@hot-updater/react-native 1.0.5 → 1.0.7

package/android/src/main/java/com/hotupdater/BundleFileStorageService.kt

@@ -124,6 +124,7 @@ interface BundleStorageService {
         manifestFileHash: String,
         assets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String? = null,
+        fileResolver: ArtifactFileResolver? = null,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult
 
@@ -239,6 +240,16 @@ class BundleFileStorageService(
         private const val MAX_SAFE_INTEGER = 9_007_199_254_740_991L
         private val SHA256_PATTERN = Regex("^[0-9a-f]{64}$")
 
+        /** Files downloaded at once when the archive is not used. */
+        private const val PARALLEL_FILE_DOWNLOADS = 16
+
+        /**
+         * What one request costs beyond the first [PARALLEL_FILE_DOWNLOADS], in
+         * bytes: each waits a round trip for a free slot, about 100 ms, which
+         * at 5 MB/s over 16 slots is the time of 32 KiB.
+         */
+        private const val REQUEST_OVERHEAD_BYTES = 32L * 1024
+
         /** A patch produced a file that does not match the target, or none at all. */
         private val PATCH_FAILURE =
             UpdateFailure(UpdateFailureStage.INSTALL, UpdateFailureReason.PATCH, resource = UpdateFailureResource.PATCH)
@@ -718,10 +729,35 @@ class BundleFileStorageService(
         if (resolveBundleFile(bundleDir, bundleId) == null) return false
         return manifest.assets.all { (assetPath, asset) ->
             val file = RelativePathResolver.resolveInside(bundleDir, assetPath)
-            file?.isFile == true && runCatching { verifyManifestAssetFileOrThrow(file, asset) }.isSuccess
+            file?.isFile == true &&
+                (
+                    runCatching { verifyManifestAssetFileOrThrow(file, asset) }.isSuccess ||
+                        isBuiltInEquivalent(assetPath, file, asset)
+                )
         }
     }
 
+    /**
+     * Whether [file] holds the packaged bytes of the built-in asset the native
+     * build recorded with the manifest's source hash, as AAPT2 re-encodes a
+     * PNG. Both come from the APK, never from app storage. The manifest's
+     * signature still covers that source hash.
+     */
+    private fun isBuiltInEquivalent(
+        assetPath: String,
+        file: File,
+        asset: ParsedManifestAsset,
+    ): Boolean {
+        val packagedHash = builtInAssetResolver.packagedHashIfSourceMatches(assetPath, asset.fileHash) ?: return false
+        return HashUtils.calculateSHA256(file).equals(packagedHash, ignoreCase = true) &&
+            runCatching {
+                if (SignatureVerifier.isSigningEnabled(context)) {
+                    val signature = asset.signature ?: throw SignatureVerificationException.InvalidSignatureFormat()
+                    SignatureVerifier.verifyHashSignature(context, asset.fileHash, signature)
+                }
+            }.isSuccess
+    }
+
     private fun recoverInterruptedPromotions(): Boolean {
         val bundleStoreDir = getBundleStoreDir()
         val backups =
@@ -1610,6 +1646,7 @@ class BundleFileStorageService(
         manifestFileHash: String,
         assets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String?,
+        fileResolver: ArtifactFileResolver?,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult =
         updateMutex.withLock {
@@ -1619,6 +1656,7 @@ class BundleFileStorageService(
                 manifestFileHash = manifestFileHash,
                 changedAssets = assets,
                 archiveUrl = archiveUrl,
+                fileResolver = fileResolver,
                 progressCallback = progressCallback,
             )
         }
@@ -1629,6 +1667,7 @@ class BundleFileStorageService(
         manifestFileHash: String,
         changedAssets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String?,
+        fileResolver: ArtifactFileResolver?,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult {
         Log.d(
@@ -1660,6 +1699,7 @@ class BundleFileStorageService(
                 manifestFileHash = manifestFileHash,
                 changedAssets = changedAssets,
                 archiveUrl = archiveUrl,
+                fileResolver = fileResolver,
                 bundleStoreDir = bundleStoreDir,
                 finalBundleDir = finalBundleDir,
                 progressCallback = progressCallback,
@@ -1710,6 +1750,35 @@ class BundleFileStorageService(
             }
         }
 
+    /**
+     * Asks [fileResolver] for the URLs of [downloads], in requests of at most
+     * [ArtifactFileResolver.ARTIFACT_FILES_REQUEST_LIMIT] paths.
+     */
+    private suspend fun resolveFileUrls(
+        fileResolver: ArtifactFileResolver,
+        downloads: MutableMap<String, ChangedAssetDescriptor>,
+    ) {
+        for (paths in downloads.keys.sorted().chunked(ArtifactFileResolver.ARTIFACT_FILES_REQUEST_LIMIT)) {
+            val files =
+                try {
+                    fileResolver.resolve(paths)
+                } catch (error: CancellationException) {
+                    throw error
+                } catch (error: Exception) {
+                    throw downloadError(error)
+                }
+            for (path in paths) {
+                val file = files[path] ?: throw HotUpdaterException.invalidBundle()
+                try {
+                    URL(file.url)
+                } catch (error: java.net.MalformedURLException) {
+                    throw HotUpdaterException.invalidFileUrl(path, file.url, UpdateFailureResource.FILE)
+                }
+                downloads[path] = downloads.getValue(path).copy(fileUrl = file.url, fileCompression = file.compression)
+            }
+        }
+    }
+
     /** The rejection for a download that returned [error]. */
     private fun downloadError(error: Exception): HotUpdaterException =
         if (error is IncompleteDownloadException) {
@@ -1945,10 +2014,15 @@ class BundleFileStorageService(
         }
         if (archive.tarByteSize < logicalBytes) return null
         val tarFramingBytes = archive.tarByteSize - logicalBytes
-        if (individualBytes > MAX_SAFE_INTEGER - tarFramingBytes) return null
-        val framedByteLimit = individualBytes + tarFramingBytes
-
-        if (archive.downloadByteSize <= individualBytes) return archive
+        // Many small files cost more in requests than in bytes.
+        val requestOverheadBytes =
+            (downloads.size - PARALLEL_FILE_DOWNLOADS).coerceAtLeast(0) * REQUEST_OVERHEAD_BYTES
+        if (individualBytes > MAX_SAFE_INTEGER - requestOverheadBytes) return null
+        val individualCost = individualBytes + requestOverheadBytes
+        if (individualCost > MAX_SAFE_INTEGER - tarFramingBytes) return null
+        val framedByteLimit = individualCost + tarFramingBytes
+
+        if (archive.downloadByteSize <= individualCost) return archive
         if (downloads.size != manifest.assets.size || downloads.values.any { it.patch != null }) return null
         return archive.takeIf { it.downloadByteSize <= framedByteLimit }
     }
@@ -2074,6 +2148,7 @@ class BundleFileStorageService(
         manifestFileHash: String,
         changedAssets: Map<String, ChangedAssetDescriptor>,
         archiveUrl: String?,
+        fileResolver: ArtifactFileResolver?,
         bundleStoreDir: File,
         finalBundleDir: File,
         progressCallback: (UpdateProgressPayload) -> Unit,
@@ -2135,14 +2210,20 @@ class BundleFileStorageService(
                     if (manifest.bundleId != bundleId) {
                         throw HotUpdaterException.invalidBundle()
                     }
-                    // Reuse never bypasses the complete artifact contract.
-                    if (manifest.assets.keys != changedAssets.keys) throw HotUpdaterException.invalidBundle()
+                    if (fileResolver == null) {
+                        // Legacy: artifact protocol v1, where every file comes with its URL.
+                        // Reuse never bypasses the complete artifact contract.
+                        if (manifest.assets.keys != changedAssets.keys) throw HotUpdaterException.invalidBundle()
+                    } else if (!manifest.assets.keys.containsAll(changedAssets.keys)) {
+                        // In v2, `assets` holds only the Hermes patch.
+                        throw HotUpdaterException.invalidBundle()
+                    }
                     manifest.assets.forEach { (path, asset) ->
-                        val descriptor = changedAssets.getValue(path)
+                        val descriptor = changedAssets[path]
                         if (RelativePathResolver.normalizeRelativePath(path) != path ||
                             path == "manifest.json" ||
-                            descriptor.fileUrl.isNullOrBlank() ||
-                            !descriptor.fileHash.equals(asset.fileHash, ignoreCase = true) ||
+                            (fileResolver == null && descriptor?.fileUrl.isNullOrBlank()) ||
+                            (fileResolver == null && !descriptor!!.fileHash.equals(asset.fileHash, ignoreCase = true)) ||
                             RelativePathResolver.resolveInside(tmpDir, path) == null
                         ) {
                             throw HotUpdaterException.invalidBundle()
@@ -2150,6 +2231,20 @@ class BundleFileStorageService(
                     }
                     manifest
                 }
+            // In v2, the manifest names every file; URLs come once the install
+            // knows which files it downloads.
+            val plannedAssets =
+                if (fileResolver == null) {
+                    changedAssets
+                } else {
+                    targetManifest.assets.mapValues { (path, asset) ->
+                        ChangedAssetDescriptor(
+                            fileUrl = null,
+                            fileHash = asset.fileHash,
+                            patch = changedAssets[path]?.patch,
+                        )
+                    }
+                }
             updateStep(UpdateFailureStage.INSTALL, resource = null) {
                 if (!tmpDir.isDirectory && !tmpDir.mkdirs()) throw HotUpdaterException.directoryCreationFailed()
                 pruneStagingDirectory(tmpDir, targetManifest.assets.keys)
@@ -2194,7 +2289,12 @@ class BundleFileStorageService(
                             verifyManifestAssetFileOrThrow(targetFile, expectedAsset)
                             return@forEachIndexed
                         }
-                        downloads[assetPath] = changedAssets.getValue(assetPath)
+                        val packagedHash = builtInAssetResolver.copyIfSourceMatches(assetPath, expectedAsset.fileHash, targetFile)
+                        if (packagedHash != null && isBuiltInEquivalent(assetPath, targetFile, expectedAsset)) {
+                            return@forEachIndexed
+                        }
+                        if (packagedHash != null) targetFile.delete()
+                        downloads[assetPath] = plannedAssets.getValue(assetPath)
                     }
                     downloads
                 }
@@ -2222,11 +2322,16 @@ class BundleFileStorageService(
                     diffFiles = archiveProgress
                     emptyList()
                 } else {
+                    if (fileResolver != null) {
+                        updateStep(UpdateFailureStage.DOWNLOAD, UpdateFailureResource.FILE) {
+                            resolveFileUrls(fileResolver, downloads)
+                        }
+                    }
                     diffFiles = createDiffProgressFiles(downloads)
                     emitDiffProgress(progressCallback, "downloading", diffFiles)
                     val progressLock = Any()
                     coroutineScope {
-                        val permits = Semaphore(4)
+                        val permits = Semaphore(PARALLEL_FILE_DOWNLOADS)
                         diffFiles
                             .toList()
                             .map { progressFile ->

package/android/src/main/java/com/hotupdater/HotUpdaterImpl.kt

@@ -162,65 +162,16 @@ class HotUpdaterImpl {
             ) ?: DEFAULT_CHANNEL
 
         /**
-         * Get minimum bundle ID string
-         * @return The minimum bundle ID string
+         * The bundle ID of the bundle this build ships (MIN_BUNDLE_ID),
+         * written by the generateHotUpdaterMinBundleId build task
          */
         fun getMinBundleId(): String {
             if (BuildConfig.DEBUG) {
                 return "00000000-0000-0000-0000-000000000000"
             }
-            return BuildConfig.MIN_BUNDLE_ID.takeIf { it != "null" } ?: generateMinBundleIdFromBuildTimestamp()
+            return HotUpdaterMinBundleId.get()
         }
 
-        /**
-         * Generates a bundle ID based on build timestamp
-         * @return The generated minimum bundle ID string
-         */
-        private fun generateMinBundleIdFromBuildTimestamp(): String =
-            try {
-                val buildTimestampMs = BuildConfig.BUILD_TIMESTAMP
-                val bytes =
-                    ByteArray(16).apply {
-                        this[0] = ((buildTimestampMs shr 40) and 0xFF).toByte()
-                        this[1] = ((buildTimestampMs shr 32) and 0xFF).toByte()
-                        this[2] = ((buildTimestampMs shr 24) and 0xFF).toByte()
-                        this[3] = ((buildTimestampMs shr 16) and 0xFF).toByte()
-                        this[4] = ((buildTimestampMs shr 8) and 0xFF).toByte()
-                        this[5] = (buildTimestampMs and 0xFF).toByte()
-                        this[6] = 0x70.toByte()
-                        this[7] = 0x00.toByte()
-                        this[8] = 0x80.toByte()
-                        this[9] = 0x00.toByte()
-                        this[10] = 0x00.toByte()
-                        this[11] = 0x00.toByte()
-                        this[12] = 0x00.toByte()
-                        this[13] = 0x00.toByte()
-                        this[14] = 0x00.toByte()
-                        this[15] = 0x00.toByte()
-                    }
-                String.format(
-                    "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-                    bytes[0].toInt() and 0xFF,
-                    bytes[1].toInt() and 0xFF,
-                    bytes[2].toInt() and 0xFF,
-                    bytes[3].toInt() and 0xFF,
-                    bytes[4].toInt() and 0xFF,
-                    bytes[5].toInt() and 0xFF,
-                    bytes[6].toInt() and 0xFF,
-                    bytes[7].toInt() and 0xFF,
-                    bytes[8].toInt() and 0xFF,
-                    bytes[9].toInt() and 0xFF,
-                    bytes[10].toInt() and 0xFF,
-                    bytes[11].toInt() and 0xFF,
-                    bytes[12].toInt() and 0xFF,
-                    bytes[13].toInt() and 0xFF,
-                    bytes[14].toInt() and 0xFF,
-                    bytes[15].toInt() and 0xFF,
-                )
-            } catch (e: Exception) {
-                "00000000-0000-0000-0000-000000000000"
-            }
-
         /**
          * Gets the current fingerprint hash
          * @param context Application context
@@ -290,6 +241,7 @@ class HotUpdaterImpl {
         channel: String?,
         selection: PersistedSelection? = null,
         archiveUrl: String? = null,
+        fileResolver: ArtifactFileResolver? = null,
         progressCallback: (UpdateProgressPayload) -> Unit,
     ): UpdateBundleResult {
         if (selection != null && !bundleStorage.stageReleaseSelection(selection)) {
@@ -302,6 +254,7 @@ class HotUpdaterImpl {
                 manifestFileHash,
                 assets,
                 archiveUrl,
+                fileResolver,
                 progressCallback,
             )
 

package/android/src/newarch/HotUpdaterModule.kt

@@ -47,7 +47,14 @@ class HotUpdaterModule internal constructor(
      */
     private fun getInstance(): HotUpdaterImpl = HotUpdater.getInstance(mReactApplicationContext)
 
-    private fun parseAssets(params: ReadableMap): Map<String, ChangedAssetDescriptor>? {
+    /**
+     * Every changed file with its hash and URL or Hermes patch; with
+     * [requireFileHash] false, also entries that hold only the Hermes patch.
+     */
+    private fun parseAssets(
+        params: ReadableMap,
+        requireFileHash: Boolean,
+    ): Map<String, ChangedAssetDescriptor>? {
         if (!params.hasKey("assets") || params.isNull("assets")) {
             return null
         }
@@ -59,38 +66,10 @@ class HotUpdaterModule internal constructor(
         while (iterator.hasNextKey()) {
             val assetPath = iterator.nextKey()
             val assetMap = changedAssetsMap.getMap(assetPath) ?: continue
-            val assetHash = assetMap.getString("fileHash") ?: continue
+            val assetHash = if (assetMap.hasKey("fileHash")) assetMap.getString("fileHash") else null
+            if (assetHash == null && requireFileHash) continue
             val patchMap = assetMap.getMap("patch")
-            val patch =
-                if (patchMap != null) {
-                    val algorithm = patchMap.getString("algorithm")
-                    val baseBundleId = patchMap.getString("baseBundleId")
-                    val baseFileHash = patchMap.getString("baseFileHash")
-                    val patchFileHash = patchMap.getString("patchFileHash")
-                    val patchUrl = patchMap.getString("patchUrl")
-                    val byteSize = readSafeInteger(patchMap, "byteSize")
-
-                    if (
-                        algorithm != null &&
-                        baseBundleId != null &&
-                        baseFileHash != null &&
-                        patchFileHash != null &&
-                        patchUrl != null
-                    ) {
-                        BsdiffPatchDescriptor(
-                            algorithm = algorithm,
-                            baseBundleId = baseBundleId,
-                            baseFileHash = baseFileHash,
-                            patchFileHash = patchFileHash,
-                            patchUrl = patchUrl,
-                            byteSize = byteSize,
-                        )
-                    } else {
-                        null
-                    }
-                } else {
-                    null
-                }
+            val patch = parsePatch(patchMap)
             val fileMap =
                 if (assetMap.hasKey("file") && !assetMap.isNull("file")) {
                     assetMap.getMap("file")
@@ -107,10 +86,13 @@ class HotUpdaterModule internal constructor(
             if (assetUrl == null && patch == null) {
                 continue
             }
+            if (assetHash == null && assetUrl != null) {
+                continue
+            }
             parsedAssets[assetPath] =
                 ChangedAssetDescriptor(
                     fileUrl = assetUrl,
-                    fileHash = assetHash,
+                    fileHash = assetHash ?: "",
                     fileCompression = fileCompression,
                     patch = patch,
                 )
@@ -119,6 +101,94 @@ class HotUpdaterModule internal constructor(
         return parsedAssets
     }
 
+    /** The update check's request headers, which the artifact files request repeats. */
+    private fun parseRequestHeaders(params: ReadableMap): Map<String, String> {
+        if (!params.hasKey("requestHeaders") || params.isNull("requestHeaders")) return emptyMap()
+        val headers = params.getMap("requestHeaders") ?: return emptyMap()
+        val parsed = linkedMapOf<String, String>()
+        val iterator = headers.keySetIterator()
+        while (iterator.hasNextKey()) {
+            val name = iterator.nextKey()
+            if (headers.getType(name) == com.facebook.react.bridge.ReadableType.String) {
+                headers.getString(name)?.let { parsed[name] = it }
+            }
+        }
+        return parsed
+    }
+
+    private fun parsePatch(patchMap: ReadableMap?): BsdiffPatchDescriptor? {
+        if (patchMap == null) return null
+        val algorithm = patchMap.getString("algorithm")
+        val baseBundleId = patchMap.getString("baseBundleId")
+        val baseFileHash = patchMap.getString("baseFileHash")
+        val patchFileHash = patchMap.getString("patchFileHash")
+        val patchUrl = patchMap.getString("patchUrl")
+        val byteSize = readSafeInteger(patchMap, "byteSize")
+
+        return if (
+            algorithm != null &&
+            baseBundleId != null &&
+            baseFileHash != null &&
+            patchFileHash != null &&
+            patchUrl != null
+        ) {
+            BsdiffPatchDescriptor(
+                algorithm = algorithm,
+                baseBundleId = baseBundleId,
+                baseFileHash = baseFileHash,
+                patchFileHash = patchFileHash,
+                patchUrl = patchUrl,
+                byteSize = byteSize,
+            )
+        } else {
+            null
+        }
+    }
+
+    /**
+     * The resolver that asks `filesUrl` for the files native downloads one by
+     * one; null when `filesUrl` is missing.
+     */
+    private fun parseFileResolver(params: ReadableMap): ArtifactFileResolver? {
+        val filesUrl =
+            if (params.hasKey("filesUrl") && !params.isNull("filesUrl")) {
+                params.getString("filesUrl")?.takeIf { it.isNotEmpty() }
+            } else {
+                null
+            } ?: return null
+        try {
+            java.net.URL(filesUrl)
+        } catch (e: java.net.MalformedURLException) {
+            throw HotUpdaterException.invalidFileUrl("filesUrl", filesUrl, UpdateFailureResource.FILE)
+        }
+        val requestTimeoutMs =
+            if (params.hasKey("requestTimeout") && !params.isNull("requestTimeout")) {
+                params.getDouble("requestTimeout").toLong().takeIf { it > 0 }
+            } else {
+                null
+            } ?: HttpArtifactFileResolver.DEFAULT_TIMEOUT_MS
+        return HttpArtifactFileResolver(filesUrl, parseRequestHeaders(params), requestTimeoutMs)
+    }
+
+    /**
+     * Artifact protocol v2: the Hermes patch as the only planned asset, and
+     * the resolver that asks `filesUrl` for the files native downloads one by
+     * one; null when `filesUrl` is missing.
+     */
+    private fun parseArtifactInstall(params: ReadableMap): Pair<Map<String, ChangedAssetDescriptor>, ArtifactFileResolver?>? {
+        val fileResolver = parseFileResolver(params) ?: return null
+        val patchMap = if (params.hasKey("patch") && !params.isNull("patch")) params.getMap("patch") else null
+        val assetPath = patchMap?.getString("assetPath")
+        val patch = parsePatch(patchMap)
+        val assets =
+            if (assetPath != null && patch != null) {
+                mapOf(assetPath to ChangedAssetDescriptor(fileUrl = null, fileHash = "", patch = patch))
+            } else {
+                emptyMap()
+            }
+        return assets to fileResolver
+    }
+
     private fun parseSelection(params: ReadableMap): PersistedSelection? {
         if (!params.hasKey("selection") || params.isNull("selection")) return null
         val selection = params.getMap("selection") ?: return null
@@ -169,6 +239,28 @@ class HotUpdaterModule internal constructor(
     override fun updateBundle(
         params: ReadableMap,
         promise: Promise,
+    ) {
+        // Legacy: artifact protocol v1, where every file comes with its URL.
+        // JavaScript from the first protocol v2 SDK also sends `filesUrl`
+        // here, with only the Hermes patch in `assets`; its OTA Bundles must
+        // still install.
+        stage(params, promise) {
+            val fileResolver = parseFileResolver(params)
+            parseAssets(params, requireFileHash = fileResolver == null)?.let { it to fileResolver }
+        }
+    }
+
+    override fun installArtifact(
+        params: ReadableMap,
+        promise: Promise,
+    ) {
+        stage(params, promise) { parseArtifactInstall(params) }
+    }
+
+    private fun stage(
+        params: ReadableMap,
+        promise: Promise,
+        plan: () -> Pair<Map<String, ChangedAssetDescriptor>, ArtifactFileResolver?>?,
     ) {
         moduleScope.launch {
             try {
@@ -180,7 +272,8 @@ class HotUpdaterModule internal constructor(
 
                 val manifestUrl = params.getString("manifestUrl")
                 val manifestFileHash = params.getString("manifestFileHash")
-                val assets = parseAssets(params)
+                val planned = plan()
+                val assets = planned?.first
                 if (manifestUrl.isNullOrEmpty() || manifestFileHash.isNullOrEmpty() || assets == null) {
                     promise.rejectUpdateBundle(HotUpdaterException.invalidManifestParams())
                     return@launch
@@ -211,6 +304,7 @@ class HotUpdaterModule internal constructor(
                     }
                 }
                 val selection = parseSelection(params)
+                val fileResolver = planned.second
 
                 val impl = getInstance()
 
@@ -223,6 +317,7 @@ class HotUpdaterModule internal constructor(
                         channel,
                         selection,
                         archiveUrl,
+                        fileResolver,
                     ) { progress ->
                         // Post to Main thread for React Native event emission
                         Handler(Looper.getMainLooper()).post {