@crossbind/extension-updater 0.0.0-stage → 2.0.0-beta.69

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Buğra Sarı and crossbind contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,36 @@
-# Temporary Holding Version
+# @crossbind/extension-updater
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A desktop app's own updates, each checked against its Ed25519 signature.
+
+An app has it by having `@crossbind/core-app-host`, which lists it as a dependency: there is nothing to install or list.
+
+## Use
+
+```js
+import { updater } from 'crossbind/app';
+
+const update = await updater.check();
+if (update) await updater.install();
+```
+
+`updater.install` downloads the version `updater.check` found, installs it once its signature holds, then quits the app
+and opens the new one.
+
+## Options
+
+`app.updater` turns it on: `{ url, publicKey }`, the address of the manifest an update is listed in and the Ed25519
+public key that checks it. `npx crossbind app updater-key` makes the key pair; a build with the private key in
+`CROSSBIND_UPDATER_PRIVATE_KEY` writes each platform's update and its signed manifest beside the app.
+
+## Platforms
+
+macOS, Linux and Windows. A Linux app updates itself from what `tar-gz` makes, and a Windows app from what `nsis` makes. An iOS or Android app updates through its store, and `updater.check()` rejects there.
+
+## Replace or leave out
+
+It holds the role `updater`. An extension that gives `replaces: 'updater'` takes it; `app: { without: ['updater'] }` in `crossbind.config.js` leaves it out. Its update goes with it. Leaving it out while `app.updater` is set stops the build. [The guide](https://crossbind.dev/guide/extensions/#replace) shows how, and [extensions.md](https://github.com/crossbind/crossbind/blob/main/docs/api/extensions.md#the-hosts-own-extensions) what a replacement answers.
+
+[app.md](https://github.com/crossbind/crossbind/blob/main/docs/api/app.md#updates) has the manifest and where to put it.
+
+It carries Monocypher 4.0.3 (BSD-2-Clause or CC0-1.0), whose Ed25519 and SHA-512 check an update, in `native/monocypher/`;
+provenance in its README.

package/crossbind.extension.js

@@ -0,0 +1,48 @@
+import {
+    UPDATER_KEY, appUpdater, checkUpdate, makeUpdate, newUpdaterKey,
+} from './src/update.js';
+
+export default function updater() {
+    return {
+        name: 'updater',
+        contract: 1,
+        root: import.meta.dirname,
+        reads: ['updater'],
+        // A phone's store updates it. An update's signature covers the app's id and version.
+        fromApp(api) {
+            const updater = ['macos', 'linux', 'windows'].includes(api.platform) ? appUpdater(api) : null;
+            return updater && { ...updater, id: api.app.id };
+        },
+        app: {
+            sources: ['native/updater.cpp', 'native/monocypher.cpp', 'native/monocypher-ed25519.cpp'],
+            macos: { sources: ['native/darwin.mm'], frameworks: ['Security'] },
+            linux: { sources: ['native/linux.cpp'] },
+            windows: { sources: ['native/windows.cpp'], libraries: ['winhttp', 'wintrust', 'crypt32'] },
+            licenses: [{
+                name: 'monocypher',
+                version: '4.0.3',
+                license: 'BSD-2-Clause OR CC0-1.0',
+                file: 'native/monocypher/LICENCE.md',
+                source: 'https://monocypher.org/download/monocypher-4.0.3.tar.gz',
+                sha256: '8cc9bc341a66249016db9bd70e9142d8d0aef9945973744b1ac05dbc55d8ee66',
+            }],
+        },
+        // An update is made last, of what the app's installers made.
+        installer: {
+            platform: 'desktop',
+            isLast: true,
+            check: checkUpdate,
+            make: makeUpdate,
+        },
+        commands: {
+            'updater-key': {
+                help: "make the key pair that signs a desktop app's updates",
+                run(api) {
+                    const { publicKey, privateKey } = newUpdaterKey();
+                    api.log(`crossbind: app.updater.publicKey in crossbind.config.js: ${publicKey}`);
+                    api.log(`crossbind: ${UPDATER_KEY}, kept secret where the app is built: ${privateKey}`);
+                },
+            },
+        },
+    };
+}

package/native/darwin.mm

@@ -0,0 +1,100 @@
+#import <Foundation/Foundation.h>
+#import <Security/Security.h>
+
+#include "updater.h"
+
+#include <stdexcept>
+
+namespace crossbind::updater {
+namespace {
+
+// How often the wait looks at what the download has received.
+constexpr int64_t CHECK_NSEC = NSEC_PER_SEC / 4;
+
+std::string describe(OSStatus status) {
+    NSString *message = CFBridgingRelease(SecCopyErrorMessageString(status, nullptr));
+    return message ? std::string(message.UTF8String) : "error " + std::to_string(status);
+}
+
+}  // namespace
+
+std::filesystem::path bundlePath() { return NSBundle.mainBundle.bundlePath.fileSystemRepresentation; }
+
+// As Sparkle holds an update: the app it unpacked to meets the requirement this app's own signature states, which for a
+// Developer ID names the app's identifier and its team. An ad hoc signature names no signer to hold it to.
+void checkSigner(const std::filesystem::path &update) {
+    @autoreleasepool {
+        SecCodeRef running = nullptr;
+        if (SecCodeCopySelf(kSecCSDefaultFlags, &running) != errSecSuccess) return;
+        CFDictionaryRef signing = nullptr;
+        const bool hasSigner = SecCodeCopySigningInformation(running, kSecCSSigningInformation, &signing) == errSecSuccess &&
+                               CFDictionaryGetValue(signing, kSecCodeInfoCertificates) != nullptr;
+        if (signing) CFRelease(signing);
+        SecRequirementRef requirement = nullptr;
+        OSStatus status = hasSigner ? SecCodeCopyDesignatedRequirement(running, kSecCSDefaultFlags, &requirement) : errSecSuccess;
+        CFRelease(running);
+        if (!hasSigner) return;
+        SecStaticCodeRef code = nullptr;
+        if (status == errSecSuccess) {
+            NSURL *app = [NSURL fileURLWithPath:@(update.c_str()) isDirectory:YES];
+            status = SecStaticCodeCreateWithPath((__bridge CFURLRef)app, kSecCSDefaultFlags, &code);
+        }
+        if (status == errSecSuccess) {
+            status = SecStaticCodeCheckValidity(code, kSecCSCheckAllArchitectures | kSecCSCheckNestedCode | kSecCSStrictValidate, requirement);
+        }
+        if (code) CFRelease(code);
+        if (requirement) CFRelease(requirement);
+        if (status != errSecSuccess) {
+            throw std::runtime_error("crossbind: cannot install the update: " + update.filename().string() + " is not signed as this app is: " +
+                                     describe(status));
+        }
+    }
+}
+
+// A session that keeps nothing, so that every check asks the server anew.
+void download(const std::string &url, const std::filesystem::path &file, std::uintmax_t maxBytes) {
+    @autoreleasepool {
+        NSString *address = [NSString stringWithUTF8String:url.c_str()];
+        NSURL *source = address ? [NSURL URLWithString:address] : nil;
+        if (!source) throw std::runtime_error("crossbind: " + url + " is no address");
+        NSString *path = [NSString stringWithUTF8String:file.c_str()];
+        if (!path) throw std::runtime_error("crossbind: cannot download to " + file.string());
+        NSURL *target = [NSURL fileURLWithPath:path];
+        NSURLSessionConfiguration *configuration = NSURLSessionConfiguration.ephemeralSessionConfiguration;
+        configuration.requestCachePolicy = NSURLRequestReloadIgnoringLocalCacheData;
+        NSURLSession *session = [NSURLSession sessionWithConfiguration:configuration];
+        dispatch_semaphore_t finished = dispatch_semaphore_create(0);
+        __block std::string failure;
+        NSURLSessionDownloadTask *task = [session downloadTaskWithURL:source
+                                                    completionHandler:^(NSURL *location, NSURLResponse *response, NSError *error) {
+                                                      const NSInteger status = [response isKindOfClass:NSHTTPURLResponse.class]
+                                                                                   ? ((NSHTTPURLResponse *)response).statusCode
+                                                                                   : 0;
+                                                      NSError *moved = nil;
+                                                      if (error) {
+                                                          failure = "crossbind: cannot download " + url + ": " +
+                                                                    (error.localizedDescription.UTF8String ?: "no reason given");
+                                                      } else if (status != 200) {
+                                                          failure = "crossbind: " + url + " answered " + std::to_string(status);
+                                                      } else {
+                                                          // The task deletes its file once this returns.
+                                                          [NSFileManager.defaultManager removeItemAtURL:target error:nil];
+                                                          if (![NSFileManager.defaultManager moveItemAtURL:location toURL:target error:&moved]) {
+                                                              failure = "crossbind: cannot keep the download of " + url + ": " +
+                                                                        (moved.localizedDescription.UTF8String ?: "no reason given");
+                                                          }
+                                                      }
+                                                      dispatch_semaphore_signal(finished);
+                                                    }];
+        [task resume];
+        const auto isTooLarge = [&] { return static_cast<std::uintmax_t>(task.countOfBytesReceived) > maxBytes; };
+        while (dispatch_semaphore_wait(finished, dispatch_time(DISPATCH_TIME_NOW, CHECK_NSEC)) != 0) {
+            if (isTooLarge()) [task cancel];
+        }
+        [session finishTasksAndInvalidate];
+        if (isTooLarge()) throw std::runtime_error("crossbind: " + url + " answered more than " + std::to_string(maxBytes) + " bytes");
+        if (!failure.empty()) throw std::runtime_error(failure);
+    }
+}
+
+}  // namespace crossbind::updater

package/native/linux.cpp

@@ -0,0 +1,69 @@
+#include "updater.h"
+
+#include <libsoup/soup.h>
+
+#include <stdexcept>
+#include <vector>
+
+namespace crossbind::updater {
+namespace {
+
+constexpr gsize READ_CHUNK = 64 * 1024;
+// Seconds a connection may stay silent.
+constexpr guint IDLE_TIMEOUT = 60;
+
+}  // namespace
+
+// Linux signs no apps, so an update is the app's when app.updater's key signed it.
+void checkSigner(const std::filesystem::path &) {}
+
+// libsoup, which WebKitGTK loads anyway. Its blocking calls run off the main thread in a context of their own, and
+// without the decoder that would unpack a .tar.gz a server labels gzip-encoded.
+void download(const std::string &url, const std::filesystem::path &file, std::uintmax_t maxBytes) {
+    GMainContext *context = g_main_context_new();
+    g_main_context_push_thread_default(context);
+    SoupSession *session = soup_session_new();
+    soup_session_set_timeout(session, IDLE_TIMEOUT);
+    soup_session_remove_feature_by_type(session, SOUP_TYPE_CONTENT_DECODER);
+    SoupMessage *message = soup_message_new(SOUP_METHOD_GET, url.c_str());
+    GError *error = nullptr;
+    GInputStream *body = message ? soup_session_send(session, message, nullptr, &error) : nullptr;
+    std::string failure;
+    if (!message) {
+        failure = "crossbind: " + url + " is no address";
+    } else if (!body) {
+        failure = "crossbind: cannot download " + url + ": " + (error ? error->message : "no reason given");
+    } else if (const unsigned status = soup_message_get_status(message); status != SOUP_STATUS_OK) {
+        failure = "crossbind: " + url + " answered " + std::to_string(status);
+    } else {
+        GFile *target = g_file_new_for_path(file.c_str());
+        GFileOutputStream *out = g_file_replace(target, nullptr, FALSE, G_FILE_CREATE_NONE, nullptr, &error);
+        std::vector<char> chunk(READ_CHUNK);
+        std::uintmax_t total = 0;
+        gssize read = out ? 0 : -1;
+        while (out && (read = g_input_stream_read(body, chunk.data(), chunk.size(), nullptr, &error)) > 0) {
+            total += static_cast<std::uintmax_t>(read);
+            if (total > maxBytes) break;
+            if (!g_output_stream_write_all(G_OUTPUT_STREAM(out), chunk.data(), static_cast<gsize>(read), nullptr, nullptr, &error)) {
+                read = -1;
+                break;
+            }
+        }
+        if (total > maxBytes) {
+            failure = "crossbind: " + url + " answered more than " + std::to_string(maxBytes) + " bytes";
+        } else if (read < 0 || !g_output_stream_close(G_OUTPUT_STREAM(out), nullptr, &error)) {
+            failure = "crossbind: cannot keep the download of " + url + ": " + (error ? error->message : "no reason given");
+        }
+        if (out) g_object_unref(out);
+        g_object_unref(target);
+    }
+    g_clear_error(&error);
+    if (body) g_object_unref(body);
+    if (message) g_object_unref(message);
+    g_object_unref(session);
+    g_main_context_pop_thread_default(context);
+    g_main_context_unref(context);
+    if (!failure.empty()) throw std::runtime_error(failure);
+}
+
+}  // namespace crossbind::updater

package/native/monocypher/LICENCE.md

@@ -0,0 +1,167 @@
+Monocypher as a whole is dual-licensed.  Choose whichever licence you
+want from the two licences listed below.
+
+The first licence is a regular 2-clause BSD licence.  The second licence
+is the CC-0 from Creative Commons. It is intended to release Monocypher
+to the public domain.  The BSD licence serves as a fallback option.
+
+See the individual files for specific information about who contributed
+to what file during which years.  See below for special notes.
+
+Licence 1 (2-clause BSD)
+------------------------
+
+Copyright (c) 2017-2023, Loup Vaillant
+Copyright (c) 2017-2019, Michael Savage
+Copyright (c) 2017-2023, Fabio Scotoni
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+Licence 2 (CC-0)
+----------------
+
+> CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+> LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+> ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+> INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+> REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+> PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+> THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+> HEREUNDER.
+
+### Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work
+of authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without
+fear of later claims of infringement build upon, modify, incorporate in
+other works, reuse and redistribute as freely as possible in any form
+whatsoever and for any purposes, including without limitation commercial
+purposes. These owners may contribute to the Commons to promote the
+ideal of a free culture and the further production of creative, cultural
+and scientific works, or to gain reputation or greater distribution for
+their Work in part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or
+she is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under
+its terms, with knowledge of his or her Copyright and Related Rights in
+the Work and the meaning and intended legal effect of CC0 on those
+rights.
+
+1. **Copyright and Related Rights.** A Work made available under CC0 may
+   be protected by copyright and related or neighboring rights
+   ("Copyright and Related Rights"). Copyright and Related Rights
+   include, but are not limited to, the following:
+
+   - the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+   - moral rights retained by the original author(s) and/or
+     performer(s); publicity and privacy rights pertaining to a person's
+     image or likeness depicted in a Work;
+   - rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+   - rights protecting the extraction, dissemination, use and reuse of
+     data in a Work;
+   - database rights (such as those arising under Directive 96/9/EC of
+     the European Parliament and of the Council of 11 March 1996 on the
+     legal protection of databases, and under any national
+     implementation thereof, including any amended or successor version
+     of such directive); and
+   - other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. **Waiver.** To the greatest extent permitted by, but not in
+   contravention of, applicable law, Affirmer hereby overtly, fully,
+   permanently, irrevocably and unconditionally waives, abandons, and
+   surrenders all of Affirmer's Copyright and Related Rights and
+   associated claims and causes of action, whether now known or unknown
+   (including existing as well as future claims and causes of action),
+   in the Work (i) in all territories worldwide, (ii) for the maximum
+   duration provided by applicable law or treaty (including future time
+   extensions), (iii) in any current or future medium and for any number
+   of copies, and (iv) for any purpose whatsoever, including without
+   limitation commercial, advertising or promotional purposes (the
+   "Waiver"). Affirmer makes the Waiver for the benefit of each member
+   of the public at large and to the detriment of Affirmer's heirs and
+   successors, fully intending that such Waiver shall not be subject to
+   revocation, rescission, cancellation, termination, or any other legal
+   or equitable action to disrupt the quiet enjoyment of the Work by the
+   public as contemplated by Affirmer's express Statement of Purpose.
+
+3. **Public License Fallback.** Should any part of the Waiver for any
+   reason be judged legally invalid or ineffective under applicable law,
+   then the Waiver shall be preserved to the maximum extent permitted
+   taking into account Affirmer's express Statement of Purpose. In
+   addition, to the extent the Waiver is so judged Affirmer hereby
+   grants to each affected person a royalty-free, non transferable, non
+   sublicensable, non exclusive, irrevocable and unconditional license
+   to exercise Affirmer's Copyright and Related Rights in the Work (i)
+   in all territories worldwide, (ii) for the maximum duration provided
+   by applicable law or treaty (including future time extensions), (iii)
+   in any current or future medium and for any number of copies, and
+   (iv) for any purpose whatsoever, including without limitation
+   commercial, advertising or promotional purposes (the "License"). The
+   License shall be deemed effective as of the date CC0 was applied by
+   Affirmer to the Work. Should any part of the License for any reason
+   be judged legally invalid or ineffective under applicable law, such
+   partial invalidity or ineffectiveness shall not invalidate the
+   remainder of the License, and in such case Affirmer hereby affirms
+   that he or she will not (i) exercise any of his or her remaining
+   Copyright and Related Rights in the Work or (ii) assert any
+   associated claims and causes of action with respect to the Work, in
+   either case contrary to Affirmer's express Statement of Purpose.
+
+4. **Limitations and Disclaimers.**
+
+   - No trademark or patent rights held by Affirmer are waived,
+     abandoned, surrendered, licensed or otherwise affected by this
+     document.
+   - Affirmer offers the Work as-is and makes no representations or
+     warranties of any kind concerning the Work, express, implied,
+     statutory or otherwise, including without limitation warranties of
+     title, merchantability, fitness for a particular purpose, non
+     infringement, or the absence of latent or other defects, accuracy,
+     or the present or absence of errors, whether or not discoverable,
+     all to the greatest extent permissible under applicable law.
+   - Affirmer disclaims responsibility for clearing rights of other
+     persons that may apply to the Work or any use thereof, including
+     without limitation any person's Copyright and Related Rights in the
+     Work. Further, Affirmer disclaims responsibility for obtaining any
+     necessary consents, permissions or other rights required for any
+     use of the Work.
+   - Affirmer understands and acknowledges that Creative Commons is not
+     a party to this document and has no duty or obligation with respect
+     to this CC0 or use of the Work.

package/native/monocypher/README.md

@@ -0,0 +1,10 @@
+# Monocypher (vendored)
+
+The host's updater checks a desktop app's update's Ed25519 signature, and hashes the update with SHA-512, with
+Monocypher, which it compiles as C++ through `../monocypher.cpp` and `../monocypher-ed25519.cpp`: `monocypher.c` and
+`monocypher.h`, and `monocypher-ed25519.c` and `monocypher-ed25519.h` from the release's `src/optional/`, unchanged.
+
+- Upstream: https://monocypher.org
+- Version: `4.0.3`, `https://monocypher.org/download/monocypher-4.0.3.tar.gz`, sha256
+  `8cc9bc341a66249016db9bd70e9142d8d0aef9945973744b1ac05dbc55d8ee66`, which matches the release's published SHA-512
+- License: BSD-2-Clause or CC0-1.0, whichever one picks; see `LICENCE.md`, the release's own