@capgo/cordova-updater 8.1.1

package/src/android/app/capgo/cordova/updater/CordovaUpdaterConfig.java

@@ -0,0 +1,56 @@
+package app.capgo.cordova.updater;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.content.res.Resources;
+import androidx.annotation.Nullable;
+
+public class CordovaUpdaterConfig {
+    private final Context context;
+    private final SharedPreferences preferences;
+
+    public CordovaUpdaterConfig(Context context) {
+        this.context = context.getApplicationContext();
+        this.preferences = this.context.getSharedPreferences("CapgoCordovaUpdaterConfig", Context.MODE_PRIVATE);
+    }
+
+    @Nullable
+    public String getString(String key, @Nullable String defaultValue) {
+        String fromPrefs = preferences.getString(prefKey(key), null);
+        if (fromPrefs != null && !fromPrefs.trim().isEmpty()) {
+            return fromPrefs.trim();
+        }
+        int resId = context.getResources().getIdentifier(stringResName(key), "string", context.getPackageName());
+        if (resId != 0) {
+            String value = context.getString(resId);
+            if (value != null && !value.trim().isEmpty()) {
+                return value.trim();
+            }
+        }
+        return defaultValue;
+    }
+
+    public boolean getBoolean(String key, boolean defaultValue) {
+        String value = getString(key, null);
+        if (value == null) return defaultValue;
+        return Boolean.parseBoolean(value);
+    }
+
+    public int getInt(String key, int defaultValue) {
+        String value = getString(key, null);
+        if (value == null) return defaultValue;
+        try { return Integer.parseInt(value.trim()); } catch (NumberFormatException e) { return defaultValue; }
+    }
+
+    private String prefKey(String key) {
+        return "capgo_updater_" + key;
+    }
+
+    private String stringResName(String key) {
+        return "capgo_updater_" + camelToSnake(key);
+    }
+
+    private String camelToSnake(String input) {
+        return input.replaceAll("([a-z])([A-Z])", "$1_$2").toLowerCase();
+    }
+}

package/src/android/app/capgo/cordova/updater/CryptoCipher.java

@@ -0,0 +1,462 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+package app.capgo.cordova.updater;
+
+/**
+ * Created by Awesometic
+ * It's encrypt returns Base64 encoded, and also decrypt for Base64 encoded cipher
+ * references: http://stackoverflow.com/questions/12471999/rsa-encryption-decryption-in-android
+ */
+import android.util.Base64;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.GeneralSecurityException;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.InvalidKeyException;
+import java.security.KeyFactory;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.X509EncodedKeySpec;
+import javax.crypto.BadPaddingException;
+import javax.crypto.Cipher;
+import javax.crypto.IllegalBlockSizeException;
+import javax.crypto.NoSuchPaddingException;
+import javax.crypto.SecretKey;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+
+public class CryptoCipher {
+
+    private static Logger logger;
+
+    public static void setLogger(Logger loggerInstance) {
+        logger = loggerInstance;
+    }
+
+    public static byte[] decryptRSA(byte[] source, PublicKey publicKey)
+        throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidAlgorithmParameterException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException {
+        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
+        cipher.init(Cipher.DECRYPT_MODE, publicKey);
+        byte[] decryptedBytes = cipher.doFinal(source);
+        return decryptedBytes;
+    }
+
+    public static byte[] decryptAES(byte[] cipherText, SecretKey key, byte[] iv) {
+        try {
+            IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
+            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+            SecretKeySpec keySpec = new SecretKeySpec(key.getEncoded(), "AES");
+            cipher.init(Cipher.DECRYPT_MODE, keySpec, ivParameterSpec);
+            return cipher.doFinal(cipherText);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return null;
+    }
+
+    public static SecretKey byteToSessionKey(byte[] sessionKey) {
+        // rebuild key using SecretKeySpec
+        return new SecretKeySpec(sessionKey, 0, sessionKey.length, "AES");
+    }
+
+    private static PublicKey readX509PublicKey(byte[] x509Bytes) throws GeneralSecurityException {
+        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
+        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(x509Bytes);
+        try {
+            return keyFactory.generatePublic(keySpec);
+        } catch (InvalidKeySpecException e) {
+            throw new IllegalArgumentException("Unexpected key format!", e);
+        }
+    }
+
+    public static PublicKey stringToPublicKey(String public_key) throws GeneralSecurityException {
+        String pkcs1Pem = public_key
+            .replaceAll("\\s+", "")
+            .replace("-----BEGINRSAPUBLICKEY-----", "")
+            .replace("-----ENDRSAPUBLICKEY-----", "");
+
+        byte[] pkcs1EncodedBytes = Base64.decode(pkcs1Pem, Base64.DEFAULT);
+        return readPkcs1PublicKey(pkcs1EncodedBytes);
+    }
+
+    // since the public key is in pkcs1 format, we have to convert it to x509 format similar
+    // to what needs done with the private key converting to pkcs8 format
+    // so, the rest of the code below here is adapted from here https://stackoverflow.com/a/54246646
+    private static final int SEQUENCE_TAG = 0x30;
+    private static final int BIT_STRING_TAG = 0x03;
+    private static final byte[] NO_UNUSED_BITS = new byte[] { 0x00 };
+    private static final byte[] RSA_ALGORITHM_IDENTIFIER_SEQUENCE = {
+        (byte) 0x30,
+        (byte) 0x0d,
+        (byte) 0x06,
+        (byte) 0x09,
+        (byte) 0x2a,
+        (byte) 0x86,
+        (byte) 0x48,
+        (byte) 0x86,
+        (byte) 0xf7,
+        (byte) 0x0d,
+        (byte) 0x01,
+        (byte) 0x01,
+        (byte) 0x01,
+        (byte) 0x05,
+        (byte) 0x00
+    };
+
+    private static PublicKey readPkcs1PublicKey(byte[] pkcs1Bytes)
+        throws NoSuchAlgorithmException, InvalidKeySpecException, GeneralSecurityException {
+        // convert the pkcs1 public key to an x509 favorable format
+        byte[] keyBitString = createDEREncoding(BIT_STRING_TAG, joinPublic(NO_UNUSED_BITS, pkcs1Bytes));
+        byte[] keyInfoValue = joinPublic(RSA_ALGORITHM_IDENTIFIER_SEQUENCE, keyBitString);
+        byte[] keyInfoSequence = createDEREncoding(SEQUENCE_TAG, keyInfoValue);
+        return readX509PublicKey(keyInfoSequence);
+    }
+
+    private static byte[] joinPublic(byte[]... bas) {
+        int len = 0;
+        for (int i = 0; i < bas.length; i++) {
+            len += bas[i].length;
+        }
+
+        byte[] buf = new byte[len];
+        int off = 0;
+        for (int i = 0; i < bas.length; i++) {
+            System.arraycopy(bas[i], 0, buf, off, bas[i].length);
+            off += bas[i].length;
+        }
+
+        return buf;
+    }
+
+    public static void decryptFile(final File file, final String publicKey, final String ivSessionKey) throws IOException {
+        if (publicKey.isEmpty() || ivSessionKey == null || ivSessionKey.isEmpty() || ivSessionKey.split(":").length != 2) {
+            logger.info("Encryption not set, no public key or session, ignored");
+            return;
+        }
+        if (!publicKey.startsWith("-----BEGIN RSA PUBLIC KEY-----")) {
+            logger.error("The public key is not a valid RSA Public key");
+            return;
+        }
+
+        try {
+            String ivB64 = ivSessionKey.split(":")[0];
+            String sessionKeyB64 = ivSessionKey.split(":")[1];
+            byte[] iv = Base64.decode(ivB64.getBytes(), Base64.DEFAULT);
+            byte[] sessionKey = Base64.decode(sessionKeyB64.getBytes(), Base64.DEFAULT);
+            PublicKey pKey = CryptoCipher.stringToPublicKey(publicKey);
+            byte[] decryptedSessionKey = CryptoCipher.decryptRSA(sessionKey, pKey);
+
+            SecretKey sKey = CryptoCipher.byteToSessionKey(decryptedSessionKey);
+            decryptAesFile(file, sKey, iv);
+        } catch (GeneralSecurityException e) {
+            logger.info("decryptFile fail");
+            throw new IOException("GeneralSecurityException", e);
+        }
+    }
+
+    static void decryptAesFile(File file, SecretKey key, byte[] iv) throws IOException, GeneralSecurityException {
+        if (file.length() == 0) {
+            throw new IOException("Empty encrypted data");
+        }
+        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(key.getEncoded(), "AES"), new IvParameterSpec(iv));
+        File parent = file.getAbsoluteFile().getParentFile();
+        if (parent == null) {
+            throw new IOException("Cannot create temp file for " + file.getAbsolutePath());
+        }
+        File tempFile = File.createTempFile("capgo-aes-", ".tmp", parent);
+        try {
+            byte[] inBuf = new byte[ioBufferBytes()];
+            // Reuse one output buffer. cipher.update(in) allocates a new byte[] per chunk.
+            byte[] outBuf = new byte[inBuf.length + 16];
+            try (FileInputStream fis = new FileInputStream(file); FileOutputStream fos = new FileOutputStream(tempFile)) {
+                int n;
+                while ((n = fis.read(inBuf)) != -1) {
+                    int outLen = cipher.update(inBuf, 0, n, outBuf, 0);
+                    if (outLen > 0) {
+                        fos.write(outBuf, 0, outLen);
+                    }
+                }
+                int last = cipher.doFinal(outBuf, 0);
+                if (last > 0) {
+                    fos.write(outBuf, 0, last);
+                }
+            }
+            if (tempFile.length() == 0) {
+                throw new IOException("Empty decrypted data");
+            }
+            replaceFile(tempFile, file);
+            tempFile = null;
+        } finally {
+            if (tempFile != null && tempFile.exists()) {
+                tempFile.delete();
+            }
+        }
+    }
+
+    static void replaceFile(File from, File to) throws IOException {
+        if (from.renameTo(to)) {
+            return;
+        }
+        throw new IOException("Failed to replace file: " + to.getAbsolutePath());
+    }
+
+    private static byte[] hexStringToByteArray(String s) {
+        int len = s.length();
+        byte[] data = new byte[len / 2];
+        for (int i = 0; i < len; i += 2) {
+            data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) + Character.digit(s.charAt(i + 1), 16));
+        }
+        return data;
+    }
+
+    public static String decryptChecksum(String checksum, String publicKey) throws IOException {
+        if (publicKey.isEmpty()) {
+            logger.error("No encryption set (public key) ignored");
+            return checksum;
+        }
+        try {
+            // TODO: remove this in a month or two
+            // Determine if input is hex or base64 encoded
+            // Hex strings only contain 0-9 and a-f, while base64 contains other characters
+            byte[] checksumBytes;
+            String detectedFormat;
+            if (checksum.matches("^[0-9a-fA-F]+$")) {
+                // Hex encoded (new format from CLI for plugin versions >= 5.30.0, 6.30.0, 7.30.0)
+                checksumBytes = hexStringToByteArray(checksum);
+                detectedFormat = "hex";
+            } else {
+                // TODO: remove backwards compatibility
+                // Base64 encoded (old format for backwards compatibility)
+                checksumBytes = Base64.decode(checksum, Base64.DEFAULT);
+                detectedFormat = "base64";
+            }
+            logger.debug(
+                "Received checksum format: " +
+                    detectedFormat +
+                    " (length: " +
+                    checksum.length() +
+                    " chars, " +
+                    checksumBytes.length +
+                    " bytes)"
+            );
+
+            // RSA-2048 encrypted data must be exactly 256 bytes
+            // If the checksum is not 256 bytes, the bundle was not encrypted properly
+            if (checksumBytes.length != 256) {
+                logger.error(
+                    "Checksum is not RSA encrypted (size: " +
+                        checksumBytes.length +
+                        " bytes, expected 256 for RSA-2048). Bundle must be uploaded with encryption when public key is configured."
+                );
+                throw new IOException("Bundle checksum is not encrypted. Upload bundle with --key flag when encryption is configured.");
+            }
+
+            PublicKey pKey = CryptoCipher.stringToPublicKey(publicKey);
+            byte[] decryptedChecksum = CryptoCipher.decryptRSA(checksumBytes, pKey);
+            // Return as hex string to match calcChecksum output format
+            StringBuilder hexString = new StringBuilder();
+            for (byte b : decryptedChecksum) {
+                String hex = Integer.toHexString(0xff & b);
+                if (hex.length() == 1) hexString.append('0');
+                hexString.append(hex);
+            }
+            String result = hexString.toString();
+
+            // Detect checksum algorithm based on length
+            String detectedAlgorithm;
+            if (decryptedChecksum.length == 32) {
+                detectedAlgorithm = "SHA-256";
+            } else if (decryptedChecksum.length == 4) {
+                detectedAlgorithm = "CRC32 (deprecated)";
+                logger.error("CRC32 checksum detected - deprecated algorithm");
+            } else {
+                detectedAlgorithm = "unknown (" + decryptedChecksum.length + " bytes)";
+                logger.error("Unknown checksum algorithm detected");
+                logger.debug("Byte count: " + decryptedChecksum.length + ", Expected: 32 (SHA-256)");
+            }
+            logger.debug(
+                "Decrypted checksum: " +
+                    detectedAlgorithm +
+                    " hex format (length: " +
+                    result.length() +
+                    " chars, " +
+                    decryptedChecksum.length +
+                    " bytes)"
+            );
+            return result;
+        } catch (GeneralSecurityException e) {
+            logger.error("Checksum decryption failed");
+            logger.debug("Error: " + e.getMessage());
+            throw new IOException("Decryption failed: " + e.getMessage());
+        }
+    }
+
+    /**
+     * Detect checksum algorithm based on hex string length.
+     * SHA-256 = 64 hex chars (32 bytes)
+     * CRC32 = 8 hex chars (4 bytes)
+     */
+    public static String detectChecksumAlgorithm(String hexChecksum) {
+        if (hexChecksum == null || hexChecksum.isEmpty()) {
+            return "empty";
+        }
+        int len = hexChecksum.length();
+        if (len == 64) {
+            return "SHA-256";
+        } else if (len == 8) {
+            return "CRC32 (deprecated)";
+        } else {
+            return "unknown (" + len + " hex chars)";
+        }
+    }
+
+    /**
+     * Log checksum info and warn if deprecated algorithm detected.
+     */
+    public static void logChecksumInfo(String label, String hexChecksum) {
+        String algorithm = detectChecksumAlgorithm(hexChecksum);
+        logger.debug(label + ": " + algorithm + " hex format (length: " + hexChecksum.length() + " chars)");
+        if (algorithm.contains("CRC32")) {
+            logger.error("CRC32 checksum detected - deprecated algorithm");
+        } else if (algorithm.contains("unknown")) {
+            logger.error("Unknown checksum algorithm detected");
+            logger.debug("Char count: " + hexChecksum.length() + ", Expected: 64 (SHA-256)");
+        }
+    }
+
+    // 256 KiB: one size for checksum, copy, and decode.
+    // 64 workers * 256 KiB = 16 MiB for one buffer; AES/Brotli hold two (~32 MiB).
+    static final int IO_BUFFER_BYTES = 256 * 1024;
+
+    static int ioBufferBytes() {
+        return IO_BUFFER_BYTES;
+    }
+
+    static int checksumBufferBytes() {
+        return IO_BUFFER_BYTES;
+    }
+
+    static int copyBufferBytes() {
+        return IO_BUFFER_BYTES;
+    }
+
+    public static String calcChecksum(File file) {
+        try (FileInputStream fis = new FileInputStream(file)) {
+            return calcChecksum(fis);
+        } catch (IOException e) {
+            logger.error("Cannot calculate checksum");
+            logger.debug("Path: " + file.getPath() + ", Error: " + e.getMessage());
+            return "";
+        }
+    }
+
+    public static String calcChecksum(InputStream inputStream) {
+        final int BUFFER_SIZE = checksumBufferBytes();
+        MessageDigest digest;
+        try {
+            digest = MessageDigest.getInstance("SHA-256");
+        } catch (java.security.NoSuchAlgorithmException e) {
+            logger.error("SHA-256 algorithm not available");
+            return "";
+        }
+
+        try {
+            byte[] buffer = new byte[BUFFER_SIZE];
+            int length;
+            while ((length = inputStream.read(buffer)) != -1) {
+                digest.update(buffer, 0, length);
+            }
+            return digestToHex(digest);
+        } catch (IOException e) {
+            logger.error("Cannot calculate checksum");
+            logger.debug("Error: " + e.getMessage());
+            return "";
+        }
+    }
+
+    static String digestToHex(MessageDigest digest) {
+        byte[] hash = digest.digest();
+        StringBuilder hexString = new StringBuilder(hash.length * 2);
+        for (byte b : hash) {
+            String hex = Integer.toHexString(0xff & b);
+            if (hex.length() == 1) hexString.append('0');
+            hexString.append(hex);
+        }
+        return hexString.toString();
+    }
+
+    static String shortPathKey(String fileName) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance("SHA-256");
+            digest.update((fileName == null ? "" : fileName).getBytes(java.nio.charset.StandardCharsets.UTF_8));
+            return digestToHex(digest).substring(0, 16);
+        } catch (java.security.NoSuchAlgorithmException e) {
+            return Integer.toHexString((fileName == null ? "" : fileName).hashCode());
+        }
+    }
+
+    private static byte[] createDEREncoding(int tag, byte[] value) {
+        if (tag < 0 || tag >= 0xFF) {
+            throw new IllegalArgumentException("Currently only single byte tags supported");
+        }
+
+        byte[] lengthEncoding = createDERLengthEncoding(value.length);
+
+        int size = 1 + lengthEncoding.length + value.length;
+        byte[] derEncodingBuf = new byte[size];
+
+        int off = 0;
+        derEncodingBuf[off++] = (byte) tag;
+        System.arraycopy(lengthEncoding, 0, derEncodingBuf, off, lengthEncoding.length);
+        off += lengthEncoding.length;
+        System.arraycopy(value, 0, derEncodingBuf, off, value.length);
+
+        return derEncodingBuf;
+    }
+
+    private static byte[] createDERLengthEncoding(int size) {
+        if (size <= 0x7F) {
+            // single byte length encoding
+            return new byte[] { (byte) size };
+        } else if (size <= 0xFF) {
+            // double byte length encoding
+            return new byte[] { (byte) 0x81, (byte) size };
+        } else if (size <= 0xFFFF) {
+            // triple byte length encoding
+            return new byte[] { (byte) 0x82, (byte) (size >> Byte.SIZE), (byte) size };
+        }
+
+        throw new IllegalArgumentException("size too large, only up to 64KiB length encoding supported: " + size);
+    }
+
+    /**
+     * Get first 20 characters of the public key for identification.
+     * Returns 20-character string or empty string if key is invalid/empty.
+     * The first 12 chars are always "MIIBCgKCAQEA" for RSA 2048-bit keys,
+     * so the unique part starts at character 13.
+     */
+    public static String calcKeyId(String publicKey) {
+        if (publicKey == null || publicKey.isEmpty()) {
+            return "";
+        }
+
+        // Remove PEM headers and whitespace to get the raw key data
+        String cleanedKey = publicKey
+            .replaceAll("\\s+", "")
+            .replace("-----BEGINRSAPUBLICKEY-----", "")
+            .replace("-----ENDRSAPUBLICKEY-----", "");
+
+        // Return first 20 characters of the base64-encoded key
+        return cleanedKey.length() >= 20 ? cleanedKey.substring(0, 20) : cleanedKey;
+    }
+}

package/src/android/app/capgo/cordova/updater/DataManager.java

@@ -0,0 +1,44 @@
+package app.capgo.cordova.updater;
+
+import java.util.HashMap;
+import java.util.Map;
+import org.json.JSONArray;
+
+public class DataManager {
+
+    private static DataManager instance;
+    private final Map<String, JSONArray> manifestsById = new HashMap<>();
+
+    private DataManager() {}
+
+    public static synchronized DataManager getInstance() {
+        if (instance == null) {
+            instance = new DataManager();
+        }
+        return instance;
+    }
+
+    public synchronized void setManifest(String downloadId, JSONArray manifest) {
+        if (downloadId == null || manifest == null) {
+            return;
+        }
+        this.manifestsById.put(downloadId, manifest);
+    }
+
+    public synchronized JSONArray getAndClearManifest(String downloadId) {
+        if (downloadId == null) {
+            return null;
+        }
+        return this.manifestsById.remove(downloadId);
+    }
+
+    public synchronized void clearManifest(String downloadId) {
+        if (downloadId != null) {
+            this.manifestsById.remove(downloadId);
+        }
+    }
+
+    public synchronized void clearAllManifests() {
+        this.manifestsById.clear();
+    }
+}

package/src/android/app/capgo/cordova/updater/DelayCondition.java

@@ -0,0 +1,56 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+package app.capgo.cordova.updater;
+
+import androidx.annotation.NonNull;
+import java.util.Objects;
+
+public class DelayCondition {
+
+    private DelayUntilNext kind;
+
+    private String value;
+
+    public DelayCondition(DelayUntilNext kind, String value) {
+        this.kind = kind;
+        this.value = value;
+    }
+
+    public DelayUntilNext getKind() {
+        return kind;
+    }
+
+    public void setKind(DelayUntilNext kind) {
+        this.kind = kind;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (!(o instanceof DelayCondition that)) return false;
+        return getKind() == that.getKind() && Objects.equals(getValue(), that.getValue());
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(getKind(), getValue());
+    }
+
+    @NonNull
+    @Override
+    public String toString() {
+        return "DelayCondition{" + "kind=" + kind + ", value='" + value + '\'' + '}';
+    }
+}

package/src/android/app/capgo/cordova/updater/DelayUntilNext.java

@@ -0,0 +1,14 @@
+/*
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ */
+
+package app.capgo.cordova.updater;
+
+public enum DelayUntilNext {
+    background,
+    kill,
+    nativeVersion,
+    date
+}