@capgo/capacitor-updater 7.0.36 → 7.0.38

package/CapgoCapacitorUpdater.podspec

@@ -16,5 +16,6 @@ Pod::Spec.new do |s|
   s.dependency 'SSZipArchive', '2.4.3'
   s.dependency 'Alamofire', '5.10.2'
   s.dependency 'Version', '0.8.0'
+  s.dependency 'BigInt', '5.2.0'
   s.swift_version = '5.1'
 end

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -57,7 +57,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     private static final String statsUrlDefault = "https://plugin.capgo.app/stats";
     private static final String channelUrlDefault = "https://plugin.capgo.app/channel_self";
 
-    private final String PLUGIN_VERSION = "7.0.36";
+    private final String PLUGIN_VERSION = "7.0.38";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipherV2.java

@@ -192,24 +192,6 @@ public class CryptoCipherV2 {
         }
     }
 
-    public static String decryptChecksum(String checksum, String publicKey, String version) throws IOException {
-        if (publicKey.isEmpty()) {
-            Log.e(CapacitorUpdater.TAG, "The public key is empty");
-            return checksum;
-        }
-        try {
-            byte[] checksumBytes = Base64.decode(checksum, Base64.DEFAULT);
-            PublicKey pKey = CryptoCipherV2.stringToPublicKey(publicKey);
-            byte[] decryptedChecksum = CryptoCipherV2.decryptRSA(checksumBytes, pKey);
-            // return Base64.encodeToString(decryptedChecksum, Base64.DEFAULT);
-            String result = Base64.encodeToString(decryptedChecksum, Base64.DEFAULT);
-            return result.replaceAll("\\s", ""); // Remove all whitespace, including newlines
-        } catch (GeneralSecurityException e) {
-            Log.e(CapacitorUpdater.TAG, "decryptChecksum fail: " + e.getMessage());
-            throw new IOException("Decryption failed: " + e.getMessage());
-        }
-    }
-
     public static String calcChecksum(File file) {
         final int BUFFER_SIZE = 1024 * 1024 * 5; // 5 MB buffer size
         MessageDigest digest;

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -377,8 +377,16 @@ public class DownloadService extends Worker {
 
         Request request = new Request.Builder().url(downloadUrl).build();
 
+        // Check if file is a Brotli file
+        boolean isBrotli = targetFile.getName().endsWith(".br");
+
+        // Create final target file with .br extension removed if it's a Brotli file
+        File finalTargetFile = isBrotli
+            ? new File(targetFile.getParentFile(), targetFile.getName().substring(0, targetFile.getName().length() - 3))
+            : targetFile;
+
         // Create a temporary file for the compressed data
-        File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".br");
+        File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".tmp");
 
         try (Response response = client.newCall(request).execute()) {
             if (!response.isSuccessful()) {
@@ -405,21 +413,27 @@ public class DownloadService extends Worker {
                 CryptoCipherV2.decryptFile(compressedFile, publicKey, sessionKey);
             }
 
-            // Use new decompression method
-            byte[] compressedData = Files.readAllBytes(compressedFile.toPath());
-            byte[] decompressedData = decompressBrotli(compressedData, targetFile.getName());
-            Files.write(targetFile.toPath(), decompressedData);
+            // Only decompress if file has .br extension
+            if (isBrotli) {
+                // Use new decompression method
+                byte[] compressedData = Files.readAllBytes(compressedFile.toPath());
+                byte[] decompressedData = decompressBrotli(compressedData, targetFile.getName());
+                Files.write(finalTargetFile.toPath(), decompressedData);
+            } else {
+                // Just copy the file without decompression
+                Files.copy(compressedFile.toPath(), finalTargetFile.toPath(), java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+            }
 
             // Delete the compressed file
             compressedFile.delete();
-            String calculatedHash = CryptoCipherV2.calcChecksum(targetFile);
+            String calculatedHash = CryptoCipherV2.calcChecksum(finalTargetFile);
 
             // Verify checksum
             if (calculatedHash.equals(expectedHash)) {
                 // Only cache if checksum is correct
-                copyFile(targetFile, cacheFile);
+                copyFile(finalTargetFile, cacheFile);
             } else {
-                targetFile.delete();
+                finalTargetFile.delete();
                 throw new IOException(
                     "Checksum verification failed for: " +
                     downloadUrl +

package/ios/Plugin/AES.swift

@@ -0,0 +1,66 @@
+import BigInt
+import CommonCrypto
+import CryptoKit
+
+///
+/// Constants
+///
+private enum AESConstants {
+    static let aesAlgorithm: CCAlgorithm = CCAlgorithm(kCCAlgorithmAES)
+    static let aesOptions: CCOptions = CCOptions(kCCOptionPKCS7Padding)
+}
+
+// We do all this stuff because ios is shit and open source libraries allow to do decryption with public key
+// So we have to do it manually, while in nodejs or Java it's ok and done at language level.
+
+///
+/// The AES key. Contains both the initialization vector and secret key.
+///
+public struct AES128Key {
+    /// Initialization vector
+    private let iv: Data
+    private let aes128Key: Data
+    #if DEBUG
+    public var __debug_iv: Data { iv }
+    public var __debug_aes128Key: Data { aes128Key }
+    #endif
+    init(iv: Data, aes128Key: Data) {
+        self.iv = iv
+        self.aes128Key = aes128Key
+    }
+    ///
+    /// Takes the data and uses the private key to decrypt it. Will call `CCCrypt` in CommonCrypto
+    /// and provide it `ivData` for the initialization vector. Will use cipher block chaining (CBC) as
+    /// the mode of operation.
+    ///
+    /// Returns the decrypted data.
+    ///
+    public func decrypt(data: Data) -> Data? {
+        let encryptedData: UnsafePointer<UInt8> = (data as NSData).bytes.bindMemory(to: UInt8.self, capacity: data.count)
+        let encryptedDataLength: Int = data.count
+
+        if let result: NSMutableData = NSMutableData(length: encryptedDataLength) {
+            let keyData: UnsafePointer<UInt8> = (self.aes128Key as NSData).bytes.bindMemory(to: UInt8.self, capacity: self.aes128Key.count)
+            let keyLength: size_t = size_t(self.aes128Key.count)
+            let ivData: UnsafePointer<UInt8> = (iv as NSData).bytes.bindMemory(to: UInt8.self, capacity: self.iv.count)
+
+            let decryptedData: UnsafeMutablePointer<UInt8> = UnsafeMutablePointer<UInt8>(result.mutableBytes.assumingMemoryBound(to: UInt8.self))
+            let decryptedDataLength: size_t = size_t(result.length)
+
+            var decryptedLength: size_t = 0
+
+            let status: CCCryptorStatus = CCCrypt(CCOperation(kCCDecrypt), AESConstants.aesAlgorithm, AESConstants.aesOptions, keyData, keyLength, ivData, encryptedData, encryptedDataLength, decryptedData, decryptedDataLength, &decryptedLength)
+
+            if Int32(status) == Int32(kCCSuccess) {
+                result.length = Int(decryptedLength)
+                return result as Data
+            } else {
+                print("\(CapacitorUpdater.TAG) AES decryption failed with status: \(status)")
+                return nil
+            }
+        } else {
+            print("\(CapacitorUpdater.TAG) Failed to allocate memory for AES decryption")
+            return nil
+        }
+    }
+}

package/ios/Plugin/BigInt.swift

@@ -0,0 +1,55 @@
+import BigInt
+
+// Extension to serialize BigInt to bytes array
+extension BigInt {
+    func serializeToBytes() -> [UInt8] {
+        let byteCount = (self.bitWidth + 7) / 8
+        var bytes = [UInt8](repeating: 0, count: byteCount)
+
+        var value = self
+        for i in 0..<byteCount {
+            bytes[byteCount - i - 1] = UInt8(truncatingIfNeeded: value & 0xFF)
+            value >>= 8
+        }
+
+        return bytes
+    }
+}
+
+// Add this custom power function to ensure safer handling of power operations
+
+// Manual exponentiation using the square-and-multiply algorithm
+// which is more efficient and avoids using the built-in functions that might handle BigInt differently
+extension BigInt {
+    func manualPower(_ exponent: BigInt, modulus: BigInt) -> BigInt {
+        // Quick checks
+        if modulus == 0 {
+            return 0
+        }
+
+        if exponent == 0 {
+            return 1
+        }
+
+        guard let base = self.magnitude as? BigUInt,
+              let exp = exponent.magnitude as? BigUInt,
+              let mod = modulus.magnitude as? BigUInt else {
+            return 0
+        }
+
+        // Square and multiply algorithm for modular exponentiation
+        var result = BigUInt(1)
+        var x = base % mod
+        var e = exp
+
+        while e > 0 {
+            if e & 1 == 1 {
+                result = (result * x) % mod
+            }
+            x = (x * x) % mod
+            e >>= 1
+        }
+
+        return BigInt(result)
+    }
+}

package/ios/Plugin/CapacitorUpdater.swift

@@ -340,7 +340,7 @@ import UIKit
 
             if !self.publicKey.isEmpty && !sessionKey.isEmpty {
                 do {
-                    fileHash = try CryptoCipherV2.decryptChecksum(checksum: fileHash, publicKey: self.publicKey, version: version)
+                    fileHash = try CryptoCipherV2.decryptChecksum(checksum: fileHash, publicKey: self.publicKey)
                 } catch {
                     downloadError = error
                     print("\(CapacitorUpdater.TAG) CryptoCipherV2.decryptChecksum error \(id) \(fileName) error: \(error)")
@@ -403,11 +403,18 @@ import UIKit
                                 try FileManager.default.removeItem(at: tempFile)
                             }
 
-                            // Decompress the Brotli data
-                            guard let decompressedData = self.decompressBrotli(data: finalData, fileName: fileName) else {
-                                throw NSError(domain: "BrotliDecompressionError", code: 1, userInfo: [NSLocalizedDescriptionKey: "Failed to decompress Brotli data for file \(fileName) at url \(downloadUrl)"])
+                            // Check if file has .br extension for Brotli decompression
+                            let isBrotli = fileName.hasSuffix(".br")
+                            let finalFileName = isBrotli ? String(fileName.dropLast(3)) : fileName
+                            let destFilePath = destFolder.appendingPathComponent(finalFileName)
+
+                            if isBrotli {
+                                // Decompress the Brotli data
+                                guard let decompressedData = self.decompressBrotli(data: finalData, fileName: fileName) else {
+                                    throw NSError(domain: "BrotliDecompressionError", code: 1, userInfo: [NSLocalizedDescriptionKey: "Failed to decompress Brotli data for file \(fileName) at url \(downloadUrl)"])
+                                }
+                                finalData = decompressedData
                             }
-                            finalData = decompressedData
 
                             try finalData.write(to: destFilePath)
                             if !self.publicKey.isEmpty && !sessionKey.isEmpty {
@@ -423,7 +430,7 @@ import UIKit
 
                             completedFiles += 1
                             self.notifyDownload(id: id, percent: self.calcTotalPercent(percent: Int((Double(completedFiles) / Double(totalFiles)) * 100), min: 10, max: 70))
-                            print("\(CapacitorUpdater.TAG) downloadManifest \(id) \(fileName) downloaded, decompressed\(!self.publicKey.isEmpty && !sessionKey.isEmpty ? ", decrypted" : ""), and cached")
+                            print("\(CapacitorUpdater.TAG) downloadManifest \(id) \(fileName) downloaded\(isBrotli ? ", decompressed" : "")\(!self.publicKey.isEmpty && !sessionKey.isEmpty ? ", decrypted" : ""), and cached")
                         } catch {
                             downloadError = error
                             NSLog("\(CapacitorUpdater.TAG) downloadManifest \(id) \(fileName) error: \(error.localizedDescription)")

package/ios/Plugin/CapacitorUpdaterPlugin.swift

@@ -45,7 +45,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         CAPPluginMethod(name: "getNextBundle", returnType: CAPPluginReturnPromise)
     ]
     public var implementation = CapacitorUpdater()
-    private let PLUGIN_VERSION: String = "7.0.36"
+    private let PLUGIN_VERSION: String = "7.0.38"
     static let updateUrlDefault = "https://plugin.capgo.app/updates"
     static let statsUrlDefault = "https://plugin.capgo.app/stats"
     static let channelUrlDefault = "https://plugin.capgo.app/channel_self"
@@ -291,7 +291,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
         DispatchQueue.global(qos: .background).async {
             do {
                 let next = try self.implementation.download(url: url!, version: version, sessionKey: sessionKey)
-                checksum = try CryptoCipherV2.decryptChecksum(checksum: checksum, publicKey: self.implementation.publicKey, version: version)
+                checksum = try CryptoCipherV2.decryptChecksum(checksum: checksum, publicKey: self.implementation.publicKey)
                 if (checksum != "" || self.implementation.publicKey != "") && next.getChecksum() != checksum {
                     print("\(CapacitorUpdater.TAG) Error checksum", next.getChecksum(), checksum)
                     self.implementation.sendStats(action: "checksum_fail", versionName: next.getVersionName())
@@ -805,7 +805,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
                         self.endBackGroundTaskWithNotif(msg: "Latest version is in error state. Aborting update.", latestVersionName: latestVersionName, current: current)
                         return
                     }
-                    res.checksum = try CryptoCipherV2.decryptChecksum(checksum: res.checksum, publicKey: self.implementation.publicKey, version: latestVersionName)
+                    res.checksum = try CryptoCipherV2.decryptChecksum(checksum: res.checksum, publicKey: self.implementation.publicKey)
                     if res.checksum != "" && next.getChecksum() != res.checksum && res.manifest == nil {
                         print("\(CapacitorUpdater.TAG) Error checksum", next.getChecksum(), res.checksum)
                         self.implementation.sendStats(action: "checksum_fail", versionName: next.getVersionName())

package/ios/Plugin/CryptoCipherV2.swift

@@ -5,235 +5,40 @@
  */
 
 import Foundation
-import CommonCrypto
 import CryptoKit
+import BigInt
 
-///
-/// Constants
-///
-private enum CryptoCipherConstants {
-    static let rsaKeySizeInBits: NSNumber = 2048
-    static let aesAlgorithm: CCAlgorithm = CCAlgorithm(kCCAlgorithmAES)
-    static let aesOptions: CCOptions = CCOptions(kCCOptionPKCS7Padding)
-    static let rsaAlgorithm: SecKeyAlgorithm = .rsaEncryptionOAEPSHA256
-}
-///
-/// The AES key. Contains both the initialization vector and secret key.
-///
-public struct AES128Key {
-    /// Initialization vector
-    private let iv: Data
-    private let aes128Key: Data
-    #if DEBUG
-    public var __debug_iv: Data { iv }
-    public var __debug_aes128Key: Data { aes128Key }
-    #endif
-    init(iv: Data, aes128Key: Data) {
-        self.iv = iv
-        self.aes128Key = aes128Key
-    }
-    ///
-    /// Takes the data and uses the private key to decrypt it. Will call `CCCrypt` in CommonCrypto
-    /// and provide it `ivData` for the initialization vector. Will use cipher block chaining (CBC) as
-    /// the mode of operation.
-    ///
-    /// Returns the decrypted data.
-    ///
-    public func decrypt(data: Data) -> Data? {
-        let encryptedData: UnsafePointer<UInt8> = (data as NSData).bytes.bindMemory(to: UInt8.self, capacity: data.count)
-        let encryptedDataLength: Int = data.count
-
-        if let result: NSMutableData = NSMutableData(length: encryptedDataLength) {
-            let keyData: UnsafePointer<UInt8> = (self.aes128Key as NSData).bytes.bindMemory(to: UInt8.self, capacity: self.aes128Key.count)
-            let keyLength: size_t = size_t(self.aes128Key.count)
-            let ivData: UnsafePointer<UInt8> = (iv as NSData).bytes.bindMemory(to: UInt8.self, capacity: self.iv.count)
-
-            let decryptedData: UnsafeMutablePointer<UInt8> = UnsafeMutablePointer<UInt8>(result.mutableBytes.assumingMemoryBound(to: UInt8.self))
-            let decryptedDataLength: size_t = size_t(result.length)
-
-            var decryptedLength: size_t = 0
-
-            let status: CCCryptorStatus = CCCrypt(CCOperation(kCCDecrypt), CryptoCipherConstants.aesAlgorithm, CryptoCipherConstants.aesOptions, keyData, keyLength, ivData, encryptedData, encryptedDataLength, decryptedData, decryptedDataLength, &decryptedLength)
+public struct CryptoCipherV2 {
 
-            if Int32(status) == Int32(kCCSuccess) {
-                result.length = Int(decryptedLength)
-                return result as Data
-            } else {
-                return nil
-            }
-        } else {
-            return nil
+    public static func decryptChecksum(checksum: String, publicKey: String) throws -> String {
+        if publicKey.isEmpty {
+            print("\(CapacitorUpdater.TAG) The public key is empty")
+            return checksum
         }
-    }
-}
-
-///
-/// The RSA public key.
-///
-public struct RSAPublicKey {
-    private let publicKey: SecKey
-
-    #if DEBUG
-    public var __debug_publicKey: SecKey { self.publicKey }
-    #endif
-
-    fileprivate init(publicKey: SecKey) {
-        self.publicKey = publicKey
-    }
-
-    ///
-    /// Takes the data and uses the public key to decrypt it.
-    /// Returns the decrypted data.
-    ///
-    public func decrypt(data: Data) -> Data? {
         do {
-            guard let decryptedData = RSAPublicKey.decryptWithRSAKey(data, rsaKeyRef: self.publicKey, padding: SecPadding()) else {
-                throw CustomError.cannotDecryptSessionKey
-            }
-
-            return decryptedData
-        } catch {
-            print("Error decrypting data: \(error)")
-            return nil
-        }
-    }
-
-    ///
-    /// Allows you to load an RSA public key (i.e. one downloaded from the net).
-    ///
-    public static func load(rsaPublicKey: String) -> RSAPublicKey? {
-        var pubKey: String = rsaPublicKey
-        pubKey = pubKey.replacingOccurrences(of: "-----BEGIN RSA PUBLIC KEY-----", with: "")
-        pubKey = pubKey.replacingOccurrences(of: "-----END RSA PUBLIC KEY-----", with: "")
-        pubKey = pubKey.replacingOccurrences(of: "\\n+", with: "", options: .regularExpression)
-        pubKey = pubKey.trimmingCharacters(in: .whitespacesAndNewlines)
-        do {
-            guard let rsaPublicKeyData: Data = Data(base64Encoded: String(pubKey)) else {
+            guard let checksumBytes = Data(base64Encoded: checksum) else {
+                print("\(CapacitorUpdater.TAG) Cannot decode checksum as base64: \(checksum)")
                 throw CustomError.cannotDecode
             }
 
-            guard let publicKey: SecKey = .loadPublicFromData(rsaPublicKeyData) else {
+            if checksumBytes.isEmpty {
+                print("\(CapacitorUpdater.TAG) Decoded checksum is empty")
                 throw CustomError.cannotDecode
             }
 
-            return RSAPublicKey(publicKey: publicKey)
-        } catch {
-            print("Error load RSA: \(error)")
-            return nil
-        }
-    }
-
-    // code is copied from here: https://github.com/btnguyen2k/swiftutils/blob/88494f4c635b6c6d42ef0fb30a7d666acd38c4fa/SwiftUtils/RSAUtils.swift#L393
-    public static func decryptWithRSAKey(_ encryptedData: Data, rsaKeyRef: SecKey, padding: SecPadding) -> Data? {
-        let blockSize = SecKeyGetBlockSize(rsaKeyRef)
-        let dataSize = encryptedData.count / MemoryLayout<UInt8>.size
-
-        var encryptedDataAsArray = [UInt8](repeating: 0, count: dataSize)
-        (encryptedData as NSData).getBytes(&encryptedDataAsArray, length: dataSize)
-
-        var decryptedData = [UInt8](repeating: 0, count: 0)
-        var idx = 0
-        while idx < encryptedDataAsArray.count {
-            var idxEnd = idx + blockSize
-            if idxEnd > encryptedDataAsArray.count {
-                idxEnd = encryptedDataAsArray.count
-            }
-            var chunkData = [UInt8](repeating: 0, count: blockSize)
-            for i in idx..<idxEnd {
-                chunkData[i-idx] = encryptedDataAsArray[i]
-            }
-
-            var decryptedDataBuffer = [UInt8](repeating: 0, count: blockSize)
-            var decryptedDataLength = blockSize
-
-            let status = SecKeyDecrypt(rsaKeyRef, padding, chunkData, idxEnd-idx, &decryptedDataBuffer, &decryptedDataLength)
-            if status != noErr {
-                return nil
-            }
-            let finalData = removePadding(decryptedDataBuffer)
-            decryptedData += finalData
-
-            idx += blockSize
-        }
-
-        return Data(decryptedData)
-    }
-
-    // code is copied from here: https://github.com/btnguyen2k/swiftutils/blob/88494f4c635b6c6d42ef0fb30a7d666acd38c4fa/SwiftUtils/RSAUtils.swift#L429
-    private static func removePadding(_ data: [UInt8]) -> [UInt8] {
-        var idxFirstZero = -1
-        var idxNextZero = data.count
-        for i in 0..<data.count {
-            if data[i] == 0 {
-                if idxFirstZero < 0 {
-                    idxFirstZero = i
-                } else {
-                    idxNextZero = i
-                    break
-                }
-            }
-        }
-        if idxNextZero-idxFirstZero-1 == 0 {
-            idxNextZero = idxFirstZero
-            idxFirstZero = -1
-        }
-        var newData = [UInt8](repeating: 0, count: idxNextZero-idxFirstZero-1)
-        for i in idxFirstZero+1..<idxNextZero {
-            newData[i-idxFirstZero-1] = data[i]
-        }
-        return newData
-    }
-}
-
-fileprivate extension SecKey {
-    func exportToData() -> Data? {
-        var error: Unmanaged<CFError>?
-        if let cfData: CFData = SecKeyCopyExternalRepresentation(self, &error) {
-            if error != nil {
-                return nil
-            } else {
-                return cfData as Data
-            }
-        } else {
-            return nil
-        }
-    }
-    static func loadPublicFromData(_ data: Data) -> SecKey? {
-        let keyDict: [NSObject: NSObject] = [
-            kSecAttrKeyType: kSecAttrKeyTypeRSA,
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
-            kSecAttrKeySizeInBits: CryptoCipherConstants.rsaKeySizeInBits
-        ]
-        return SecKeyCreateWithData(data as NSData, keyDict as CFDictionary, nil)
-    }
-    static func loadPrivateFromData(_ data: Data) -> SecKey? {
-        let keyDict: [NSObject: NSObject] = [
-            kSecAttrKeyType: kSecAttrKeyTypeRSA,
-            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-            kSecAttrKeySizeInBits: CryptoCipherConstants.rsaKeySizeInBits
-        ]
-        return SecKeyCreateWithData(data as CFData, keyDict as CFDictionary, nil)
-    }
-}
-
-public struct CryptoCipherV2 {
-
-    public static func decryptChecksum(checksum: String, publicKey: String, version: String) throws -> String {
-        if publicKey.isEmpty {
-            return checksum
-        }
-        do {
-            let checksumBytes: Data = Data(base64Encoded: checksum)!
-            guard let rsaPublicKey: RSAPublicKey = .load(rsaPublicKey: publicKey) else {
-                print("cannot decode publicKey", publicKey)
+            guard let rsaPublicKey = RSAPublicKey.load(rsaPublicKey: publicKey) else {
+                print("\(CapacitorUpdater.TAG) The public key is not a valid RSA Public key")
                 throw CustomError.cannotDecode
             }
+
             guard let decryptedChecksum = rsaPublicKey.decrypt(data: checksumBytes) else {
+                print("\(CapacitorUpdater.TAG) decryptChecksum fail")
                 throw NSError(domain: "Failed to decrypt session key data", code: 2, userInfo: nil)
             }
+
             return decryptedChecksum.base64EncodedString()
         } catch {
-            print("\(CapacitorUpdater.TAG) Cannot decrypt checksum: \(checksum)", error)
+            print("\(CapacitorUpdater.TAG) decryptChecksum fail: \(error.localizedDescription)")
             throw CustomError.cannotDecode
         }
     }
@@ -242,13 +47,35 @@ public struct CryptoCipherV2 {
         var sha256 = SHA256()
 
         do {
-            let fileHandle = try FileHandle(forReadingFrom: filePath)
+            let fileHandle: FileHandle
+            do {
+                fileHandle = try FileHandle(forReadingFrom: filePath)
+            } catch {
+                print("\(CapacitorUpdater.TAG) Cannot open file for checksum: \(filePath.path)", error)
+                return ""
+            }
+
             defer {
-                fileHandle.closeFile()
+                do {
+                    try fileHandle.close()
+                } catch {
+                    print("\(CapacitorUpdater.TAG) Error closing file: \(error)")
+                }
             }
 
             while autoreleasepool(invoking: {
-                let fileData = fileHandle.readData(ofLength: bufferSize)
+                let fileData: Data
+                do {
+                    if #available(iOS 13.4, *) {
+                        fileData = try fileHandle.read(upToCount: bufferSize) ?? Data()
+                    } else {
+                        fileData = fileHandle.readData(ofLength: bufferSize)
+                    }
+                } catch {
+                    print("\(CapacitorUpdater.TAG) Error reading file: \(error)")
+                    return false
+                }
+
                 if fileData.count > 0 {
                     sha256.update(data: fileData)
                     return true // Continue
@@ -266,44 +93,89 @@ public struct CryptoCipherV2 {
     }
 
     public static func decryptFile(filePath: URL, publicKey: String, sessionKey: String, version: String) throws {
-        if publicKey.isEmpty || sessionKey.isEmpty  || sessionKey.components(separatedBy: ":").count != 2 {
-            print("\(CapacitorUpdater.TAG) Cannot find public key or sessionKey")
+        if publicKey.isEmpty || sessionKey.isEmpty || sessionKey.components(separatedBy: ":").count != 2 {
+            print("\(CapacitorUpdater.TAG) Cannot found public key or sessionKey")
             return
         }
+
+        if !publicKey.hasPrefix("-----BEGIN RSA PUBLIC KEY-----") {
+            print("\(CapacitorUpdater.TAG) The public key is not a valid RSA Public key")
+            return
+        }
+
         do {
-            guard let rsaPublicKey: RSAPublicKey = .load(rsaPublicKey: publicKey) else {
-                print("cannot decode publicKey", publicKey)
+            guard let rsaPublicKey = RSAPublicKey.load(rsaPublicKey: publicKey) else {
+                print("\(CapacitorUpdater.TAG) The public key is not a valid RSA Public key")
                 throw CustomError.cannotDecode
             }
 
-            let sessionKeyArray: [String] = sessionKey.components(separatedBy: ":")
-            guard let ivData: Data = Data(base64Encoded: sessionKeyArray[0]) else {
-                print("cannot decode sessionKey", sessionKey)
+            let sessionKeyComponents = sessionKey.components(separatedBy: ":")
+            let ivBase64 = sessionKeyComponents[0]
+            let encryptedKeyBase64 = sessionKeyComponents[1]
+
+            guard let ivData = Data(base64Encoded: ivBase64) else {
+                print("\(CapacitorUpdater.TAG) Cannot decode sessionKey IV", ivBase64)
                 throw CustomError.cannotDecode
             }
 
-            guard let sessionKeyDataEncrypted = Data(base64Encoded: sessionKeyArray[1]) else {
+            if ivData.count != 16 {
+                print("\(CapacitorUpdater.TAG) IV data has invalid length: \(ivData.count), expected 16")
+                throw CustomError.cannotDecode
+            }
+
+            guard let sessionKeyDataEncrypted = Data(base64Encoded: encryptedKeyBase64) else {
+                print("\(CapacitorUpdater.TAG) Cannot decode sessionKey data", encryptedKeyBase64)
                 throw NSError(domain: "Invalid session key data", code: 1, userInfo: nil)
             }
 
             guard let sessionKeyDataDecrypted = rsaPublicKey.decrypt(data: sessionKeyDataEncrypted) else {
+                print("\(CapacitorUpdater.TAG) Failed to decrypt session key data")
                 throw NSError(domain: "Failed to decrypt session key data", code: 2, userInfo: nil)
             }
 
+            if sessionKeyDataDecrypted.count != 16 {
+                print("\(CapacitorUpdater.TAG) Decrypted session key has invalid length: \(sessionKeyDataDecrypted.count), expected 16")
+                throw NSError(domain: "Invalid decrypted session key", code: 5, userInfo: nil)
+            }
+
             let aesPrivateKey = AES128Key(iv: ivData, aes128Key: sessionKeyDataDecrypted)
 
-            guard let encryptedData = try? Data(contentsOf: filePath) else {
+            let encryptedData: Data
+            do {
+                encryptedData = try Data(contentsOf: filePath)
+            } catch {
+                print("\(CapacitorUpdater.TAG) Failed to read encrypted data: \(error)")
                 throw NSError(domain: "Failed to read encrypted data", code: 3, userInfo: nil)
             }
 
+            if encryptedData.isEmpty {
+                print("\(CapacitorUpdater.TAG) Encrypted file data is empty")
+                throw NSError(domain: "Empty encrypted data", code: 6, userInfo: nil)
+            }
+
             guard let decryptedData = aesPrivateKey.decrypt(data: encryptedData) else {
+                print("\(CapacitorUpdater.TAG) Failed to decrypt data")
                 throw NSError(domain: "Failed to decrypt data", code: 4, userInfo: nil)
             }
 
-            try decryptedData.write(to: filePath)
+            if decryptedData.isEmpty {
+                print("\(CapacitorUpdater.TAG) Decrypted data is empty")
+                throw NSError(domain: "Empty decrypted data", code: 7, userInfo: nil)
+            }
+
+            do {
+                try decryptedData.write(to: filePath, options: .atomic)
+                if !FileManager.default.fileExists(atPath: filePath.path) {
+                    print("\(CapacitorUpdater.TAG) File was not created after write")
+                    throw NSError(domain: "File write failed", code: 8, userInfo: nil)
+                }
+            } catch {
+                print("\(CapacitorUpdater.TAG) Error writing decrypted file: \(error)")
+                throw error
+            }
 
         } catch {
-            print("\(CapacitorUpdater.TAG) Cannot decode: \(filePath.path)", error)
+            print("\(CapacitorUpdater.TAG) decryptFile fail")
             throw CustomError.cannotDecode
         }
     }

package/ios/Plugin/RSA.swift

@@ -0,0 +1,273 @@
+import BigInt
+import CommonCrypto
+import CryptoKit
+
+///
+/// Constants
+///
+private enum RSAConstants {
+    static let rsaKeySizeInBits: NSNumber = 2048
+    static let rsaAlgorithm: SecKeyAlgorithm = .rsaEncryptionOAEPSHA256
+}
+
+// We do all this stuff because ios is shit and open source libraries allow to do decryption with public key
+// So we have to do it manually, while in nodejs or Java it's ok and done at language level.
+
+///
+/// The RSA public key.
+///
+public struct RSAPublicKey {
+    private let manualKey: ManualRSAPublicKey
+
+    fileprivate init(manualKey: ManualRSAPublicKey) {
+        self.manualKey = manualKey
+    }
+
+    ///
+    /// Takes the data and uses the public key to decrypt it.
+    /// Returns the decrypted data.
+    ///
+    public func decrypt(data: Data) -> Data? {
+        return manualKey.decrypt(data)
+    }
+
+    ///
+    /// Allows you to load an RSA public key (i.e. one downloaded from the net).
+    ///
+    public static func load(rsaPublicKey: String) -> RSAPublicKey? {
+        // Clean up the key string
+        var pubKey: String = rsaPublicKey
+        pubKey = pubKey.replacingOccurrences(of: "-----BEGIN RSA PUBLIC KEY-----", with: "")
+        pubKey = pubKey.replacingOccurrences(of: "-----END RSA PUBLIC KEY-----", with: "")
+        pubKey = pubKey.replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")
+        pubKey = pubKey.replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")
+        pubKey = pubKey.replacingOccurrences(of: "\\n+", with: "", options: .regularExpression)
+        pubKey = pubKey.replacingOccurrences(of: "\n", with: "")
+        pubKey = pubKey.trimmingCharacters(in: .whitespacesAndNewlines)
+
+        do {
+            guard let rsaPublicKeyData: Data = Data(base64Encoded: String(pubKey)) else {
+                throw CustomError.cannotDecode
+            }
+
+            // Try parsing as PKCS#1
+            if let manualKey = ManualRSAPublicKey.fromPKCS1(rsaPublicKeyData) {
+                return RSAPublicKey(manualKey: manualKey)
+            }
+
+            // Most common public exponent is 65537 (0x010001)
+            let commonExponent = Data([0x01, 0x00, 0x01]) // 65537 in big-endian
+
+            // Assume the entire key data is the modulus
+            let lastResortKey = ManualRSAPublicKey(modulus: rsaPublicKeyData, exponent: commonExponent)
+            return RSAPublicKey(manualKey: lastResortKey)
+        } catch {
+            return nil
+        }
+    }
+}
+
+// Manual RSA Public Key Implementation using the BigInt library
+struct ManualRSAPublicKey {
+    let modulus: BigInt
+    let exponent: BigInt
+
+    init(modulus: Data, exponent: Data) {
+        // Create positive BigInts from Data
+        let modulusBytes = [UInt8](modulus)
+        var modulusValue = BigUInt(0)
+        for byte in modulusBytes {
+            modulusValue = (modulusValue << 8) | BigUInt(byte)
+        }
+        self.modulus = BigInt(modulusValue)
+        let exponentBytes = [UInt8](exponent)
+        var exponentValue = BigUInt(0)
+        for byte in exponentBytes {
+            exponentValue = (exponentValue << 8) | BigUInt(byte)
+        }
+        self.exponent = BigInt(exponentValue)
+    }
+
+    // Parse PKCS#1 format public key
+    static func fromPKCS1(_ publicKeyData: Data) -> ManualRSAPublicKey? {
+        // Parse ASN.1 DER encoded RSA public key
+        // Format: RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }
+
+        guard publicKeyData.count > 0 else {
+            return nil
+        }
+
+        let bytes = [UInt8](publicKeyData)
+
+        // Check for sequence tag (0x30)
+        guard bytes[0] == 0x30 else {
+            // Try direct modulus/exponent approach as fallback
+            if publicKeyData.count >= 3 {
+                // Assume this is a raw RSA public key with modulus + exponent
+                // Most common: modulus is 256 bytes (2048 bits), exponent is 3 bytes (0x010001 = 65537)
+                let modulusSize = publicKeyData.count - 3
+                if modulusSize > 0 {
+                    let modulusData = publicKeyData.prefix(modulusSize)
+                    let exponentData = publicKeyData.suffix(3)
+                    return ManualRSAPublicKey(modulus: modulusData, exponent: exponentData)
+                }
+            }
+
+            return nil
+        }
+
+        var index = 1
+
+        // Skip length
+        if bytes[index] & 0x80 != 0 {
+            let lenBytes = Int(bytes[index] & 0x7F)
+            if (index + 1 + lenBytes) >= bytes.count {
+                return nil
+            }
+            index += 1 + lenBytes
+        } else {
+            index += 1
+        }
+
+        // Check for INTEGER tag for modulus (0x02)
+        if index >= bytes.count {
+            return nil
+        }
+
+        guard bytes[index] == 0x02 else {
+            return nil
+        }
+        index += 1
+
+        // Get modulus length
+        if index >= bytes.count {
+            return nil
+        }
+
+        var modulusLength = 0
+        if bytes[index] & 0x80 != 0 {
+            let lenBytes = Int(bytes[index] & 0x7F)
+            if (index + 1 + lenBytes) >= bytes.count {
+                return nil
+            }
+            index += 1
+            for i in 0..<lenBytes {
+                modulusLength = (modulusLength << 8) | Int(bytes[index + i])
+            }
+            index += lenBytes
+        } else {
+            modulusLength = Int(bytes[index])
+            index += 1
+        }
+
+        // Skip any leading zero in modulus (for unsigned integer)
+        if index < bytes.count && bytes[index] == 0x00 {
+            index += 1
+            modulusLength -= 1
+        }
+
+        // Extract modulus
+        if (index + modulusLength) > bytes.count {
+            return nil
+        }
+
+        let modulusData = Data(bytes[index..<(index + modulusLength)])
+        index += modulusLength
+
+        // Check for INTEGER tag for exponent
+        if index >= bytes.count {
+            return nil
+        }
+
+        guard bytes[index] == 0x02 else {
+            return nil
+        }
+        index += 1
+
+        // Get exponent length
+        if index >= bytes.count {
+            return nil
+        }
+
+        var exponentLength = 0
+        if bytes[index] & 0x80 != 0 {
+            let lenBytes = Int(bytes[index] & 0x7F)
+            if (index + 1 + lenBytes) >= bytes.count {
+                return nil
+            }
+            index += 1
+            for i in 0..<lenBytes {
+                exponentLength = (exponentLength << 8) | Int(bytes[index + i])
+            }
+            index += lenBytes
+        } else {
+            exponentLength = Int(bytes[index])
+            index += 1
+        }
+
+        // Extract exponent
+        if (index + exponentLength) > bytes.count {
+            return nil
+        }
+
+        let exponentData = Data(bytes[index..<(index + exponentLength)])
+        return ManualRSAPublicKey(modulus: modulusData, exponent: exponentData)
+    }
+
+    // Decrypt data using raw RSA operation (c^d mod n)
+    func decrypt(_ encryptedData: Data) -> Data? {
+        // Create positive BigInt from encrypted data
+        let encryptedBytes = [UInt8](encryptedData)
+        var encryptedValue = BigUInt(0)
+        for byte in encryptedBytes {
+            encryptedValue = (encryptedValue << 8) | BigUInt(byte)
+        }
+        let encrypted = BigInt(encryptedValue)
+
+        // In Node.js:
+        // privateEncrypt uses the private key (d) to encrypt
+        // publicDecrypt uses the public key (e) to decrypt
+        // The operation we want is: ciphertext^e mod n
+
+        // RSA operation: c^e mod n
+        let decrypted = encrypted.manualPower(exponent, modulus: modulus)
+
+        // Convert to bytes with proper padding
+        guard let bigUIntValue = decrypted.magnitude as? BigUInt else {
+            return nil
+        }
+
+        // Convert BigUInt to bytes with padding
+        var resultBytes = [UInt8]()
+        var tempValue = bigUIntValue
+        while tempValue > 0 {
+            let byte = UInt8(tempValue & 0xFF)
+            resultBytes.insert(byte, at: 0)  // Prepend to get big-endian
+            tempValue >>= 8
+        }
+
+        // Ensure we have at least 256 bytes (2048 bits) with leading zeros
+        let paddedBytes = [UInt8](repeating: 0, count: max(0, 256 - resultBytes.count)) + resultBytes
+
+        // For PKCS1 padding from Node.js privateEncrypt, the format is:
+        // 0x00 || 0x01 || PS || 0x00 || actual data
+        // where PS is a string of 0xFF bytes
+
+        // Check for privateEncrypt padding format (0x00 || 0x01 || PS || 0x00)
+        var startIndex = 0
+        if paddedBytes.count > 2 && paddedBytes[0] == 0x00 && paddedBytes[1] == 0x01 {
+            for i in 2..<paddedBytes.count {
+                if paddedBytes[i] == 0x00 {
+                    startIndex = i + 1
+                    break
+                }
+            }
+        }
+        if startIndex < paddedBytes.count {
+            let result = Data(paddedBytes[startIndex...])
+            return result
+        } else {
+            return Data(paddedBytes)
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "7.0.36",
+  "version": "7.0.38",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",