@capgo/capacitor-updater 8.51.12 → 8.51.13

package/android/src/main/java/ee/forgr/capacitor_updater/CapacitorUpdaterPlugin.java

@@ -146,7 +146,7 @@ public class CapacitorUpdaterPlugin extends Plugin {
     static final int APPLICATION_EXIT_REASON_USER_REQUESTED = 10;
     static final int APPLICATION_EXIT_REASON_DEPENDENCY_DIED = 12;
 
-    private final String pluginVersion = "8.51.12";
+    private final String pluginVersion = "8.51.13";
     private static final String DELAY_CONDITION_PREFERENCES = "";
 
     private SharedPreferences.Editor editor;

package/android/src/main/java/ee/forgr/capacitor_updater/CryptoCipher.java

@@ -369,14 +369,7 @@ public class CryptoCipher {
             while ((length = inputStream.read(buffer)) != -1) {
                 digest.update(buffer, 0, length);
             }
-            byte[] hash = digest.digest();
-            StringBuilder hexString = new StringBuilder();
-            for (byte b : hash) {
-                String hex = Integer.toHexString(0xff & b);
-                if (hex.length() == 1) hexString.append('0');
-                hexString.append(hex);
-            }
-            return hexString.toString();
+            return digestToHex(digest);
         } catch (IOException e) {
             logger.error("Cannot calculate checksum");
             logger.debug("Error: " + e.getMessage());
@@ -384,6 +377,27 @@ public class CryptoCipher {
         }
     }
 
+    static String digestToHex(MessageDigest digest) {
+        byte[] hash = digest.digest();
+        StringBuilder hexString = new StringBuilder(hash.length * 2);
+        for (byte b : hash) {
+            String hex = Integer.toHexString(0xff & b);
+            if (hex.length() == 1) hexString.append('0');
+            hexString.append(hex);
+        }
+        return hexString.toString();
+    }
+
+    static String shortPathKey(String fileName) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            digest.update((fileName == null ? "" : fileName).getBytes(java.nio.charset.StandardCharsets.UTF_8));
+            return digestToHex(digest).substring(0, 16);
+        } catch (java.security.NoSuchAlgorithmException e) {
+            return Integer.toHexString((fileName == null ? "" : fileName).hashCode());
+        }
+    }
+
     private static byte[] createDEREncoding(int tag, byte[] value) {
         if (tag < 0 || tag >= 0xFF) {
             throw new IllegalArgumentException("Currently only single byte tags supported");

package/android/src/main/java/ee/forgr/capacitor_updater/DownloadService.java

@@ -157,6 +157,7 @@ public class DownloadService extends Worker {
 
         // Clean up old temporary files on service initialization
         cleanupOldTempFiles(getApplicationContext().getCacheDir());
+        cleanupOldTempFiles(new File(getApplicationContext().getCacheDir(), "capgo_downloads"));
     }
 
     private void setProgress(int percent) {
@@ -532,7 +533,16 @@ public class DownloadService extends Worker {
                         ) {
                             logger.debug("already cached " + fileName);
                         } else {
-                            downloadAndVerify(downloadUrl, targetFile, cacheFile, finalFileHash, sessionKey, publicKey, finalIsBrotli);
+                            downloadAndVerify(
+                                downloadUrl,
+                                targetFile,
+                                cacheFile,
+                                finalFileHash,
+                                sessionKey,
+                                publicKey,
+                                finalIsBrotli,
+                                fileName
+                            );
                         }
 
                         long completed = completedFiles.incrementAndGet();
@@ -827,96 +837,137 @@ public class DownloadService extends Worker {
         String expectedHash,
         String sessionKey,
         String publicKey,
-        boolean isBrotli
+        boolean isBrotli,
+        String relativeName
     ) throws Exception {
         logger.debug("downloadAndVerify " + downloadUrl);
 
-        Request request = new Request.Builder().url(downloadUrl).build();
-
-        // targetFile is already the final destination without .br extension
         File finalTargetFile = targetFile;
-
-        // Create a temporary file for the compressed data with a unique name to avoid race conditions
-        // between threads processing files with the same basename in different directories
-        File compressedFile = new File(
-            getApplicationContext().getCacheDir(),
-            "temp_" + java.util.UUID.randomUUID().toString() + "_" + targetFile.getName() + ".tmp"
-        );
-
+        File cacheFolder = new File(getApplicationContext().getCacheDir(), "capgo_downloads");
+        if (!cacheFolder.exists() && !cacheFolder.mkdirs()) {
+            throw new IOException("Failed to create cache directory: " + cacheFolder.getAbsolutePath());
+        }
+        File partial = manifestPartialFile(cacheFolder, expectedHash, relativeName);
+        File workFile = null;
+        boolean keepPartial = partial.isFile();
         try {
-            try (Response response = sharedClient.newCall(request).execute()) {
-                if (!response.isSuccessful()) {
+            long existing = partial.isFile() ? partial.length() : 0;
+            Request.Builder builder = new Request.Builder().url(downloadUrl);
+            if (existing > 0) {
+                builder.header("Range", "bytes=" + existing + "-");
+            }
+            try (Response response = sharedClient.newCall(builder.build()).execute()) {
+                int code = response.code();
+                if (code == 416 && existing > 0) {
+                    logger.debug("Range not satisfiable, using existing partial " + partial.getName());
+                    keepPartial = true;
+                } else if (code != HttpURLConnection.HTTP_OK && code != HttpURLConnection.HTTP_PARTIAL) {
                     sendStatsAsync("download_manifest_file_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
-                    throw new IOException("Unexpected response code: " + response.code());
-                }
-
-                // Download compressed file atomically
-                ResponseBody responseBody = response.body();
-                if (responseBody == null) {
-                    throw new IOException("Response body is null");
+                    throw new IOException("Unexpected response code: " + code);
+                } else {
+                    ResponseBody responseBody = response.body();
+                    if (responseBody == null) {
+                        throw new IOException("Response body is null");
+                    }
+                    try {
+                        writeHttpBody(partial, responseBody.byteStream(), code, existing);
+                        keepPartial = true;
+                    } catch (Exception e) {
+                        keepPartial = true;
+                        throw e;
+                    }
                 }
+            }
 
-                // Use OkIO for atomic write
-                writeFileAtomic(compressedFile, responseBody.byteStream(), null);
-
-                if (publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty()) {
+            boolean needDecrypt = publicKey != null && !publicKey.isEmpty() && sessionKey != null && !sessionKey.isEmpty();
+            File source = partial;
+            if (needDecrypt) {
+                workFile = new File(cacheFolder, "work_" + UUID.randomUUID() + "_" + targetFile.getName() + ".tmp");
+                copyFile(partial, workFile);
+                try {
                     logger.debug("Decrypting file " + targetFile.getName());
-                    CryptoCipher.decryptFile(compressedFile, publicKey, sessionKey);
+                    CryptoCipher.decryptFile(workFile, publicKey, sessionKey);
+                    source = workFile;
+                } catch (Exception e) {
+                    keepPartial = false;
+                    throw e;
                 }
+            }
 
-                // Only decompress if file has .br extension
+            try {
                 if (isBrotli) {
-                    try {
-                        decompressBrotli(compressedFile, finalTargetFile, targetFile.getName());
-                    } catch (IOException e) {
-                        sendStatsAsync(
-                            "download_manifest_brotli_fail",
-                            getInputData().getString(VERSION) + ":" + finalTargetFile.getName()
-                        );
-                        throw e;
-                    }
+                    decompressBrotli(source, finalTargetFile, targetFile.getName(), expectedHash);
                 } else {
-                    try (FileInputStream fis = new FileInputStream(compressedFile)) {
-                        writeFileAtomic(finalTargetFile, fis, null);
+                    try (FileInputStream fis = new FileInputStream(source)) {
+                        writeFileAtomic(finalTargetFile, fis, expectedHash);
                     }
                 }
-
-                // Delete the compressed file
-                compressedFile.delete();
-                String calculatedHash = CryptoCipher.calcChecksum(finalTargetFile);
-                CryptoCipher.logChecksumInfo("Calculated checksum", calculatedHash);
-                CryptoCipher.logChecksumInfo("Expected checksum", expectedHash);
-
-                // Verify checksum
-                if (calculatedHash.equalsIgnoreCase(expectedHash)) {
-                    // Only cache if checksum is correct - use atomic copy
-                    if (cacheFile != null) {
-                        try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
-                            writeFileAtomic(cacheFile, fis, null);
-                        }
+            } catch (IOException e) {
+                String msg = e.getMessage();
+                if (msg != null && msg.contains("Checksum verification failed")) {
+                    if (finalTargetFile.exists() && !finalTargetFile.delete()) {
+                        logger.debug("Failed to delete dest after checksum mismatch");
                     }
-                } else {
-                    finalTargetFile.delete();
                     sendStatsAsync("download_manifest_checksum_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
-                    throw new IOException(
-                        "Checksum verification failed for: " +
-                            downloadUrl +
-                            " " +
-                            targetFile.getName() +
-                            " expected: " +
-                            expectedHash +
-                            " calculated: " +
-                            calculatedHash
-                    );
+                    keepPartial = false;
+                } else if (isBrotli) {
+                    sendStatsAsync("download_manifest_brotli_fail", getInputData().getString(VERSION) + ":" + finalTargetFile.getName());
+                    keepPartial = false;
+                }
+                throw e;
+            }
+
+            CryptoCipher.logChecksumInfo("Calculated checksum", expectedHash);
+            CryptoCipher.logChecksumInfo("Expected checksum", expectedHash);
+
+            if (cacheFile != null) {
+                try (FileInputStream fis = new FileInputStream(finalTargetFile)) {
+                    writeFileAtomic(cacheFile, fis, null);
                 }
             }
+            keepPartial = false;
         } catch (Exception e) {
-            throw new IOException("Error in downloadAndVerify: " + e.getMessage());
+            throw new IOException("Error in downloadAndVerify: " + e.getMessage(), e);
         } finally {
-            // Always cleanup the compressed temp file if it still exists
-            if (compressedFile.exists()) {
-                compressedFile.delete();
+            if (workFile != null && workFile.exists() && !workFile.delete()) {
+                logger.debug("Failed to delete decrypt work file");
+            }
+            if (!keepPartial && partial.exists() && !partial.delete()) {
+                logger.debug("Failed to delete manifest partial " + partial.getName());
+            }
+        }
+    }
+
+    static String safePartialToken(String fileName) {
+        return CryptoCipher.shortPathKey(fileName);
+    }
+
+    static File manifestPartialFile(File cacheDir, String hash, String fileName) {
+        String token = safePartialToken(fileName);
+        if (CapgoUpdater.isSafeCacheHash(hash) && hash.length() == 64) {
+            return new File(cacheDir, "partial_" + hash + "_" + token + ".tmp");
+        }
+        return new File(cacheDir, "temp_" + UUID.randomUUID() + "_" + token + ".tmp");
+    }
+
+    static boolean shouldAppendHttpBody(int statusCode, long existingBytes) {
+        return existingBytes > 0 && statusCode == HttpURLConnection.HTTP_PARTIAL;
+    }
+
+    static void writeHttpBody(File dest, InputStream body, int statusCode, long existingBytes) throws IOException {
+        boolean append = shouldAppendHttpBody(statusCode, existingBytes);
+        byte[] buffer = new byte[CryptoCipher.ioBufferBytes()];
+        try (FileOutputStream fos = new FileOutputStream(dest, append)) {
+            int n;
+            long written = append ? existingBytes : 0;
+            while ((n = body.read(buffer)) != -1) {
+                fos.write(buffer, 0, n);
+                written += n;
+                if (written % (1024 * 1024) == 0) {
+                    fos.flush();
+                }
             }
+            fos.flush();
         }
     }
 
@@ -950,13 +1001,17 @@ public class DownloadService extends Worker {
     }
 
     static void decompressBrotli(File input, File output, String fileName) throws IOException {
+        decompressBrotli(input, output, fileName, null);
+    }
+
+    static void decompressBrotli(File input, File output, String fileName, String expectedChecksum) throws IOException {
         File parent = output.getParentFile();
         if (parent != null) {
             parent.mkdirs();
         }
         long length = input.length();
         if (length == 0) {
-            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), null);
+            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), expectedChecksum);
             return;
         }
 
@@ -971,7 +1026,7 @@ public class DownloadService extends Worker {
         }
 
         if (length == 3 && head[0] == 0x1B && head[1] == 0x00 && head[2] == 0x06) {
-            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), null);
+            writeFileAtomic(output, new ByteArrayInputStream(new byte[0]), expectedChecksum);
             return;
         }
 
@@ -988,14 +1043,14 @@ public class DownloadService extends Worker {
                         }
                         skipped += n;
                     }
-                    writeFileAtomic(output, new BoundedInputStream(fis, length - 4), null);
+                    writeFileAtomic(output, new BoundedInputStream(fis, length - 4), expectedChecksum);
                 }
                 return;
             }
         }
 
         try (FileInputStream fis = new FileInputStream(input); BrotliInputStream brotliInputStream = new BrotliInputStream(fis)) {
-            writeFileAtomic(output, brotliInputStream, null);
+            writeFileAtomic(output, brotliInputStream, expectedChecksum);
         } catch (IOException e) {
             logger.error("Error: Brotli process failed for " + fileName + ". Status: " + e.getMessage());
             StringBuilder hexDump = new StringBuilder();
@@ -1048,6 +1103,7 @@ public class DownloadService extends Worker {
 
     /**
      * Atomically write a stream to a file using the 256 KiB IO buffer.
+     * When expectedChecksum is set, SHA-256 is hashed during the write.
      */
     static void writeFileAtomic(File targetFile, InputStream inputStream, String expectedChecksum) throws IOException {
         File tempFile = File.createTempFile("capgo-", ".tmp", targetFile.getParentFile());
@@ -1056,26 +1112,39 @@ public class DownloadService extends Worker {
             // Okio's default segment is 8 KiB. Copy with 256 KiB so 8 MiB wrapper unwraps
             // are not 1000 tiny writes.
             byte[] buffer = new byte[CryptoCipher.ioBufferBytes()];
+            MessageDigest digest = null;
+            if (expectedChecksum != null && !expectedChecksum.isEmpty()) {
+                try {
+                    digest = MessageDigest.getInstance("SHA-256");
+                } catch (java.security.NoSuchAlgorithmException e) {
+                    throw new IOException("SHA-256 algorithm not available", e);
+                }
+            }
             try (FileOutputStream fos = new FileOutputStream(tempFile)) {
                 int n;
                 while ((n = inputStream.read(buffer)) != -1) {
+                    if (digest != null) {
+                        digest.update(buffer, 0, n);
+                    }
                     fos.write(buffer, 0, n);
                 }
             }
 
-            // Verify checksum if provided
-            if (expectedChecksum != null && !expectedChecksum.isEmpty()) {
-                String actualChecksum = CryptoCipher.calcChecksum(tempFile);
+            if (digest != null) {
+                String actualChecksum = CryptoCipher.digestToHex(digest);
                 if (!expectedChecksum.equalsIgnoreCase(actualChecksum)) {
-                    tempFile.delete();
-                    throw new IOException("Checksum verification failed");
+                    throw new IOException("Checksum verification failed expected: " + expectedChecksum + " calculated: " + actualChecksum);
                 }
             }
 
             // Atomic rename (on same filesystem). renameTo works on API 24; Files.move does not.
             CryptoCipher.replaceFile(tempFile, targetFile);
+        } catch (IOException e) {
+            if (tempFile.exists()) {
+                tempFile.delete();
+            }
+            throw e;
         } catch (Exception e) {
-            // Clean up temp file on error
             if (tempFile.exists()) {
                 tempFile.delete();
             }

package/ios/Sources/CapacitorUpdaterPlugin/CapacitorUpdaterPlugin.swift

@@ -96,7 +96,7 @@ public class CapacitorUpdaterPlugin: CAPPlugin, CAPBridgedPlugin {
     deinit {
         implementation.shutdown()
     }
-    private let pluginVersion: String = "8.51.12"
+    private let pluginVersion: String = "8.51.13"
     private let launchStartedAtMs = Int64(Date().timeIntervalSince1970 * 1000)
     static let updateUrlDefault = "https://plugin.capgo.app/updates"
     static let statsUrlDefault = "https://plugin.capgo.app/stats"

package/ios/Sources/CapacitorUpdaterPlugin/CapgoUpdater.swift

@@ -305,9 +305,47 @@ import UIKit
         return fileManager.fileExists(atPath: fallback.path) ? fallback : nil
     }
 
-    private func storeDownloadedFile(_ downloadedFileURL: URL, at tempPath: URL, existingBytes: Int64, response: HTTPURLResponse?) throws {
+    static func shouldAppendHttpBody(statusCode: Int, existingBytes: Int64) -> Bool {
+        existingBytes > 0 && statusCode == 206
+    }
+
+    static func safePartialToken(_ fileName: String) -> String {
+        CryptoCipher.shortPathKey(fileName)
+    }
+
+    static func manifestPartialURL(cacheFolder: URL, hash: String, fileName: String) -> URL {
+        let token = safePartialToken(fileName)
+        if isSafeCacheHash(hash) && hash.count == 64 {
+            return cacheFolder.appendingPathComponent("partial_\(hash)_\(token).tmp")
+        }
+        return cacheFolder.appendingPathComponent("temp_\(UUID().uuidString)_\(token).tmp")
+    }
+
+    private func cleanupOldManifestPartials() {
+        let cutoff = Date().addingTimeInterval(-3600)
+        guard let files = try? FileManager.default.contentsOfDirectory(
+            at: cacheFolder,
+            includingPropertiesForKeys: [.contentModificationDateKey],
+            options: [.skipsHiddenFiles]
+        ) else {
+            return
+        }
+        for url in files {
+            let name = url.lastPathComponent
+            guard name.hasPrefix("partial_") && name.hasSuffix(".tmp") else {
+                continue
+            }
+            let modified = (try? url.resourceValues(forKeys: [.contentModificationDateKey]).contentModificationDate) ?? .distantPast
+            if modified < cutoff {
+                try? FileManager.default.removeItem(at: url)
+            }
+        }
+    }
+
+    func storeDownloadedFile(_ downloadedFileURL: URL, at tempPath: URL, existingBytes: Int64, response: HTTPURLResponse?) throws {
         let fileManager = FileManager.default
-        if existingBytes > 0 && (response?.statusCode == 206 || response == nil) {
+        if Self.shouldAppendHttpBody(statusCode: response?.statusCode ?? 0, existingBytes: existingBytes) ||
+            (existingBytes > 0 && response == nil) {
             let fileHandle = try FileHandle(forWritingTo: tempPath)
             defer {
                 try? fileHandle.close()
@@ -1342,6 +1380,7 @@ import UIKit
         try checkDiskSpace(estimatedSize: estimatedSize)
 
         try FileManager.default.createDirectory(at: cacheFolder, withIntermediateDirectories: true, attributes: nil)
+        cleanupOldManifestPartials()
         try FileManager.default.createDirectory(at: destFolder, withIntermediateDirectories: true, attributes: nil)
 
         // Create and save BundleInfo before starting the download process
@@ -1550,7 +1589,7 @@ import UIKit
             )
         }
 
-        guard let request = createRequest(url: url, method: "GET") else {
+        guard var request = createRequest(url: url, method: "GET") else {
             throw NSError(
                 domain: "ManifestDownloadError",
                 code: 2,
@@ -1558,6 +1597,18 @@ import UIKit
             )
         }
 
+        try FileManager.default.createDirectory(at: cacheFolder, withIntermediateDirectories: true, attributes: nil)
+        let partialURL = Self.manifestPartialURL(cacheFolder: cacheFolder, hash: fileHash, fileName: fileName)
+        let existingBytes: Int64
+        if FileManager.default.fileExists(atPath: partialURL.path) {
+            existingBytes = Int64((try FileManager.default.attributesOfItem(atPath: partialURL.path)[.size] as? NSNumber)?.int64Value ?? 0)
+        } else {
+            existingBytes = 0
+        }
+        if existingBytes > 0 {
+            request.setValue("bytes=\(existingBytes)-", forHTTPHeaderField: "Range")
+        }
+
         let result = performDownloadRequest(request, label: "downloadManifestFile \(fileName)")
         defer {
             if let fileURL = result.fileURL {
@@ -1566,6 +1617,7 @@ import UIKit
         }
 
         if result.timedOut {
+            persistPartialDownload(result, id: bundleId, tempPath: partialURL, existingBytes: existingBytes)
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             throw NSError(
                 domain: NSURLErrorDomain,
@@ -1575,6 +1627,7 @@ import UIKit
         }
 
         if let error = result.error {
+            persistPartialDownload(result, id: bundleId, tempPath: partialURL, existingBytes: existingBytes)
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             self.logger.error("Manifest file download network error")
             self.logger.debug("Bundle: \(bundleId), File: \(fileName), Error: \(error.localizedDescription)")
@@ -1582,12 +1635,24 @@ import UIKit
         }
 
         let statusCode = result.response?.statusCode ?? 200
-        if statusCode < 200 || statusCode >= 300 {
+        if statusCode == 416 && existingBytes > 0 {
+            logger.debug("Range not satisfiable, using existing partial \(partialURL.lastPathComponent)")
+        } else if statusCode < 200 || statusCode >= 300 {
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             throw NSError(domain: "StatusCodeError", code: statusCode, userInfo: [NSLocalizedDescriptionKey: "Failed to fetch. Status code (\(statusCode)) invalid for file \(fileName) at url \(downloadUrl)"])
+        } else {
+            guard let downloadedFileURL = result.fileURL, FileManager.default.fileExists(atPath: downloadedFileURL.path) else {
+                self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
+                throw NSError(
+                    domain: "ManifestDownloadError",
+                    code: 3,
+                    userInfo: [NSLocalizedDescriptionKey: "Manifest file response was empty for \(fileName) at url \(downloadUrl)"]
+                )
+            }
+            try storeDownloadedFile(downloadedFileURL, at: partialURL, existingBytes: existingBytes, response: result.response)
         }
 
-        guard let downloadedFileURL = result.fileURL, FileManager.default.fileExists(atPath: downloadedFileURL.path) else {
+        guard FileManager.default.fileExists(atPath: partialURL.path) else {
             self.sendStats(action: "download_manifest_file_fail", versionName: "\(version):\(fileName)")
             throw NSError(
                 domain: "ManifestDownloadError",
@@ -1596,42 +1661,60 @@ import UIKit
             )
         }
 
+        var workURL: URL?
+        defer {
+            if let workURL {
+                try? FileManager.default.removeItem(at: workURL)
+            }
+        }
+
         do {
-            // Decrypt in place when a session key is present — streamed, not a whole-file copy.
+            var source = partialURL
             if !self.publicKey.isEmpty && !sessionKey.isEmpty {
+                let work = cacheFolder.appendingPathComponent("work_\(UUID().uuidString)_\((fileName as NSString).lastPathComponent)")
+                try FileManager.default.copyItem(at: partialURL, to: work)
+                workURL = work
                 do {
-                    try CryptoCipher.decryptFile(filePath: downloadedFileURL, publicKey: self.publicKey, sessionKey: sessionKey, version: version)
+                    try CryptoCipher.decryptFile(filePath: work, publicKey: self.publicKey, sessionKey: sessionKey, version: version)
                 } catch {
+                    try? FileManager.default.removeItem(at: partialURL)
                     self.sendStats(action: "decrypt_fail", versionName: version)
                     throw error
                 }
+                source = work
             }
 
+            let calculatedChecksum: String
             if isBrotli {
                 do {
-                    try decompressBrotli(from: downloadedFileURL, to: destFilePath, fileName: fileName)
+                    calculatedChecksum = try decompressBrotli(from: source, to: destFilePath, fileName: fileName)
                 } catch {
+                    try? FileManager.default.removeItem(at: partialURL)
                     self.sendStats(action: "download_manifest_brotli_fail", versionName: "\(version):\(destFileName)")
                     throw error
                 }
             } else {
-                try copyItemReplacing(from: downloadedFileURL, to: destFilePath)
+                let handle = try FileHandle(forReadingFrom: source)
+                defer {
+                    try? handle.close()
+                }
+                let length = (try FileManager.default.attributesOfItem(atPath: source.path)[.size] as? NSNumber)?.uint64Value ?? 0
+                calculatedChecksum = try streamCopy(from: handle, count: length, to: destFilePath)
             }
 
-            // Always verify checksum when file_hash is present
-            let calculatedChecksum = CryptoCipher.calcChecksum(filePath: destFilePath)
             CryptoCipher.logChecksumInfo(label: "Calculated checksum", hexChecksum: calculatedChecksum)
             CryptoCipher.logChecksumInfo(label: "Expected checksum", hexChecksum: fileHash)
             if calculatedChecksum != fileHash {
                 try? FileManager.default.removeItem(at: destFilePath)
+                try? FileManager.default.removeItem(at: partialURL)
                 self.sendStats(action: "download_manifest_checksum_fail", versionName: "\(version):\(destFileName)")
                 throw NSError(domain: "ChecksumError", code: 1, userInfo: [NSLocalizedDescriptionKey: "Computed checksum is not equal to required checksum (\(calculatedChecksum) != \(fileHash)) for file \(fileName) at url \(downloadUrl)"])
             }
 
-            // Save to cache (replace stale cache entries from partial or concurrent downloads)
             if let cacheFilePath {
                 try copyItemAtomically(from: destFilePath, to: cacheFilePath)
             }
+            try? FileManager.default.removeItem(at: partialURL)
 
             self.logger.info("Manifest file downloaded and cached")
             self.logger.debug("Bundle: \(bundleId), File: \(fileName), Brotli: \(isBrotli), Encrypted: \(!self.publicKey.isEmpty && !sessionKey.isEmpty)")
@@ -1701,13 +1784,13 @@ import UIKit
 
     /// Stream Brotli from disk to disk. Peek only the 3-byte header and last byte
     /// for the empty/wrapper special cases; never load the whole file.
-    func decompressBrotli(from source: URL, to dest: URL, fileName: String) throws {
+    func decompressBrotli(from source: URL, to dest: URL, fileName: String) throws -> String {
         let fileManager = FileManager.default
         try fileManager.createDirectory(at: dest.deletingLastPathComponent(), withIntermediateDirectories: true, attributes: nil)
         let length = (try fileManager.attributesOfItem(atPath: source.path)[.size] as? NSNumber)?.uint64Value ?? 0
         if length == 0 {
             try Data().write(to: dest, options: .atomic)
-            return
+            return CryptoCipher.RunningChecksum().hex()
         }
 
         let handle = try FileHandle(forReadingFrom: source)
@@ -1724,7 +1807,7 @@ import UIKit
 
         if length == 3 && head.count == 3 && head[0] == 0x1B && head[1] == 0x00 && head[2] == 0x06 {
             try Data().write(to: dest, options: .atomic)
-            return
+            return CryptoCipher.RunningChecksum().hex()
         }
 
         if length > 3 && head.count == 3 && last == 0x03 {
@@ -1732,16 +1815,15 @@ import UIKit
             let isQualityZeroWrapper = head[0] == 0x0b && head[1] == 0x02 && head[2] == 0x80
             if isEmptyWrapper || isQualityZeroWrapper {
                 try handle.seek(toOffset: 3)
-                try streamCopy(from: handle, count: length - 4, to: dest)
-                return
+                return try streamCopy(from: handle, count: length - 4, to: dest)
             }
         }
 
         try handle.seek(toOffset: 0)
-        try streamBrotliDecode(from: handle, to: dest, fileName: fileName)
+        return try streamBrotliDecode(from: handle, to: dest, fileName: fileName)
     }
 
-    private func streamCopy(from handle: FileHandle, count: UInt64, to dest: URL) throws {
+    func streamCopy(from handle: FileHandle, count: UInt64, to dest: URL) throws -> String {
         let fileManager = FileManager.default
         let tempURL = dest.deletingLastPathComponent().appendingPathComponent("capgo-br-\(UUID().uuidString).tmp")
         fileManager.createFile(atPath: tempURL.path, contents: nil)
@@ -1751,6 +1833,7 @@ import UIKit
             try? fileManager.removeItem(at: tempURL)
         }
 
+        let hasher = CryptoCipher.RunningChecksum()
         var remaining = count
         let chunkSize = CryptoCipher.ioBufferBytes()
         while remaining > 0 {
@@ -1758,6 +1841,7 @@ import UIKit
                 let toRead = Int(min(UInt64(chunkSize), remaining))
                 let chunk = try handle.read(upToCount: toRead) ?? Data()
                 if !chunk.isEmpty {
+                    hasher.update(chunk)
                     try output.write(contentsOf: chunk)
                 }
                 return chunk.count
@@ -1769,9 +1853,10 @@ import UIKit
         }
         try output.close()
         try replaceItemAtomically(at: dest, withItemAt: tempURL)
+        return hasher.hex()
     }
 
-    private func streamBrotliDecode(from handle: FileHandle, to dest: URL, fileName: String) throws {
+    private func streamBrotliDecode(from handle: FileHandle, to dest: URL, fileName: String) throws -> String {
         let fileManager = FileManager.default
         let tempURL = dest.deletingLastPathComponent().appendingPathComponent("capgo-br-\(UUID().uuidString).tmp")
         fileManager.createFile(atPath: tempURL.path, contents: nil)
@@ -1780,6 +1865,7 @@ import UIKit
             try? output.close()
             try? fileManager.removeItem(at: tempURL)
         }
+        let hasher = CryptoCipher.RunningChecksum()
 
         let chunkSize = max(CryptoCipher.ioBufferBytes(), 65536)
         var inputBuffer = [UInt8](repeating: 0, count: chunkSize)
@@ -1824,7 +1910,9 @@ import UIKit
                     status = compression_stream_process(streamPointer, flags)
                     let have = chunkSize - streamPointer.pointee.dst_size
                     if have > 0 {
-                        try output.write(contentsOf: Data(bytes: outBase, count: have))
+                        let decoded = Data(bytes: outBase, count: have)
+                        hasher.update(decoded)
+                        try output.write(contentsOf: decoded)
                     }
                     streamPointer.pointee.dst_ptr = outBase
                     streamPointer.pointee.dst_size = chunkSize
@@ -1848,6 +1936,7 @@ import UIKit
 
         try output.close()
         try replaceItemAtomically(at: dest, withItemAt: tempURL)
+        return hasher.hex()
     }
 
     public func download(url: URL, version: String, sessionKey: String, link: String? = nil, comment: String? = nil) throws -> BundleInfo {

package/ios/Sources/CapacitorUpdaterPlugin/CryptoCipher.swift

@@ -198,8 +198,7 @@ public struct CryptoCipher {
                 }
             }) {}
 
-            let digest = sha256.finalize()
-            return digest.compactMap { String(format: "%02x", $0) }.joined()
+            return hexString(from: sha256)
         } catch {
             logger.error("Cannot calculate checksum")
             logger.debug("Path: \(filePath.path), Error: \(error)")
@@ -207,6 +206,32 @@ public struct CryptoCipher {
         }
     }
 
+    final class RunningChecksum {
+        private var sha256 = SHA256()
+
+        func update(_ data: Data) {
+            guard !data.isEmpty else {
+                return
+            }
+            sha256.update(data: data)
+        }
+
+        func hex() -> String {
+            CryptoCipher.hexString(from: sha256)
+        }
+    }
+
+    static func hexString(from sha256: SHA256) -> String {
+        var copy = sha256
+        return copy.finalize().compactMap { String(format: "%02x", $0) }.joined()
+    }
+
+    static func shortPathKey(_ fileName: String) -> String {
+        var sha256 = SHA256()
+        sha256.update(data: Data(fileName.utf8))
+        return String(hexString(from: sha256).prefix(16))
+    }
+
     public static func decryptFile(filePath: URL, publicKey: String, sessionKey: String, version: String) throws {
         if publicKey.isEmpty || sessionKey.isEmpty || sessionKey.components(separatedBy: ":").count != 2 {
             logger.info("Encryption not set, no public key or session, ignored")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-updater",
-  "version": "8.51.12",
+  "version": "8.51.13",
   "license": "MPL-2.0",
   "description": "Live update for capacitor apps",
   "main": "dist/plugin.cjs.js",