@capgo/capacitor-updater 6.30.0 → 6.35.0

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -400,16 +400,16 @@ public class CapgoUpdater {
 
                 if (!this.hasOldPrivateKeyPropertyInConfig && !sessionKey.isEmpty()) {
                     // V2 Encryption (publicKey)
-                    CryptoCipherV2.decryptFile(downloaded, publicKey, sessionKey);
-                    checksumDecrypted = CryptoCipherV2.decryptChecksum(checksumRes, publicKey);
-                    checksum = CryptoCipherV2.calcChecksum(downloaded);
+                    CryptoCipher.decryptFile(downloaded, publicKey, sessionKey);
+                    checksumDecrypted = CryptoCipher.decryptChecksum(checksumRes, publicKey);
+                    checksum = CryptoCipher.calcChecksum(downloaded);
                 } else if (this.hasOldPrivateKeyPropertyInConfig) {
-                    // V1 Encryption (privateKey) - deprecated but supported
-                    CryptoCipherV1.decryptFile(downloaded, privateKey, sessionKey, version);
-                    checksum = CryptoCipherV1.calcChecksum(downloaded);
-                } else {
-                    checksum = CryptoCipherV2.calcChecksum(downloaded);
+                    // V1 Encryption (privateKey) - deprecated not supported
+                    this.sendStats("checksum_fail");
+                    throw new IOException("V1 decryption is no longer supported for security reasons.");
                 }
+                CryptoCipher.logChecksumInfo("Calculated checksum", checksum);
+                CryptoCipher.logChecksumInfo("Expected checksum", checksumDecrypted);
                 if ((!checksumDecrypted.isEmpty() || !this.publicKey.isEmpty()) && !checksumDecrypted.equals(checksum)) {
                     logger.error("Error checksum '" + checksumDecrypted + "' '" + checksum + "' '");
                     this.sendStats("checksum_fail");
@@ -973,115 +973,41 @@ public class CapgoUpdater {
         makeJsonRequest(updateUrl, json, callback);
     }
 
-    public void unsetChannel(final Callback callback) {
-        // Check if rate limit was exceeded
-        if (rateLimitExceeded) {
-            logger.debug("Skipping unsetChannel due to rate limit (429). Requests will resume after app restart.");
-            final Map<String, Object> retError = new HashMap<>();
-            retError.put("message", "Rate limit exceeded");
-            retError.put("error", "rate_limit_exceeded");
-            callback.callback(retError);
-            return;
-        }
+    public void unsetChannel(
+        final SharedPreferences.Editor editor,
+        final String defaultChannelKey,
+        final String configDefaultChannel,
+        final Callback callback
+    ) {
+        // Clear persisted defaultChannel and revert to config value
+        editor.remove(defaultChannelKey);
+        editor.apply();
+        this.defaultChannel = configDefaultChannel;
+        logger.info("Persisted defaultChannel cleared, reverted to config value: " + configDefaultChannel);
+
+        Map<String, Object> ret = new HashMap<>();
+        ret.put("status", "ok");
+        ret.put("message", "Channel override removed");
+        callback.callback(ret);
+    }
 
-        String channelUrl = this.channelUrl;
-        if (channelUrl == null || channelUrl.isEmpty()) {
-            logger.error("Channel URL is not set");
+    public void setChannel(
+        final String channel,
+        final SharedPreferences.Editor editor,
+        final String defaultChannelKey,
+        final boolean allowSetDefaultChannel,
+        final Callback callback
+    ) {
+        // Check if setting defaultChannel is allowed
+        if (!allowSetDefaultChannel) {
+            logger.error("setChannel is disabled by allowSetDefaultChannel config");
             final Map<String, Object> retError = new HashMap<>();
-            retError.put("message", "channelUrl missing");
-            retError.put("error", "missing_config");
+            retError.put("message", "setChannel is disabled by configuration");
+            retError.put("error", "disabled_by_config");
             callback.callback(retError);
             return;
         }
-        JSONObject json;
-        try {
-            json = this.createInfoObject();
-        } catch (JSONException e) {
-            logger.error("Error unsetChannel JSONException " + e.getMessage());
-            final Map<String, Object> retError = new HashMap<>();
-            retError.put("message", "Cannot get info: " + e);
-            retError.put("error", "json_error");
-            callback.callback(retError);
-            return;
-        }
-
-        Request request = new Request.Builder()
-            .url(channelUrl)
-            .delete(RequestBody.create(json.toString(), MediaType.get("application/json")))
-            .build();
-
-        DownloadService.sharedClient
-            .newCall(request)
-            .enqueue(
-                new okhttp3.Callback() {
-                    @Override
-                    public void onFailure(@NonNull Call call, @NonNull IOException e) {
-                        Map<String, Object> retError = new HashMap<>();
-                        retError.put("message", "Request failed: " + e.getMessage());
-                        retError.put("error", "network_error");
-                        callback.callback(retError);
-                    }
 
-                    @Override
-                    public void onResponse(@NonNull Call call, @NonNull Response response) throws IOException {
-                        try (ResponseBody responseBody = response.body()) {
-                            // Check for 429 rate limit
-                            if (checkAndHandleRateLimitResponse(response)) {
-                                Map<String, Object> retError = new HashMap<>();
-                                retError.put("message", "Rate limit exceeded");
-                                retError.put("error", "rate_limit_exceeded");
-                                callback.callback(retError);
-                                return;
-                            }
-
-                            if (!response.isSuccessful()) {
-                                Map<String, Object> retError = new HashMap<>();
-                                retError.put("message", "Server error: " + response.code());
-                                retError.put("error", "response_error");
-                                callback.callback(retError);
-                                return;
-                            }
-
-                            assert responseBody != null;
-                            String responseData = responseBody.string();
-                            JSONObject jsonResponse = new JSONObject(responseData);
-
-                            // Check for server-side errors first
-                            if (jsonResponse.has("error")) {
-                                Map<String, Object> retError = new HashMap<>();
-                                retError.put("error", jsonResponse.getString("error"));
-                                if (jsonResponse.has("message")) {
-                                    retError.put("message", jsonResponse.getString("message"));
-                                } else {
-                                    retError.put("message", "server did not provide a message");
-                                }
-                                callback.callback(retError);
-                                return;
-                            }
-
-                            Map<String, Object> ret = new HashMap<>();
-
-                            Iterator<String> keys = jsonResponse.keys();
-                            while (keys.hasNext()) {
-                                String key = keys.next();
-                                if (jsonResponse.has(key)) {
-                                    ret.put(key, jsonResponse.get(key));
-                                }
-                            }
-                            logger.info("Channel unset");
-                            callback.callback(ret);
-                        } catch (JSONException e) {
-                            Map<String, Object> retError = new HashMap<>();
-                            retError.put("message", "JSON parse error: " + e.getMessage());
-                            retError.put("error", "parse_error");
-                            callback.callback(retError);
-                        }
-                    }
-                }
-            );
-    }
-
-    public void setChannel(final String channel, final Callback callback) {
         // Check if rate limit was exceeded
         if (rateLimitExceeded) {
             logger.debug("Skipping setChannel due to rate limit (429). Requests will resume after app restart.");
@@ -1114,7 +1040,18 @@ public class CapgoUpdater {
             return;
         }
 
-        makeJsonRequest(channelUrl, json, callback);
+        makeJsonRequest(channelUrl, json, (res) -> {
+            if (res.containsKey("error")) {
+                callback.callback(res);
+            } else {
+                // Success - persist defaultChannel
+                this.defaultChannel = channel;
+                editor.putString(defaultChannelKey, channel);
+                editor.apply();
+                logger.info("defaultChannel persisted locally: " + channel);
+                callback.callback(res);
+            }
+        });
     }
 
     public void getChannel(final Callback callback) {

package/android/src/main/java/ee/forgr/capacitor_updater/{CryptoCipherV2.java → CryptoCipher.java}

@@ -10,8 +10,6 @@ package ee.forgr.capacitor_updater;
  * Created by Awesometic
  * It's encrypt returns Base64 encoded, and also decrypt for Base64 encoded cipher
  * references: http://stackoverflow.com/questions/12471999/rsa-encryption-decryption-in-android
- *
- * V2 Encryption - uses publicKey (modern encryption from main branch)
  */
 import android.util.Base64;
 import java.io.BufferedInputStream;
@@ -37,7 +35,7 @@ import javax.crypto.SecretKey;
 import javax.crypto.spec.IvParameterSpec;
 import javax.crypto.spec.SecretKeySpec;
 
-public class CryptoCipherV2 {
+public class CryptoCipher {
 
     private static Logger logger;
 
@@ -155,10 +153,10 @@ public class CryptoCipherV2 {
             String sessionKeyB64 = ivSessionKey.split(":")[1];
             byte[] iv = Base64.decode(ivB64.getBytes(), Base64.DEFAULT);
             byte[] sessionKey = Base64.decode(sessionKeyB64.getBytes(), Base64.DEFAULT);
-            PublicKey pKey = CryptoCipherV2.stringToPublicKey(publicKey);
-            byte[] decryptedSessionKey = CryptoCipherV2.decryptRSA(sessionKey, pKey);
+            PublicKey pKey = CryptoCipher.stringToPublicKey(publicKey);
+            byte[] decryptedSessionKey = CryptoCipher.decryptRSA(sessionKey, pKey);
 
-            SecretKey sKey = CryptoCipherV2.byteToSessionKey(decryptedSessionKey);
+            SecretKey sKey = CryptoCipher.byteToSessionKey(decryptedSessionKey);
             byte[] content = new byte[(int) file.length()];
 
             try (
@@ -168,7 +166,7 @@ public class CryptoCipherV2 {
             ) {
                 dis.readFully(content);
                 dis.close();
-                byte[] decrypted = CryptoCipherV2.decryptAES(content, sKey, iv);
+                byte[] decrypted = CryptoCipher.decryptAES(content, sKey, iv);
                 // write the decrypted string to the file
                 try (final FileOutputStream fos = new FileOutputStream(file.getAbsolutePath())) {
                     fos.write(decrypted);
@@ -200,14 +198,26 @@ public class CryptoCipherV2 {
             // Determine if input is hex or base64 encoded
             // Hex strings only contain 0-9 and a-f, while base64 contains other characters
             byte[] checksumBytes;
+            String detectedFormat;
             if (checksum.matches("^[0-9a-fA-F]+$")) {
                 // Hex encoded (new format from CLI for plugin versions >= 5.30.0, 6.30.0, 7.30.0)
                 checksumBytes = hexStringToByteArray(checksum);
+                detectedFormat = "hex";
             } else {
                 // TODO: remove backwards compatibility
                 // Base64 encoded (old format for backwards compatibility)
                 checksumBytes = Base64.decode(checksum, Base64.DEFAULT);
+                detectedFormat = "base64";
             }
+            logger.debug(
+                "Received encrypted checksum format: " +
+                    detectedFormat +
+                    " (length: " +
+                    checksum.length() +
+                    " chars, " +
+                    checksumBytes.length +
+                    " bytes)"
+            );
             PublicKey pKey = CryptoCipher.stringToPublicKey(publicKey);
             byte[] decryptedChecksum = CryptoCipher.decryptRSA(checksumBytes, pKey);
             // Return as hex string to match calcChecksum output format
@@ -217,13 +227,75 @@ public class CryptoCipherV2 {
                 if (hex.length() == 1) hexString.append('0');
                 hexString.append(hex);
             }
-            return hexString.toString();
+            String result = hexString.toString();
+
+            // Detect checksum algorithm based on length
+            String detectedAlgorithm;
+            if (decryptedChecksum.length == 32) {
+                detectedAlgorithm = "SHA-256";
+            } else if (decryptedChecksum.length == 4) {
+                detectedAlgorithm = "CRC32 (deprecated)";
+                logger.error(
+                    "CRC32 checksum detected. This algorithm is deprecated and no longer supported. Please update your CLI to use SHA-256 checksums."
+                );
+            } else {
+                detectedAlgorithm = "unknown (" + decryptedChecksum.length + " bytes)";
+                logger.error(
+                    "Unknown checksum algorithm detected with " + decryptedChecksum.length + " bytes. Expected SHA-256 (32 bytes)."
+                );
+            }
+            logger.debug(
+                "Decrypted checksum: " +
+                    detectedAlgorithm +
+                    " hex format (length: " +
+                    result.length() +
+                    " chars, " +
+                    decryptedChecksum.length +
+                    " bytes)"
+            );
+            return result;
         } catch (GeneralSecurityException e) {
             logger.error("decryptChecksum fail: " + e.getMessage());
             throw new IOException("Decryption failed: " + e.getMessage());
         }
     }
 
+    /**
+     * Detect checksum algorithm based on hex string length.
+     * SHA-256 = 64 hex chars (32 bytes)
+     * CRC32 = 8 hex chars (4 bytes)
+     */
+    public static String detectChecksumAlgorithm(String hexChecksum) {
+        if (hexChecksum == null || hexChecksum.isEmpty()) {
+            return "empty";
+        }
+        int len = hexChecksum.length();
+        if (len == 64) {
+            return "SHA-256";
+        } else if (len == 8) {
+            return "CRC32 (deprecated)";
+        } else {
+            return "unknown (" + len + " hex chars)";
+        }
+    }
+
+    /**
+     * Log checksum info and warn if deprecated algorithm detected.
+     */
+    public static void logChecksumInfo(String label, String hexChecksum) {
+        String algorithm = detectChecksumAlgorithm(hexChecksum);
+        logger.debug(label + ": " + algorithm + " hex format (length: " + hexChecksum.length() + " chars)");
+        if (algorithm.contains("CRC32")) {
+            logger.error(
+                "CRC32 checksum detected. This algorithm is deprecated and no longer supported. Please update your CLI to use SHA-256 checksums."
+            );
+        } else if (algorithm.contains("unknown")) {
+            logger.error(
+                "Unknown checksum algorithm detected. Expected SHA-256 (64 hex chars) but got " + hexChecksum.length() + " chars."
+            );
+        }
+    }
+
     public static String calcChecksum(File file) {
         final int BUFFER_SIZE = 1024 * 1024 * 5; // 5 MB buffer size
         MessageDigest digest;

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -293,7 +293,7 @@ public class DownloadService extends Worker {
 
                 if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
                     try {
-                        fileHash = CryptoCipherV2.decryptChecksum(fileHash, publicKey);
+                        fileHash = CryptoCipher.decryptChecksum(fileHash, publicKey);
                     } catch (Exception e) {
                         logger.error("Error decrypting checksum for " + fileName + "fileHash: " + fileHash);
                         hasError.set(true);
@@ -302,7 +302,12 @@ public class DownloadService extends Worker {
                 }
 
                 final String finalFileHash = fileHash;
-                File targetFile = new File(destFolder, fileName);
+
+                // Check if file is a Brotli file and remove .br extension from target
+                boolean isBrotli = fileName.endsWith(".br");
+                String targetFileName = isBrotli ? fileName.substring(0, fileName.length() - 3) : fileName;
+
+                File targetFile = new File(destFolder, targetFileName);
                 File cacheFile = new File(cacheFolder, finalFileHash + "_" + new File(fileName).getName());
                 File builtinFile = new File(builtinFolder, fileName);
 
@@ -313,6 +318,7 @@ public class DownloadService extends Worker {
                     continue;
                 }
 
+                final boolean finalIsBrotli = isBrotli;
                 Future<?> future = executor.submit(() -> {
                     try {
                         if (builtinFile.exists() && verifyChecksum(builtinFile, finalFileHash)) {
@@ -322,7 +328,7 @@ public class DownloadService extends Worker {
                             copyFile(cacheFile, targetFile);
                             logger.debug("already cached " + fileName);
                         } else {
-                            downloadAndVerify(downloadUrl, targetFile, cacheFile, finalFileHash, sessionKey, publicKey);
+                            downloadAndVerify(downloadUrl, targetFile, cacheFile, finalFileHash, sessionKey, publicKey, finalIsBrotli);
                         }
 
                         long completed = completedFiles.incrementAndGet();
@@ -572,98 +578,103 @@ public class DownloadService extends Worker {
         File cacheFile,
         String expectedHash,
         String sessionKey,
-        String publicKey
+        String publicKey,
+        boolean isBrotli
     ) throws Exception {
         logger.debug("downloadAndVerify " + downloadUrl);
 
         Request request = new Request.Builder().url(downloadUrl).build();
 
-        // Check if file is a Brotli file
-        boolean isBrotli = targetFile.getName().endsWith(".br");
-
-        // Create final target file with .br extension removed if it's a Brotli file
-        File finalTargetFile = isBrotli
-            ? new File(targetFile.getParentFile(), targetFile.getName().substring(0, targetFile.getName().length() - 3))
-            : targetFile;
+        // targetFile is already the final destination without .br extension
+        File finalTargetFile = targetFile;
 
         // Create a temporary file for the compressed data
         File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".tmp");
 
-        try (Response response = sharedClient.newCall(request).execute()) {
-            if (!response.isSuccessful()) {
-                sendStatsAsync("download_manifest_file_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
-                throw new IOException("Unexpected response code: " + response.code());
-            }
+        try {
+            try (Response response = sharedClient.newCall(request).execute()) {
+                if (!response.isSuccessful()) {
+                    sendStatsAsync("download_manifest_file_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
+                    throw new IOException("Unexpected response code: " + response.code());
+                }
 
-            // Download compressed file atomically
-            ResponseBody responseBody = response.body();
-            if (responseBody == null) {
-                throw new IOException("Response body is null");
-            }
+                // Download compressed file atomically
+                ResponseBody responseBody = response.body();
+                if (responseBody == null) {
+                    throw new IOException("Response body is null");
+                }
 
-            // Use OkIO for atomic write
-            writeFileAtomic(compressedFile, responseBody.byteStream(), null);
+                // Use OkIO for atomic write
+                writeFileAtomic(compressedFile, responseBody.byteStream(), null);
 
-            if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
-                logger.debug("Decrypting file " + targetFile.getName());
-                CryptoCipherV2.decryptFile(compressedFile, publicKey, sessionKey);
-            }
+                if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                    logger.debug("Decrypting file " + targetFile.getName());
+                    CryptoCipher.decryptFile(compressedFile, publicKey, sessionKey);
+                }
 
-            // Only decompress if file has .br extension
-            if (isBrotli) {
-                // Use new decompression method with atomic write
-                try (FileInputStream fis = new FileInputStream(compressedFile)) {
-                    byte[] compressedData = new byte[(int) compressedFile.length()];
-                    fis.read(compressedData);
-                    byte[] decompressedData;
-                    try {
-                        decompressedData = decompressBrotli(compressedData, targetFile.getName());
-                    } catch (IOException e) {
-                        sendStatsAsync(
-                            "download_manifest_brotli_fail",
-                            getInputData().getString(VERSION) + ":" + finalTargetFile.getName()
-                        );
-                        throw e;
-                    }
+                // Only decompress if file has .br extension
+                if (isBrotli) {
+                    // Use new decompression method with atomic write
+                    try (FileInputStream fis = new FileInputStream(compressedFile)) {
+                        byte[] compressedData = new byte[(int) compressedFile.length()];
+                        fis.read(compressedData);
+                        byte[] decompressedData;
+                        try {
+                            decompressedData = decompressBrotli(compressedData, targetFile.getName());
+                        } catch (IOException e) {
+                            sendStatsAsync(
+                                "download_manifest_brotli_fail",
+                                getInputData().getString(VERSION) + ":" + finalTargetFile.getName()
+                            );
+                            throw e;
+                        }
 
-                    // Write decompressed data atomically
-                    try (java.io.ByteArrayInputStream bais = new java.io.ByteArrayInputStream(decompressedData)) {
-                        writeFileAtomic(finalTargetFile, bais, null);
+                        // Write decompressed data atomically
+                        try (java.io.ByteArrayInputStream bais = new java.io.ByteArrayInputStream(decompressedData)) {
+                            writeFileAtomic(finalTargetFile, bais, null);
+                        }
+                    }
+                } else {
+                    // Just copy the file without decompression using atomic operation
+                    try (FileInputStream fis = new FileInputStream(compressedFile)) {
+                        writeFileAtomic(finalTargetFile, fis, null);
                     }
                 }
-            } else {
-                // Just copy the file without decompression using atomic operation
-                try (FileInputStream fis = new FileInputStream(compressedFile)) {
-                    writeFileAtomic(finalTargetFile, fis, null);
-                }
-            }
 
-            // Delete the compressed file
-            compressedFile.delete();
-            String calculatedHash = CryptoCipherV2.calcChecksum(finalTargetFile);
-
-            // Verify checksum
-            if (calculatedHash.equals(expectedHash)) {
-                // Only cache if checksum is correct - use atomic copy
-                try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
-                    writeFileAtomic(cacheFile, fis, expectedHash);
+                // Delete the compressed file
+                compressedFile.delete();
+                String calculatedHash = CryptoCipher.calcChecksum(finalTargetFile);
+                CryptoCipher.logChecksumInfo("Calculated checksum", calculatedHash);
+                CryptoCipher.logChecksumInfo("Expected checksum", expectedHash);
+
+                // Verify checksum
+                if (calculatedHash.equals(expectedHash)) {
+                    // Only cache if checksum is correct - use atomic copy
+                    try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
+                        writeFileAtomic(cacheFile, fis, expectedHash);
+                    }
+                } else {
+                    finalTargetFile.delete();
+                    sendStatsAsync("download_manifest_checksum_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
+                    throw new IOException(
+                        "Checksum verification failed for: " +
+                            downloadUrl +
+                            " " +
+                            targetFile.getName() +
+                            " expected: " +
+                            expectedHash +
+                            " calculated: " +
+                            calculatedHash
+                    );
                 }
-            } else {
-                finalTargetFile.delete();
-                sendStatsAsync("download_manifest_checksum_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
-                throw new IOException(
-                    "Checksum verification failed for: " +
-                        downloadUrl +
-                        " " +
-                        targetFile.getName() +
-                        " expected: " +
-                        expectedHash +
-                        " calculated: " +
-                        calculatedHash
-                );
             }
         } catch (Exception e) {
             throw new IOException("Error in downloadAndVerify: " + e.getMessage());
+        } finally {
+            // Always cleanup the compressed temp file if it still exists
+            if (compressedFile.exists()) {
+                compressedFile.delete();
+            }
         }
     }
 
@@ -769,7 +780,7 @@ public class DownloadService extends Worker {
 
             // Verify checksum if provided
             if (expectedChecksum != null && !expectedChecksum.isEmpty()) {
-                String actualChecksum = CryptoCipherV2.calcChecksum(tempFile);
+                String actualChecksum = CryptoCipher.calcChecksum(tempFile);
                 if (!expectedChecksum.equalsIgnoreCase(actualChecksum)) {
                     tempFile.delete();
                     throw new IOException("Checksum verification failed");