@hot-updater/react-native 1.0.7 → 1.1.0

package/ios/HotUpdater/Internal/BundleFileStorageService.swift

@@ -283,10 +283,24 @@ public protocol BundleStorageService {
     func getCachedBundleURL() -> URL?
     func getFallbackBundleURL(bundle: Bundle) -> URL? // Synchronous as it's lightweight
     func prepareLaunch(bundle: Bundle, pendingRecovery: PendingCrashRecovery?) -> LaunchSelection
+    /// Settles what the previous process left once per process, before the
+    /// first read of the selection: a crash rollback and a launch that never
+    /// finished. `prepareLaunch` runs it first; a native update check that runs
+    /// before React Native starts runs it earlier. `pendingRecovery` is called
+    /// only when this run settles.
+    func settlePreviousLaunch(pendingRecovery: () -> PendingCrashRecovery?)
+    /// The bundle the next `prepareLaunch` would run, read without preparing
+    /// the launch. Nil is the built-in bundle. Call `settlePreviousLaunch`
+    /// first, or a bundle the next launch rolls back is returned.
+    func peekLaunchBundleId() -> String?
 
     // Bundle update
-    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL?, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver?, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void)
-    func stageReleaseSelection(_ selection: PersistedSelection) -> Bool
+    /// Stages a bundle. `selection` is the Release selection the staging
+    /// commits; it travels with this staging, and the staging fails as stale
+    /// when it is no longer current.
+    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL?, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver?, selection: PersistedSelection?, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void)
+    /// Whether a staging of `selection` would still commit.
+    func isSelectionCurrent(_ selection: PersistedSelection) -> Bool
     func acceptReleaseCatalog(catalogId: String, scopeKey: String, generation: Int64, catalogHash: String, channel: String, selectionContextHash: String) -> Bool
     func getActiveUpdateState() -> [String: Any]
     func isReleaseSelectionCurrent(catalogId: String, scopeKey: String, generation: Int64, catalogHash: String, channel: String, selectionContextHash: String) -> Bool
@@ -294,6 +308,12 @@ public protocol BundleStorageService {
 
     // Rollback support
     func markLaunchStarted(bundleId: String?)
+    /// Forgets that the launch of `bundleId` started, leaving it pending: the
+    /// next start launches it again instead of counting an unfinished launch.
+    /// For a launch whose process another instance's crash takes down.
+    /// Returns whether the launch had started.
+    @discardableResult
+    func clearLaunchStarted(bundleId: String?) -> Bool
     func markLaunchCompleted(bundleId: String?)
     func notifyAppReady() -> [String: Any]
     func getCrashHistory() -> CrashedHistory
@@ -327,7 +347,11 @@ public protocol BundleStorageService {
 }
 
 public extension BundleStorageService {
-    func stageReleaseSelection(_: PersistedSelection) -> Bool { false }
+    func settlePreviousLaunch(pendingRecovery _: () -> PendingCrashRecovery?) {}
+    @discardableResult
+    func clearLaunchStarted(bundleId _: String?) -> Bool { false }
+    func peekLaunchBundleId() -> String? { nil }
+    func isSelectionCurrent(_: PersistedSelection) -> Bool { false }
     func acceptReleaseCatalog(catalogId _: String, scopeKey _: String, generation _: Int64, catalogHash _: String, channel _: String, selectionContextHash _: String) -> Bool { false }
     func getActiveUpdateState() -> [String: Any] { [:] }
     func isReleaseSelectionCurrent(catalogId _: String, scopeKey _: String, generation _: Int64, catalogHash _: String, channel _: String, selectionContextHash _: String) -> Bool { false }
@@ -374,11 +398,16 @@ class BundleFileStorageService: BundleStorageService {
     private let downloadRetryDelay: TimeInterval
     private let preferences: PreferencesService
     private let isolationKey: String
+    /// Whose store this is: main's `Documents/bundle-store`, or a named
+    /// instance's own, with its public key and update strategy.
+    private let instance: HotUpdaterInstanceEnvironment
 
     // Queue for potentially long-running sequences within updateBundle or for explicit background tasks.
     private let fileOperationQueue: DispatchQueue
 
     private var hasPreparedLaunch = false
+    private let settleLock = NSLock()
+    private var hasSettledPreviousLaunch = false
     private var currentLaunchReport: LaunchReport?
     // The staged bundle this process launched before its first content. Only that
     // launch is pending; a bundle staged later waits for the next launch.
@@ -393,16 +422,20 @@ class BundleFileStorageService: BundleStorageService {
     private let builtInAssetResolver: BuiltInAssetResolver
     private let updateStrategyProvider: () -> UpdateStrategy
     private let releaseStateLock = NSRecursiveLock()
-    private var pendingInstallSelections: [String: PersistedSelection] = [:]
 
-    private let installIdentityLock = NSLock()
-    private var currentInstallIdentity: InstallIdentity?
+    /// App-wide: every instance's storage reads the same install identity
+    /// file, so one lock and cache per file keep two instances that start at
+    /// once from creating different ids.
+    private static let installIdentityLock = NSLock()
+    private static var installIdentities: [String: InstallIdentity] = [:]
 
     private let protectedBundleStoreEntries: Set<String> = [
         BundleMetadata.metadataFilename,
         CrashedHistory.crashedHistoryFilename,
         LaunchReport.launchReportFilename,
         "builtin-index-v1.json",
+        // Written when a launch crashes, read at the next start.
+        HotUpdaterCrashMarker.filename,
     ]
 
     private func createDiffProgressFiles(
@@ -725,7 +758,8 @@ class BundleFileStorageService: BundleStorageService {
             throw BundleStorageError.signatureVerificationFailed(.fileHashMismatch)
         }
 
-        guard SignatureVerifier.isSigningEnabled() else {
+        let publicKey = instance.publicKey()
+        guard SignatureVerifier.isSigningEnabled(publicKey: publicKey) else {
             return
         }
 
@@ -735,7 +769,8 @@ class BundleFileStorageService: BundleStorageService {
 
         switch SignatureVerifier.verifyHashSignature(
             fileHash: asset.fileHash,
-            signatureBase64: signature
+            signatureBase64: signature,
+            publicKey: publicKey
         ) {
         case .success:
             return
@@ -748,13 +783,10 @@ class BundleFileStorageService: BundleStorageService {
                 downloadService: DownloadService,
                 preferences: PreferencesService,
                 isolationKey: String,
+                instance: HotUpdaterInstanceEnvironment = .main,
                 builtInBundleIdProvider: @escaping () -> String = { "" },
                 builtInAssetResolver: BuiltInAssetResolver? = nil,
-                updateStrategyProvider: @escaping () -> UpdateStrategy = {
-                    let fingerprintHash = HotUpdaterConfig.shared.fingerprintHash
-                        ?? Bundle.main.object(forInfoDictionaryKey: "HOT_UPDATER_FINGERPRINT_HASH") as? String
-                    return (fingerprintHash?.isEmpty == false) ? .fingerprint : .appVersion
-                },
+                updateStrategyProvider: (() -> UpdateStrategy)? = nil,
                 downloadRetryDelay: TimeInterval = 1) {
 
         self.fileSystem = fileSystem
@@ -762,13 +794,14 @@ class BundleFileStorageService: BundleStorageService {
         self.downloadService = downloadService
         self.preferences = preferences
         self.isolationKey = isolationKey
+        self.instance = instance
         self.builtInBundleIdProvider = builtInBundleIdProvider
         self.builtInAssetResolver = builtInAssetResolver ?? IOSBuiltInAssetResolver(
-            cacheURL: URL(fileURLWithPath: fileSystem.documentsPath())
-                .appendingPathComponent("bundle-store", isDirectory: true)
-                .appendingPathComponent("builtin-index-v1.json")
+            cacheURL: URL(fileURLWithPath: instance.bundleStorePath(documentsPath: fileSystem.documentsPath()), isDirectory: true)
+                .appendingPathComponent("builtin-index-v1.json"),
+            defaultBundle: { instance.bundle }
         )
-        self.updateStrategyProvider = updateStrategyProvider
+        self.updateStrategyProvider = updateStrategyProvider ?? { instance.updateStrategy() }
 
         // Create queue for file operations
         self.fileOperationQueue = DispatchQueue(label: "com.hotupdater.fileoperations",
@@ -860,21 +893,21 @@ class BundleFileStorageService: BundleStorageService {
     /// Loads the install identity, creating it once when its file is missing.
     @discardableResult
     private func loadOrCreateInstallIdentity() -> InstallIdentity {
-        installIdentityLock.lock()
-        defer { installIdentityLock.unlock() }
+        Self.installIdentityLock.lock()
+        defer { Self.installIdentityLock.unlock() }
 
-        if let currentInstallIdentity {
-            return currentInstallIdentity
-        }
         let file = installIdentityFileURL()
+        if let identity = Self.installIdentities[file.path] {
+            return identity
+        }
         if let identity = InstallIdentity.load(from: file) {
-            currentInstallIdentity = identity
+            Self.installIdentities[file.path] = identity
             return identity
         }
 
         let identity = InstallIdentity()
         // Keep the new id for this process even when it cannot be saved.
-        currentInstallIdentity = identity
+        Self.installIdentities[file.path] = identity
         _ = identity.save(to: file)
         return identity
     }
@@ -1285,11 +1318,12 @@ class BundleFileStorageService: BundleStorageService {
         return metadata.verificationPending && metadata.stagingBundleId != nil
     }
 
-    private func prepareMetadataForNewStagingBundle(_ metadata: BundleMetadata, bundleId: String) -> BundleMetadata? {
+    private func prepareMetadataForNewStagingBundle(
+        _ metadata: BundleMetadata,
+        bundleId: String,
+        incomingSelection: PersistedSelection?
+    ) -> BundleMetadata? {
         let currentVerifiedBundleId = getCurrentVerifiedBundleId(metadata).flatMap { $0 == bundleId ? nil : $0 }
-        releaseStateLock.lock()
-        let incomingSelection = pendingInstallSelections.removeValue(forKey: bundleId)
-        releaseStateLock.unlock()
         if let incomingSelection, !isSelectionCurrent(incomingSelection) {
             return nil
         }
@@ -1325,7 +1359,7 @@ class BundleFileStorageService: BundleStorageService {
                 toBundleId: stagingSelection.bundleId
             ),
             highestSeenCatalogs: metadata.highestSeenCatalogs,
-            currentSelectionContexts: metadata.currentSelectionContexts,
+            currentSelectionContexts: contextsAfterCommitting(metadata.currentSelectionContexts, incomingSelection),
             updatedAt: Date().timeIntervalSince1970 * 1000
         )
     }
@@ -1424,6 +1458,21 @@ class BundleFileStorageService: BundleStorageService {
         "\(catalogId)|\(scopeKey)"
     }
 
+    /// The selection contexts that stay current once `selection` commits: only
+    /// its own scope's, or none for a staging without a Release selection. A
+    /// check made before this commit, of another scope such as another channel,
+    /// no longer stages over it.
+    private func contextsAfterCommitting(
+        _ contexts: [String: String],
+        _ selection: PersistedSelection?
+    ) -> [String: String] {
+        guard let catalogId = selection?.catalogId, let scopeKey = selection?.scopeKey else {
+            return [:]
+        }
+        let stateKey = releaseScopeStateKey(catalogId: catalogId, scopeKey: scopeKey)
+        return contexts.filter { $0.key == stateKey }
+    }
+
     private func selectionContextValue(channel: String, selectionContextHash: String) -> String {
         "\(channel)\n\(selectionContextHash)"
     }
@@ -1511,7 +1560,7 @@ class BundleFileStorageService: BundleStorageService {
         )
     }
 
-    private func isSelectionCurrent(_ selection: PersistedSelection) -> Bool {
+    func isSelectionCurrent(_ selection: PersistedSelection) -> Bool {
         guard let catalogId = selection.catalogId,
               let scopeKey = selection.scopeKey,
               let generation = selection.generation,
@@ -1529,13 +1578,6 @@ class BundleFileStorageService: BundleStorageService {
         )
     }
 
-    func stageReleaseSelection(_ selection: PersistedSelection) -> Bool {
-        releaseStateLock.lock()
-        defer { releaseStateLock.unlock() }
-        guard isSelectionCurrent(selection) else { return false }
-        pendingInstallSelections[selection.bundleId] = selection
-        return true
-    }
 
     func commitReleaseSelection(_ selection: PersistedSelection) -> Bool {
         releaseStateLock.lock()
@@ -1547,6 +1589,15 @@ class BundleFileStorageService: BundleStorageService {
                 || metadata.stagingBundleId == selection.bundleId {
                 metadata.stagingBundleId = selection.bundleId
                 metadata.stagingSelection = selection
+                // The launch of the staged bundle reports this Release as applied.
+                if let transition = metadata.pendingSelectionTransition, transition.toBundleId == selection.bundleId {
+                    metadata.pendingSelectionTransition = PendingSelectionTransition(
+                        fromReleaseId: transition.fromReleaseId,
+                        fromBundleId: transition.fromBundleId,
+                        toReleaseId: selection.releaseId,
+                        toBundleId: transition.toBundleId
+                    )
+                }
             } else if metadata.stableSelection?.bundleId == selection.bundleId
                 || metadata.stableBundleId == selection.bundleId {
                 metadata.stableBundleId = selection.bundleId
@@ -1566,6 +1617,7 @@ class BundleFileStorageService: BundleStorageService {
             metadata.pendingSelectionTransition = nil
         }
         metadata.updatedAt = Date().timeIntervalSince1970 * 1000
+        metadata.currentSelectionContexts = contextsAfterCommitting(metadata.currentSelectionContexts, selection)
         guard saveMetadata(metadata) else { return false }
         do {
             try preferences.setItem(
@@ -1608,7 +1660,7 @@ class BundleFileStorageService: BundleStorageService {
      * @return Result with the directory path or error
      */
     func bundleStoreDir() -> Result<String, Error> {
-        let path = (fileSystem.documentsPath() as NSString).appendingPathComponent("bundle-store")
+        let path = instance.bundleStorePath(documentsPath: fileSystem.documentsPath())
         return ensureDirectoryExists(path: path)
     }
     
@@ -1618,7 +1670,7 @@ class BundleFileStorageService: BundleStorageService {
      * @return Result with the directory path or error
      */
     func tempDir() -> Result<String, Error> {
-        let path = (fileSystem.documentsPath() as NSString).appendingPathComponent("bundle-temp")
+        let path = instance.tempPath(documentsPath: fileSystem.documentsPath())
         return ensureDirectoryExists(path: path)
     }
     
@@ -1998,20 +2050,69 @@ class BundleFileStorageService: BundleStorageService {
         )
     }
 
-    func prepareLaunch(bundle: Bundle, pendingRecovery: PendingCrashRecovery?) -> LaunchSelection {
-        builtInAssetResolver.use(bundle: bundle)
+    func peekLaunchBundleId() -> String? {
+        // Reads the store without bundleStoreDir(), which creates it.
+        let storeDir = instance.bundleStorePath(documentsPath: fileSystem.documentsPath())
+        let metadataFile = URL(fileURLWithPath: storeDir).appendingPathComponent(BundleMetadata.metadataFilename)
+        guard let metadata = BundleMetadata.load(from: metadataFile, expectedIsolationKey: isolationKey) else {
+            return nil
+        }
+        func hasBundleFile(_ bundleId: String) -> Bool {
+            let directory = (storeDir as NSString).appendingPathComponent(bundleId)
+            guard case .success(let bundlePath) = findBundleFile(in: directory, expectedBundleId: bundleId) else {
+                return false
+            }
+            return bundlePath != nil
+        }
+        if let stagingBundleId = metadata.stagingBundleId, hasBundleFile(stagingBundleId) {
+            return stagingBundleId
+        }
+        if let stableBundleId = metadata.stableBundleId, hasBundleFile(stableBundleId) {
+            return stableBundleId
+        }
+        return nil
+    }
+
+    func settlePreviousLaunch(pendingRecovery: () -> PendingCrashRecovery?) {
+        settleLock.lock()
+        defer { settleLock.unlock() }
+        guard !hasSettledPreviousLaunch else { return }
+        hasSettledPreviousLaunch = true
+        // Cleared before the rollbacks below, so the launch reports their RECOVERED.
         saveLaunchReport(nil)
-        loadOrCreateInstallIdentity()
-        applyPendingRecoveryIfNeeded(pendingRecovery)
+        applyPendingRecoveryIfNeeded(pendingRecovery())
         // Only a new storage instance consumes an unfinished launch. Repeated bundle
         // lookups or bridge reloads in this process must not reject its own launch.
-        if !hasPreparedLaunch,
-           let metadata = loadMetadataOrNull(),
+        if let metadata = loadMetadataOrNull(),
            metadata.verificationPending,
            metadata.launchInProgress,
            let stagingBundleId = metadata.stagingBundleId {
             rollbackPendingBundle(stagingBundleId, unfinishedLaunch: true)
         }
+        // A pending bundle whose file is gone rolls back, as selectLaunch does.
+        if let metadata = loadMetadataOrNull(),
+           metadata.verificationPending,
+           let stagingBundleId = metadata.stagingBundleId,
+           case .success(let storeDir) = bundleStoreDir() {
+            let stagingBundleDir = (storeDir as NSString).appendingPathComponent(stagingBundleId)
+            if case .success(let bundlePath) = findBundleFile(in: stagingBundleDir, expectedBundleId: stagingBundleId),
+               bundlePath != nil {
+                return
+            }
+            rollbackPendingBundle(stagingBundleId)
+        }
+    }
+
+    func prepareLaunch(bundle: Bundle, pendingRecovery: PendingCrashRecovery?) -> LaunchSelection {
+        builtInAssetResolver.use(bundle: bundle)
+        loadOrCreateInstallIdentity()
+        if hasPreparedLaunch {
+            // A later launch in this process, after a reset or a reload.
+            saveLaunchReport(nil)
+            applyPendingRecoveryIfNeeded(pendingRecovery)
+        } else {
+            settlePreviousLaunch { pendingRecovery }
+        }
         hasPreparedLaunch = true
         // A launch is recorded only once it can show UI (markLaunchStarted).
         let selection = selectLaunch(bundle: bundle)
@@ -2029,7 +2130,7 @@ class BundleFileStorageService: BundleStorageService {
      * @param progressHandler Callback for download and extraction progress (0.0 to 1.0)
      * @param completion Callback with result of the operation
      */
-    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL? = nil, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver? = nil, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void) {
+    func updateBundle(bundleId: String, manifestUrl: URL, manifestFileHash: String, archiveUrl: URL? = nil, assets: [String: ChangedAssetDescriptor], fileResolver: ArtifactFileResolver? = nil, selection: PersistedSelection? = nil, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<UpdateDelivery, Error>) -> Void) {
         // Check if bundle is in crashed history
         if getCrashHistory().contains(bundleId) {
             NSLog("[BundleStorage] Bundle '\(bundleId)' is in crashed history, rejecting update")
@@ -2053,6 +2154,7 @@ class BundleFileStorageService: BundleStorageService {
                 archiveUrl: archiveUrl,
                 changedAssets: assets,
                 fileResolver: fileResolver,
+                selection: selection,
                 storeDir: storeDir,
                 progressHandler: progressHandler,
                 completion: completion
@@ -2079,6 +2181,16 @@ class BundleFileStorageService: BundleStorageService {
                 guard let file = files[path], let descriptor = downloads[path] else {
                     throw BundleStorageError.invalidBundle
                 }
+                // A download needs an absolute HTTP(S) URL with a host.
+                guard ["http", "https"].contains(file.url.scheme?.lowercased() ?? ""),
+                      file.url.host?.isEmpty == false else {
+                    throw UpdateFailureError(
+                        underlying: NSError(domain: "HotUpdater", code: 0, userInfo: [
+                            NSLocalizedDescriptionKey: "Invalid '\(path)' provided: \(file.url.absoluteString)"
+                        ]),
+                        failure: UpdateFailure.invalidResponse.with(resource: .file)
+                    )
+                }
                 downloads[path] = ChangedAssetDescriptor(
                     fileUrl: file.url,
                     fileHash: descriptor.fileHash,
@@ -2481,6 +2593,7 @@ class BundleFileStorageService: BundleStorageService {
 
     private func promoteStagedBundle(
         bundleId: String,
+        selection: PersistedSelection?,
         stagingDirectory: String,
         finalDirectory: String,
         bundlePathInStaging: String
@@ -2488,7 +2601,11 @@ class BundleFileStorageService: BundleStorageService {
         releaseStateLock.lock()
         defer { releaseStateLock.unlock() }
         let currentMetadata = loadMetadataOrNull() ?? createInitialMetadata()
-        guard let updatedMetadata = prepareMetadataForNewStagingBundle(currentMetadata, bundleId: bundleId) else {
+        guard let updatedMetadata = prepareMetadataForNewStagingBundle(
+            currentMetadata,
+            bundleId: bundleId,
+            incomingSelection: selection
+        ) else {
             throw BundleStorageError.unknown(StaleReleaseSelectionError())
         }
         let finalBundlePath = try resolveBundlePathAfterMove(
@@ -2535,6 +2652,7 @@ class BundleFileStorageService: BundleStorageService {
         archiveUrl: URL?,
         changedAssets: [String: ChangedAssetDescriptor],
         fileResolver: ArtifactFileResolver?,
+        selection: PersistedSelection?,
         storeDir: String,
         progressHandler: @escaping (UpdateProgressPayload) -> Void,
         completion: @escaping (Result<UpdateDelivery, Error>) -> Void
@@ -2604,7 +2722,8 @@ class BundleFileStorageService: BundleStorageService {
             failurePhase = .verification
             let manifestVerificationResult = SignatureVerifier.verifyBundle(
                 fileURL: URL(fileURLWithPath: tempManifestPath),
-                fileHash: manifestFileHash
+                fileHash: manifestFileHash,
+                publicKey: instance.publicKey()
             )
             guard case .success = manifestVerificationResult else {
                 if case .failure(let error) = manifestVerificationResult {
@@ -2831,6 +2950,7 @@ class BundleFileStorageService: BundleStorageService {
 
                 let updatedMetadata = try promoteStagedBundle(
                     bundleId: bundleId,
+                    selection: selection,
                     stagingDirectory: tmpDir,
                     finalDirectory: realDir,
                     bundlePathInStaging: bundlePathInTmp
@@ -2881,6 +3001,21 @@ class BundleFileStorageService: BundleStorageService {
         _ = saveMetadata(metadata)
     }
 
+    @discardableResult
+    func clearLaunchStarted(bundleId: String?) -> Bool {
+        releaseStateLock.lock()
+        defer { releaseStateLock.unlock() }
+        guard let bundleId,
+              var metadata = loadMetadataOrNull(),
+              metadata.verificationPending,
+              metadata.launchInProgress,
+              metadata.stagingBundleId == bundleId else {
+            return false
+        }
+        metadata.launchInProgress = false
+        return saveMetadata(metadata)
+    }
+
     func markLaunchCompleted(bundleId: String?) {
         // Before the guard: content from the built-in bundle (nil) also counts.
         readyInterruptedLaunchRetry(bundleId)
@@ -3077,6 +3212,9 @@ class BundleFileStorageService: BundleStorageService {
         clearedMetadata.verificationPending = false
         clearedMetadata.pendingTransition = nil
         clearedMetadata.pendingSelectionTransition = nil
+        // Selections made before the reset no longer stage; the high-water
+        // marks stay, so an older catalog is still refused.
+        clearedMetadata.currentSelectionContexts = [:]
         clearedMetadata.updatedAt = Date().timeIntervalSince1970 * 1000
 
         guard saveMetadata(clearedMetadata) else {

package/ios/HotUpdater/Internal/CohortService.swift

@@ -2,6 +2,10 @@ import Foundation
 import UIKit
 
 final class CohortService {
+    /// App-wide: every instance's service reads and creates the same stored
+    /// cohort, so instances that check at once never pick different ones.
+    private static let lock = NSLock()
+
     private let userDefaults: UserDefaults
 
     private let cohortKey = "HotUpdater_CustomCohort"
@@ -41,10 +45,14 @@ final class CohortService {
         if cohort.isEmpty {
             return
         }
+        Self.lock.lock()
+        defer { Self.lock.unlock() }
         userDefaults.set(cohort, forKey: cohortKey)
     }
 
     func getCohort() -> String {
+        Self.lock.lock()
+        defer { Self.lock.unlock() }
         if let cohort = userDefaults.string(forKey: cohortKey), !cohort.isEmpty {
             return cohort
         }