Map<String, byte[]> contents) throws IOException {

package/cli/commands/createHistoryCommand/createReleaseHistory.test.ts

@@ -0,0 +1,133 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterEach, beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { createReleaseHistory } from "./createReleaseHistory.js";
+import { updateReleaseHistory } from "../updateHistoryCommand/updateReleaseHistory.js";
+
+/**
+ * Covers where the release history is staged before the config is handed it.
+ *
+ * The config receives a path rather than the history itself, so the command has to put the
+ * file somewhere first. Two releases of one app for different platforms are the same binary
+ * version, so a staging path derived from that version alone is the same path for both, and
+ * they overwrite each other's contents before either has read its own.
+ */
+
+const BINARY_VERSION = "1.0.0";
+
+let workingDir: string;
+let previousCwd: string;
+
+beforeEach(() => {
+    previousCwd = process.cwd();
+    workingDir = fs.mkdtempSync(path.join(os.tmpdir(), "codepush-history-staging-"));
+    process.chdir(workingDir);
+});
+
+afterEach(() => {
+    process.chdir(previousCwd);
+    fs.rmSync(workingDir, { recursive: true, force: true });
+    jest.restoreAllMocks();
+});
+
+function stagedPath(platform: "ios" | "android"): string {
+    return path.join(workingDir, "codepush-release-history", platform, `${BINARY_VERSION}.json`);
+}
+
+/**
+ * Turns the command's own exit into a throw, so a staging failure fails the test instead
+ * of taking the worker down with it.
+ */
+function failOnExit(): void {
+    jest.spyOn(process, "exit").mockImplementation((code) => {
+        throw new Error(`the command exited with code ${String(code)}`);
+    });
+    jest.spyOn(console, "error").mockImplementation(() => undefined);
+    jest.spyOn(console, "log").mockImplementation(() => undefined);
+}
+
+describe("staging the release history a config is handed", () => {
+    it("gives each platform writing at the same time a file of its own", async () => {
+        failOnExit();
+
+        const staged: Record<string, { jsonFilePath: string; contents: string }> = {};
+        const setReleaseHistory = async (
+            _binaryVersion: string,
+            jsonFilePath: string,
+            _releaseInfo: unknown,
+            platform: "ios" | "android",
+        ): Promise<void> => {
+            // Yields once, which is all it takes for the other platform to reach its own
+            // write and its own clean-up while this one still holds only a path.
+            await Promise.resolve();
+            staged[platform] = { jsonFilePath, contents: fs.readFileSync(jsonFilePath, "utf8") };
+        };
+
+        await Promise.all([
+            createReleaseHistory(BINARY_VERSION, setReleaseHistory, "ios", "RN0840"),
+            createReleaseHistory(BINARY_VERSION, setReleaseHistory, "android", "RN0840"),
+        ]);
+
+        expect(staged.ios.jsonFilePath).not.toBe(staged.android.jsonFilePath);
+    });
+
+    it("hands each platform the history that platform released", async () => {
+        failOnExit();
+
+        const released: Record<string, string> = {
+            ios: JSON.stringify({ [BINARY_VERSION]: { enabled: true, mandatory: false, downloadUrl: "", packageHash: "" }, "1.0.1": { enabled: true, mandatory: true, downloadUrl: "ios-url", packageHash: "ios-hash" } }),
+            android: JSON.stringify({ [BINARY_VERSION]: { enabled: true, mandatory: false, downloadUrl: "", packageHash: "" }, "1.0.1": { enabled: true, mandatory: true, downloadUrl: "android-url", packageHash: "android-hash" } }),
+        };
+
+        const staged: Record<string, string> = {};
+        const getReleaseHistory = async (
+            _binaryVersion: string,
+            platform: "ios" | "android",
+        ) => JSON.parse(released[platform]);
+        const setReleaseHistory = async (
+            _binaryVersion: string,
+            jsonFilePath: string,
+            _releaseInfo: unknown,
+            platform: "ios" | "android",
+        ): Promise<void> => {
+            await Promise.resolve();
+            staged[platform] = fs.readFileSync(jsonFilePath, "utf8");
+        };
+
+        await Promise.all([
+            updateReleaseHistory("1.0.1", BINARY_VERSION, getReleaseHistory, setReleaseHistory, "ios", "RN0840", undefined, false, undefined),
+            updateReleaseHistory("1.0.1", BINARY_VERSION, getReleaseHistory, setReleaseHistory, "android", "RN0840", undefined, false, undefined),
+        ]);
+
+        expect(staged.ios).toContain("ios-url");
+        expect(staged.ios).not.toContain("android-url");
+        expect(staged.android).toContain("android-url");
+        expect(staged.android).not.toContain("ios-url");
+    });
+
+    it("takes the file away once the config has stored the history", async () => {
+        failOnExit();
+
+        const setReleaseHistory = async (): Promise<void> => undefined;
+        await createReleaseHistory(BINARY_VERSION, setReleaseHistory, "ios", "RN0840");
+
+        expect(fs.existsSync(stagedPath("ios"))).toBe(false);
+    });
+
+    it("leaves the file behind when the config could not store the history", async () => {
+        failOnExit();
+
+        const setReleaseHistory = async (): Promise<void> => {
+            throw new Error("the storage backend rejected the history");
+        };
+
+        await expect(createReleaseHistory(BINARY_VERSION, setReleaseHistory, "ios", "RN0840")).rejects.toThrow(
+            "the command exited with code 1",
+        );
+
+        // What the release tried to store is worth reading back, so a failed release keeps
+        // its history at a path that is the same on every run.
+        expect(Object.keys(JSON.parse(fs.readFileSync(stagedPath("ios"), "utf8")))).toEqual([BINARY_VERSION]);
+    });
+});

package/cli/commands/createHistoryCommand/createReleaseHistory.ts

@@ -1,6 +1,5 @@
-import fs from "fs";
-import path from "path";
 import type { CliConfigInterface, ReleaseHistoryInterface, ReleaseInfo } from "../../../typings/react-native-code-push.d.ts";
+import { stageReleaseHistoryFile } from "../../functions/stageReleaseHistoryFile.js";
 
 export async function createReleaseHistory(
     targetVersion: string,
@@ -20,15 +19,8 @@ export async function createReleaseHistory(
     };
 
     try {
-        const JSON_FILE_NAME = `${targetVersion}.json`;
-        const JSON_FILE_PATH = path.resolve(process.cwd(), JSON_FILE_NAME);
-
-        console.log(`log: creating JSON file... ("${JSON_FILE_NAME}")\n`, JSON.stringify(INITIAL_HISTORY, null, 2));
-        fs.writeFileSync(JSON_FILE_PATH, JSON.stringify(INITIAL_HISTORY));
-
-        await setReleaseHistory(targetVersion, JSON_FILE_PATH, INITIAL_HISTORY, platform, identifier)
-
-        fs.unlinkSync(JSON_FILE_PATH);
+        await stageReleaseHistoryFile(targetVersion, INITIAL_HISTORY, platform, (jsonFilePath) =>
+            setReleaseHistory(targetVersion, jsonFilePath, INITIAL_HISTORY, platform, identifier));
     } catch (error) {
         console.error('Error occurred while creating new history:', error);
         process.exit(1)

package/cli/commands/releaseCommand/addToReleaseHistory.ts

@@ -1,6 +1,5 @@
-import path from "path";
-import fs from "fs";
 import type { CliConfigInterface } from "../../../typings/react-native-code-push.d.ts";
+import { stageReleaseHistoryFile } from "../../functions/stageReleaseHistoryFile.js";
 
 export async function addToReleaseHistory(
     appVersion: string,
@@ -51,15 +50,8 @@ export async function addToReleaseHistory(
     }
 
     try {
-        const JSON_FILE_NAME = `${binaryVersion}.json`;
-        const JSON_FILE_PATH = path.resolve(process.cwd(), JSON_FILE_NAME);
-
-        console.log(`log: creating JSON file... ("${JSON_FILE_NAME}")\n`, JSON.stringify(newReleaseHistory, null, 2));
-        fs.writeFileSync(JSON_FILE_PATH, JSON.stringify(newReleaseHistory));
-
-        await setReleaseHistory(binaryVersion, JSON_FILE_PATH, newReleaseHistory, platform, identifier)
-
-        fs.unlinkSync(JSON_FILE_PATH);
+        await stageReleaseHistoryFile(binaryVersion, newReleaseHistory, platform, (jsonFilePath) =>
+            setReleaseHistory(binaryVersion, jsonFilePath, newReleaseHistory, platform, identifier));
     } catch (error) {
         console.error('Error occurred while updating history:', error);
         process.exit(1)

package/cli/commands/releaseCommand/release.test.ts

@@ -206,9 +206,9 @@ beforeEach(() => {
 
 afterEach(() => {
     jest.restoreAllMocks();
-    // addToReleaseHistory writes its JSON next to the invocation, and only removes it
-    // when the history was stored successfully.
-    fs.rmSync(path.resolve(process.cwd(), `${BINARY_VERSION}.json`), { force: true });
+    // addToReleaseHistory writes its JSON under the directory it was invoked in, and only
+    // removes it when the history was stored successfully.
+    fs.rmSync(path.resolve(process.cwd(), "codepush-release-history"), { recursive: true, force: true });
 });
 
 describe("release without --binary-bundle-path", () => {