@onekeyfe/hd-core 1.2.0-alpha.96 → 1.2.0-alpha.98

package/src/api/device/DeviceUpdateBootloader.ts

@@ -14,6 +14,7 @@ import { resolveFirmwareUpdateHostBinding } from '../firmware/FirmwareHostBindin
 import {
   assertFirmwareUpdatePreparedPlanBinding,
   assertFirmwareUpdatePreparedPlanDeviceIdentity,
+  getFirmwareUpdatePreparedRawArtifact,
   validateFirmwareUpdatePreparedPlan,
 } from '../firmware/FirmwareUpdatePreparedPlan';
 import { getDeviceType, getDeviceUUID } from '../../utils';
@@ -159,22 +160,28 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
 
     const payload = this.payload as DeviceUpdateBootloaderParams;
     const hasPreparedPlan = payload.preparedPlan !== undefined;
-    const hasPreparedArtifact = payload.artifact !== undefined;
-    if (hasPreparedPlan !== hasPreparedArtifact) {
+    if (hasPreparedPlan && payload.binary !== undefined) {
       throw ERRORS.TypedError(
         HardwareErrorCode.CallMethodInvalidParameter,
-        'Prepared bootloader plans require exactly one prepared artifact'
+        'Prepared bootloader plans cannot be combined with a legacy binary'
       );
     }
-    if (payload.binary !== undefined && hasPreparedArtifact) {
+    if (!hasPreparedPlan && payload.artifact !== undefined) {
       throw ERRORS.TypedError(
         HardwareErrorCode.CallMethodInvalidParameter,
-        'Bootloader binary and prepared artifact are mutually exclusive'
+        'Bootloader artifacts require a prepared plan'
       );
     }
-    const preparedPlan = hasPreparedArtifact
+    const preparedPlan = hasPreparedPlan
       ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
       : undefined;
+    const plannedArtifact = preparedPlan
+      ? getFirmwareUpdatePreparedRawArtifact({
+          preparedPlan,
+          target: 'bootloader',
+          role: 'bootloader',
+        }).artifact
+      : undefined;
     const artifactReader = preparedPlan
       ? resolveFirmwareUpdateHostBinding(
           payload.hostBindingGeneration,
@@ -185,7 +192,7 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
       ...payload,
       artifactReader,
     };
-    if (payload.artifact) {
+    if (preparedPlan && plannedArtifact) {
       assertFirmwareUpdatePreparedPlanDeviceIdentity({
         preparedPlan,
         deviceIdentity: getDeviceUUID(features) || undefined,
@@ -199,12 +206,12 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
         bindings: [
           {
             target: 'bootloader',
-            artifact: payload.artifact,
+            artifact: payload.artifact ?? plannedArtifact,
           },
         ],
       });
       const source = await openFirmwareByteSource({
-        artifact: payload.artifact,
+        artifact: plannedArtifact,
         reader: executionParams.artifactReader,
       });
       if (!source) {
@@ -215,13 +222,11 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
       }
       try {
         const deviceType = device.getCurrentDeviceType();
-        const deviceFirmwareType = device.getCurrentFirmwareType();
-        const firmwareType = payload.firmwareType ?? deviceFirmwareType;
         if (DeviceModelToTypes.model_touch.includes(deviceType)) {
           return await this.updateTouchBootloader({
             device,
             features,
-            firmwareType,
+            firmwareType: preparedPlan.firmwareType,
             source,
           });
         }

package/src/api/firmware/FirmwarePreparedResourceArchive.ts

@@ -0,0 +1,207 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+import JSZip from 'jszip';
+
+import { openFirmwareByteSource, readFirmwareByteSourceFully } from './FirmwareArtifactSource';
+import { getFirmwareUpdateResourceName } from './FirmwareUpdatePreparedPlan';
+
+import type { FirmwareArtifactReader } from '../../types/api/firmwareUpdate';
+import type { FirmwareUpdatePreparedPlan } from '../../types/api/firmwareUpdatePreparedPlan';
+
+const PREPARED_RESOURCE_ARCHIVE_MAX_BYTES = 256 * 1024 * 1024;
+const PREPARED_RESOURCE_ENTRY_MAX_COUNT = 512;
+
+type JSZipSizedEntry = JSZip.JSZipObject & {
+  _data?: {
+    compressedSize?: unknown;
+    uncompressedSize?: unknown;
+  };
+};
+
+export type VerifiedPreparedResourceEntry = {
+  entryName: string;
+  binary: ArrayBuffer;
+};
+
+const resourceArchiveError = (
+  message: string,
+  firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' | 'FirmwareArtifactReceiptMismatch'
+): never => {
+  throw ERRORS.TypedError(HardwareErrorCode.RuntimeError, message, { firmwareUpdateCode });
+};
+
+const getZipEntrySizes = (entry: JSZip.JSZipObject) => {
+  const { compressedSize, uncompressedSize } = (entry as JSZipSizedEntry)._data ?? {};
+  if (
+    !Number.isSafeInteger(compressedSize) ||
+    Number(compressedSize) < 0 ||
+    !Number.isSafeInteger(uncompressedSize) ||
+    Number(uncompressedSize) <= 0
+  ) {
+    return resourceArchiveError(
+      `Firmware prepared resource ZIP entry size is invalid: ${entry.name}`,
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  return {
+    compressedSize: Number(compressedSize),
+    uncompressedSize: Number(uncompressedSize),
+  };
+};
+
+/**
+ * 从 PreparedPlan 批准的 ZIP 本体生成资源条目。
+ * 宿主提供的 materializedEntries 仅作为 receipt，设备写入始终使用 ZIP 内的规范字节。
+ */
+export const readVerifiedPreparedResourceArchive = async ({
+  preparedPlan,
+  reader,
+}: {
+  preparedPlan: FirmwareUpdatePreparedPlan;
+  reader: FirmwareArtifactReader | undefined;
+}): Promise<VerifiedPreparedResourceEntry[]> => {
+  const resourceArtifacts = preparedPlan.artifacts.filter(
+    artifact => artifact.target === 'resource'
+  );
+  if (!preparedPlan.targetsToUpdate.includes('resource')) {
+    if (resourceArtifacts.length > 0) {
+      return resourceArchiveError(
+        'Firmware prepared resource artifact is outside the approved targets',
+        'FirmwareArtifactsNotPrepared'
+      );
+    }
+    return [];
+  }
+  if (resourceArtifacts.length !== 1) {
+    return resourceArchiveError(
+      'Firmware prepared plan must contain exactly one materialized resource ZIP',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+
+  const archiveArtifact = resourceArtifacts[0];
+  const preparedEntries = archiveArtifact.materializedEntries;
+  if (
+    archiveArtifact.role !== 'resource' ||
+    archiveArtifact.container !== 'zip' ||
+    !preparedEntries?.length
+  ) {
+    return resourceArchiveError(
+      'Firmware prepared plan must contain exactly one materialized resource ZIP',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  const archiveSource = await openFirmwareByteSource({
+    artifact: archiveArtifact.artifact,
+    reader,
+  });
+  if (!archiveSource) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP is unavailable',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  if (archiveSource.size > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES) {
+    await archiveSource.close().catch(() => undefined);
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP exceeds the archive size limit',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+
+  let archiveBinary: ArrayBuffer;
+  try {
+    archiveBinary = await readFirmwareByteSourceFully(archiveSource);
+  } finally {
+    await archiveSource.close().catch(() => undefined);
+  }
+  const archiveDigest = bytesToHex(sha256(new Uint8Array(archiveBinary)));
+  if (archiveDigest !== archiveArtifact.artifact.sha256.toLowerCase()) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP does not match its approved receipt',
+      'FirmwareArtifactReceiptMismatch'
+    );
+  }
+
+  let zip: JSZip;
+  try {
+    zip = await JSZip.loadAsync(archiveBinary);
+  } catch {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP cannot be parsed',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  const zipEntries = Object.values(zip.files);
+  if (
+    zipEntries.some(entry => entry.unsafeOriginalName && entry.unsafeOriginalName !== entry.name)
+  ) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP contains an unsafe entry path',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  const files = zipEntries.filter(entry => !entry.dir);
+  if (files.length === 0 || files.length > PREPARED_RESOURCE_ENTRY_MAX_COUNT) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP entry set is invalid',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+
+  let totalSize = 0;
+  const canonicalNames = new Set<string>();
+  for (const entry of files) {
+    const { compressedSize, uncompressedSize } = getZipEntrySizes(entry);
+    const resourceName = getFirmwareUpdateResourceName(entry.name);
+    const canonicalName = resourceName.toLowerCase();
+    totalSize += uncompressedSize;
+    if (
+      compressedSize > archiveBinary.byteLength ||
+      uncompressedSize > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES ||
+      totalSize > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES ||
+      canonicalNames.has(canonicalName)
+    ) {
+      return resourceArchiveError(
+        `Firmware prepared resource ZIP entry bounds are invalid: ${entry.name}`,
+        'FirmwareArtifactsNotPrepared'
+      );
+    }
+    canonicalNames.add(canonicalName);
+  }
+
+  const preparedEntriesByName = new Map(
+    preparedEntries.map(entry => [entry.entryName, entry] as const)
+  );
+  if (preparedEntriesByName.size !== files.length || preparedEntries.length !== files.length) {
+    return resourceArchiveError(
+      'Firmware prepared resource entries do not match the approved ZIP',
+      'FirmwareArtifactReceiptMismatch'
+    );
+  }
+
+  const verifiedEntries: VerifiedPreparedResourceEntry[] = [];
+  for (const entry of files) {
+    const { uncompressedSize } = getZipEntrySizes(entry);
+    const binary = await entry.async('arraybuffer');
+    const preparedEntry = preparedEntriesByName.get(entry.name);
+    const digest = bytesToHex(sha256(new Uint8Array(binary)));
+    if (
+      binary.byteLength !== uncompressedSize ||
+      !preparedEntry ||
+      preparedEntry.artifact.size !== binary.byteLength ||
+      preparedEntry.artifact.sha256.toLowerCase() !== digest
+    ) {
+      return resourceArchiveError(
+        `Firmware prepared resource entry does not match the approved ZIP: ${entry.name}`,
+        'FirmwareArtifactReceiptMismatch'
+      );
+    }
+    verifiedEntries.push({
+      entryName: getFirmwareUpdateResourceName(entry.name),
+      binary,
+    });
+  }
+  return verifiedEntries;
+};

package/src/api/firmware/FirmwareUpdateBaseMethod.ts

@@ -191,6 +191,8 @@ export class FirmwareUpdateBaseMethod<Params> extends BaseMethod<Params> {
           !hasPromptedWebDevice &&
           !isPromptingWebDevice
         ) {
+          clearInterval(intervalTimer);
+          clearTimeout(timeoutTimer);
           isPromptingWebDevice = true;
           try {
             this.postTipMessage(FirmwareUpdateTipMessage.SelectDeviceInBootloaderForWebDevice);

package/src/api/firmware/FirmwareUpdatePlan.ts

@@ -95,7 +95,7 @@ const asIntegrity = ({
 }: {
   size: unknown;
   sha256: unknown;
-}): Pick<FirmwareUpdatePlanArtifact, 'expectedSize' | 'expectedSha256'> => {
+}): Partial<Pick<FirmwareUpdatePlanArtifact, 'expectedSize' | 'expectedSha256'>> => {
   const sha256Value =
     typeof value === 'string' && /^[a-f0-9]{64}$/iu.test(value) ? value.toLowerCase() : undefined;
   return {
@@ -172,6 +172,20 @@ const planError = (message: string): never => {
   });
 };
 
+const requireArtifactIntegrity = (
+  input: Parameters<typeof asIntegrity>[0],
+  label: string
+): Pick<FirmwareUpdatePlanArtifact, 'expectedSize' | 'expectedSha256'> => {
+  const integrity = asIntegrity(input);
+  if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
+    return planError(`${label} integrity metadata is invalid`);
+  }
+  return {
+    expectedSize: integrity.expectedSize,
+    expectedSha256: integrity.expectedSha256,
+  };
+};
+
 const FIRMWARE_UPDATE_PLAN_FORCE_TARGETS = new Set<FirmwareUpdatePlanForceTarget>([
   'firmware',
   'ble',
@@ -309,8 +323,8 @@ export const assertFirmwareUpdatePlan = (value: unknown): FirmwareUpdatePlan =>
     }
     assertExactKeys(
       artifact,
-      ['artifactId', 'role', 'target', 'url', 'container'],
-      ['logicalName', 'expectedSize', 'expectedSha256', 'targetVersion']
+      ['artifactId', 'role', 'target', 'url', 'container', 'expectedSize', 'expectedSha256'],
+      ['logicalName', 'targetVersion']
     );
     const artifactId = assertBoundedString(artifact.artifactId, 'artifact id', 160);
     if (artifactIds.has(artifactId)) {
@@ -329,16 +343,12 @@ export const assertFirmwareUpdatePlan = (value: unknown): FirmwareUpdatePlan =>
     if (artifact.logicalName !== undefined) {
       assertBoundedString(artifact.logicalName, 'logical name', 256);
     }
-    if (
-      artifact.expectedSize !== undefined &&
-      (!Number.isSafeInteger(artifact.expectedSize) || (artifact.expectedSize as number) <= 0)
-    ) {
+    if (!Number.isSafeInteger(artifact.expectedSize) || (artifact.expectedSize as number) <= 0) {
       return planError('Firmware update plan artifact size is invalid');
     }
     if (
-      artifact.expectedSha256 !== undefined &&
-      (typeof artifact.expectedSha256 !== 'string' ||
-        !/^[a-f0-9]{64}$/u.test(artifact.expectedSha256))
+      typeof artifact.expectedSha256 !== 'string' ||
+      !/^[a-f0-9]{64}$/u.test(artifact.expectedSha256)
     ) {
       return planError('Firmware update plan artifact digest is invalid');
     }
@@ -502,13 +512,10 @@ const buildProtocolV2Artifacts = (
       );
     }
     componentTargetSet.add(target);
-    const integrity = asIntegrity({
-      size: component.expectedSize,
-      sha256: component.fingerprint,
-    });
-    if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
-      planError(`Protocol V2 component ${key} integrity metadata is invalid`);
-    }
+    const integrity = requireArtifactIntegrity(
+      { size: component.expectedSize, sha256: component.fingerprint },
+      `Protocol V2 component ${key}`
+    );
     artifacts.push({
       artifactId: `component:${target}`,
       role: 'component',
@@ -714,13 +721,10 @@ export const buildProtocolV2FirmwareUpdatePlan = ({
     if (!archive) {
       return planError('Protocol V2 resource target has no resource archive');
     }
-    const integrity = asIntegrity({
-      size: archive.archiveSize,
-      sha256: archive.archiveSha256,
-    });
-    if (integrity.expectedSize === undefined || integrity.expectedSha256 === undefined) {
-      planError('Protocol V2 resource archive integrity metadata is invalid');
-    }
+    const integrity = requireArtifactIntegrity(
+      { size: archive.archiveSize, sha256: archive.archiveSha256 },
+      'Protocol V2 resource archive'
+    );
     protocolV2.artifacts.push({
       artifactId: 'resource:archive',
       role: 'resourceBundle',
@@ -791,7 +795,11 @@ export const buildFirmwareUpdatePlan = ({
     !!asRelease(release);
   const shouldUpdateFirmware =
     isUpgrade(firmware) || isRecoveryInstall(firmware) || forcedTargets.has('firmware');
-  const shouldUpdateResource = isUpgrade(firmware) || forcedTargets.has('resource');
+  // V2 cannot write legacy resources once the device is already in bootloader
+  // recovery. Do not approve an artifact that its executor cannot apply.
+  const shouldUpdateResource =
+    !(executor === 'v2' && bootloaderMode) &&
+    (isUpgrade(firmware) || forcedTargets.has('resource'));
 
   if (
     executor === 'v4' &&
@@ -808,19 +816,24 @@ export const buildFirmwareUpdatePlan = ({
     targetsToUpdate = protocolV2.targets;
   } else {
     if (isUpgrade(bootloader) || forcedTargets.has('bootloader')) {
+      const bootloaderRelease = asRelease(bootloader);
+      const integrity = requireArtifactIntegrity(
+        {
+          size: bootloaderRelease?.bootloaderExpectedSize,
+          sha256: bootloaderRelease?.bootloaderFingerprint,
+        },
+        'Bootloader release'
+      );
       artifacts.push({
         artifactId: 'bootloader',
         role: 'bootloader',
         target: 'bootloader',
-        url: assertArtifactUrl(asRelease(bootloader)?.bootloaderResource, 'Bootloader release'),
+        url: assertArtifactUrl(bootloaderRelease?.bootloaderResource, 'Bootloader release'),
         container: 'raw',
-        ...asIntegrity({
-          size: asRelease(bootloader)?.bootloaderExpectedSize,
-          sha256: asRelease(bootloader)?.bootloaderFingerprint,
-        }),
-        ...(asVersion(asRelease(bootloader)?.bootloaderVersion)
+        ...integrity,
+        ...(asVersion(bootloaderRelease?.bootloaderVersion)
           ? {
-              targetVersion: asVersion(asRelease(bootloader)?.bootloaderVersion),
+              targetVersion: asVersion(bootloaderRelease?.bootloaderVersion),
             }
           : {}),
       });
@@ -832,16 +845,17 @@ export const buildFirmwareUpdatePlan = ({
         });
       }
       if (shouldUpdateFirmware) {
+        const integrity = requireArtifactIntegrity(
+          { size: firmwareRelease.expectedSize, sha256: firmwareRelease.fingerprint },
+          'Firmware release'
+        );
         artifacts.push({
           artifactId: 'firmware',
           role: 'firmware',
           target: 'firmware',
           url: assertArtifactUrl(firmwareRelease.url, 'Firmware release'),
           container: 'raw',
-          ...asIntegrity({
-            size: firmwareRelease.expectedSize,
-            sha256: firmwareRelease.fingerprint,
-          }),
+          ...integrity,
           ...(asVersion(firmwareRelease.version)
             ? { targetVersion: asVersion(firmwareRelease.version) }
             : {}),
@@ -854,13 +868,8 @@ export const buildFirmwareUpdatePlan = ({
           platform,
         });
         if (resourceUrl) {
-          artifacts.push({
-            artifactId: 'resource',
-            role: 'resource',
-            target: 'resource',
-            url: assertArtifactUrl(resourceUrl, 'Firmware resource release'),
-            container: 'zip',
-            ...asIntegrity({
+          const integrity = requireArtifactIntegrity(
+            {
               size:
                 resourceUrl === asString(firmwareRelease.fullResource)
                   ? firmwareRelease.fullResourceExpectedSize
@@ -869,23 +878,36 @@ export const buildFirmwareUpdatePlan = ({
                 resourceUrl === asString(firmwareRelease.fullResource)
                   ? firmwareRelease.fullResourceFingerprint
                   : firmwareRelease.resourceFingerprint,
-            }),
+            },
+            'Legacy resource archive'
+          );
+          artifacts.push({
+            artifactId: 'resource',
+            role: 'resource',
+            target: 'resource',
+            url: assertArtifactUrl(resourceUrl, 'Firmware resource release'),
+            container: 'zip',
+            ...integrity,
           });
         }
       }
     }
     if (isUpgrade(ble) || isRecoveryInstall(ble) || forcedTargets.has('ble')) {
       const bleRelease = asRelease(ble);
+      const integrity = requireArtifactIntegrity(
+        {
+          size: bleRelease?.expectedSize,
+          sha256: bleRelease?.fingerprintWeb ?? bleRelease?.fingerprint,
+        },
+        'BLE release'
+      );
       artifacts.push({
         artifactId: 'ble',
         role: 'ble',
         target: 'ble',
         url: assertArtifactUrl(bleRelease?.webUpdate ?? bleRelease?.url, 'BLE release'),
         container: 'raw',
-        ...asIntegrity({
-          size: bleRelease?.expectedSize,
-          sha256: bleRelease?.fingerprintWeb ?? bleRelease?.fingerprint,
-        }),
+        ...integrity,
         ...(asVersion(bleRelease?.version)
           ? { targetVersion: asVersion(bleRelease?.version) }
           : {}),

package/src/api/firmware/FirmwareUpdatePreparedPlan.ts

@@ -302,6 +302,23 @@ export const validateFirmwareUpdatePreparedPlan = (value: unknown): FirmwareUpda
   return preparedPlan;
 };
 
+export const getFirmwareUpdatePreparedRawArtifact = ({
+  preparedPlan: value,
+  target,
+  role,
+}: {
+  preparedPlan: unknown;
+  target: FirmwareUpdatePreparedArtifact['target'];
+  role: FirmwareUpdatePreparedArtifact['role'];
+}): FirmwareUpdatePreparedArtifact => {
+  const preparedPlan = validateFirmwareUpdatePreparedPlan(value);
+  const artifacts = preparedPlan.artifacts.filter(artifact => artifact.target === target);
+  if (artifacts.length !== 1 || artifacts[0].role !== role || artifacts[0].container !== 'raw') {
+    return preparedPlanError(`Firmware prepared plan ${target} artifact is invalid`);
+  }
+  return artifacts[0];
+};
+
 /**
  * Identity observed on the live device while a degraded recovery plan runs, keyed by
  * the plan's opaque lease. Bootloader recovery starts with no serial and the device

package/src/types/api/deviceUpdateBootloader.ts

@@ -8,6 +8,7 @@ export type DeviceUpdateBootloaderParams = {
   preparedPlan?: FirmwareUpdatePreparedPlan;
   hostBindingGeneration?: number;
   binary?: ArrayBuffer;
+  /** @deprecated Core derives the bootloader artifact from preparedPlan. */
   artifact?: FirmwareArtifactReference;
   artifactReader?: FirmwareArtifactReader;
   firmwareType?: EFirmwareType;

package/src/types/api/firmwareUpdate.ts

@@ -38,7 +38,8 @@ export interface FirmwareUpdateBinaryParams {
 export interface FirmwareUpdateArtifactParams {
   preparedPlan: FirmwareUpdatePreparedPlan;
   hostBindingGeneration: number;
-  artifact: FirmwareArtifactReference;
+  /** @deprecated Core derives the component artifact from preparedPlan. */
+  artifact?: FirmwareArtifactReference;
   resourceEntries?: Array<{
     entryName: string;
     artifact: FirmwareArtifactReference;

package/src/types/api/firmwareUpdatePlan.ts

@@ -20,8 +20,8 @@ export interface FirmwareUpdatePlanArtifact {
   url: string;
   container: 'raw' | 'zip';
   logicalName?: string;
-  expectedSize?: number;
-  expectedSha256?: string;
+  expectedSize: number;
+  expectedSha256: string;
   targetVersion?: string;
 }