@crossbind/extension-updater 0.0.0-stage → 2.0.0-beta.69

package/native/updater.cpp

@@ -0,0 +1,461 @@
+// A desktop app's updates. The manifest at app.updater.url names the newest version, its file beside the manifest and
+// the signature the key of app.updater.publicKey checks, as `crossbind app build` writes them with the key in
+// CROSSBIND_UPDATER_PRIVATE_KEY. The file downloads into the app's cache folder and, once its signature holds, takes
+// the app's place: a macOS or Linux app is swapped for the one the file unpacks, and a Windows app's setup program
+// installs it once the app has quit. The app then opens anew. A desktop app with app.updater alone has the extension,
+// whose options its build gives: app.updater, with the app's version and id.
+#include "crossbind/app.h"
+#include "crossbind/extension.h"
+#include "monocypher/monocypher-ed25519.h"
+#include "updater.h"
+
+#include <algorithm>
+#include <cerrno>
+#include <cstdio>
+#include <cstring>
+#include <fstream>
+#include <iterator>
+#include <map>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#ifndef _WIN32
+#include <fcntl.h>
+#include <spawn.h>
+#include <stdio.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include <cstdlib>
+
+extern char **environ;
+#endif
+
+namespace crossbind::updater {
+namespace {
+
+namespace fs = std::filesystem;
+
+// What the build signed the update for.
+#if defined(__APPLE__)
+constexpr const char *PLATFORM = "darwin";
+#elif defined(_WIN32)
+constexpr const char *PLATFORM = "win32";
+#else
+constexpr const char *PLATFORM = "linux";
+#endif
+#if defined(__aarch64__) || defined(_M_ARM64)
+constexpr const char *ARCH = "arm64";
+#else
+constexpr const char *ARCH = "x64";
+#endif
+constexpr size_t KEY_SIZE = 32;
+constexpr size_t SIGNATURE_SIZE = 64;
+constexpr size_t SIGNATURE_TEXT_SIZE = (SIGNATURE_SIZE + 2) / 3 * 4;
+// A manifest is three short fields; a server that sends more, or an update past what any app weighs, fills the disk.
+constexpr std::uintmax_t MAX_MANIFEST_SIZE = 64 * 1024;
+constexpr std::uintmax_t MAX_UPDATE_SIZE = std::uintmax_t{2} << 30;
+constexpr size_t READ_CHUNK = 64 * 1024;
+
+// A check and an install download into the same folder, so one runs at a time and another fails meanwhile.
+std::mutex updating;
+
+// app.updater as the build gives it: the address of the manifest for this app's platform and architecture, the key that
+// signs the app's updates, and the app's version and id, which a signature covers.
+struct Updater {
+    std::string manifestUrl;
+    std::vector<uint8_t> key;
+    std::string version;
+    std::string id;
+};
+
+struct Manifest {
+    std::string version;
+    std::string file;
+    std::string signature;
+};
+
+// A version as semver orders it: its three numbers, then its prerelease's identifiers. Build metadata does not count.
+struct Version {
+    std::vector<std::string> numbers;
+    std::vector<std::string> prerelease;
+};
+
+struct NoManifest {};
+
+// ASCII alone, whatever locale GTK sets.
+bool isDigit(char c) { return c >= '0' && c <= '9'; }
+bool isWordChar(char c) { return isDigit(c) || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || c == '-'; }
+bool isSpace(char c) { return c == ' ' || c == '\t' || c == '\n' || c == '\r'; }
+bool isNumber(const std::string &part) { return !part.empty() && std::all_of(part.begin(), part.end(), isDigit); }
+bool isIdentifier(const std::string &part) { return !part.empty() && std::all_of(part.begin(), part.end(), isWordChar); }
+
+// The file a manifest names beside it: characters an address carries as they are, and no leading dot.
+bool isFileName(const std::string &name) {
+    return !name.empty() && name[0] != '.' &&
+           std::all_of(name.begin(), name.end(), [](char c) { return isWordChar(c) || c == '.' || c == '_' || c == '~'; });
+}
+
+std::vector<std::string> split(const std::string &text, char separator) {
+    std::vector<std::string> parts;
+    size_t start = 0;
+    for (size_t end = text.find(separator); end != std::string::npos; end = text.find(separator, start)) {
+        parts.push_back(text.substr(start, end - start));
+        start = end + 1;
+    }
+    parts.push_back(text.substr(start));
+    return parts;
+}
+
+std::optional<Version> versionOf(const std::string &text) {
+    const size_t plus = text.find('+');
+    const std::string release = text.substr(0, plus);
+    const size_t dash = release.find('-');
+    const std::vector<std::string> numbers = split(release.substr(0, dash), '.');
+    const std::vector<std::string> prerelease = dash == std::string::npos ? std::vector<std::string>() : split(release.substr(dash + 1), '.');
+    const std::vector<std::string> build = plus == std::string::npos ? std::vector<std::string>() : split(text.substr(plus + 1), '.');
+    const bool isValid = numbers.size() == 3 && std::all_of(numbers.begin(), numbers.end(), isNumber) &&
+                         std::all_of(prerelease.begin(), prerelease.end(), isIdentifier) &&
+                         std::all_of(build.begin(), build.end(), isIdentifier);
+    return isValid ? std::optional<Version>(Version{numbers, prerelease}) : std::nullopt;
+}
+
+// Below, at or above zero as a sorts before, with or after b: numbers by their value and before words, words in ASCII
+// order.
+int compare(const std::string &a, const std::string &b) {
+    if (isNumber(a) != isNumber(b)) return isNumber(a) ? -1 : 1;
+    if (!isNumber(a)) return a.compare(b);
+    const std::string x = a.substr(std::min(a.find_first_not_of('0'), a.size()));
+    const std::string y = b.substr(std::min(b.find_first_not_of('0'), b.size()));
+    if (x.size() != y.size()) return x.size() < y.size() ? -1 : 1;
+    return x.compare(y);
+}
+
+bool isNewer(const Version &a, const Version &b) {
+    for (size_t i = 0; i < a.numbers.size(); i += 1) {
+        if (const int order = compare(a.numbers[i], b.numbers[i])) return order > 0;
+    }
+    // A release comes after its prereleases.
+    if (a.prerelease.empty() || b.prerelease.empty()) return a.prerelease.empty() && !b.prerelease.empty();
+    for (size_t i = 0; i < std::min(a.prerelease.size(), b.prerelease.size()); i += 1) {
+        if (const int order = compare(a.prerelease[i], b.prerelease[i])) return order > 0;
+    }
+    return a.prerelease.size() > b.prerelease.size();
+}
+
+// The string fields of the JSON object a manifest is, which holds no other value and no escape.
+std::map<std::string, std::string> fieldsOf(const std::string &text) {
+    size_t at = 0;
+    const auto skipSpace = [&] {
+        while (at < text.size() && isSpace(text[at])) at += 1;
+    };
+    const auto skip = [&](char c) {
+        skipSpace();
+        if (at == text.size() || text[at] != c) return false;
+        at += 1;
+        return true;
+    };
+    const auto expect = [&](char c) {
+        if (!skip(c)) throw NoManifest();
+    };
+    const auto string = [&] {
+        expect('"');
+        const size_t end = text.find('"', at);
+        if (end == std::string::npos || text.find('\\', at) < end) throw NoManifest();
+        std::string value = text.substr(at, end - at);
+        at = end + 1;
+        return value;
+    };
+    std::map<std::string, std::string> fields;
+    expect('{');
+    do {
+        std::string key = string();
+        expect(':');
+        fields[std::move(key)] = string();
+    } while (skip(','));
+    expect('}');
+    skipSpace();
+    if (at != text.size()) throw NoManifest();
+    return fields;
+}
+
+std::string replaced(std::string text, const std::string &from, const std::string &to) {
+    for (size_t at = text.find(from); at != std::string::npos; at = text.find(from, at + to.size())) text.replace(at, from.size(), to);
+    return text;
+}
+
+// The bytes of base64 text, or nothing when base64 writes them otherwise: in groups of four, padded, with no bit past the
+// last byte.
+std::optional<std::vector<uint8_t>> fromBase64(const std::string &text) {
+    static constexpr std::string_view ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    if (text.size() % 4 != 0) return std::nullopt;
+    const size_t padding = text.ends_with("==") ? 2 : text.ends_with('=') ? 1 : 0;
+    std::vector<uint8_t> bytes;
+    uint32_t bits = 0;
+    int held = 0;
+    for (const char c : std::string_view(text).substr(0, text.size() - padding)) {
+        const size_t value = ALPHABET.find(c);
+        if (value == std::string_view::npos) return std::nullopt;
+        bits = bits << 6 | static_cast<uint32_t>(value);
+        held += 6;
+        if (held >= 8) {
+            held -= 8;
+            bytes.push_back(static_cast<uint8_t>(bits >> held));
+            bits &= (1u << held) - 1;
+        }
+    }
+    if (bits != 0) return std::nullopt;
+    return bytes;
+}
+
+Updater updaterOf(const Value &options) {
+    const std::string version = options["version"].asString();
+    const std::optional<std::vector<uint8_t>> key = fromBase64(options["publicKey"].asString());
+    if (!versionOf(version) || !key || key->size() != KEY_SIZE) {
+        throw std::runtime_error("crossbind: the updater's options are no app.updater, as crossbind's build gives them");
+    }
+    return {replaced(replaced(options["url"].asString(), "{platform}", PLATFORM), "{arch}", ARCH), *key, version, options["id"].asString()};
+}
+
+// The update's file is beside its manifest.
+std::string fileUrl(const std::string &manifest, const std::string &file) {
+    const std::string address = manifest.substr(0, manifest.find_first_of("?#"));
+    return address.substr(0, address.rfind('/') + 1) + file;
+}
+
+fs::path pathOf(const std::string &text) { return fs::path(std::u8string(text.begin(), text.end())); }
+
+std::string textOf(const fs::path &path) {
+    const std::u8string text = path.u8string();
+    return std::string(text.begin(), text.end());
+}
+
+std::unique_lock<std::mutex> lockUpdates() {
+    std::unique_lock<std::mutex> lock(updating, std::try_to_lock);
+    if (!lock.owns_lock()) throw std::runtime_error("crossbind: the app is checking for or installing an update already");
+    return lock;
+}
+
+// Emptied each time, so that no download outlives the next check; a setup program that still runs keeps its file.
+fs::path updateFolder() {
+    const fs::path folder = pathOf(app::paths().cache) / "update";
+    std::error_code ignored;
+    fs::remove_all(folder, ignored);
+    fs::create_directories(folder);
+    return folder;
+}
+
+Manifest fetchManifest(const Updater &updater, const fs::path &folder) {
+    const fs::path file = folder / "manifest.json";
+    download(updater.manifestUrl, file, MAX_MANIFEST_SIZE);
+    try {
+        std::ifstream in(file, std::ios::binary);
+        std::map<std::string, std::string> fields = fieldsOf(std::string(std::istreambuf_iterator<char>(in), std::istreambuf_iterator<char>()));
+        const Manifest manifest{fields["version"], fields["file"], fields["signature"]};
+        if (!versionOf(manifest.version) || !isFileName(manifest.file) || manifest.signature.size() != SIGNATURE_TEXT_SIZE) throw NoManifest();
+        return manifest;
+    } catch (const NoManifest &) {
+        throw std::runtime_error("crossbind: " + updater.manifestUrl + " is no update manifest, as `crossbind app build` writes beside an app's update");
+    }
+}
+
+// The update the manifest offers when its version is newer than this app's.
+std::optional<Manifest> newerUpdate(const Updater &updater, const fs::path &folder) {
+    const Manifest manifest = fetchManifest(updater, folder);
+    if (!isNewer(versionOf(manifest.version).value(), versionOf(updater.version).value())) return std::nullopt;
+    return manifest;
+}
+
+std::string sha512Of(const fs::path &file) {
+    std::ifstream in(file, std::ios::binary);
+    crypto_sha512_ctx context;
+    crypto_sha512_init(&context);
+    std::vector<char> chunk(READ_CHUNK);
+    while (in.read(chunk.data(), static_cast<std::streamsize>(chunk.size())) || in.gcount() > 0) {
+        crypto_sha512_update(&context, reinterpret_cast<const uint8_t *>(chunk.data()), static_cast<size_t>(in.gcount()));
+    }
+    if (!in.eof()) throw std::runtime_error("crossbind: cannot read the update " + textOf(file));
+    uint8_t hash[64];
+    crypto_sha512_final(&context, hash);
+    std::string hex;
+    for (const uint8_t byte : hash) {
+        char digits[3];
+        std::snprintf(digits, sizeof digits, "%02x", byte);
+        hex += digits;
+    }
+    return hex;
+}
+
+// The signature covers the app's id, its platform and architecture, the version and the file's SHA-512, as the build
+// signed them, so that no update passes for another app's, platform's or version's.
+void verify(const Updater &updater, const Manifest &manifest, const fs::path &file) {
+    const std::optional<std::vector<uint8_t>> signature = fromBase64(manifest.signature);
+    const std::string text = "crossbind update\n" + updater.id + "\n" + PLATFORM + "-" + ARCH + "\n" + manifest.version + "\n" + sha512Of(file) + "\n";
+    const bool holds = signature && signature->size() == SIGNATURE_SIZE &&
+                       crypto_ed25519_check(signature->data(), updater.key.data(), reinterpret_cast<const uint8_t *>(text.data()), text.size()) == 0;
+    if (!holds) {
+        throw std::runtime_error("crossbind: the update to " + manifest.version +
+                                 " is not signed with the key of app.updater.publicKey, so the app does not install it");
+    }
+}
+
+#ifndef _WIN32
+
+#ifdef __APPLE__
+constexpr const char *READ_ONLY_HINT = "The app updates in a folder its user can change: one opened from its disk image, or from where it was "
+                                       "downloaded to, updates once it is moved to Applications.";
+#else
+constexpr const char *READ_ONLY_HINT = "The app updates in a folder its user can change: one installed from its Debian package updates with the "
+                                       "package manager.";
+#endif
+
+[[noreturn]] void cannotInstall(const std::string &why) { throw std::runtime_error("crossbind: cannot install the update: " + why); }
+
+// The child's id, or -1 with errno saying why there is none.
+pid_t spawn(const std::vector<std::string> &command) {
+    std::vector<char *> argv;
+    for (const auto &arg : command) argv.push_back(const_cast<char *>(arg.c_str()));
+    argv.push_back(nullptr);
+    pid_t child = 0;
+    if (const int error = posix_spawn(&child, argv[0], nullptr, nullptr, argv.data(), environ)) {
+        errno = error;
+        return -1;
+    }
+    return child;
+}
+
+bool runs(const std::vector<std::string> &command) {
+    const pid_t child = spawn(command);
+    if (child < 0) return false;
+    int status = 0;
+    pid_t waited = 0;
+    do {
+        waited = waitpid(child, &status, 0);
+    } while (waited < 0 && errno == EINTR);
+    return waited == child && WIFEXITED(status) && WEXITSTATUS(status) == 0;
+}
+
+// The one folder an update unpacks to, or none.
+fs::path unpackedApp(const fs::path &staging) {
+    std::vector<fs::path> entries;
+    for (const auto &entry : fs::directory_iterator(staging)) entries.push_back(entry.path());
+    return entries.size() == 1 && fs::is_directory(fs::symlink_status(entries[0])) ? entries[0] : fs::path();
+}
+
+// Trades the two places at once, so that no moment leaves the app missing.
+bool swapped(const fs::path &a, const fs::path &b) {
+#ifdef __APPLE__
+    return renamex_np(a.c_str(), b.c_str(), RENAME_SWAP) == 0;
+#else
+    return renameat2(AT_FDCWD, a.c_str(), AT_FDCWD, b.c_str(), RENAME_EXCHANGE) == 0;
+#endif
+}
+
+// Puts the app the update unpacks in place of this one. The update unpacks beside the app, on the same disk, whose file
+// system swaps the two.
+void replaceApp(const fs::path &update) {
+#ifdef __APPLE__
+    // A macOS app is its bundle, which ditto unpacks with its signature and Apple's ticket.
+    const fs::path app = bundlePath();
+    const fs::path marker = fs::path("Contents") / "Info.plist";
+    const std::vector<std::string> unpack = {"/usr/bin/ditto", "-x", "-k", update.string()};
+#else
+    // A Linux app is a folder, which tar unpacks as this user's.
+    const fs::path executable = fs::read_symlink("/proc/self/exe");
+    const fs::path app = executable.parent_path();
+    const fs::path marker = executable.filename();
+    const std::vector<std::string> unpack = {"/bin/tar", "--no-same-owner", "-xzf", update.string(), "-C"};
+#endif
+    std::string staging = (app.parent_path() / ".crossbind-update-XXXXXX").string();
+    if (!mkdtemp(staging.data())) cannotInstall(app.parent_path().string() + ": " + std::strerror(errno) + ". " + READ_ONLY_HINT);
+    std::error_code ignored;
+    try {
+        std::vector<std::string> command = unpack;
+        command.push_back(staging);
+        if (!runs(command)) cannotInstall(command[0] + " cannot unpack " + update.string());
+        const fs::path unpacked = unpackedApp(staging);
+        if (unpacked.empty() || !fs::exists(unpacked / marker)) cannotInstall(update.string() + " holds no app");
+        checkSigner(unpacked);
+        if (!swapped(unpacked, app)) cannotInstall(app.parent_path().string() + " cannot swap the app for its update: " + std::strerror(errno));
+    } catch (...) {
+        fs::remove_all(staging, ignored);
+        throw;
+    }
+    // The old app is where the update was unpacked.
+    fs::remove_all(staging, ignored);
+}
+
+#endif
+
+// The version the manifest offers when it is newer than this app's.
+std::optional<std::string> check(const Updater &updater) {
+    const std::unique_lock<std::mutex> lock = lockUpdates();
+    const std::optional<Manifest> manifest = newerUpdate(updater, updateFolder());
+    return manifest ? std::optional<std::string>(manifest->version) : std::nullopt;
+}
+
+// Installs the newer version, then quits the app, which opens anew: a macOS or Linux app once it has quit, a Windows one
+// from its setup program.
+void install(const Updater &updater) {
+#ifdef CROSSBIND_APP_DEV
+    // CROSSBIND_APP_DEV marks a debug host, as `crossbind app dev` builds, whose app its dev server opened; app.relaunch()
+    // refuses it as well.
+    throw std::runtime_error("crossbind: a development session does not install an update, which would take the place of the app its dev "
+                             "server opened: the built app does");
+#endif
+    const std::unique_lock<std::mutex> lock = lockUpdates();
+    const fs::path folder = updateFolder();
+    const std::optional<Manifest> manifest = newerUpdate(updater, folder);
+    if (!manifest) {
+        throw std::runtime_error("crossbind: the app is up to date: " + updater.manifestUrl + " offers no version newer than " + updater.version);
+    }
+    const fs::path file = folder / manifest->file;
+    try {
+        download(fileUrl(updater.manifestUrl, manifest->file), file, MAX_UPDATE_SIZE);
+        verify(updater, *manifest, file);
+#ifdef _WIN32
+        checkSigner(file);
+        runSetup(file);
+#else
+        replaceApp(file);
+#endif
+    } catch (...) {
+        std::error_code ignored;
+        fs::remove(file, ignored);
+        throw;
+    }
+#ifdef _WIN32
+    app::quit();
+#else
+    std::error_code ignored;
+    fs::remove(file, ignored);
+    app::relaunch();
+#endif
+}
+
+}  // namespace
+}  // namespace crossbind::updater
+
+void crossbind_extension_updater(crossbind::Registry &registry) {
+    using namespace crossbind::updater;
+    using crossbind::Call;
+    using crossbind::Value;
+    const Updater updater = updaterOf(registry.options());
+    // The updater downloads, so its calls run on a thread of their own, which answers them.
+    registry.function("updater.check", [updater](Call call) {
+        crossbind::inBackground(std::move(call), [updater] {
+            const std::optional<std::string> version = check(updater);
+            return version ? Value(Value::Object{{"version", *version}}) : Value();
+        });
+    });
+    registry.function("updater.install", [updater](Call call) {
+        crossbind::inBackground(std::move(call), [updater] {
+            install(updater);
+            return Value();
+        });
+    });
+}

package/native/updater.h

@@ -0,0 +1,27 @@
+#pragma once
+
+// What each desktop platform does for the updater.
+#include <cstdint>
+#include <filesystem>
+#include <string>
+
+namespace crossbind::updater {
+
+// Fetches an address into a file, on the thread that calls it, which is not the main one, and throws why it could not,
+// as when the answer runs past maxBytes.
+void download(const std::string &url, const std::filesystem::path &file, std::uintmax_t maxBytes);
+// Throws why not when an update, the app it unpacked to or its setup program, is not signed by the app's own signer: on
+// macOS by its code signature, on Windows by its Authenticode signature, which Windows trusts. A leaked key of
+// app.updater's then installs nothing else. An app without such a signature, as a Linux app always is, takes any update
+// the key signed; a Windows app whose own signature Windows does not trust takes none.
+void checkSigner(const std::filesystem::path &update);
+#ifdef __APPLE__
+// The app's bundle, which an update takes the place of.
+std::filesystem::path bundlePath();
+#endif
+#ifdef _WIN32
+// Starts an update's setup program, which installs it where the app is once the app has quit, and opens it anew.
+void runSetup(const std::filesystem::path &setup);
+#endif
+
+}  // namespace crossbind::updater

package/native/windows.cpp

@@ -0,0 +1,195 @@
+#include "updater.h"
+
+#include <windows.h>
+
+#include <softpub.h>
+#include <wincrypt.h>
+#include <winhttp.h>
+#include <wintrust.h>
+
+#include <cstdio>
+#include <fstream>
+#include <memory>
+#include <stdexcept>
+#include <vector>
+
+namespace crossbind::updater {
+namespace {
+
+constexpr DWORD READ_CHUNK = 64 * 1024;
+// Antivirus software reads a program it has just seen written, which holds it from running for a moment.
+constexpr int SETUP_TRIES = 4;
+constexpr DWORD SETUP_RETRY_MS = 500;
+
+std::wstring wide(const std::string &text) {
+    if (text.empty()) return {};
+    const int size = MultiByteToWideChar(CP_UTF8, 0, text.data(), static_cast<int>(text.size()), nullptr, 0);
+    std::wstring result(static_cast<size_t>(size), L'\0');
+    MultiByteToWideChar(CP_UTF8, 0, text.data(), static_cast<int>(text.size()), result.data(), size);
+    return result;
+}
+
+std::string utf8(const wchar_t *text) {
+    if (!text || !*text) return {};
+    const int size = WideCharToMultiByte(CP_UTF8, 0, text, -1, nullptr, 0, nullptr, nullptr);
+    std::string result(static_cast<size_t>(size - 1), '\0');
+    WideCharToMultiByte(CP_UTF8, 0, text, -1, result.data(), size, nullptr, nullptr);
+    return result;
+}
+
+// The app's executable, however long its path.
+std::wstring executablePath() {
+    std::wstring path(MAX_PATH, L'\0');
+    for (;;) {
+        const DWORD length = GetModuleFileNameW(nullptr, path.data(), static_cast<DWORD>(path.size()));
+        if (length < path.size()) {
+            path.resize(length);
+            return path;
+        }
+        path.resize(path.size() * 2);
+    }
+}
+
+// WinHTTP's handles, closed as they go out of scope.
+using Internet = std::unique_ptr<void, decltype(&WinHttpCloseHandle)>;
+
+Internet internet(HINTERNET opened) { return Internet(opened, &WinHttpCloseHandle); }
+
+std::runtime_error failed(const std::string &url) {
+    return std::runtime_error("crossbind: cannot download " + url + ": WinHTTP error " + std::to_string(GetLastError()));
+}
+
+std::string hex(LONG status) {
+    char text[sizeof "0x00000000"];
+    std::snprintf(text, sizeof text, "0x%08lx", static_cast<unsigned long>(status));
+    return text;
+}
+
+// A file's Authenticode signature: whether Windows trusts it, whether the file has none at all, which WinVerifyTrust
+// tells apart from one it cannot read by the thread's last error, and the common name of the certificate that made it
+// once Windows trusts it. Windows checks no revocation for it, as a revocation server out of reach would refuse every
+// update.
+struct Signature {
+    LONG trust;
+    bool isUnsigned;
+    std::wstring signer;
+};
+
+Signature signature(const std::wstring &file) {
+    WINTRUST_FILE_INFO info{};
+    info.cbStruct = sizeof info;
+    info.pcwszFilePath = file.c_str();
+    WINTRUST_DATA data{};
+    data.cbStruct = sizeof data;
+    data.dwUIChoice = WTD_UI_NONE;
+    data.fdwRevocationChecks = WTD_REVOKE_NONE;
+    data.dwUnionChoice = WTD_CHOICE_FILE;
+    data.pFile = &info;
+    data.dwStateAction = WTD_STATEACTION_VERIFY;
+    data.dwProvFlags = WTD_REVOCATION_CHECK_NONE;
+    GUID action = WINTRUST_ACTION_GENERIC_VERIFY_V2;
+    const HWND noWindow = static_cast<HWND>(INVALID_HANDLE_VALUE);
+    Signature result{WinVerifyTrust(noWindow, &action, &data), false, {}};
+    if (result.trust == TRUST_E_NOSIGNATURE) {
+        const auto reason = static_cast<LONG>(GetLastError());
+        result.isUnsigned = reason == TRUST_E_NOSIGNATURE || reason == TRUST_E_SUBJECT_FORM_UNKNOWN || reason == TRUST_E_PROVIDER_UNKNOWN;
+    }
+    if (result.trust == ERROR_SUCCESS) {
+        CRYPT_PROVIDER_DATA *provider = WTHelperProvDataFromStateData(data.hWVTStateData);
+        CRYPT_PROVIDER_SGNR *signer = provider ? WTHelperGetProvSignerFromChain(provider, 0, FALSE, 0) : nullptr;
+        CRYPT_PROVIDER_CERT *leaf = signer ? WTHelperGetProvCertFromChain(signer, 0) : nullptr;
+        if (leaf) {
+            void *commonName = const_cast<char *>(szOID_COMMON_NAME);
+            const DWORD length = CertGetNameStringW(leaf->pCert, CERT_NAME_ATTR_TYPE, 0, commonName, nullptr, 0);
+            result.signer.resize(length);
+            CertGetNameStringW(leaf->pCert, CERT_NAME_ATTR_TYPE, 0, commonName, result.signer.data(), length);
+            result.signer.resize(length - 1);
+        }
+    }
+    data.dwStateAction = WTD_STATEACTION_CLOSE;
+    WinVerifyTrust(noWindow, &action, &data);
+    return result;
+}
+
+}  // namespace
+
+// A signed app's update has a setup program whose signature Windows trusts, by the app's own signer: the same common
+// name, which a renewed certificate keeps. A signed app whose own signature Windows does not trust installs none.
+void checkSigner(const std::filesystem::path &update) {
+    const Signature own = signature(executablePath());
+    if (own.isUnsigned) return;
+    if (own.trust != ERROR_SUCCESS) {
+        throw std::runtime_error("crossbind: cannot install the update: Windows does not trust this app's own signature (" + hex(own.trust) +
+                                 "), whose signer an update must carry; sign the app with a certificate Windows trusts");
+    }
+    const Signature theirs = signature(update.wstring());
+    if (theirs.trust != ERROR_SUCCESS || theirs.signer != own.signer) {
+        const std::string but = theirs.trust != ERROR_SUCCESS ? ", and Windows trusts no signature of it (" + hex(theirs.trust) + ")"
+                                                              : ", but by " + utf8(theirs.signer.c_str());
+        throw std::runtime_error("crossbind: cannot install the update: " + utf8(update.filename().c_str()) + " is not signed by " + utf8(own.signer.c_str()) +
+                                 ", who signs this app" + but);
+    }
+}
+
+// WinHTTP keeps no cache, so every check asks the server anew, and it goes through the system's proxy.
+void download(const std::string &url, const std::filesystem::path &file, std::uintmax_t maxBytes) {
+    const std::wstring address = wide(url);
+    URL_COMPONENTS parts{};
+    parts.dwStructSize = sizeof parts;
+    parts.dwHostNameLength = parts.dwUrlPathLength = parts.dwExtraInfoLength = static_cast<DWORD>(-1);
+    if (!WinHttpCrackUrl(address.c_str(), 0, 0, &parts)) throw std::runtime_error("crossbind: " + url + " is no address");
+    const std::wstring host(parts.lpszHostName, parts.dwHostNameLength);
+    const std::wstring path = std::wstring(parts.lpszUrlPath, parts.dwUrlPathLength) + std::wstring(parts.lpszExtraInfo, parts.dwExtraInfoLength);
+    const Internet session = internet(WinHttpOpen(L"crossbind", WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0));
+    if (!session) throw failed(url);
+    const Internet connection = internet(WinHttpConnect(session.get(), host.c_str(), parts.nPort, 0));
+    if (!connection) throw failed(url);
+    const Internet request = internet(WinHttpOpenRequest(connection.get(), L"GET", path.c_str(), nullptr, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES,
+                                                         parts.nScheme == INTERNET_SCHEME_HTTPS ? WINHTTP_FLAG_SECURE : 0));
+    DWORD status = 0;
+    DWORD size = sizeof status;
+    if (!request || !WinHttpSendRequest(request.get(), WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0) ||
+        !WinHttpReceiveResponse(request.get(), nullptr) ||
+        !WinHttpQueryHeaders(request.get(), WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER, WINHTTP_HEADER_NAME_BY_INDEX, &status, &size,
+                             WINHTTP_NO_HEADER_INDEX)) {
+        throw failed(url);
+    }
+    if (status != HTTP_STATUS_OK) throw std::runtime_error("crossbind: " + url + " answered " + std::to_string(status));
+    std::ofstream out(file, std::ios::binary | std::ios::trunc);
+    std::vector<char> chunk(READ_CHUNK);
+    std::uintmax_t total = 0;
+    for (DWORD read = 0;;) {
+        if (!WinHttpReadData(request.get(), chunk.data(), READ_CHUNK, &read)) throw failed(url);
+        if (read == 0) break;
+        total += read;
+        if (total > maxBytes) throw std::runtime_error("crossbind: " + url + " answered more than " + std::to_string(maxBytes) + " bytes");
+        out.write(chunk.data(), read);
+    }
+    if (!out.flush()) throw std::runtime_error("crossbind: cannot keep the download of " + url);
+}
+
+// installer.nsi's /UPDATE waits for the app to quit, installs the update in the app's folder, which /D= names unquoted
+// and last, and opens it anew. A folder this user cannot write to fails here, as the setup program shows nothing.
+void runSetup(const std::filesystem::path &setup) {
+    const std::filesystem::path folder = std::filesystem::path(executablePath()).parent_path();
+    wchar_t probe[MAX_PATH];
+    if (!GetTempFileNameW(folder.c_str(), L"cbu", 0, probe)) {
+        throw std::runtime_error("crossbind: cannot install the update: this user cannot change " + utf8(folder.c_str()));
+    }
+    DeleteFileW(probe);
+    std::wstring command = L"\"" + setup.wstring() + L"\" /S /UPDATE /D=" + folder.wstring();
+    STARTUPINFOW startup{};
+    startup.cb = sizeof startup;
+    PROCESS_INFORMATION process{};
+    for (int tries = 1; !CreateProcessW(setup.c_str(), command.data(), nullptr, nullptr, FALSE, 0, nullptr, nullptr, &startup, &process); tries += 1) {
+        const DWORD error = GetLastError();
+        if (error != ERROR_SHARING_VIOLATION || tries == SETUP_TRIES) {
+            throw std::runtime_error("crossbind: cannot install the update: Windows cannot run its setup program, error " + std::to_string(error));
+        }
+        Sleep(SETUP_RETRY_MS);
+    }
+    CloseHandle(process.hThread);
+    CloseHandle(process.hProcess);
+}
+
+}  // namespace crossbind::updater