@bravemobile/react-native-code-push 13.1.0-beta.4 → 13.1.0-beta.6

package/android/app/src/test/java/com/microsoft/codepush/react/CodePushUpdateManagerDownloadTest.java

@@ -2,9 +2,11 @@ package com.microsoft.codepush.react;
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
+import org.json.JSONException;
 import org.json.JSONObject;
 import org.junit.After;
 import org.junit.Before;
@@ -90,7 +92,7 @@ public class CodePushUpdateManagerDownloadTest {
     }
 
     @Test
-    public void installsAnUpdateFromItsBinaryPatchArchive() throws IOException {
+    public void installsAnUpdateFromItsBinaryPatchArchive() throws IOException, JSONException {
         String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
         String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
 
@@ -102,7 +104,12 @@ public class CodePushUpdateManagerDownloadTest {
         assertInstalledContents();
         assertEquals("applied", patchResult.optString("status", null));
         assertFalse("an applied patch has nothing to report a reason for", patchResult.has("fallbackReason"));
-        assertTrue("the apply is timed", patchResult.optLong("applyDurationMs", -1) >= 0);
+        assertTrue("the whole path is timed", patchResult.optLong("totalDurationMs", -1) >= 0);
+        assertFalse("the result no longer carries a top level apply time", patchResult.has("applyDurationMs"));
+
+        JSONObject appliedAttempt = patchResult.getJSONArray("attempts").getJSONObject(0);
+        assertTrue("an applied attempt carries its apply time", appliedAttempt.has("applyDurationMs"));
+        assertTrue(appliedAttempt.optLong("applyDurationMs", -1) >= 0);
     }
 
     @Test
@@ -116,22 +123,73 @@ public class CodePushUpdateManagerDownloadTest {
 
         assertEquals(Arrays.asList("/patch.zip", "/full.zip"), mServer.requestedPaths());
         assertInstalledContents();
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_INVALID_MANIFEST);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_INVALID_MANIFEST);
     }
 
     @Test
     public void reportsAnInvalidManifestWhenThePatchUrlDoesNotServeAnArchive() throws IOException {
         String patchUrl = serve("/patch.zip", ERROR_PAGE);
 
-        BinaryPatchResult result = updateManager(applierWriting(TARGET_BUNDLE)).downloadAndInstallPackage(
+        ArchiveRestoreResult result = updateManager(applierWriting(TARGET_BUNDLE)).downloadAndInstallPackage(
                 updatePackage("https://example.test/unused.zip", patchUrl), BUNDLE_FILE_NAME, ignoreProgress(),
-                patchUrl, true, new BinaryPatchAttempt());
+                patchUrl, true, new ArchiveAttemptLog());
 
         assertFalse(result.succeeded());
-        assertEquals(BinaryPatchResult.REASON_INVALID_MANIFEST, result.getFailureReason());
+        assertEquals(ArchiveRestoreResult.REASON_INVALID_MANIFEST, result.getFailureReason());
         assertFalse("bytes that are not an update must not reach the package folder", mPackageFolder.exists());
     }
 
+    @Test
+    public void failsTheDownloadWhenTheServerAnswersTheArchiveWithAnErrorStatus() throws IOException {
+        // Nothing is served at this path, so the server answers it with a 404.
+        String fullUrl = mServer.urlOf("/missing-full.zip");
+
+        try {
+            updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                    fullUpdatePackage(mPackageHash, fullUrl), BUNDLE_FILE_NAME, ignoreProgress());
+            fail("a download the server refused must not be reported as installed");
+        } catch (CodePushHttpException e) {
+            assertEquals(404, e.getStatusCode());
+            assertTrue("the message names the status the server answered with",
+                    e.getMessage().contains("404"));
+        }
+
+        assertFalse("nothing the server refused reaches the package folder", mPackageFolder.exists());
+    }
+
+    @Test
+    public void givesUpTheDownloadWhenThePatchArchiveArrivesShort() throws IOException {
+        // The connection carried part of the body and stopped. The full archive is behind
+        // the same connection and is larger, so there is nothing to fall back to.
+        byte[] patchArchive = zipOf(patchArchiveContents());
+        String patchUrl = mServer.serveClaimingLength("/patch.zip", patchArchive, patchArchive.length + 1024);
+        String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
+
+        try {
+            updateManager(applierWriting(TARGET_BUNDLE))
+                    .downloadPackage(updatePackage(fullUrl, patchUrl), BUNDLE_FILE_NAME, ignoreProgress());
+            fail("a download that stopped short must not be reported as installed");
+        } catch (IOException e) {
+            assertEquals(CodePushErrorCode.NETWORK, CodePushErrorCode.of(e));
+        }
+
+        assertEquals("the full archive is behind the connection that just stopped",
+                Arrays.asList("/patch.zip"), mServer.requestedPaths());
+        assertFalse("nothing that arrived short reaches the package folder", mPackageFolder.exists());
+    }
+
+    @Test
+    public void installsAnUpdateTheServerSentWithoutDeclaringItsLength() throws IOException {
+        // `getContentLength()` answers -1 for a body sent with no `Content-Length`, which no
+        // read total matches - so a download checked against it anyway could never arrive.
+        String fullUrl = mServer.serveWithoutContentLength("/full.zip", zipOf(fullArchiveContents()));
+
+        updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                fullUpdatePackage(mPackageHash, fullUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertInstalledContents();
+    }
+
     @Test
     public void fallsBackToTheFullArchiveWhenApplyingThePatchRunsOutOfMemory() throws IOException {
         String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
@@ -167,7 +225,7 @@ public class CodePushUpdateManagerDownloadTest {
 
         assertEquals(Arrays.asList("/patch.zip", "/full.zip"), mServer.requestedPaths());
         assertInstalledContents();
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_PACKAGE_VERIFICATION_FAILED);
     }
 
     @Test
@@ -204,7 +262,7 @@ public class CodePushUpdateManagerDownloadTest {
                 .downloadPackage(updatePackage(updateHash, fullUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
 
         assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/full.zip"), mServer.requestedPaths());
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_PACKAGE_VERIFICATION_FAILED);
         assertInstalledContents(updateHash, updateContents);
     }
 
@@ -221,10 +279,177 @@ public class CodePushUpdateManagerDownloadTest {
                 .downloadPackage(updatePackage(updateHash, fullUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
 
         assertEquals(Arrays.asList("/diff.zip", "/full.zip"), mServer.requestedPaths());
-        assertFallbackResult(patchResult, BinaryPatchResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertFallbackResult(patchResult, ArchiveRestoreResult.REASON_PACKAGE_VERIFICATION_FAILED);
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void fallsBackToThePatchArchiveWhenTheInstalledPackageIsGoneFromDisk() throws IOException {
+        // The metadata still names the installed update, but its files are gone: the merge
+        // has nothing to read, which is a failure of the merge itself rather than of its
+        // result - and the one failure the patch archive, carrying every asset, is not
+        // implicated in.
+        installBaseUpdate();
+        FileUtils.deleteDirectoryAtPath(new File(
+                new File(mDocumentsDirectory, CodePushConstants.CODE_PUSH_FOLDER_PREFIX),
+                packageHashOf(installedArchiveContents())).getAbsolutePath());
+
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip", zipOf(assetDiffArchiveContents(DROPPED_ASSET_PATH)));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(ArchiveRestoreResult.REASON_ASSET_MERGE_FAILED,
+                patchResult.optJSONArray("attempts").optJSONObject(0).optString("fallbackReason", null));
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void fallsBackToThePatchArchiveWhenTheAssetDiffManifestCannotBeParsed() throws IOException {
+        // Bytes that are not JSON leave nothing to read the deletions out of, so the merge
+        // has no way to know what it was supposed to delete - a failure of the merge itself.
+        installBaseUpdate();
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip",
+                zipOf(assetDiffArchiveContentsWithManifest(bytes("{\"deletedFiles\":"))));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(ArchiveRestoreResult.REASON_ASSET_MERGE_FAILED,
+                patchResult.optJSONArray("attempts").optJSONObject(0).optString("fallbackReason", null));
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void fallsBackToThePatchArchiveWhenTheAssetDiffManifestDoesNotNameTheFilesToDelete() throws IOException {
+        // A manifest without the key is not a manifest with nothing to delete: the CLI always
+        // writes it, an empty list included, so its absence says the manifest is not the one
+        // the release published - and merging past it would leave behind files the update
+        // dropped.
+        installBaseUpdate();
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip", zipOf(assetDiffArchiveContentsWithManifest(bytes("{}"))));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/installed.zip", "/diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(ArchiveRestoreResult.REASON_ASSET_MERGE_FAILED,
+                patchResult.optJSONArray("attempts").optJSONObject(0).optString("fallbackReason", null));
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void triesThePatchArchiveWhenTheServerDoesNotServeTheAssetDiff() throws IOException {
+        // A 404 is a verdict on the URL it was asked of. Diffs are published one per recent
+        // version and are the first thing a retention policy clears out, while the patch
+        // archive at its own URL stays - so nothing about a diff that is gone says the patch
+        // archive is.
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = mServer.urlOf("/missing-diff.zip");
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals("the full archive is not downloaded when the patch archive installs",
+                Arrays.asList("/missing-diff.zip", "/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(2, patchResult.optJSONArray("attempts").length());
+        assertInstalledContents(updateHash, updateContents);
+    }
+
+    @Test
+    public void skipsThePatchArchiveWhenTheAssetDiffFailsInItsBundlePatch() throws IOException {
+        // Both archives carry that patch byte for byte, so an applier that refused it here
+        // would refuse it there - and trying it would put a second doomed download in front
+        // of the full one.
+        Map<String, byte[]> updateContents = assetDiffTargetContents();
+        String updateHash = packageHashOf(updateContents);
+        String diffUrl = serve("/diff.zip", zipOf(assetDiffArchiveContents(DROPPED_ASSET_PATH)));
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContentsForAssetDiffTarget()));
+        String fullUrl = serve("/full.zip", zipOf(updateContents));
+
+        JSONObject patchResult = updateManager(applierRefusingThePatch()).downloadPackage(
+                updatePackageWithAssetDiff(updateHash, fullUrl, patchUrl, diffUrl), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals(Arrays.asList("/diff.zip", "/full.zip"), mServer.requestedPaths());
+        assertEquals(1, patchResult.optJSONArray("attempts").length());
         assertInstalledContents(updateHash, updateContents);
     }
 
+    @Test
+    public void givesUpTheDownloadWhenTheNetworkCannotCarryTheAssetDiff() throws IOException {
+        // A refused connection is the network failing rather than a verdict on the archive,
+        // and the archives behind it are behind the same network - the full one only larger
+        // and started over from nothing.
+        String unreachableDiffUrl = "http://127.0.0.1:" + portNothingListensOn() + "/diff.zip";
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
+        String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
+
+        try {
+            updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                    updatePackageWithAssetDiff(mPackageHash, fullUrl, patchUrl, unreachableDiffUrl),
+                    BUNDLE_FILE_NAME, ignoreProgress());
+            fail("a network that carried nothing must not be reported as an installed update");
+        } catch (IOException e) {
+            assertEquals(CodePushErrorCode.NETWORK, CodePushErrorCode.of(e));
+        }
+
+        assertTrue("no archive behind the same network is asked for", mServer.requestedPaths().isEmpty());
+        assertFalse("nothing that never arrived reaches the package folder", mPackageFolder.exists());
+    }
+
+
+    /** A loopback port that is opened only to be closed, so connecting to it is refused. */
+    private static int portNothingListensOn() throws IOException {
+        ServerSocket socket = new ServerSocket(0, 0, InetAddress.getByName("127.0.0.1"));
+        int port = socket.getLocalPort();
+        socket.close();
+        return port;
+    }
+
+    @Test
+    public void installsFromThePatchArchiveWhenTheAssetDiffUrlIsAnEmptyString() throws IOException {
+        // An empty slot is not an archive on offer. Attempting it would fail for want of a
+        // URL and leave no verdict behind, which is what skips the patch archive - so the
+        // update would be downloaded in full with a perfectly good patch archive untried.
+        String patchUrl = serve("/patch.zip", zipOf(patchArchiveContents()));
+        String fullUrl = serve("/full.zip", zipOf(fullArchiveContents()));
+
+        JSONObject patchResult = updateManager(applierWriting(TARGET_BUNDLE)).downloadPackage(
+                updatePackageWithAssetDiff(mPackageHash, fullUrl, patchUrl, ""), BUNDLE_FILE_NAME, ignoreProgress());
+
+        assertEquals("the empty diff slot is not downloaded and does not cost the patch archive its try",
+                Arrays.asList("/patch.zip"), mServer.requestedPaths());
+        assertEquals("applied", patchResult.optString("status", null));
+        assertEquals("binary-patch", patchResult.optString("archive", null));
+        assertEquals(1, patchResult.optJSONArray("attempts").length());
+        assertInstalledContents();
+    }
+
     @Test
     public void leavesAFileOutsideThePackageFolderAloneWhenTheAssetDiffManifestNamesIt() throws IOException {
         // A manifest entry that climbs out of the package folder: the client is not the one
@@ -287,7 +512,8 @@ public class CodePushUpdateManagerDownloadTest {
     private static void assertFallbackResult(JSONObject patchResult, String expectedReason) {
         assertEquals("fallback", patchResult.optString("status", null));
         assertEquals(expectedReason, patchResult.optString("fallbackReason", null));
-        assertTrue("the attempt is timed", patchResult.optLong("applyDurationMs", -1) >= 0);
+        assertTrue("the whole path is timed", patchResult.optLong("totalDurationMs", -1) >= 0);
+        assertFalse("the result no longer carries a top level apply time", patchResult.has("applyDurationMs"));
     }
 
     /** The installed update is the full archive's contents, whichever archive it came from. */
@@ -307,7 +533,7 @@ public class CodePushUpdateManagerDownloadTest {
         // How the update was downloaded says nothing about the update, so it is not part of
         // what the update is installed from and outlives the download in no file.
         assertFalse("the patch attempt reached the stored metadata",
-                metadata.has(CodePushConstants.BINARY_PATCH_RESULT_KEY));
+                metadata.has(CodePushConstants.UPDATE_ARCHIVE_RESULT_KEY));
 
         File binaryPatchFolder = new File(
                 new File(mDocumentsDirectory, CodePushConstants.CODE_PUSH_FOLDER_PREFIX),
@@ -378,6 +604,16 @@ public class CodePushUpdateManagerDownloadTest {
         return new CodePushUpdateManager(mDocumentsDirectory, binaryPatch);
     }
 
+    /** An applier that refuses the bundle patch, which every archive of a release carries. */
+    private static CodePushBinaryPatch.PatchApplier applierRefusingThePatch() {
+        return new CodePushBinaryPatch.PatchApplier() {
+            @Override
+            public int apply(byte[] base, byte[] patch, String outputPath, long expectedTargetSize) {
+                return RESULT_APPLY_FAILED;
+            }
+        };
+    }
+
     private static CodePushBinaryPatch.PatchApplier applierWriting(final byte[] restoredBundle) {
         return new CodePushBinaryPatch.PatchApplier() {
             @Override
@@ -437,11 +673,16 @@ public class CodePushUpdateManagerDownloadTest {
      * holds unchanged is not shipped at all - the client copies it over.
      */
     private Map<String, byte[]> assetDiffArchiveContents(String deletedAssetPath) {
+        return assetDiffArchiveContentsWithManifest(
+                bytes("{\"deletedFiles\":[\"" + CONTENTS_DIR_NAME + "/" + deletedAssetPath + "\"]}"));
+    }
+
+    /** The same archive carrying a manifest of its own, which is how one the CLI did not write arrives. */
+    private Map<String, byte[]> assetDiffArchiveContentsWithManifest(byte[] manifest) {
         Map<String, byte[]> contents = patchArchiveContents();
         contents.remove(CONTENTS_DIR_NAME + "/" + ASSET_PATH);
         contents.put(CONTENTS_DIR_NAME + "/" + ADDED_ASSET_PATH, ADDED_ASSET);
-        contents.put(CodePushConstants.DIFF_MANIFEST_FILE_NAME,
-                bytes("{\"deletedFiles\":[\"" + CONTENTS_DIR_NAME + "/" + deletedAssetPath + "\"]}"));
+        contents.put(CodePushConstants.DIFF_MANIFEST_FILE_NAME, manifest);
         return contents;
     }
 
@@ -453,6 +694,13 @@ public class CodePushUpdateManagerDownloadTest {
         return contents;
     }
 
+    /** The patch archive of the release the asset diff belongs to: every asset, no merge. */
+    private Map<String, byte[]> patchArchiveContentsForAssetDiffTarget() {
+        Map<String, byte[]> contents = patchArchiveContents();
+        contents.put(CONTENTS_DIR_NAME + "/" + ADDED_ASSET_PATH, ADDED_ASSET);
+        return contents;
+    }
+
     /** What an asset diff has to add up to: the contents of the update's full archive. */
     private Map<String, byte[]> assetDiffTargetContents() {
         Map<String, byte[]> contents = fullArchiveContents();
@@ -470,6 +718,14 @@ public class CodePushUpdateManagerDownloadTest {
         return updatePackage;
     }
 
+    /** A release offering all three archives, the diff in the slot of its own the JS fills. */
+    private JSONObject updatePackageWithAssetDiff(String packageHash, String downloadUrl,
+                                                  String binaryPatchDownloadUrl, String assetDiffDownloadUrl) {
+        JSONObject updatePackage = updatePackage(packageHash, downloadUrl, binaryPatchDownloadUrl);
+        CodePushUtils.setJSONValueForKey(updatePackage, CodePushConstants.ASSET_DIFF_DOWNLOAD_URL_KEY, assetDiffDownloadUrl);
+        return updatePackage;
+    }
+
     /** A release with no second archive to try, so it is downloaded in full. */
     private JSONObject fullUpdatePackage(String packageHash, String downloadUrl) {
         JSONObject updatePackage = new JSONObject();
@@ -491,7 +747,10 @@ public class CodePushUpdateManagerDownloadTest {
     private static class TestArchiveServer {
 
         private final ServerSocket mSocket;
+        private static final long NO_CONTENT_LENGTH = -1;
+
         private final Map<String, byte[]> mBodies = new HashMap<>();
+        private final Map<String, Long> mDeclaredLengths = new HashMap<>();
         private final List<String> mRequestedPaths = Collections.synchronizedList(new ArrayList<String>());
 
         TestArchiveServer() throws IOException {
@@ -508,6 +767,23 @@ public class CodePushUpdateManagerDownloadTest {
 
         synchronized String serve(String path, byte[] body) {
             mBodies.put(path, body);
+            return urlOf(path);
+        }
+
+        /** Serves a body under a `Content-Length` of the server's choosing rather than its own. */
+        synchronized String serveClaimingLength(String path, byte[] body, long declaredLength) {
+            mBodies.put(path, body);
+            mDeclaredLengths.put(path, declaredLength);
+            return urlOf(path);
+        }
+
+        /** Serves a body with no `Content-Length` at all, which the client reads until it closes. */
+        synchronized String serveWithoutContentLength(String path, byte[] body) {
+            return serveClaimingLength(path, body, NO_CONTENT_LENGTH);
+        }
+
+        /** The URL of a path this server answers - with a 404, when nothing is served there. */
+        String urlOf(String path) {
             return "http://127.0.0.1:" + mSocket.getLocalPort() + path;
         }
 
@@ -557,8 +833,17 @@ public class CodePushUpdateManagerDownloadTest {
             if (body == null) {
                 response.write(bytes("HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"));
             } else {
-                response.write(bytes("HTTP/1.1 200 OK\r\nContent-Length: " + body.length
-                        + "\r\nConnection: close\r\n\r\n"));
+                Long declaredLength = declaredLengthFor(path);
+                if (declaredLength == null) {
+                    response.write(bytes("HTTP/1.1 200 OK\r\nContent-Length: " + body.length
+                            + "\r\nConnection: close\r\n\r\n"));
+                } else if (declaredLength == NO_CONTENT_LENGTH) {
+                    response.write(bytes("HTTP/1.1 200 OK\r\nConnection: close\r\n\r\n"));
+                } else {
+                    response.write(bytes("HTTP/1.1 200 OK\r\nContent-Length: " + declaredLength
+                            + "\r\nConnection: close\r\n\r\n"));
+                }
+
                 response.write(body);
             }
             response.flush();
@@ -573,6 +858,10 @@ public class CodePushUpdateManagerDownloadTest {
         private synchronized byte[] bodyFor(String path) {
             return mBodies.get(path);
         }
+
+        private synchronized Long declaredLengthFor(String path) {
+            return mDeclaredLengths.get(path);
+        }
     }
 
     private static byte[] zipOf(Map<String, byte[]> contents) throws IOException {

package/cli/commands/buildPatchToolsCommand/buildPatchTools.test.ts

@@ -0,0 +1,118 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+import { buildPatchTools, hashBuildScript } from "./buildPatchTools.js";
+
+/**
+ * The command is a thin wrapper around the build script this package ships. What it has
+ * to get right is what it hands the script: the directory the CLI will later look in, and
+ * `--force` when asked. A script that records what it was handed proves both without
+ * cloning and compiling HDiffPatch. The shipped script is run once at the end, against an
+ * install it already finds complete, to show the wrapper speaks its actual interface.
+ */
+
+const REPO_ROOT = path.resolve(__dirname, "..", "..", "..");
+const SHIPPED_BUILD_SCRIPT = path.join(REPO_ROOT, "scripts", "binary-patch", "build-hdiffpatch.sh");
+/** Where `jest.globalSetup.ts` built the tools for this run. */
+const INSTALLED_TOOLS_DIR = process.env.HDIFFPATCH_TOOLS_DIR || path.join(REPO_ROOT, ".hdiffpatch-tools");
+
+let workDir: string;
+
+beforeEach(() => {
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "build-patch-tools-"));
+});
+
+afterEach(() => {
+    fs.rmSync(workDir, { recursive: true, force: true });
+});
+
+function writeScript(body: string): string {
+    const scriptPath = path.join(workDir, "build.sh");
+    fs.writeFileSync(scriptPath, `#!/bin/sh\n${body}\n`, { mode: 0o755 });
+    return scriptPath;
+}
+
+/** A script that writes the install directory it was given, then each argument, one per line. */
+function writeRecordingScript(): string {
+    return writeScript('printf \'%s\\n\' "$HDIFFPATCH_TOOLS_DIR" "$@" > "$HDIFFPATCH_TOOLS_DIR/invocation"');
+}
+
+function readInvocation(toolsDir: string): string[] {
+    return fs.readFileSync(path.join(toolsDir, "invocation"), "utf8").trimEnd().split("\n");
+}
+
+describe("buildPatchTools", () => {
+    it("runs the build script against the tools directory it was given, without forcing a rebuild", () => {
+        const toolsDir = path.join(workDir, "tools");
+        fs.mkdirSync(toolsDir);
+
+        buildPatchTools({ buildScriptPath: writeRecordingScript(), toolsDir, force: false });
+
+        expect(readInvocation(toolsDir)).toEqual([toolsDir]);
+    });
+
+    it("asks the build script to rebuild when forced", () => {
+        const toolsDir = path.join(workDir, "tools");
+        fs.mkdirSync(toolsDir);
+
+        buildPatchTools({ buildScriptPath: writeRecordingScript(), toolsDir, force: true });
+
+        expect(readInvocation(toolsDir)).toEqual([toolsDir, "--force"]);
+    });
+
+    it("fails with the exit code when the build script fails", () => {
+        const buildScriptPath = writeScript("exit 3");
+
+        expect(() => buildPatchTools({ buildScriptPath, toolsDir: workDir, force: false })).toThrow(/exit code 3/);
+    });
+
+    it("fails naming the script when it cannot be started", () => {
+        const buildScriptPath = path.join(workDir, "no-such-script.sh");
+
+        expect(() => buildPatchTools({ buildScriptPath, toolsDir: workDir, force: false })).toThrow(
+            /no-such-script\.sh/,
+        );
+    });
+
+    it("succeeds against an install the shipped script already finds complete", () => {
+        // Without an install the shipped script clones and compiles for minutes, and
+        // `spawnSync` holds the worker past any jest timeout. `jest.globalSetup.ts`
+        // provides the install; this says so when it did not.
+        const missing = ["hdiffz", "hpatchz"].filter((tool) => !fs.existsSync(path.join(INSTALLED_TOOLS_DIR, tool)));
+        if (missing.length > 0) {
+            throw new Error(
+                `${missing.join(", ")} not installed in ${INSTALLED_TOOLS_DIR}: jest.globalSetup.ts should have built the tools first`,
+            );
+        }
+
+        expect(() =>
+            buildPatchTools({ buildScriptPath: SHIPPED_BUILD_SCRIPT, toolsDir: INSTALLED_TOOLS_DIR, force: false }),
+        ).not.toThrow();
+    });
+});
+
+/**
+ * A CI cache of the installed tools is keyed by this hash, so it has to stay the same for as
+ * long as the script would build the same tools, and change as soon as it would not.
+ */
+describe("hashBuildScript", () => {
+    it("hashes two scripts with the same contents to the same hex digest", () => {
+        const first = path.join(workDir, "first.sh");
+        const second = path.join(workDir, "second.sh");
+        fs.writeFileSync(first, "#!/bin/sh\nHDIFFPATCH_TAG=v5.1.3\n");
+        fs.writeFileSync(second, "#!/bin/sh\nHDIFFPATCH_TAG=v5.1.3\n");
+
+        expect(hashBuildScript(first)).toBe(hashBuildScript(second));
+        expect(hashBuildScript(first)).toMatch(/^[0-9a-f]{64}$/);
+    });
+
+    it("hashes a script whose pinned version changed to a different value", () => {
+        const before = path.join(workDir, "before.sh");
+        const after = path.join(workDir, "after.sh");
+        fs.writeFileSync(before, "#!/bin/sh\nHDIFFPATCH_TAG=v5.1.3\n");
+        fs.writeFileSync(after, "#!/bin/sh\nHDIFFPATCH_TAG=v5.1.4\n");
+
+        expect(hashBuildScript(after)).not.toBe(hashBuildScript(before));
+    });
+});

package/cli/commands/buildPatchToolsCommand/buildPatchTools.ts

@@ -0,0 +1,46 @@
+import { spawnSync } from "child_process";
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import { TOOLS_DIR_ENV_NAME } from "../../utils/binaryPatch.js";
+
+interface BuildPatchToolsOptions {
+    /** The `build-hdiffpatch.sh` this package ships. */
+    buildScriptPath: string;
+    /** Where the script installs `hdiffz` and `hpatchz`. It has to be a place the CLI looks in. */
+    toolsDir: string;
+    /** Rebuild even when both tools are already there. */
+    force: boolean;
+}
+
+/**
+ * Runs the build script with the install directory the caller chose.
+ *
+ * The script's output goes straight to the terminal: a first build clones and compiles
+ * HDiffPatch, which takes minutes, and a silent wait would look like a hang. So when the
+ * script fails, its own message has already been shown, and the error raised here only
+ * has to say that it did.
+ */
+export function buildPatchTools({ buildScriptPath, toolsDir, force }: BuildPatchToolsOptions): void {
+    const result = spawnSync(buildScriptPath, force ? ['--force'] : [], {
+        stdio: 'inherit',
+        env: { ...process.env, [TOOLS_DIR_ENV_NAME]: toolsDir },
+    });
+
+    if (result.error) {
+        throw new Error(`failed to run ${buildScriptPath}: ${result.error.message}`);
+    }
+    if (result.status !== 0) {
+        const reason = result.status === null ? `signal ${result.signal}` : `exit code ${result.status}`;
+        throw new Error(`${path.basename(buildScriptPath)} failed with ${reason}`);
+    }
+}
+
+/**
+ * SHA-256 of the build script's bytes, for keying a CI cache of the installed tools. The
+ * script pins the sources and the build flags, so it changes whenever the tools it would
+ * build do.
+ */
+export function hashBuildScript(buildScriptPath: string): string {
+    return crypto.createHash('sha256').update(fs.readFileSync(buildScriptPath)).digest('hex');
+}

package/cli/commands/buildPatchToolsCommand/index.ts

@@ -0,0 +1,44 @@
+import path from "path";
+import { fileURLToPath } from "url";
+import { program } from "commander";
+import { TOOLS_DIR_ENV_NAME, TOOLS_DIR_NAME } from "../../utils/binaryPatch.js";
+import { buildPatchTools, hashBuildScript } from "./buildPatchTools.js";
+
+type Options = {
+    toolsDir: string;
+    force: boolean;
+    printHash: boolean;
+}
+
+/**
+ * The CLI runs compiled, from `cli/dist/commands/buildPatchToolsCommand/`, which puts the
+ * package root - and the script shipped under it - four levels up.
+ */
+const BUILD_SCRIPT_PATH = fileURLToPath(
+    new URL("../../../../scripts/binary-patch/build-hdiffpatch.sh", import.meta.url),
+);
+
+/**
+ * Installs where `release` will look: `HDIFFPATCH_TOOLS_DIR` when it is set, and otherwise
+ * a `.hdiffpatch-tools` directory in the working directory, the first place the lookup
+ * checks before walking up.
+ */
+const DEFAULT_TOOLS_DIR = process.env[TOOLS_DIR_ENV_NAME] || path.resolve(process.cwd(), TOOLS_DIR_NAME);
+
+program.command('build-patch-tools')
+    .description('Builds hdiffz and hpatchz from source and installs them where `release --binary-bundle-path` looks for them.\nThe build clones the pinned HDiffPatch sources, so it needs git, make, a C/C++ compiler and network access. It does nothing when the tools are already installed.')
+    .option('--tools-dir <path>', 'directory to install the tools into', DEFAULT_TOOLS_DIR)
+    .option('--force', 'rebuild even when the tools are already installed', false)
+    .option('--print-hash', 'print a hash of the build script, for keying a CI cache of the tools, and exit without building', false)
+    .action((options: Options) => {
+        if (options.printHash) {
+            console.log(hashBuildScript(BUILD_SCRIPT_PATH));
+            return;
+        }
+
+        buildPatchTools({
+            buildScriptPath: BUILD_SCRIPT_PATH,
+            toolsDir: path.resolve(options.toolsDir),
+            force: options.force,
+        });
+    });