@hot-updater/react-native 1.0.4 → 1.0.6

package/HotUpdater.podspec

@@ -16,14 +16,35 @@ Pod::Spec.new do |s|
   s.source_files  = "ios/**/*.{h,m,mm,swift}"
   s.public_header_files = "ios/HotUpdater/Public/*.h"
   s.private_header_files = "ios/HotUpdater/Internal/*.h"
-  s.exclude_files = ["ios/HotUpdater/Package.swift", "ios/HotUpdater/Test/**/*.{swift,h,m,mm}"]
+  # ios/HotUpdater/Interface, ios/Plugins and HotUpdaterInterface.swift are
+  # for Swift Package Manager builds (Package.swift) only.
+  s.exclude_files = [
+    "ios/HotUpdater/Package.swift",
+    "ios/HotUpdater/Test/**/*.{swift,h,m,mm}",
+    "ios/HotUpdater/Interface/**/*",
+    "ios/HotUpdater/Internal/HotUpdaterInterface.swift",
+    "ios/Plugins/**/*"
+  ]
   s.libraries = "bz2"
 
   s.pod_target_xcconfig = {
     "DEFINES_MODULE" => "YES",
-    "OTHER_SWIFT_FLAGS" => "-enable-experimental-feature AccessLevelOnImport"
+    "OTHER_SWIFT_FLAGS" => "-enable-experimental-feature AccessLevelOnImport",
+    "HEADER_SEARCH_PATHS" => "\"$(DERIVED_FILE_DIR)\""
   }
 
+  # Every build, before compiling, writes the build's MIN_BUNDLE_ID into the
+  # header HotUpdaterMinBundleId.m includes, so Xcode, xcodebuild and the CLI
+  # all ship the time they built.
+  s.script_phases = [{
+    :name => "[HotUpdater] Generate MIN_BUNDLE_ID",
+    :script => File.read(File.join(__dir__, "ios/scripts/generate-min-bundle-id.zsh")),
+    :shell_path => "/bin/zsh",
+    :execution_position => :before_compile,
+    :output_files => ["$(DERIVED_FILE_DIR)/HotUpdaterBuildMinBundleId.h"],
+    :always_out_of_date => "1"
+  }]
+
   # Use install_modules_dependencies helper to install the dependencies if React Native version >=0.71.0.
   # See https://github.com/facebook/react-native/blob/febf6b7f33fdb4904669f99d795eba4c0f95d7bf/scripts/cocoapods/new_architecture.rb#L79.
   if respond_to?(:install_modules_dependencies, true)
@@ -35,7 +56,7 @@ Pod::Spec.new do |s|
     if ENV["RCT_NEW_ARCH_ENABLED"] == "1" then
       s.compiler_flags = folly_compiler_flags + " -DRCT_NEW_ARCH_ENABLED=1"
       s.pod_target_xcconfig    = {
-          "HEADER_SEARCH_PATHS" => "\"$(PODS_ROOT)/boost\"",
+          "HEADER_SEARCH_PATHS" => "\"$(PODS_ROOT)/boost\" \"$(DERIVED_FILE_DIR)\"",
           "OTHER_CPLUSPLUSFLAGS" => "-DFOLLY_NO_CONFIG -DFOLLY_MOBILE=1 -DFOLLY_USE_LIBCPP=1",
           "CLANG_CXX_LANGUAGE_STANDARD" => "c++17"
       }

package/Package.swift

@@ -0,0 +1,100 @@
+// swift-tools-version: 6.0
+import PackageDescription
+
+// Swift Package Manager support for React Native's SwiftPM autolinking
+// (`npx react-native spm`, react-native >= 0.87). CocoaPods builds use
+// HotUpdater.podspec instead and never read this file.
+//
+// The autolinker references this package through
+// <app>/ios/build/generated/autolinking/libs/HotUpdater (`spm.name` in
+// react-native.config.js), so the two React Native packages below resolve
+// relative to that symlink.
+//
+// SwiftPM compiles one language per target, so the module is split:
+// HotUpdaterSwift holds the Swift implementation, and HotUpdater, the
+// Objective-C++ module React Native loads, calls it through the protocols in
+// HotUpdaterInterface (see HotUpdaterInterface.h for why). Swift reaches the
+// Objective-C++ side through `@_silgen_name` symbols only.
+let reactNativeDependencies: [Target.Dependency] = [
+    .product(name: "ReactHeaders", package: "ReactNative"),
+    .product(name: "ReactNativeHeaders", package: "ReactNative"),
+    .product(name: "ReactNativeDependenciesHeaders", package: "ReactNative"),
+    .product(name: "ReactAppHeaders", package: "React-GeneratedCode"),
+]
+
+let reactNativeCxxSettings: [CXXSetting] = [
+    .define("RCT_NEW_ARCH_ENABLED", to: "1"),
+    .define("DEBUG", .when(configuration: .debug)),
+    .define("NDEBUG", .when(configuration: .release)),
+]
+
+let package = Package(
+    name: "HotUpdater",
+    platforms: [.iOS(.v15)],
+    products: [
+        .library(name: "HotUpdater", targets: ["HotUpdater"]),
+    ],
+    dependencies: [
+        .package(name: "ReactNative", path: "../../../../xcframeworks"),
+        .package(name: "React-GeneratedCode", path: "../../../ios"),
+    ],
+    targets: [
+        .target(
+            name: "HotUpdater",
+            dependencies: [
+                "HotUpdaterInterface",
+                "HotUpdaterSwift",
+            ] + reactNativeDependencies,
+            path: "ios/HotUpdater",
+            sources: ["Internal/HotUpdater.mm"],
+            publicHeadersPath: "Public",
+            cxxSettings: reactNativeCxxSettings
+        ),
+        .target(
+            name: "HotUpdaterSwift",
+            dependencies: [
+                "HotUpdaterBsdiffPatch",
+                "HotUpdaterInterface",
+                "HotUpdaterRecovery",
+            ] + reactNativeDependencies,
+            path: "ios/HotUpdater/Internal",
+            exclude: [
+                "BsdiffPatchBridge.h",
+                "BsdiffPatchBridge.mm",
+                "HotUpdater-Bridging-Header.h",
+                "HotUpdater.mm",
+                "HotUpdaterMinBundleId.m",
+            ],
+            plugins: ["HotUpdaterMinBundleIdPlugin"]
+        ),
+        .target(
+            name: "HotUpdaterInterface",
+            dependencies: reactNativeDependencies,
+            path: "ios/HotUpdater/Interface",
+            publicHeadersPath: "."
+        ),
+        .target(
+            name: "HotUpdaterRecovery",
+            dependencies: reactNativeDependencies,
+            path: "ios/HotUpdater/Recovery",
+            publicHeadersPath: ".",
+            cxxSettings: reactNativeCxxSettings
+        ),
+        .target(
+            name: "HotUpdaterBsdiffPatch",
+            path: "ios/HotUpdater/Internal",
+            sources: ["BsdiffPatchBridge.mm"],
+            publicHeadersPath: ".",
+            linkerSettings: [.linkedLibrary("bz2")]
+        ),
+        // Writes this build's MIN_BUNDLE_ID before every build, as the
+        // podspec's script phase does for CocoaPods.
+        .plugin(
+            name: "HotUpdaterMinBundleIdPlugin",
+            capability: .buildTool(),
+            path: "ios/Plugins/HotUpdaterMinBundleIdPlugin"
+        ),
+    ],
+    swiftLanguageModes: [.v5],
+    cxxLanguageStandard: .cxx20
+)

package/android/build.gradle

@@ -31,6 +31,7 @@ def isNewArchitectureEnabled() {
 apply plugin: "com.android.library"
 apply plugin: "kotlin-android"
 apply from: "$projectDir/react-native-helpers.gradle"
+apply from: "$projectDir/hot-updater-builtin-assets.gradle"
 
 if (isNewArchitectureEnabled()) {
   apply plugin: "com.facebook.react"
@@ -71,7 +72,6 @@ android {
     targetSdkVersion getExtOrIntegerDefault("targetSdkVersion")
     buildConfigField "boolean", "IS_NEW_ARCHITECTURE_ENABLED", isNewArchitectureEnabled().toString()
     consumerProguardFiles 'proguard-rules.pro'
-    buildConfigField "long", "BUILD_TIMESTAMP", "${System.currentTimeMillis()}L"
 
     ndk {
       abiFilters(*reactNativeArchitectures())
@@ -82,9 +82,6 @@ android {
         arguments "-DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON"
       }
     }
-
-    def minBundleId = project.hasProperty("MIN_BUNDLE_ID") ? project.properties["MIN_BUNDLE_ID"] : null
-    buildConfigField "String", "MIN_BUNDLE_ID", minBundleId == null ? "\"null\"" : "\"${minBundleId}\""
   }
 
   buildFeatures {
@@ -136,6 +133,8 @@ android {
   }
 }
 
+apply from: "$projectDir/hot-updater-min-bundle-id.gradle"
+
 repositories {
   mavenCentral()
   google()

package/android/hot-updater-builtin-assets.gradle

@@ -0,0 +1,67 @@
+import groovy.json.JsonOutput
+import java.security.MessageDigest
+
+/**
+ * Records, in the app's assets, the SHA-256 of every asset React Native's
+ * bundle task emits, keyed by its path in the bundle, as an OTA manifest lists
+ * it (`drawable-mdpi/logo.png`).
+ *
+ * AAPT2 re-encodes PNGs in release builds (`crunchPngs`), so the packaged
+ * bytes no longer match the OTA's while the image is the same. With this
+ * record, the first OTA after a store install still reuses such an asset
+ * instead of downloading it: the record proves it came from the same source.
+ */
+class HotUpdaterBuiltInAssetIndex implements Action<Task> {
+  static final String FILE_NAME = "hot-updater-builtin-assets.json"
+
+  private final Provider<Directory> resourcesDir
+  private final Provider<Directory> jsBundleDir
+
+  HotUpdaterBuiltInAssetIndex(Provider<Directory> resourcesDir, Provider<Directory> jsBundleDir) {
+    this.resourcesDir = resourcesDir
+    this.jsBundleDir = jsBundleDir
+  }
+
+  private static String sha256(File file) {
+    MessageDigest digest = MessageDigest.getInstance("SHA-256")
+    file.withInputStream { input ->
+      byte[] buffer = new byte[65536]
+      int read
+      while ((read = input.read(buffer)) > 0) {
+        digest.update(buffer, 0, read)
+      }
+    }
+    return digest.digest().collect { String.format("%02x", it) }.join()
+  }
+
+  @Override
+  void execute(Task task) {
+    File resources = resourcesDir.get().asFile
+    File output = jsBundleDir.get().asFile
+    Map<String, String> assets = new TreeMap<>()
+    if (resources.isDirectory()) {
+      resources.eachFileRecurse { File file ->
+        if (!file.isFile()) return
+        String path = resources.toPath().relativize(file.toPath()).toString().replace(File.separatorChar, '/' as char)
+        // A nine-patch's border becomes a chunk, not a re-encoding of the image.
+        if (path.endsWith(".9.png")) return
+        assets[path] = sha256(file)
+      }
+    }
+    output.mkdirs()
+    new File(output, FILE_NAME).text = JsonOutput.toJson([schemaVersion: 1, assets: assets])
+  }
+}
+
+def hotUpdaterRecordBuiltInAssets = { Project app ->
+  app.tasks.matching { it.name ==~ /createBundle.+JsAndAssets/ }.configureEach { Task task ->
+    if (!task.hasProperty("resourcesDir") || !task.hasProperty("jsBundleDir")) return
+    task.doLast(new HotUpdaterBuiltInAssetIndex(task.resourcesDir, task.jsBundleDir))
+  }
+}
+
+rootProject.allprojects { Project candidate ->
+  candidate.pluginManager.withPlugin("com.android.application") {
+    hotUpdaterRecordBuiltInAssets(candidate)
+  }
+}

package/android/hot-updater-min-bundle-id.gradle

@@ -0,0 +1,69 @@
+// Writes this build's MIN_BUNDLE_ID into a generated source on every build,
+// at execution time, so neither an up-to-date check nor the configuration
+// cache keeps an earlier build's value. MIN_BUNDLE_ID is a UUIDv7 with zeroed
+// random bits on the same epoch millisecond clock as the bundle IDs
+// `hot-updater deploy` issues. The hot-updater CLI passes its own value as
+// -PMIN_BUNDLE_ID, which wins.
+abstract class GenerateHotUpdaterMinBundleIdTask extends DefaultTask {
+  @Input
+  @Optional
+  abstract Property<String> getMinBundleId()
+
+  @OutputDirectory
+  abstract DirectoryProperty getOutputDirectory()
+
+  @TaskAction
+  void generate() {
+    def minBundleId = getMinBundleId().getOrNull()?.toLowerCase(Locale.ROOT)
+    if (minBundleId == null) {
+      def timestampMs = System.currentTimeMillis()
+      minBundleId = String.format(
+        "%08x-%04x-7000-8000-000000000000",
+        timestampMs >>> 16,
+        timestampMs & 0xffff
+      )
+    } else if (!(minBundleId ==~ /[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/)) {
+      throw new GradleException("MIN_BUNDLE_ID must be a UUIDv7, got: ${getMinBundleId().get()}")
+    }
+
+    def source = getOutputDirectory().file("com/hotupdater/HotUpdaterMinBundleId.java").get().asFile
+    source.parentFile.mkdirs()
+    source.text = """package com.hotupdater;
+
+// Generated by generateHotUpdaterMinBundleId on every build.
+final class HotUpdaterMinBundleId {
+  private HotUpdaterMinBundleId() {}
+
+  static String get() {
+    return "${minBundleId}";
+  }
+}
+"""
+  }
+}
+
+def generateHotUpdaterMinBundleId = tasks.register("generateHotUpdaterMinBundleId", GenerateHotUpdaterMinBundleIdTask) {
+  minBundleId.set(providers.gradleProperty("MIN_BUNDLE_ID"))
+  outputDirectory.set(layout.buildDirectory.dir("generated/source/hotUpdaterMinBundleId"))
+  outputs.upToDateWhen { false }
+}
+
+def agpVersion = androidComponents.pluginVersion
+
+// AGP 7.3 added generated source directories to the Variant API. Older AGP,
+// which React Native 0.70 and earlier ship, registers the task on the legacy
+// variant API instead.
+if (agpVersion.major > 7 || (agpVersion.major == 7 && agpVersion.minor >= 3)) {
+  androidComponents {
+    onVariants(selector().all()) { variant ->
+      variant.sources.java.addGeneratedSourceDirectory(generateHotUpdaterMinBundleId) { it.outputDirectory }
+    }
+  }
+} else {
+  android.libraryVariants.all { variant ->
+    variant.registerJavaGeneratingTask(
+      generateHotUpdaterMinBundleId,
+      generateHotUpdaterMinBundleId.get().outputDirectory.get().asFile
+    )
+  }
+}

package/android/src/main/java/com/hotupdater/ArtifactFileResolver.kt

@@ -0,0 +1,85 @@
+package com.hotupdater
+
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONArray
+import org.json.JSONObject
+import java.util.concurrent.TimeUnit
+
+/** A download URL the server signed for one manifest file. */
+data class ResolvedArtifactFile(
+    val url: String,
+    val compression: String?,
+)
+
+/**
+ * Artifact protocol v2: the server signs only the files an install downloads
+ * one by one, after reusing local files and choosing the archive.
+ */
+interface ArtifactFileResolver {
+    /** Download URLs for [paths], at most [ARTIFACT_FILES_REQUEST_LIMIT]. */
+    suspend fun resolve(paths: List<String>): Map<String, ResolvedArtifactFile>
+
+    companion object {
+        /** `ARTIFACT_FILES_REQUEST_LIMIT` in @hot-updater/protocol. */
+        const val ARTIFACT_FILES_REQUEST_LIMIT = 100
+    }
+}
+
+/**
+ * POSTs `{ paths }` to the files URL the SDK composed, with the update check's
+ * headers and request timeout.
+ */
+class HttpArtifactFileResolver(
+    private val filesUrl: String,
+    private val headers: Map<String, String>,
+    private val timeoutMs: Long = DEFAULT_TIMEOUT_MS,
+) : ArtifactFileResolver {
+    override suspend fun resolve(paths: List<String>): Map<String, ResolvedArtifactFile> =
+        withContext(Dispatchers.IO) {
+            val body = JSONObject().put("paths", JSONArray(paths)).toString()
+            val request =
+                Request
+                    .Builder()
+                    .url(filesUrl)
+                    .header("Accept", "application/json")
+                    .apply { headers.forEach { (name, value) -> header(name, value) } }
+                    .post(body.toRequestBody("application/json".toMediaType()))
+                    .build()
+            client
+                .newBuilder()
+                .callTimeout(timeoutMs, TimeUnit.MILLISECONDS)
+                .build()
+                .newCall(request)
+                .execute()
+                .use { response ->
+                    if (!response.isSuccessful) {
+                        throw HttpStatusException(response.code, response.message)
+                    }
+                    val files =
+                        JSONObject(response.body?.string() ?: "").optJSONObject("files")
+                            ?: throw IllegalStateException("Artifact files response has no files")
+                    paths.associateWith { path ->
+                        val file =
+                            files.optJSONObject(path)
+                                ?: throw IllegalStateException("Artifact files response omits $path")
+                        ResolvedArtifactFile(
+                            url = file.getString("url"),
+                            compression =
+                                if (file.has("compression") && !file.isNull("compression")) file.getString("compression") else null,
+                        )
+                    }
+                }
+        }
+
+    companion object {
+        /** The SDK's request timeout when the app sets none. */
+        const val DEFAULT_TIMEOUT_MS = 5_000L
+
+        private val client = OkHttpClient()
+    }
+}

package/android/src/main/java/com/hotupdater/BuiltInAssetResolver.kt

@@ -15,6 +15,28 @@ interface BuiltInAssetResolver {
         expectedHash: String,
         destination: File,
     ): Boolean
+
+    /**
+     * Copies the packaged asset at [assetPath] when the native build recorded
+     * [expectedHash] as the hash of its source, although its packaged bytes
+     * differ, as AAPT2's PNG crunch leaves them. Returns the SHA-256 of the
+     * copied bytes, or null when the asset is not the same.
+     */
+    fun copyIfSourceMatches(
+        assetPath: String,
+        expectedHash: String,
+        destination: File,
+    ): String? = null
+
+    /**
+     * The SHA-256 of the packaged asset at [assetPath] when the native build
+     * recorded [expectedHash] as its source; null otherwise. Read from the
+     * APK itself, so nothing in app storage can vouch for a file.
+     */
+    fun packagedHashIfSourceMatches(
+        assetPath: String,
+        expectedHash: String,
+    ): String? = null
 }
 
 internal class AndroidBuiltInAssetResolver(
@@ -28,6 +50,12 @@ internal class AndroidBuiltInAssetResolver(
 
     private val lock = Any()
 
+    /** Source hashes the native build recorded, by asset path. */
+    private val sourceHashes: Map<String, String> by lazy { readSourceHashes() }
+
+    /** Packaged bytes' hashes by locator, read from the APK in this process only. */
+    private val packagedHashes = mutableMapOf<String, String>()
+
     override fun copyIfMatches(
         assetPath: String,
         expectedHash: String,
@@ -50,6 +78,73 @@ internal class AndroidBuiltInAssetResolver(
             true
         }
 
+    override fun copyIfSourceMatches(
+        assetPath: String,
+        expectedHash: String,
+        destination: File,
+    ): String? =
+        synchronized(lock) {
+            val normalizedPath = RelativePathResolver.normalizeRelativePath(assetPath) ?: return@synchronized null
+            if (!sourceHashes[normalizedPath].equals(expectedHash, ignoreCase = true)) return@synchronized null
+            val packageIdentity = packageIdentity() ?: return@synchronized null
+            // Resolved again, never from the cached index in app storage.
+            val locator = resolveLocator(normalizedPath) ?: return@synchronized null
+            val packagedHash = copyLocator(locator, destination) { true } ?: return@synchronized null
+            packagedHashes[locator] = packagedHash
+
+            val index = readIndex(packageIdentity)
+            index.locators[normalizedPath] = locator
+            writeIndex(index)
+            packagedHash
+        }
+
+    override fun packagedHashIfSourceMatches(
+        assetPath: String,
+        expectedHash: String,
+    ): String? =
+        synchronized(lock) {
+            val normalizedPath = RelativePathResolver.normalizeRelativePath(assetPath) ?: return@synchronized null
+            if (!sourceHashes[normalizedPath].equals(expectedHash, ignoreCase = true)) return@synchronized null
+            val locator = resolveLocator(normalizedPath) ?: return@synchronized null
+            packagedHashes[locator] ?: hashLocator(locator)?.also { packagedHashes[locator] = it }
+        }
+
+    private fun hashLocator(locator: String): String? =
+        try {
+            openLocator(locator)?.use { source ->
+                val digest = MessageDigest.getInstance("SHA-256")
+                val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+                while (true) {
+                    val count = source.read(buffer)
+                    if (count < 0) break
+                    digest.update(buffer, 0, count)
+                }
+                digest.digest().joinToString("") { "%02x".format(it) }
+            }
+        } catch (_: Exception) {
+            null
+        }
+
+    private fun readSourceHashes(): Map<String, String> =
+        try {
+            val json =
+                JSONObject(
+                    context.assets
+                        .open(SOURCE_HASHES_ASSET)
+                        .bufferedReader()
+                        .use { it.readText() },
+                )
+            if (json.optInt("schemaVersion") != SOURCE_HASHES_SCHEMA_VERSION) {
+                emptyMap()
+            } else {
+                val assets = json.optJSONObject("assets") ?: JSONObject()
+                assets.keys().asSequence().associateWith { assets.getString(it) }
+            }
+        } catch (_: Exception) {
+            // A build without the record reuses only byte-identical assets.
+            emptyMap()
+        }
+
     private fun resolveLocator(assetPath: String): String? {
         if (assetPath == "index.android.bundle") {
             return try {
@@ -123,8 +218,15 @@ internal class AndroidBuiltInAssetResolver(
         locator: String,
         expectedHash: String,
         destination: File,
-    ): Boolean {
-        val input = openLocator(locator) ?: return false
+    ): Boolean = copyLocator(locator, destination) { it.equals(expectedHash, ignoreCase = true) } != null
+
+    /** Copies the located bytes when [accepts] their SHA-256, and returns it. */
+    private fun copyLocator(
+        locator: String,
+        destination: File,
+        accepts: (String) -> Boolean,
+    ): String? {
+        val input = openLocator(locator) ?: return null
         val tempFile = File(destination.parentFile, "${destination.name}.builtin.tmp")
         return try {
             destination.parentFile?.mkdirs()
@@ -141,21 +243,20 @@ internal class AndroidBuiltInAssetResolver(
                 }
             }
             val actualHash = digest.digest().joinToString("") { "%02x".format(it) }
-            if (!actualHash.equals(expectedHash, ignoreCase = true)) {
+            if (!accepts(actualHash)) {
                 tempFile.delete()
-                false
+                null
             } else {
                 if (destination.exists()) destination.delete()
-                tempFile.renameTo(destination) ||
-                    run {
-                        tempFile.copyTo(destination, overwrite = true)
-                        tempFile.delete()
-                        true
-                    }
+                if (!tempFile.renameTo(destination)) {
+                    tempFile.copyTo(destination, overwrite = true)
+                    tempFile.delete()
+                }
+                actualHash
             }
         } catch (_: Exception) {
             tempFile.delete()
-            false
+            null
         }
     }
 
@@ -282,5 +383,9 @@ internal class AndroidBuiltInAssetResolver(
 
     companion object {
         private const val SCHEMA_VERSION = 1
+
+        /** Written by the native build: see android/hot-updater-builtin-assets.gradle. */
+        private const val SOURCE_HASHES_ASSET = "hot-updater-builtin-assets.json"
+        private const val SOURCE_HASHES_SCHEMA_VERSION = 1
     }
 }