@capgo/capacitor-updater 6.34.0 → 6.37.0

package/README.md

@@ -66,6 +66,8 @@ The most complete [documentation here](https://capgo.app/docs/).
 ## Community
 Join the [discord](https://discord.gg/VnYRvBfgA6) to get help.
 
+## Migration to v8
+
 ## Migration to v7.34
 
 - **Channel storage change**: `setChannel()` now stores channel assignments locally on the device instead of in the cloud. This provides better offline support and reduces backend load.
@@ -76,13 +78,15 @@ Join the [discord](https://discord.gg/VnYRvBfgA6) to get help.
 
 ## Migration to v7
 
-- `privateKey` is not available anymore, it was used for the old encryption method. to migrate follow this guide : [https://capgo.app/docs/plugin/cloud-mode/getting-started/](https://capgo.app/docs/cli/migrations/encryption/)
-- To capacitor v7 : [https://capacitorjs.com/docs/updating/7-0](https://capacitorjs.com/docs/updating/7-0)
+The min version of IOS is now 15.5 instead of 15 as Capacitor 8 requirement.
+This is due to bump of ZipArchive to latest, a key dependency of this project is the zlib library. zlib before version 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches according to [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/cve-2018-25032).
+zlib is a native library so we need to bump the minimum iOS version to 15.5 as ZipArchive did the same in their latest versions.
 
 ## Compatibility
 
 | Plugin version | Capacitor compatibility | Maintained        |
 | -------------- | ----------------------- | ----------------- |
+| v8.\*.\*       | v8.\*.\*                | Beta                 |
 | v7.\*.\*       | v7.\*.\*                | ✅                 |
 | v6.\*.\*       | v6.\*.\*                | ✅                 |
 | v5.\*.\*       | v5.\*.\*                | ⚠️ Deprecated |
@@ -256,7 +260,7 @@ CapacitorUpdater can be configured with these options:
 | **`autoDeleteFailed`**        | <code>boolean</code>                                          | Configure whether the plugin should use automatically delete failed bundles. Only available for Android and iOS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | <code>true</code>                                                             |         |
 | **`autoDeletePrevious`**      | <code>boolean</code>                                          | Configure whether the plugin should use automatically delete previous bundles after a successful update. Only available for Android and iOS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | <code>true</code>                                                             |         |
 | **`autoUpdate`**              | <code>boolean</code>                                          | Configure whether the plugin should use Auto Update via an update server. Only available for Android and iOS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | <code>true</code>                                                             |         |
-| **`resetWhenUpdate`**         | <code>boolean</code>                                          | Automatically delete previous downloaded bundles when a newer native app bundle is installed to the device. Only available for Android and iOS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | <code>true</code>                                                             |         |
+| **`resetWhenUpdate`**         | <code>boolean</code>                                          | Automatically delete previous downloaded bundles when a newer native app bundle is installed to the device. Setting this to false can broke the auto update flow if the user download from the store a native app bundle that is older than the current downloaded bundle. Upload will be prevented by channel setting downgrade_under_native. Only available for Android and iOS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                | <code>true</code>                                                             |         |
 | **`updateUrl`**               | <code>string</code>                                           | Configure the URL / endpoint to which update checks are sent. Only available for Android and iOS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | <code>https://plugin.capgo.app/updates</code>                                 |         |
 | **`channelUrl`**              | <code>string</code>                                           | Configure the URL / endpoint for channel operations. Only available for Android and iOS.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | <code>https://plugin.capgo.app/channel_self</code>                            |         |
 | **`statsUrl`**                | <code>string</code>                                           | Configure the URL / endpoint to which update statistics are sent. Only available for Android and iOS. Set to "" to disable stats reporting.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | <code>https://plugin.capgo.app/stats</code>                                   |         |
@@ -295,7 +299,7 @@ In `capacitor.config.json`:
 {
   "plugins": {
     "CapacitorUpdater": {
-      "appReadyTimeout": 1000 // (1 second),
+      "appReadyTimeout": 1000 // (1 second, minimum 1000),
       "responseTimeout": 10 // (10 second),
       "autoDeleteFailed": false,
       "autoDeletePrevious": false,
@@ -345,7 +349,7 @@ import { CapacitorConfig } from '@capacitor/cli';
 const config: CapacitorConfig = {
   plugins: {
     CapacitorUpdater: {
-      appReadyTimeout: 1000 // (1 second),
+      appReadyTimeout: 1000 // (1 second, minimum 1000),
       responseTimeout: 10 // (10 second),
       autoDeleteFailed: false,
       autoDeletePrevious: false,
@@ -1771,6 +1775,8 @@ If you don't use backend, you need to provide the URL and version of the bundle.
 | **`old`**        | <code>string</code>          | The previous/current version name (provided for reference).                                                                                                                                                   |        |
 | **`url`**        | <code>string</code>          | Download URL for the bundle (when a new version is available).                                                                                                                                                |        |
 | **`manifest`**   | <code>ManifestEntry[]</code> | File list for partial updates (when using multi-file downloads).                                                                                                                                              | 6.1    |
+| **`link`**       | <code>string</code>          | Optional link associated with this bundle version (e.g., release notes URL, changelog, GitHub release).                                                                                                       | 7.35.0 |
+| **`comment`**    | <code>string</code>          | Optional comment or description for this bundle version.                                                                                                                                                      | 7.35.0 |
 
 
 ##### GetLatestOptions

package/android/src/main/java/ee/forgr/capacitor_updater/BundleInfo.java

@@ -29,25 +29,53 @@ public class BundleInfo {
     private final String version;
     private final String checksum;
     private final BundleStatus status;
+    private final String link;
+    private final String comment;
 
     static {
         sdf.setTimeZone(TimeZone.getTimeZone("GMT"));
     }
 
     public BundleInfo(final BundleInfo source) {
-        this(source.id, source.version, source.status, source.downloaded, source.checksum);
+        this(source.id, source.version, source.status, source.downloaded, source.checksum, source.link, source.comment);
     }
 
     public BundleInfo(final String id, final String version, final BundleStatus status, final Date downloaded, final String checksum) {
-        this(id, version, status, sdf.format(downloaded), checksum);
+        this(id, version, status, sdf.format(downloaded), checksum, null, null);
+    }
+
+    public BundleInfo(
+        final String id,
+        final String version,
+        final BundleStatus status,
+        final Date downloaded,
+        final String checksum,
+        final String link,
+        final String comment
+    ) {
+        this(id, version, status, sdf.format(downloaded), checksum, link, comment);
     }
 
     public BundleInfo(final String id, final String version, final BundleStatus status, final String downloaded, final String checksum) {
+        this(id, version, status, downloaded, checksum, null, null);
+    }
+
+    public BundleInfo(
+        final String id,
+        final String version,
+        final BundleStatus status,
+        final String downloaded,
+        final String checksum,
+        final String link,
+        final String comment
+    ) {
         this.downloaded = downloaded != null ? downloaded.trim() : "";
         this.id = id != null ? id : "";
         this.version = version;
         this.checksum = checksum != null ? checksum : "";
         this.status = status != null ? status : BundleStatus.ERROR;
+        this.link = link;
+        this.comment = comment;
     }
 
     public Boolean isBuiltin() {
@@ -75,7 +103,7 @@ public class BundleInfo {
     }
 
     public BundleInfo setDownloaded(Date downloaded) {
-        return new BundleInfo(this.id, this.version, this.status, downloaded, this.checksum);
+        return new BundleInfo(this.id, this.version, this.status, downloaded, this.checksum, this.link, this.comment);
     }
 
     public String getChecksum() {
@@ -83,7 +111,7 @@ public class BundleInfo {
     }
 
     public BundleInfo setChecksum(String checksum) {
-        return new BundleInfo(this.id, this.version, this.status, this.downloaded, checksum);
+        return new BundleInfo(this.id, this.version, this.status, this.downloaded, checksum, this.link, this.comment);
     }
 
     public String getId() {
@@ -91,7 +119,7 @@ public class BundleInfo {
     }
 
     public BundleInfo setId(String id) {
-        return new BundleInfo(id, this.version, this.status, this.downloaded, this.checksum);
+        return new BundleInfo(id, this.version, this.status, this.downloaded, this.checksum, this.link, this.comment);
     }
 
     public String getVersionName() {
@@ -99,7 +127,7 @@ public class BundleInfo {
     }
 
     public BundleInfo setVersionName(String version) {
-        return new BundleInfo(this.id, version, this.status, this.downloaded, this.checksum);
+        return new BundleInfo(this.id, version, this.status, this.downloaded, this.checksum, this.link, this.comment);
     }
 
     public BundleStatus getStatus() {
@@ -110,7 +138,23 @@ public class BundleInfo {
     }
 
     public BundleInfo setStatus(BundleStatus status) {
-        return new BundleInfo(this.id, this.version, status, this.downloaded, this.checksum);
+        return new BundleInfo(this.id, this.version, status, this.downloaded, this.checksum, this.link, this.comment);
+    }
+
+    public String getLink() {
+        return this.link;
+    }
+
+    public BundleInfo setLink(String link) {
+        return new BundleInfo(this.id, this.version, this.status, this.downloaded, this.checksum, link, this.comment);
+    }
+
+    public String getComment() {
+        return this.comment;
+    }
+
+    public BundleInfo setComment(String comment) {
+        return new BundleInfo(this.id, this.version, this.status, this.downloaded, this.checksum, this.link, comment);
     }
 
     public static BundleInfo fromJSON(final String jsonString) throws JSONException {
@@ -120,7 +164,9 @@ public class BundleInfo {
             json.has("version") ? json.getString("version") : BundleInfo.VERSION_UNKNOWN,
             json.has("status") ? BundleStatus.fromString(json.getString("status")) : BundleStatus.PENDING,
             json.has("downloaded") ? json.getString("downloaded") : "",
-            json.has("checksum") ? json.getString("checksum") : ""
+            json.has("checksum") ? json.getString("checksum") : "",
+            json.has("link") ? json.getString("link") : null,
+            json.has("comment") ? json.getString("comment") : null
         );
     }
 
@@ -131,6 +177,12 @@ public class BundleInfo {
         result.put("downloaded", this.getDownloaded());
         result.put("checksum", this.getChecksum());
         result.put("status", this.getStatus().toString());
+        if (this.link != null && !this.link.isEmpty()) {
+            result.put("link", this.link);
+        }
+        if (this.comment != null && !this.comment.isEmpty()) {
+            result.put("comment", this.comment);
+        }
         return result;
     }
 

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -72,7 +72,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private static final String[] BREAKING_EVENT_NAMES = { "breakingAvailable", "majorAvailable" };
     private static final String LAST_FAILED_BUNDLE_PREF_KEY = "CapacitorUpdater.lastFailedBundle";
 
-    private final String pluginVersion = "6.27.11";
+    private final String pluginVersion = "6.37.0";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;
@@ -111,6 +111,11 @@ public class CapacitorUpdaterPlugin extends Plugin {
     //  private static final CountDownLatch semaphoreReady = new CountDownLatch(1);
     private static final Phaser semaphoreReady = new Phaser(1);
 
+    // Lock to ensure cleanup completes before downloads start
+    private final Object cleanupLock = new Object();
+    private volatile boolean cleanupComplete = false;
+    private volatile Thread cleanupThread = null;
+
     private int lastNotifiedStatPercent = 0;
 
     private DelayUpdateUtils delayUpdateUtils;
@@ -304,10 +309,11 @@ public class CapacitorUpdaterPlugin extends Plugin {
         this.persistCustomId = this.getConfig().getBoolean("persistCustomId", false);
         this.persistModifyUrl = this.getConfig().getBoolean("persistModifyUrl", false);
         this.allowSetDefaultChannel = this.getConfig().getBoolean("allowSetDefaultChannel", true);
-        this.implementation.publicKey = this.getConfig().getString("publicKey", "");
-        this.implementation.privateKey = this.getConfig().getString("privateKey", "");
-        if (this.implementation.privateKey != null && !this.implementation.privateKey.isEmpty()) {
-            this.implementation.hasOldPrivateKeyPropertyInConfig = true;
+        this.implementation.setPublicKey(this.getConfig().getString("publicKey", ""));
+        // Log public key prefix if encryption is enabled
+        String keyId = this.implementation.getKeyId();
+        if (keyId != null && !keyId.isEmpty()) {
+            logger.info("Public key prefix: " + keyId);
         }
         this.implementation.statsUrl = this.getConfig().getString("statsUrl", statsUrlDefault);
         this.implementation.channelUrl = this.getConfig().getString("channelUrl", channelUrlDefault);
@@ -381,7 +387,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
             }
         }
         this.autoUpdate = this.getConfig().getBoolean("autoUpdate", true);
-        this.appReadyTimeout = this.getConfig().getInt("appReadyTimeout", 10000);
+        this.appReadyTimeout = Math.max(1000, this.getConfig().getInt("appReadyTimeout", 10000)); // Minimum 1 second
         this.keepUrlPathAfterReload = this.getConfig().getBoolean("keepUrlPathAfterReload", false);
         this.syncKeepUrlPathFlag(this.keepUrlPathAfterReload);
         this.allowManualBundleError = this.getConfig().getBoolean("allowManualBundleError", false);
@@ -700,37 +706,80 @@ public class CapacitorUpdaterPlugin extends Plugin {
     }
 
     private void cleanupObsoleteVersions() {
-        startNewThread(() -> {
-            try {
-                final String previous = this.prefs.getString("LatestNativeBuildVersion", "");
-                if (!"".equals(previous) && !Objects.equals(this.currentBuildVersion, previous)) {
-                    logger.info("New native build version detected: " + this.currentBuildVersion);
-                    this.implementation.reset(true);
-                    final List<BundleInfo> installed = this.implementation.list(false);
-                    for (final BundleInfo bundle : installed) {
-                        try {
-                            logger.info("Deleting obsolete bundle: " + bundle.getId());
-                            this.implementation.delete(bundle.getId());
-                        } catch (final Exception e) {
-                            logger.error("Failed to delete: " + bundle.getId() + " " + e.getMessage());
+        cleanupThread = startNewThread(() -> {
+            synchronized (cleanupLock) {
+                try {
+                    final String previous = this.prefs.getString("LatestNativeBuildVersion", "");
+                    if (!"".equals(previous) && !Objects.equals(this.currentBuildVersion, previous)) {
+                        logger.info("New native build version detected: " + this.currentBuildVersion);
+                        this.implementation.reset(true);
+                        final List<BundleInfo> installed = this.implementation.list(false);
+                        for (final BundleInfo bundle : installed) {
+                            // Check if thread was interrupted (cancelled)
+                            if (Thread.currentThread().isInterrupted()) {
+                                logger.warn("Cleanup was cancelled, stopping");
+                                return;
+                            }
+                            try {
+                                logger.info("Deleting obsolete bundle: " + bundle.getId());
+                                this.implementation.delete(bundle.getId());
+                            } catch (final Exception e) {
+                                logger.error("Failed to delete: " + bundle.getId() + " " + e.getMessage());
+                            }
                         }
-                    }
-                    final List<BundleInfo> storedBundles = this.implementation.list(true);
-                    final Set<String> allowedIds = new HashSet<>();
-                    for (final BundleInfo info : storedBundles) {
-                        if (info != null && info.getId() != null && !info.getId().isEmpty()) {
-                            allowedIds.add(info.getId());
+                        final List<BundleInfo> storedBundles = this.implementation.list(true);
+                        final Set<String> allowedIds = new HashSet<>();
+                        for (final BundleInfo info : storedBundles) {
+                            if (info != null && info.getId() != null && !info.getId().isEmpty()) {
+                                allowedIds.add(info.getId());
+                            }
                         }
+                        this.implementation.cleanupDownloadDirectories(allowedIds, Thread.currentThread());
+
+                        // Check again before the expensive delta cache cleanup
+                        if (Thread.currentThread().isInterrupted()) {
+                            logger.warn("Cleanup was cancelled before delta cache cleanup");
+                            return;
+                        }
+                        this.implementation.cleanupDeltaCache(Thread.currentThread());
                     }
-                    this.implementation.cleanupDownloadDirectories(allowedIds);
-                    this.implementation.cleanupDeltaCache();
+                    this.editor.putString("LatestNativeBuildVersion", this.currentBuildVersion);
+                    this.editor.apply();
+                } catch (Exception e) {
+                    logger.error("Error during cleanupObsoleteVersions: " + e.getMessage());
+                } finally {
+                    cleanupComplete = true;
+                    logger.info("Cleanup complete");
                 }
-                this.editor.putString("LatestNativeBuildVersion", this.currentBuildVersion);
-                this.editor.apply();
-            } catch (Exception e) {
-                logger.error("Error during cleanupObsoleteVersions: " + e.getMessage());
             }
         });
+
+        // Start a timeout watchdog thread to cancel cleanup if it takes too long
+        final long timeout = this.appReadyTimeout / 2;
+        startNewThread(() -> {
+            try {
+                Thread.sleep(timeout);
+                if (cleanupThread != null && cleanupThread.isAlive() && !cleanupComplete) {
+                    logger.warn("Cleanup timeout exceeded (" + timeout + "ms), interrupting cleanup thread");
+                    cleanupThread.interrupt();
+                }
+            } catch (InterruptedException e) {
+                // Watchdog thread was interrupted, that's fine
+            }
+        });
+    }
+
+    private void waitForCleanupIfNeeded() {
+        if (cleanupComplete) {
+            return; // Already done, no need to wait
+        }
+
+        logger.info("Waiting for cleanup to complete before starting download...");
+
+        // Wait for cleanup to complete - blocks until lock is released
+        synchronized (cleanupLock) {
+            logger.info("Cleanup finished, proceeding with download");
+        }
     }
 
     public void notifyDownload(final String id, final int percent) {
@@ -1678,6 +1727,8 @@ public class CapacitorUpdaterPlugin extends Plugin {
             ? "Update will occur now."
             : "Update will occur next time app moves to background.";
         return startNewThread(() -> {
+            // Wait for cleanup to complete before starting download
+            waitForCleanupIfNeeded();
             logger.info("Check for update via: " + CapacitorUpdaterPlugin.this.updateUrl);
             try {
                 CapacitorUpdaterPlugin.this.implementation.getLatest(CapacitorUpdaterPlugin.this.updateUrl, null, (res) -> {

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -83,6 +83,9 @@ public class CapgoUpdater {
     public String deviceID = "";
     public int timeout = 20000;
 
+    // Cached key ID calculated once from publicKey
+    private String cachedKeyId = "";
+
     // Flag to track if we received a 429 response - stops requests until app restart
     private static volatile boolean rateLimitExceeded = false;
 
@@ -147,6 +150,19 @@ public class CapgoUpdater {
         return sb.toString();
     }
 
+    public void setPublicKey(String publicKey) {
+        this.publicKey = publicKey;
+        if (!publicKey.isEmpty()) {
+            this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
+        } else {
+            this.cachedKeyId = "";
+        }
+    }
+
+    public String getKeyId() {
+        return this.cachedKeyId;
+    }
+
     private File unzip(final String id, final File zipFile, final String dest) throws IOException {
         final File targetDirectory = new File(this.documentsDir, dest);
         try (
@@ -485,11 +501,20 @@ public class CapgoUpdater {
     }
 
     private void deleteDirectory(final File file) throws IOException {
+        deleteDirectory(file, null);
+    }
+
+    private void deleteDirectory(final File file, final Thread threadToCheck) throws IOException {
+        // Check if thread was interrupted (cancelled)
+        if (threadToCheck != null && threadToCheck.isInterrupted()) {
+            throw new IOException("Operation cancelled");
+        }
+
         if (file.isDirectory()) {
             final File[] entries = file.listFiles();
             if (entries != null) {
                 for (final File entry : entries) {
-                    this.deleteDirectory(entry);
+                    this.deleteDirectory(entry, threadToCheck);
                 }
             }
         }
@@ -499,6 +524,10 @@ public class CapgoUpdater {
     }
 
     public void cleanupDeltaCache() {
+        cleanupDeltaCache(null);
+    }
+
+    public void cleanupDeltaCache(final Thread threadToCheck) {
         if (this.activity == null) {
             logger.warn("Activity is null, skipping delta cache cleanup");
             return;
@@ -508,7 +537,7 @@ public class CapgoUpdater {
             return;
         }
         try {
-            this.deleteDirectory(cacheFolder);
+            this.deleteDirectory(cacheFolder, threadToCheck);
             logger.info("Cleaned up delta cache folder");
         } catch (IOException e) {
             logger.error("Failed to cleanup delta cache: " + e.getMessage());
@@ -516,6 +545,10 @@ public class CapgoUpdater {
     }
 
     public void cleanupDownloadDirectories(final Set<String> allowedIds) {
+        cleanupDownloadDirectories(allowedIds, null);
+    }
+
+    public void cleanupDownloadDirectories(final Set<String> allowedIds, final Thread threadToCheck) {
         if (this.documentsDir == null) {
             logger.warn("Documents directory is null, skipping download cleanup");
             return;
@@ -529,6 +562,12 @@ public class CapgoUpdater {
         final File[] entries = bundleRoot.listFiles();
         if (entries != null) {
             for (final File entry : entries) {
+                // Check if thread was interrupted (cancelled)
+                if (threadToCheck != null && threadToCheck.isInterrupted()) {
+                    logger.warn("cleanupDownloadDirectories was cancelled");
+                    return;
+                }
+
                 if (!entry.isDirectory()) {
                     continue;
                 }
@@ -540,7 +579,7 @@ public class CapgoUpdater {
                 }
 
                 try {
-                    this.deleteDirectory(entry);
+                    this.deleteDirectory(entry, threadToCheck);
                     this.removeBundleInfo(id);
                     logger.info("Deleted orphan bundle directory: " + id);
                 } catch (IOException e) {
@@ -811,6 +850,12 @@ public class CapgoUpdater {
         json.put("is_emulator", this.isEmulator());
         json.put("is_prod", this.isProd());
         json.put("defaultChannel", this.defaultChannel);
+
+        // Add encryption key ID if encryption is enabled (use cached value)
+        if (!this.cachedKeyId.isEmpty()) {
+            json.put("key_id", this.cachedKeyId);
+        }
+
         return json;
     }
 

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipher.java

@@ -359,4 +359,23 @@ public class CryptoCipher {
 
         throw new IllegalArgumentException("size too large, only up to 64KiB length encoding supported: " + size);
     }
+
+    /**
+     * Get first 4 characters of the public key for identification.
+     * Returns 4-character string or empty string if key is invalid/empty.
+     */
+    public static String calcKeyId(String publicKey) {
+        if (publicKey == null || publicKey.isEmpty()) {
+            return "";
+        }
+
+        // Remove PEM headers and whitespace to get the raw key data
+        String cleanedKey = publicKey
+            .replaceAll("\\s+", "")
+            .replace("-----BEGINRSAPUBLICKEY-----", "")
+            .replace("-----ENDRSAPUBLICKEY-----", "");
+
+        // Return first 4 characters of the base64-encoded key
+        return cleanedKey.length() >= 4 ? cleanedKey.substring(0, 4) : cleanedKey;
+    }
 }