@capgo/capacitor-updater 8.0.1 → 8.1.0

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -6,7 +6,6 @@
 package ee.forgr.capacitor_updater;
 
 import android.content.Context;
-import android.util.Log;
 import androidx.annotation.NonNull;
 import androidx.work.Data;
 import androidx.work.Worker;
@@ -16,6 +15,8 @@ import java.io.FileInputStream;
 import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.channels.FileChannel;
+import java.nio.file.Files;
+import java.nio.file.StandardCopyOption;
 import java.security.MessageDigest;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -27,18 +28,33 @@ import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
+import okhttp3.Call;
+import okhttp3.Callback;
+import okhttp3.Interceptor;
+import okhttp3.MediaType;
 import okhttp3.OkHttpClient;
 import okhttp3.Protocol;
 import okhttp3.Request;
+import okhttp3.RequestBody;
 import okhttp3.Response;
 import okhttp3.ResponseBody;
+import okio.Buffer;
+import okio.BufferedSink;
+import okio.BufferedSource;
+import okio.Okio;
+import okio.Source;
 import org.brotli.dec.BrotliInputStream;
 import org.json.JSONArray;
 import org.json.JSONObject;
 
 public class DownloadService extends Worker {
 
-    public static final String TAG = "Capacitor-updater";
+    private static Logger logger;
+
+    public static void setLogger(Logger loggerInstance) {
+        logger = loggerInstance;
+    }
+
     public static final String URL = "URL";
     public static final String ID = "id";
     public static final String PERCENT = "percent";
@@ -50,12 +66,60 @@ public class DownloadService extends Worker {
     public static final String CHECKSUM = "checksum";
     public static final String PUBLIC_KEY = "publickey";
     public static final String IS_MANIFEST = "is_manifest";
+    public static final String APP_ID = "app_id";
+    public static final String pluginVersion = "plugin_version";
+    public static final String STATS_URL = "stats_url";
+    public static final String DEVICE_ID = "device_id";
+    public static final String CUSTOM_ID = "custom_id";
+    public static final String VERSION_BUILD = "version_build";
+    public static final String VERSION_CODE = "version_code";
+    public static final String VERSION_OS = "version_os";
+    public static final String DEFAULT_CHANNEL = "default_channel";
+    public static final String IS_PROD = "is_prod";
+    public static final String IS_EMULATOR = "is_emulator";
     private static final String UPDATE_FILE = "update.dat";
 
-    private final OkHttpClient client = new OkHttpClient.Builder().protocols(Arrays.asList(Protocol.HTTP_2, Protocol.HTTP_1_1)).build();
+    // Shared OkHttpClient to prevent resource leaks
+    protected static OkHttpClient sharedClient;
+    private static String currentAppId = "unknown";
+    private static String currentPluginVersion = "unknown";
+    private static String currentVersionOs = "unknown";
+
+    // Initialize shared client with User-Agent interceptor
+    static {
+        sharedClient = new OkHttpClient.Builder()
+            .protocols(Arrays.asList(Protocol.HTTP_2, Protocol.HTTP_1_1))
+            .addInterceptor((chain) -> {
+                Request originalRequest = chain.request();
+                String userAgent =
+                    "CapacitorUpdater/" +
+                    (currentPluginVersion != null ? currentPluginVersion : "unknown") +
+                    " (" +
+                    (currentAppId != null ? currentAppId : "unknown") +
+                    ") android/" +
+                    (currentVersionOs != null ? currentVersionOs : "unknown");
+                Request requestWithUserAgent = originalRequest.newBuilder().header("User-Agent", userAgent).build();
+                return chain.proceed(requestWithUserAgent);
+            })
+            .build();
+    }
+
+    // Method to update User-Agent values
+    public static void updateUserAgent(String appId, String pluginVersion, String versionOs) {
+        currentAppId = appId != null ? appId : "unknown";
+        currentPluginVersion = pluginVersion != null ? pluginVersion : "unknown";
+        currentVersionOs = versionOs != null ? versionOs : "unknown";
+        logger.debug(
+            "Updated User-Agent: CapacitorUpdater/" + currentPluginVersion + " (" + currentAppId + ") android/" + currentVersionOs
+        );
+    }
 
     public DownloadService(@NonNull Context context, @NonNull WorkerParameters params) {
         super(context, params);
+        // Use shared client - no need to create new instances
+
+        // Clean up old temporary files on service initialization
+        cleanupOldTempFiles(getApplicationContext().getCacheDir());
     }
 
     private void setProgress(int percent) {
@@ -79,6 +143,11 @@ public class DownloadService extends Worker {
         return Result.success(output);
     }
 
+    private String getInputString(String key, String fallback) {
+        String value = getInputData().getString(key);
+        return value != null ? value : fallback;
+    }
+
     @NonNull
     @Override
     public Result doWork() {
@@ -93,7 +162,7 @@ public class DownloadService extends Worker {
             String publicKey = getInputData().getString(PUBLIC_KEY);
             boolean isManifest = getInputData().getBoolean(IS_MANIFEST, false);
 
-            Log.d(TAG, "doWork isManifest: " + isManifest);
+            logger.debug("doWork isManifest: " + isManifest);
 
             if (isManifest) {
                 JSONArray manifest = DataManager.getInstance().getAndClearManifest();
@@ -101,7 +170,7 @@ public class DownloadService extends Worker {
                     handleManifestDownload(id, documentsDir, dest, version, sessionKey, publicKey, manifest.toString());
                     return createSuccessResult(dest, version, sessionKey, checksum, true);
                 } else {
-                    Log.e(TAG, "Manifest is null");
+                    logger.error("Manifest is null");
                     return createFailureResult("Manifest is null");
                 }
             } else {
@@ -109,7 +178,6 @@ public class DownloadService extends Worker {
                 return createSuccessResult(dest, version, sessionKey, checksum, false);
             }
         } catch (Exception e) {
-            Log.e(TAG, "Error in doWork", e);
             return createFailureResult(e.getMessage());
         }
     }
@@ -124,6 +192,62 @@ public class DownloadService extends Worker {
         return percent;
     }
 
+    private void sendStatsAsync(String action, String version) {
+        try {
+            String statsUrl = getInputData().getString(STATS_URL);
+            if (statsUrl == null || statsUrl.isEmpty()) {
+                return;
+            }
+
+            JSONObject json = new JSONObject();
+            json.put("platform", "android");
+            json.put("app_id", getInputString(APP_ID, "unknown"));
+            json.put("plugin_version", getInputString(pluginVersion, "unknown"));
+            json.put("version_name", version != null ? version : "");
+            json.put("old_version_name", "");
+            json.put("action", action);
+            json.put("device_id", getInputString(DEVICE_ID, ""));
+            json.put("custom_id", getInputString(CUSTOM_ID, ""));
+            json.put("version_build", getInputString(VERSION_BUILD, ""));
+            json.put("version_code", getInputString(VERSION_CODE, ""));
+            json.put("version_os", getInputString(VERSION_OS, currentVersionOs));
+            json.put("defaultChannel", getInputString(DEFAULT_CHANNEL, ""));
+            json.put("is_prod", getInputData().getBoolean(IS_PROD, true));
+            json.put("is_emulator", getInputData().getBoolean(IS_EMULATOR, false));
+
+            Request request = new Request.Builder()
+                .url(statsUrl)
+                .post(RequestBody.create(json.toString(), MediaType.get("application/json")))
+                .build();
+
+            sharedClient
+                .newCall(request)
+                .enqueue(
+                    new Callback() {
+                        @Override
+                        public void onFailure(@NonNull Call call, @NonNull IOException e) {
+                            if (logger != null) {
+                                logger.error("Failed to send stats: " + e.getMessage());
+                            }
+                        }
+
+                        @Override
+                        public void onResponse(@NonNull Call call, @NonNull Response response) {
+                            try (ResponseBody body = response.body()) {
+                                // nothing else to do, just closing body
+                            } catch (Exception ignored) {} finally {
+                                response.close();
+                            }
+                        }
+                    }
+                );
+        } catch (Exception e) {
+            if (logger != null) {
+                logger.error("sendStatsAsync error: " + e.getMessage());
+            }
+        }
+    }
+
     private void handleManifestDownload(
         String id,
         String documentsDir,
@@ -134,7 +258,11 @@ public class DownloadService extends Worker {
         String manifestString
     ) {
         try {
-            Log.d(TAG, "handleManifestDownload");
+            logger.debug("handleManifestDownload");
+
+            // Send stats for manifest download start
+            sendStatsAsync("download_manifest_start", version);
+
             JSONArray manifest = new JSONArray(manifestString);
             File destFolder = new File(documentsDir, dest);
             File cacheFolder = new File(getApplicationContext().getCacheDir(), "capgo_downloads");
@@ -163,32 +291,52 @@ public class DownloadService extends Worker {
                 String fileHash = entry.getString("file_hash");
                 String downloadUrl = entry.getString("download_url");
 
-                File targetFile = new File(destFolder, fileName);
-                File cacheFile = new File(cacheFolder, fileHash + "_" + new File(fileName).getName());
+                if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                    try {
+                        fileHash = CryptoCipher.decryptChecksum(fileHash, publicKey);
+                    } catch (Exception e) {
+                        logger.error("Error decrypting checksum for " + fileName + "fileHash: " + fileHash);
+                        hasError.set(true);
+                        continue;
+                    }
+                }
+
+                final String finalFileHash = fileHash;
+
+                // Check if file is a Brotli file and remove .br extension from target
+                boolean isBrotli = fileName.endsWith(".br");
+                String targetFileName = isBrotli ? fileName.substring(0, fileName.length() - 3) : fileName;
+
+                File targetFile = new File(destFolder, targetFileName);
+                File cacheFile = new File(cacheFolder, finalFileHash + "_" + new File(fileName).getName());
                 File builtinFile = new File(builtinFolder, fileName);
 
                 // Ensure parent directories of the target file exist
                 if (!Objects.requireNonNull(targetFile.getParentFile()).exists() && !targetFile.getParentFile().mkdirs()) {
-                    throw new IOException("Failed to create parent directory for: " + targetFile.getAbsolutePath());
+                    logger.error("Failed to create parent directory for: " + targetFile.getAbsolutePath());
+                    hasError.set(true);
+                    continue;
                 }
 
+                final boolean finalIsBrotli = isBrotli;
                 Future<?> future = executor.submit(() -> {
                     try {
-                        if (builtinFile.exists() && verifyChecksum(builtinFile, fileHash)) {
+                        if (builtinFile.exists() && verifyChecksum(builtinFile, finalFileHash)) {
                             copyFile(builtinFile, targetFile);
-                            Log.d(TAG, "using builtin file " + fileName);
-                        } else if (cacheFile.exists() && verifyChecksum(cacheFile, fileHash)) {
+                            logger.debug("using builtin file " + fileName);
+                        } else if (cacheFile.exists() && verifyChecksum(cacheFile, finalFileHash)) {
                             copyFile(cacheFile, targetFile);
-                            Log.d(TAG, "already cached " + fileName);
+                            logger.debug("already cached " + fileName);
                         } else {
-                            downloadAndVerify(downloadUrl, targetFile, cacheFile, fileHash, sessionKey, publicKey);
+                            downloadAndVerify(downloadUrl, targetFile, cacheFile, finalFileHash, sessionKey, publicKey, finalIsBrotli);
                         }
 
                         long completed = completedFiles.incrementAndGet();
                         int percent = calcTotalPercent(completed, totalFiles);
                         setProgress(percent);
                     } catch (Exception e) {
-                        Log.e(TAG, "Error processing file: " + fileName, e);
+                        logger.error("Error processing file: " + fileName + " " + e.getMessage());
+                        sendStatsAsync("download_manifest_file_fail", version + ":" + fileName);
                         hasError.set(true);
                     }
                 });
@@ -200,7 +348,7 @@ public class DownloadService extends Worker {
                 try {
                     future.get();
                 } catch (Exception e) {
-                    Log.e(TAG, "Error waiting for download", e);
+                    logger.error("Error waiting for download " + e.getMessage());
                     hasError.set(true);
                 }
             }
@@ -216,10 +364,15 @@ public class DownloadService extends Worker {
             }
 
             if (hasError.get()) {
+                logger.error("One or more files failed to download");
                 throw new IOException("One or more files failed to download");
             }
+
+            // Send stats for manifest download complete
+            sendStatsAsync("download_manifest_complete", version);
         } catch (Exception e) {
-            Log.e(TAG, "Error in handleManifestDownload", e);
+            logger.error("Error in handleManifestDownload " + e.getMessage());
+            throw new RuntimeException(e.getLocalizedMessage());
         }
     }
 
@@ -232,96 +385,163 @@ public class DownloadService extends Worker {
         String sessionKey,
         String checksum
     ) {
+        // Send stats for zip download start
+        sendStatsAsync("download_zip_start", version);
+
         File target = new File(documentsDir, dest);
-        File infoFile = new File(documentsDir, UPDATE_FILE); // The file where the download progress (how much byte
-        // downloaded) is stored
-        File tempFile = new File(documentsDir, "temp" + ".tmp"); // Temp file, where the downloaded data is stored
+        File infoFile = new File(documentsDir, UPDATE_FILE);
+        File tempFile = new File(documentsDir, "temp" + ".tmp");
+
+        // Check available disk space before starting
+        long availableSpace = target.getParentFile().getUsableSpace();
+        long estimatedSize = 50 * 1024 * 1024; // 50MB default estimate
+        if (availableSpace < estimatedSize * 2) {
+            throw new RuntimeException("insufficient_disk_space");
+        }
+
+        HttpURLConnection httpConn = null;
+        InputStream inputStream = null;
+        FileOutputStream outputStream = null;
+        BufferedReader reader = null;
+        BufferedWriter writer = null;
+
         try {
             URL u = new URL(url);
-            HttpURLConnection httpConn = null;
-            try {
-                httpConn = (HttpURLConnection) u.openConnection();
+            httpConn = (HttpURLConnection) u.openConnection();
 
-                // Reading progress file (if exist)
-                long downloadedBytes = 0;
+            // Set reasonable timeouts
+            httpConn.setConnectTimeout(30000); // 30 seconds
+            httpConn.setReadTimeout(60000); // 60 seconds
 
-                if (infoFile.exists() && tempFile.exists()) {
-                    try (BufferedReader reader = new BufferedReader(new FileReader(infoFile))) {
-                        String updateVersion = reader.readLine();
-                        if (!updateVersion.equals(version)) {
-                            clearDownloadData(documentsDir);
-                        } else {
-                            downloadedBytes = tempFile.length();
-                        }
+            // Reading progress file (if exist)
+            long downloadedBytes = 0;
+
+            if (infoFile.exists() && tempFile.exists()) {
+                try {
+                    reader = new BufferedReader(new FileReader(infoFile));
+                    String updateVersion = reader.readLine();
+                    if (updateVersion != null && !updateVersion.equals(version)) {
+                        clearDownloadData(documentsDir);
+                    } else {
+                        downloadedBytes = tempFile.length();
+                    }
+                } finally {
+                    if (reader != null) {
+                        try {
+                            reader.close();
+                        } catch (Exception ignored) {}
                     }
-                } else {
-                    clearDownloadData(documentsDir);
                 }
+            } else {
+                clearDownloadData(documentsDir);
+            }
+
+            if (downloadedBytes > 0) {
+                httpConn.setRequestProperty("Range", "bytes=" + downloadedBytes + "-");
+            }
+
+            int responseCode = httpConn.getResponseCode();
 
-                if (downloadedBytes > 0) {
-                    httpConn.setRequestProperty("Range", "bytes=" + downloadedBytes + "-");
+            if (responseCode == HttpURLConnection.HTTP_OK || responseCode == HttpURLConnection.HTTP_PARTIAL) {
+                long contentLength = httpConn.getContentLength() + downloadedBytes;
+
+                // Check if we have enough space for the actual file
+                if (contentLength > 0 && availableSpace < contentLength * 2) {
+                    throw new RuntimeException("insufficient_disk_space");
                 }
 
-                int responseCode = httpConn.getResponseCode();
+                try {
+                    inputStream = httpConn.getInputStream();
+                    outputStream = new FileOutputStream(tempFile, downloadedBytes > 0);
+
+                    if (downloadedBytes == 0) {
+                        writer = new BufferedWriter(new FileWriter(infoFile));
+                        writer.write(String.valueOf(version));
+                        writer.close();
+                        writer = null;
+                    }
 
-                if (responseCode == HttpURLConnection.HTTP_OK || responseCode == HttpURLConnection.HTTP_PARTIAL) {
-                    long contentLength = httpConn.getContentLength() + downloadedBytes;
+                    byte[] buffer = new byte[8192]; // Larger buffer for better performance
+                    int lastNotifiedPercent = 0;
+                    int bytesRead;
 
-                    try (
-                        InputStream inputStream = httpConn.getInputStream();
-                        FileOutputStream outputStream = new FileOutputStream(tempFile, downloadedBytes > 0)
-                    ) {
-                        if (downloadedBytes == 0) {
-                            try (BufferedWriter writer = new BufferedWriter(new FileWriter(infoFile))) {
-                                writer.write(String.valueOf(version));
-                            }
-                        }
-                        // Updating the info file
-                        try (BufferedWriter writer = new BufferedWriter(new FileWriter(infoFile))) {
-                            writer.write(String.valueOf(version));
+                    while ((bytesRead = inputStream.read(buffer)) != -1) {
+                        outputStream.write(buffer, 0, bytesRead);
+                        downloadedBytes += bytesRead;
+
+                        // Flush every 1MB to ensure progress is saved
+                        if (downloadedBytes % (1024 * 1024) == 0) {
+                            outputStream.flush();
                         }
 
-                        int bytesRead = -1;
-                        byte[] buffer = new byte[4096];
-                        int lastNotifiedPercent = 0;
-                        while ((bytesRead = inputStream.read(buffer)) != -1) {
-                            outputStream.write(buffer, 0, bytesRead);
-                            downloadedBytes += bytesRead;
-                            // Saving progress (flushing every 100 Ko)
-                            if (downloadedBytes % 102400 == 0) {
-                                outputStream.flush();
-                            }
-                            // Computing percentage
-                            int percent = calcTotalPercent(downloadedBytes, contentLength);
-                            while (lastNotifiedPercent + 10 <= percent) {
-                                lastNotifiedPercent += 10;
-                                // Artificial delay using CPU-bound calculation to take ~5 seconds
-                                double result = 0;
-                                setProgress(lastNotifiedPercent);
-                            }
+                        // Computing percentage
+                        int percent = calcTotalPercent(downloadedBytes, contentLength);
+                        if (percent >= lastNotifiedPercent + 10) {
+                            lastNotifiedPercent = (percent / 10) * 10;
+                            setProgress(lastNotifiedPercent);
                         }
+                    }
+
+                    // Final flush
+                    outputStream.flush();
+                    outputStream.close();
+                    outputStream = null;
 
-                        outputStream.close();
-                        inputStream.close();
+                    inputStream.close();
+                    inputStream = null;
 
-                        // Rename the temp file with the final name (dest)
-                        tempFile.renameTo(new File(documentsDir, dest));
-                        infoFile.delete();
+                    // Rename the temp file with the final name (dest)
+                    if (!tempFile.renameTo(new File(documentsDir, dest))) {
+                        throw new RuntimeException("Failed to rename temp file to final destination");
                     }
-                } else {
                     infoFile.delete();
+
+                    // Send stats for zip download complete
+                    sendStatsAsync("download_zip_complete", version);
+                } catch (OutOfMemoryError e) {
+                    logger.error("Out of memory during download: " + e.getMessage());
+                    // Try to free some memory
+                    System.gc();
+                    throw new RuntimeException("low_mem_fail");
+                } finally {
+                    // Ensure all resources are closed
+                    if (outputStream != null) {
+                        try {
+                            outputStream.close();
+                        } catch (Exception ignored) {}
+                    }
+                    if (inputStream != null) {
+                        try {
+                            inputStream.close();
+                        } catch (Exception ignored) {}
+                    }
+                    if (writer != null) {
+                        try {
+                            writer.close();
+                        } catch (Exception ignored) {}
+                    }
                 }
-            } finally {
-                if (httpConn != null) {
-                    httpConn.disconnect();
-                }
+            } else {
+                infoFile.delete();
+                throw new RuntimeException("HTTP error: " + responseCode);
             }
         } catch (OutOfMemoryError e) {
-            e.printStackTrace();
+            logger.error("Critical memory error: " + e.getMessage());
+            System.gc(); // Suggest garbage collection
             throw new RuntimeException("low_mem_fail");
+        } catch (SecurityException e) {
+            logger.error("Security error during download: " + e.getMessage());
+            throw new RuntimeException("security_error: " + e.getMessage());
         } catch (Exception e) {
-            e.printStackTrace();
-            throw new RuntimeException(e.getLocalizedMessage());
+            logger.error("Download error: " + e.getMessage());
+            throw new RuntimeException(e.getMessage());
+        } finally {
+            // Ensure connection is closed
+            if (httpConn != null) {
+                try {
+                    httpConn.disconnect();
+                } catch (Exception ignored) {}
+            }
         }
     }
 
@@ -334,7 +554,8 @@ public class DownloadService extends Worker {
             infoFile.createNewFile();
             tempFile.createNewFile();
         } catch (IOException e) {
-            e.printStackTrace();
+            logger.error("Error in clearDownloadData " + e.getMessage());
+            // not a fatal error, so we don't throw an exception
         }
     }
 
@@ -357,67 +578,102 @@ public class DownloadService extends Worker {
         File cacheFile,
         String expectedHash,
         String sessionKey,
-        String publicKey
+        String publicKey,
+        boolean isBrotli
     ) throws Exception {
-        Log.d(TAG, "downloadAndVerify " + downloadUrl);
+        logger.debug("downloadAndVerify " + downloadUrl);
 
         Request request = new Request.Builder().url(downloadUrl).build();
 
+        // targetFile is already the final destination without .br extension
+        File finalTargetFile = targetFile;
+
         // Create a temporary file for the compressed data
-        File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".br");
+        File compressedFile = new File(getApplicationContext().getCacheDir(), "temp_" + targetFile.getName() + ".tmp");
 
-        try (Response response = client.newCall(request).execute()) {
-            if (!response.isSuccessful()) {
-                throw new IOException("Unexpected response code: " + response.code());
-            }
+        try {
+            try (Response response = sharedClient.newCall(request).execute()) {
+                if (!response.isSuccessful()) {
+                    sendStatsAsync("download_manifest_file_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
+                    throw new IOException("Unexpected response code: " + response.code());
+                }
 
-            // Download compressed file
-            try (ResponseBody responseBody = response.body(); FileOutputStream compressedFos = new FileOutputStream(compressedFile)) {
+                // Download compressed file atomically
+                ResponseBody responseBody = response.body();
                 if (responseBody == null) {
                     throw new IOException("Response body is null");
                 }
 
-                byte[] buffer = new byte[8192];
-                int bytesRead;
-                try (InputStream inputStream = responseBody.byteStream()) {
-                    while ((bytesRead = inputStream.read(buffer)) != -1) {
-                        compressedFos.write(buffer, 0, bytesRead);
-                    }
+                // Use OkIO for atomic write
+                writeFileAtomic(compressedFile, responseBody.byteStream(), null);
+
+                if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+                    logger.debug("Decrypting file " + targetFile.getName());
+                    CryptoCipher.decryptFile(compressedFile, publicKey, sessionKey);
                 }
-            }
 
-            String decryptedExpectedHash = expectedHash;
+                // Only decompress if file has .br extension
+                if (isBrotli) {
+                    // Use new decompression method with atomic write
+                    try (FileInputStream fis = new FileInputStream(compressedFile)) {
+                        byte[] compressedData = new byte[(int) compressedFile.length()];
+                        fis.read(compressedData);
+                        byte[] decompressedData;
+                        try {
+                            decompressedData = decompressBrotli(compressedData, targetFile.getName());
+                        } catch (IOException e) {
+                            sendStatsAsync(
+                                "download_manifest_brotli_fail",
+                                getInputData().getString(VERSION) + ":" + finalTargetFile.getName()
+                            );
+                            throw e;
+                        }
 
-            if (!publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
-                Log.d(CapacitorUpdater.TAG + " DLSrv", "Decrypting file " + targetFile.getName());
-                CryptoCipherV2.decryptFile(compressedFile, publicKey, sessionKey);
-                decryptedExpectedHash = CryptoCipherV2.decryptChecksum(decryptedExpectedHash, publicKey);
-            }
+                        // Write decompressed data atomically
+                        try (java.io.ByteArrayInputStream bais = new java.io.ByteArrayInputStream(decompressedData)) {
+                            writeFileAtomic(finalTargetFile, bais, null);
+                        }
+                    }
+                } else {
+                    // Just copy the file without decompression using atomic operation
+                    try (FileInputStream fis = new FileInputStream(compressedFile)) {
+                        writeFileAtomic(finalTargetFile, fis, null);
+                    }
+                }
 
-            // Decompress the file
-            try (
-                FileInputStream fis = new FileInputStream(compressedFile);
-                BrotliInputStream brotliInputStream = new BrotliInputStream(fis);
-                FileOutputStream fos = new FileOutputStream(targetFile)
-            ) {
-                byte[] buffer = new byte[8192];
-                int len;
-                while ((len = brotliInputStream.read(buffer)) != -1) {
-                    fos.write(buffer, 0, len);
+                // Delete the compressed file
+                compressedFile.delete();
+                String calculatedHash = CryptoCipher.calcChecksum(finalTargetFile);
+                CryptoCipher.logChecksumInfo("Calculated checksum", calculatedHash);
+                CryptoCipher.logChecksumInfo("Expected checksum", expectedHash);
+
+                // Verify checksum
+                if (calculatedHash.equals(expectedHash)) {
+                    // Only cache if checksum is correct - use atomic copy
+                    try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
+                        writeFileAtomic(cacheFile, fis, expectedHash);
+                    }
+                } else {
+                    finalTargetFile.delete();
+                    sendStatsAsync("download_manifest_checksum_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
+                    throw new IOException(
+                        "Checksum verification failed for: " +
+                            downloadUrl +
+                            " " +
+                            targetFile.getName() +
+                            " expected: " +
+                            expectedHash +
+                            " calculated: " +
+                            calculatedHash
+                    );
                 }
             }
-
-            // Delete the compressed file
-            compressedFile.delete();
-            String calculatedHash = CryptoCipherV2.calcChecksum(targetFile);
-
-            // Verify checksum
-            if (calculatedHash.equals(decryptedExpectedHash)) {
-                // Only cache if checksum is correct
-                copyFile(targetFile, cacheFile);
-            } else {
-                targetFile.delete();
-                throw new IOException("Checksum verification failed for " + targetFile.getName());
+        } catch (Exception e) {
+            throw new IOException("Error in downloadAndVerify: " + e.getMessage());
+        } finally {
+            // Always cleanup the compressed temp file if it still exists
+            if (compressedFile.exists()) {
+                compressedFile.delete();
             }
         }
     }
@@ -434,14 +690,14 @@ public class DownloadService extends Worker {
 
     private String calculateFileHash(File file) throws Exception {
         MessageDigest digest = MessageDigest.getInstance("SHA-256");
-        FileInputStream fis = new FileInputStream(file);
         byte[] byteArray = new byte[1024];
         int bytesCount = 0;
 
-        while ((bytesCount = fis.read(byteArray)) != -1) {
-            digest.update(byteArray, 0, bytesCount);
+        try (FileInputStream fis = new FileInputStream(file)) {
+            while ((bytesCount = fis.read(byteArray)) != -1) {
+                digest.update(byteArray, 0, bytesCount);
+            }
         }
-        fis.close();
 
         byte[] bytes = digest.digest();
         StringBuilder sb = new StringBuilder();
@@ -450,4 +706,112 @@ public class DownloadService extends Worker {
         }
         return sb.toString();
     }
+
+    private byte[] decompressBrotli(byte[] data, String fileName) throws IOException {
+        // Validate input
+        if (data == null) {
+            logger.error("Error: Null data received for " + fileName);
+            throw new IOException("Null data received");
+        }
+
+        // Handle empty files
+        if (data.length == 0) {
+            return new byte[0];
+        }
+
+        // Handle the special EMPTY_BROTLI_STREAM case
+        if (data.length == 3 && data[0] == 0x1B && data[1] == 0x00 && data[2] == 0x06) {
+            return new byte[0];
+        }
+
+        // For small files, check if it's a minimal Brotli wrapper
+        if (data.length > 3) {
+            try {
+                // Handle our minimal wrapper pattern
+                if (data[0] == 0x1B && data[1] == 0x00 && data[2] == 0x06 && data[data.length - 1] == 0x03) {
+                    return Arrays.copyOfRange(data, 3, data.length - 1);
+                }
+
+                // Handle brotli.compress minimal wrapper (quality 0)
+                if (data[0] == 0x0b && data[1] == 0x02 && data[2] == (byte) 0x80 && data[data.length - 1] == 0x03) {
+                    return Arrays.copyOfRange(data, 3, data.length - 1);
+                }
+            } catch (ArrayIndexOutOfBoundsException e) {
+                logger.error("Error: Malformed data for " + fileName);
+                throw new IOException("Malformed data structure");
+            }
+        }
+
+        // For all other cases, try standard decompression
+        try (
+            ByteArrayInputStream bis = new ByteArrayInputStream(data);
+            BrotliInputStream brotliInputStream = new BrotliInputStream(bis);
+            ByteArrayOutputStream bos = new ByteArrayOutputStream()
+        ) {
+            byte[] buffer = new byte[8192];
+            int len;
+            while ((len = brotliInputStream.read(buffer)) != -1) {
+                bos.write(buffer, 0, len);
+            }
+            return bos.toByteArray();
+        } catch (IOException e) {
+            logger.error("Error: Brotli process failed for " + fileName + ". Status: " + e.getMessage());
+            // Add hex dump for debugging
+            StringBuilder hexDump = new StringBuilder();
+            for (int i = 0; i < Math.min(32, data.length); i++) {
+                hexDump.append(String.format("%02x ", data[i]));
+            }
+            logger.error("Error: Raw data (" + fileName + "): " + hexDump.toString());
+            throw e;
+        }
+    }
+
+    /**
+     * Atomically write data to a file using OkIO
+     */
+    private void writeFileAtomic(File targetFile, InputStream inputStream, String expectedChecksum) throws IOException {
+        File tempFile = new File(targetFile.getParent(), targetFile.getName() + ".tmp");
+
+        try {
+            // Write to temp file first using OkIO
+            try (BufferedSink sink = Okio.buffer(Okio.sink(tempFile)); BufferedSource source = Okio.buffer(Okio.source(inputStream))) {
+                sink.writeAll(source);
+            }
+
+            // Verify checksum if provided
+            if (expectedChecksum != null && !expectedChecksum.isEmpty()) {
+                String actualChecksum = CryptoCipher.calcChecksum(tempFile);
+                if (!expectedChecksum.equalsIgnoreCase(actualChecksum)) {
+                    tempFile.delete();
+                    throw new IOException("Checksum verification failed");
+                }
+            }
+
+            // Atomic rename (on same filesystem)
+            Files.move(tempFile.toPath(), targetFile.toPath(), StandardCopyOption.REPLACE_EXISTING);
+        } catch (Exception e) {
+            // Clean up temp file on error
+            if (tempFile.exists()) {
+                tempFile.delete();
+            }
+            throw new IOException("Failed to write file atomically: " + e.getMessage(), e);
+        }
+    }
+
+    /**
+     * Clean up old temporary files
+     */
+    private void cleanupOldTempFiles(File directory) {
+        if (directory == null || !directory.exists()) return;
+
+        File[] tempFiles = directory.listFiles((dir, name) -> name.endsWith(".tmp"));
+        if (tempFiles != null) {
+            long oneHourAgo = System.currentTimeMillis() - 3600000;
+            for (File tempFile : tempFiles) {
+                if (tempFile.lastModified() < oneHourAgo) {
+                    tempFile.delete();
+                }
+            }
+        }
+    }
 }