@capgo/capacitor-updater 6.41.1 → 6.42.9

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -7,7 +7,6 @@
 package ee.forgr.capacitor_updater;
 
 import android.app.Activity;
-import android.app.ActivityManager;
 import android.content.Context;
 import android.content.Intent;
 import android.content.SharedPreferences;
@@ -71,7 +70,7 @@ import org.json.JSONObject;
 @CapacitorPlugin(name = "CapacitorUpdater")
 public class CapacitorUpdaterPlugin extends Plugin {
 
-    private final Logger logger = new Logger("CapgoUpdater");
+    private Logger logger;
 
     private static final String updateUrlDefault = "https://plugin.capgo.app/updates";
     private static final String statsUrlDefault = "https://plugin.capgo.app/stats";
@@ -85,7 +84,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private static final String[] BREAKING_EVENT_NAMES = { "breakingAvailable", "majorAvailable" };
     private static final String LAST_FAILED_BUNDLE_PREF_KEY = "CapacitorUpdater.lastFailedBundle";
 
-    private final String pluginVersion = "6.41.1";
+    private final String pluginVersion = "6.42.9";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;
@@ -116,6 +115,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private Boolean allowManualBundleError = false;
     private Boolean allowSetDefaultChannel = true;
 
+    // Used for activity-based foreground/background detection on Android < 14
     private Boolean isPreviousMainActivity = true;
 
     private volatile Thread backgroundDownloadTask;
@@ -138,6 +138,9 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private FrameLayout splashscreenLoaderOverlay;
     private Runnable splashscreenTimeoutRunnable;
 
+    // App lifecycle observer using ProcessLifecycleOwner for reliable foreground/background detection
+    private AppLifecycleObserver appLifecycleObserver;
+
     // Play Store In-App Updates
     private AppUpdateManager appUpdateManager;
     private AppUpdateInfo cachedAppUpdateInfo;
@@ -216,6 +219,13 @@ public class CapacitorUpdaterPlugin extends Plugin {
     @Override
     public void load() {
         super.load();
+
+        // Initialize logger with osLogging config
+        // Default to true for both platforms to enable system logging by default
+        boolean osLogging = this.getConfig().getBoolean("osLogging", true);
+        Logger.Options loggerOptions = new Logger.Options(osLogging);
+        this.logger = new Logger("CapgoUpdater", loggerOptions);
+
         this.prefs = this.getContext().getSharedPreferences(WebView.WEBVIEW_PREFS_NAME, Activity.MODE_PRIVATE);
         this.editor = this.prefs.edit();
 
@@ -431,6 +441,31 @@ public class CapacitorUpdaterPlugin extends Plugin {
         this.delayUpdateUtils.checkCancelDelay(DelayUpdateUtils.CancelDelaySource.KILLED);
 
         this.checkForUpdateAfterDelay();
+
+        // On Android 14+ (API 34+), topActivity in RecentTaskInfo returns null due to
+        // security restrictions (StrandHogg task hijacking mitigations). Use ProcessLifecycleOwner
+        // for reliable app-level foreground/background detection on these versions.
+        // On older versions, we use the traditional activity lifecycle callbacks in handleOnStart/handleOnStop.
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            this.appLifecycleObserver = new AppLifecycleObserver(
+                new AppLifecycleObserver.AppLifecycleListener() {
+                    @Override
+                    public void onAppMovedToForeground() {
+                        CapacitorUpdaterPlugin.this.appMovedToForeground();
+                    }
+
+                    @Override
+                    public void onAppMovedToBackground() {
+                        CapacitorUpdaterPlugin.this.appMovedToBackground();
+                    }
+                },
+                logger
+            );
+            this.appLifecycleObserver.register();
+            logger.info("Using ProcessLifecycleOwner for foreground/background detection (Android 14+)");
+        } else {
+            logger.info("Using activity lifecycle callbacks for foreground/background detection (Android <14)");
+        }
     }
 
     private void semaphoreWait(Number waitTime) {
@@ -2081,6 +2116,9 @@ public class CapacitorUpdaterPlugin extends Plugin {
     }
 
     public void appMovedToBackground() {
+        // Reset timeout flag at start of each background cycle
+        this.autoSplashscreenTimedOut = false;
+
         final BundleInfo current = CapacitorUpdaterPlugin.this.implementation.getCurrentBundle();
 
         // Show splashscreen FIRST, before any other background work to ensure launcher shows it
@@ -2129,16 +2167,22 @@ public class CapacitorUpdaterPlugin extends Plugin {
         }
     }
 
+    /**
+     * Check if the current activity is the main activity.
+     * Used for activity-based foreground/background detection on Android < 14.
+     * On Android 14+, topActivity returns null due to security restrictions, so we use
+     * ProcessLifecycleOwner instead.
+     */
     private boolean isMainActivity() {
         try {
             Context mContext = this.getContext();
-            ActivityManager activityManager = (ActivityManager) mContext.getSystemService(Context.ACTIVITY_SERVICE);
-            List<ActivityManager.AppTask> runningTasks = activityManager.getAppTasks();
+            android.app.ActivityManager activityManager = (android.app.ActivityManager) mContext.getSystemService(Context.ACTIVITY_SERVICE);
+            java.util.List<android.app.ActivityManager.AppTask> runningTasks = activityManager.getAppTasks();
             if (runningTasks.isEmpty()) {
                 return false;
             }
-            ActivityManager.RecentTaskInfo runningTask = runningTasks.get(0).getTaskInfo();
-            String className = Objects.requireNonNull(runningTask.baseIntent.getComponent()).getClassName();
+            android.app.ActivityManager.RecentTaskInfo runningTask = runningTasks.get(0).getTaskInfo();
+            String className = java.util.Objects.requireNonNull(runningTask.baseIntent.getComponent()).getClassName();
             if (runningTask.topActivity == null) {
                 return false;
             }
@@ -2152,12 +2196,17 @@ public class CapacitorUpdaterPlugin extends Plugin {
     @Override
     public void handleOnStart() {
         try {
-            if (isPreviousMainActivity) {
-                logger.info("handleOnStart: appMovedToForeground");
-                this.appMovedToForeground();
-            }
             logger.info("handleOnStart: onActivityStarted " + getActivity().getClass().getName());
-            isPreviousMainActivity = true;
+
+            // On Android < 14, use activity lifecycle for foreground detection
+            // On Android 14+, ProcessLifecycleOwner handles this via AppLifecycleObserver
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                if (isPreviousMainActivity) {
+                    logger.info("handleOnStart: appMovedToForeground (Android <14 path)");
+                    this.appMovedToForeground();
+                }
+                isPreviousMainActivity = true;
+            }
 
             // Initialize shake menu if enabled and activity is BridgeActivity
             if (shakeMenuEnabled && getActivity() instanceof com.getcapacitor.BridgeActivity && shakeMenu == null) {
@@ -2176,10 +2225,16 @@ public class CapacitorUpdaterPlugin extends Plugin {
     @Override
     public void handleOnStop() {
         try {
-            isPreviousMainActivity = isMainActivity();
-            if (isPreviousMainActivity) {
-                logger.info("handleOnStop: appMovedToBackground");
-                this.appMovedToBackground();
+            logger.info("handleOnStop: onActivityStopped");
+
+            // On Android < 14, use activity lifecycle for background detection
+            // On Android 14+, ProcessLifecycleOwner handles this via AppLifecycleObserver
+            if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+                isPreviousMainActivity = isMainActivity();
+                if (isPreviousMainActivity) {
+                    logger.info("handleOnStop: appMovedToBackground (Android <14 path)");
+                    this.appMovedToBackground();
+                }
             }
         } catch (Exception e) {
             logger.error("Failed to run handleOnStop: " + e.getMessage());
@@ -2604,6 +2659,17 @@ public class CapacitorUpdaterPlugin extends Plugin {
                     logger.error("Failed to clean up shake menu: " + e.getMessage());
                 }
             }
+
+            // Clean up app lifecycle observer
+            if (appLifecycleObserver != null) {
+                try {
+                    appLifecycleObserver.unregister();
+                    appLifecycleObserver = null;
+                    logger.info("AppLifecycleObserver cleaned up");
+                } catch (Exception e) {
+                    logger.error("Failed to clean up AppLifecycleObserver: " + e.getMessage());
+                }
+            }
         } catch (Exception e) {
             logger.error("Failed to run handleOnDestroy: " + e.getMessage());
         }

package/android/src/main/java/ee/forgr/capacitor_updater/CapgoUpdater.java

@@ -35,8 +35,11 @@ import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.TimeUnit;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
@@ -93,6 +96,12 @@ public class CapgoUpdater {
     // Flag to track if we've already sent the rate limit statistic - prevents infinite loop
     private static volatile boolean rateLimitStatisticSent = false;
 
+    // Stats batching - queue events and send max once per second
+    private final List<JSONObject> statsQueue = new CopyOnWriteArrayList<>();
+    private final ScheduledExecutorService statsScheduler = Executors.newSingleThreadScheduledExecutor();
+    private ScheduledFuture<?> statsFlushTask = null;
+    private static final long STATS_FLUSH_INTERVAL_MS = 1000;
+
     private final Map<String, CompletableFuture<BundleInfo>> downloadFutures = new ConcurrentHashMap<>();
     private final ExecutorService io = Executors.newSingleThreadExecutor();
 
@@ -155,12 +164,25 @@ public class CapgoUpdater {
     }
 
     public void setPublicKey(String publicKey) {
-        this.publicKey = publicKey;
-        if (!publicKey.isEmpty()) {
-            this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
-        } else {
+        // Empty string means no encryption - proceed normally
+        if (publicKey == null || publicKey.isEmpty()) {
+            this.publicKey = "";
             this.cachedKeyId = "";
+            return;
         }
+
+        // Non-empty: must be a valid RSA key or crash
+        try {
+            CryptoCipher.stringToPublicKey(publicKey);
+        } catch (Exception e) {
+            throw new RuntimeException(
+                "Invalid public key in capacitor.config.json: failed to parse RSA key. Remove the key or provide a valid PEM-formatted RSA public key.",
+                e
+            );
+        }
+
+        this.publicKey = publicKey;
+        this.cachedKeyId = CryptoCipher.calcKeyId(publicKey);
     }
 
     public String getKeyId() {
@@ -241,13 +263,90 @@ public class CapgoUpdater {
         }
         if (entries.length == 1 && !"index.html".equals(entries[0])) {
             final File child = new File(sourceFile, entries[0]);
-            child.renameTo(destinationFile);
+            if (!child.renameTo(destinationFile)) {
+                throw new IOException("Failed to move bundle contents: " + child.getPath() + " -> " + destinationFile.getPath());
+            }
         } else {
-            sourceFile.renameTo(destinationFile);
+            if (!sourceFile.renameTo(destinationFile)) {
+                throw new IOException("Failed to move bundle contents: " + sourceFile.getPath() + " -> " + destinationFile.getPath());
+            }
         }
         sourceFile.delete();
     }
 
+    private void cacheBundleFilesAsync(final String id) {
+        io.execute(() -> cacheBundleFiles(id));
+    }
+
+    private void cacheBundleFiles(final String id) {
+        if (this.activity == null) {
+            logger.debug("Skip delta cache population: activity is null");
+            return;
+        }
+
+        final File bundleDir = this.getBundleDirectory(id);
+        if (!bundleDir.exists()) {
+            logger.debug("Skip delta cache population: bundle dir missing");
+            return;
+        }
+
+        final File cacheDir = new File(this.activity.getCacheDir(), "capgo_downloads");
+        if (cacheDir.exists() && !cacheDir.isDirectory()) {
+            logger.debug("Skip delta cache population: cache dir is not a directory");
+            return;
+        }
+        if (!cacheDir.exists() && !cacheDir.mkdirs()) {
+            logger.debug("Skip delta cache population: failed to create cache dir");
+            return;
+        }
+
+        final List<File> files = new ArrayList<>();
+        collectFiles(bundleDir, files);
+        for (File file : files) {
+            final String checksum = CryptoCipher.calcChecksum(file);
+            if (checksum.isEmpty()) {
+                continue;
+            }
+            final String cacheName = checksum + "_" + file.getName();
+            final File cacheFile = new File(cacheDir, cacheName);
+            if (cacheFile.exists()) {
+                continue;
+            }
+            try {
+                copyFile(file, cacheFile);
+            } catch (IOException e) {
+                logger.debug("Delta cache copy failed: " + file.getPath());
+            }
+        }
+    }
+
+    private void collectFiles(final File dir, final List<File> files) {
+        final File[] entries = dir.listFiles();
+        if (entries == null) {
+            return;
+        }
+        for (File entry : entries) {
+            if (!this.filter.accept(dir, entry.getName())) {
+                continue;
+            }
+            if (entry.isDirectory()) {
+                collectFiles(entry, files);
+            } else if (entry.isFile()) {
+                files.add(entry);
+            }
+        }
+    }
+
+    private void copyFile(final File source, final File dest) throws IOException {
+        try (final FileInputStream input = new FileInputStream(source); final FileOutputStream output = new FileOutputStream(dest)) {
+            final byte[] buffer = new byte[1024 * 1024];
+            int length;
+            while ((length = input.read(buffer)) != -1) {
+                output.write(buffer, 0, length);
+            }
+        }
+    }
+
     private void observeWorkProgress(Context context, String id) {
         if (!(context instanceof LifecycleOwner)) {
             logger.error("Context is not a LifecycleOwner, cannot observe work progress");
@@ -465,6 +564,7 @@ public class CapgoUpdater {
                 this.notifyDownload(id, 91);
                 final String idName = bundleDirectory + "/" + id;
                 this.flattenAssets(extractedDir, idName);
+                this.cacheBundleFilesAsync(id);
             } else {
                 this.notifyDownload(id, 91);
                 final String idName = bundleDirectory + "/" + id;
@@ -1148,6 +1248,13 @@ public class CapgoUpdater {
         makeJsonRequest(channelUrl, json, (res) -> {
             if (res.containsKey("error")) {
                 callback.callback(res);
+            } else if (Boolean.TRUE.equals(res.get("unset"))) {
+                // Server requested to unset channel (public channel was requested)
+                // Clear persisted defaultChannel and revert to config value
+                editor.remove(defaultChannelKey);
+                editor.apply();
+                logger.info("Public channel requested, channel override removed");
+                callback.callback(res);
             } else {
                 // Success - persist defaultChannel
                 this.defaultChannel = channel;
@@ -1442,30 +1549,74 @@ public class CapgoUpdater {
         if (statsUrl == null || statsUrl.isEmpty()) {
             return;
         }
+
         JSONObject json;
         try {
             json = this.createInfoObject();
             json.put("version_name", versionName);
             json.put("old_version_name", oldVersionName);
             json.put("action", action);
+            json.put("timestamp", System.currentTimeMillis());
         } catch (JSONException e) {
             logger.error("Error preparing stats");
             logger.debug("JSONException: " + e.getMessage());
             return;
         }
 
+        statsQueue.add(json);
+        ensureStatsTimerStarted();
+    }
+
+    private synchronized void ensureStatsTimerStarted() {
+        if (statsFlushTask == null || statsFlushTask.isCancelled() || statsFlushTask.isDone()) {
+            statsFlushTask = statsScheduler.scheduleAtFixedRate(
+                this::flushStatsQueue,
+                STATS_FLUSH_INTERVAL_MS,
+                STATS_FLUSH_INTERVAL_MS,
+                TimeUnit.MILLISECONDS
+            );
+        }
+    }
+
+    private void flushStatsQueue() {
+        if (statsQueue.isEmpty()) {
+            return;
+        }
+
+        String statsUrl = this.statsUrl;
+        if (statsUrl == null || statsUrl.isEmpty()) {
+            statsQueue.clear();
+            return;
+        }
+
+        // Copy and clear the queue atomically using synchronized block
+        List<JSONObject> eventsToSend;
+        synchronized (statsQueue) {
+            if (statsQueue.isEmpty()) {
+                return;
+            }
+            eventsToSend = new ArrayList<>(statsQueue);
+            statsQueue.clear();
+        }
+
+        JSONArray jsonArray = new JSONArray();
+        for (JSONObject event : eventsToSend) {
+            jsonArray.put(event);
+        }
+
         Request request = new Request.Builder()
             .url(statsUrl)
-            .post(RequestBody.create(json.toString(), MediaType.get("application/json")))
+            .post(RequestBody.create(jsonArray.toString(), MediaType.get("application/json")))
             .build();
 
+        final int eventCount = eventsToSend.size();
         DownloadService.sharedClient
             .newCall(request)
             .enqueue(
                 new okhttp3.Callback() {
                     @Override
                     public void onFailure(@NonNull Call call, @NonNull IOException e) {
-                        logger.error("Failed to send stats");
+                        logger.error("Failed to send stats batch");
                         logger.debug("Error: " + e.getMessage());
                     }
 
@@ -1478,10 +1629,10 @@ public class CapgoUpdater {
                             }
 
                             if (response.isSuccessful()) {
-                                logger.info("Stats sent successfully");
-                                logger.debug("Action: " + action + ", Version: " + versionName);
+                                logger.info("Stats batch sent successfully");
+                                logger.debug("Sent " + eventCount + " events");
                             } else {
-                                logger.error("Error sending stats");
+                                logger.error("Error sending stats batch");
                                 logger.debug("Response code: " + response.code());
                             }
                         }
@@ -1615,4 +1766,30 @@ public class CapgoUpdater {
         this.editor.commit();
         return true;
     }
+
+    /**
+     * Shuts down the stats scheduler and flushes any pending stats.
+     * Should be called when the plugin is destroyed to prevent resource leaks.
+     */
+    public void shutdown() {
+        // Cancel the scheduled task
+        if (statsFlushTask != null) {
+            statsFlushTask.cancel(false);
+            statsFlushTask = null;
+        }
+
+        // Flush any remaining stats before shutdown
+        flushStatsQueue();
+
+        // Shutdown the scheduler
+        statsScheduler.shutdown();
+        try {
+            if (!statsScheduler.awaitTermination(2, TimeUnit.SECONDS)) {
+                statsScheduler.shutdownNow();
+            }
+        } catch (InterruptedException e) {
+            statsScheduler.shutdownNow();
+            Thread.currentThread().interrupt();
+        }
+    }
 }

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipher.java

@@ -210,7 +210,7 @@ public class CryptoCipher {
                 detectedFormat = "base64";
             }
             logger.debug(
-                "Received encrypted checksum format: " +
+                "Received checksum format: " +
                     detectedFormat +
                     " (length: " +
                     checksum.length() +
@@ -218,6 +218,18 @@ public class CryptoCipher {
                     checksumBytes.length +
                     " bytes)"
             );
+
+            // RSA-2048 encrypted data must be exactly 256 bytes
+            // If the checksum is not 256 bytes, the bundle was not encrypted properly
+            if (checksumBytes.length != 256) {
+                logger.error(
+                    "Checksum is not RSA encrypted (size: " +
+                        checksumBytes.length +
+                        " bytes, expected 256 for RSA-2048). Bundle must be uploaded with encryption when public key is configured."
+                );
+                throw new IOException("Bundle checksum is not encrypted. Upload bundle with --key flag when encryption is configured.");
+            }
+
             PublicKey pKey = CryptoCipher.stringToPublicKey(publicKey);
             byte[] decryptedChecksum = CryptoCipher.decryptRSA(checksumBytes, pKey);
             // Return as hex string to match calcChecksum output format

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -288,10 +288,16 @@ public class DownloadService extends Worker {
             for (int i = 0; i < totalFiles; i++) {
                 JSONObject entry = manifest.getJSONObject(i);
                 String fileName = entry.getString("file_name");
-                String fileHash = entry.getString("file_hash");
+                String fileHash = entry.optString("file_hash", "");
                 String downloadUrl = entry.getString("download_url");
 
-                if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                if (fileHash.isEmpty()) {
+                    logger.error("Missing file_hash for manifest entry: " + fileName);
+                    hasError.set(true);
+                    continue;
+                }
+
+                if (publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
                     try {
                         fileHash = CryptoCipher.decryptChecksum(fileHash, publicKey);
                     } catch (Exception e) {
@@ -308,7 +314,9 @@ public class DownloadService extends Worker {
                 String targetFileName = isBrotli ? fileName.substring(0, fileName.length() - 3) : fileName;
 
                 File targetFile = new File(destFolder, targetFileName);
-                File cacheFile = new File(cacheFolder, finalFileHash + "_" + new File(fileName).getName());
+                String cacheBaseName = new File(isBrotli ? targetFileName : fileName).getName();
+                File cacheFile = new File(cacheFolder, finalFileHash + "_" + cacheBaseName);
+                final File legacyCacheFile = isBrotli ? new File(cacheFolder, finalFileHash + "_" + new File(fileName).getName()) : null;
                 File builtinFile = new File(builtinFolder, fileName);
 
                 // Ensure parent directories of the target file exist
@@ -324,7 +332,10 @@ public class DownloadService extends Worker {
                         if (builtinFile.exists() && verifyChecksum(builtinFile, finalFileHash)) {
                             copyFile(builtinFile, targetFile);
                             logger.debug("using builtin file " + fileName);
-                        } else if (tryCopyFromCache(cacheFile, targetFile, finalFileHash)) {
+                        } else if (
+                            tryCopyFromCache(cacheFile, targetFile, finalFileHash) ||
+                            (legacyCacheFile != null && tryCopyFromCache(legacyCacheFile, targetFile, finalFileHash))
+                        ) {
                             logger.debug("already cached " + fileName);
                         } else {
                             downloadAndVerify(downloadUrl, targetFile, cacheFile, finalFileHash, sessionKey, publicKey, finalIsBrotli);
@@ -614,8 +625,12 @@ public class DownloadService extends Worker {
         // targetFile is already the final destination without .br extension
         File finalTargetFile = targetFile;
 
-        // Create a temporary file for the compressed data
-        File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".tmp");
+        // Create a temporary file for the compressed data with a unique name to avoid race conditions
+        // between threads processing files with the same basename in different directories
+        File compressedFile = new File(
+            getApplicationContext().getCacheDir(),
+            "temp_" + java.util.UUID.randomUUID().toString() + "_" + targetFile.getName() + ".tmp"
+        );
 
         try {
             try (Response response = sharedClient.newCall(request).execute()) {
@@ -633,7 +648,7 @@ public class DownloadService extends Worker {
                 // Use OkIO for atomic write
                 writeFileAtomic(compressedFile, responseBody.byteStream(), null);
 
-                if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                if (publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
                     logger.debug("Decrypting file " + targetFile.getName());
                     CryptoCipher.decryptFile(compressedFile, publicKey, sessionKey);
                 }
@@ -643,7 +658,14 @@ public class DownloadService extends Worker {
                     // Use new decompression method with atomic write
                     try (FileInputStream fis = new FileInputStream(compressedFile)) {
                         byte[] compressedData = new byte[(int) compressedFile.length()];
-                        fis.read(compressedData);
+                        int offset = 0;
+                        int bytesRead;
+                        while (
+                            offset < compressedData.length &&
+                            (bytesRead = fis.read(compressedData, offset, compressedData.length - offset)) != -1
+                        ) {
+                            offset += bytesRead;
+                        }
                         byte[] decompressedData;
                         try {
                             decompressedData = decompressBrotli(compressedData, targetFile.getName());
@@ -674,7 +696,7 @@ public class DownloadService extends Worker {
                 CryptoCipher.logChecksumInfo("Expected checksum", expectedHash);
 
                 // Verify checksum
-                if (calculatedHash.equals(expectedHash)) {
+                if (calculatedHash.equalsIgnoreCase(expectedHash)) {
                     // Only cache if checksum is correct - use atomic copy
                     try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
                         writeFileAtomic(cacheFile, fis, expectedHash);
@@ -707,7 +729,7 @@ public class DownloadService extends Worker {
     private boolean verifyChecksum(File file, String expectedHash) {
         try {
             String actualHash = calculateFileHash(file);
-            return actualHash.equals(expectedHash);
+            return actualHash.equalsIgnoreCase(expectedHash);
         } catch (Exception e) {
             e.printStackTrace();
             return false;