@onekeyfe/hd-core 1.2.0-alpha.97 → 1.2.0-alpha.98

package/__tests__/firmware-update/firmware-prepared-resource-archive.test.ts

@@ -0,0 +1,150 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { EFirmwareType } from '@onekeyfe/hd-shared';
+import JSZip from 'jszip';
+
+import { readVerifiedPreparedResourceArchive } from '../../src/api/firmware/FirmwarePreparedResourceArchive';
+import { prepareFirmwareUpdatePlan } from '../../src/api/firmware/FirmwareUpdatePreparedPlan';
+import { digestFirmwareUpdateContract } from '../../src/api/firmware/FirmwareUpdatePlan';
+
+import type {
+  FirmwareArtifactReader,
+  FirmwareArtifactReference,
+} from '../../src/types/api/firmwareUpdate';
+import type { FirmwareUpdatePlan } from '../../src/types/api/firmwareUpdatePlan';
+
+jest.mock('../../src/data/config', () => ({
+  getSDKVersion: jest.fn(() => '1.0.0'),
+  DEFAULT_DOMAIN: 'https://jssdk.onekey.so/1.0.0/',
+}));
+
+const createReference = (artifactRef: string, binary: ArrayBuffer): FirmwareArtifactReference => ({
+  artifactRef,
+  size: binary.byteLength,
+  sha256: bytesToHex(sha256(new Uint8Array(binary))),
+});
+
+const createReader = (artifacts: Map<string, ArrayBuffer>): FirmwareArtifactReader => {
+  const opened = new Map<string, ArrayBuffer>();
+  let sequence = 0;
+  return {
+    open({ artifactRef }) {
+      const binary = artifacts.get(artifactRef);
+      if (!binary) throw new Error(`missing artifact: ${artifactRef}`);
+      sequence += 1;
+      const readerId = `reader-${sequence}`;
+      opened.set(readerId, binary);
+      return Promise.resolve({ readerId, size: binary.byteLength });
+    },
+    read({ readerId, offset, length }) {
+      const binary = opened.get(readerId);
+      if (!binary) throw new Error(`missing reader: ${readerId}`);
+      const data = binary.slice(offset, offset + length);
+      return Promise.resolve({
+        data,
+        bytesRead: data.byteLength,
+        eof: offset + length === binary.byteLength,
+      });
+    },
+    close({ readerId }) {
+      opened.delete(readerId);
+      return Promise.resolve();
+    },
+  };
+};
+
+const createPreparedResourcePlan = ({
+  executor,
+  archiveBinary,
+  entryBinary,
+}: {
+  executor: 'v2' | 'v3';
+  archiveBinary: ArrayBuffer;
+  entryBinary: ArrayBuffer;
+}) => {
+  const archiveArtifact = createReference('resource-archive', archiveBinary);
+  const entryArtifact = createReference('resource-entry', entryBinary);
+  const planWithoutDigest: Omit<FirmwareUpdatePlan, 'planDigest'> = {
+    schemaVersion: 2,
+    executor,
+    deviceIdentity: `${executor}-device`,
+    deviceModel: executor === 'v2' ? 'TOUCH' : 'PRO',
+    firmwareType: EFirmwareType.Universal,
+    platform: 'desktop',
+    artifacts: [
+      {
+        artifactId: 'resource',
+        role: 'resource',
+        target: 'resource',
+        url: 'https://firmware.onekey.so/resource.zip',
+        container: 'zip',
+        expectedSize: archiveArtifact.size,
+        expectedSha256: archiveArtifact.sha256,
+      },
+    ],
+    targetsToUpdate: ['resource'],
+  };
+  const plan: FirmwareUpdatePlan = {
+    ...planWithoutDigest,
+    planDigest: digestFirmwareUpdateContract(planWithoutDigest),
+  };
+  return {
+    archiveArtifact,
+    preparedPlan: prepareFirmwareUpdatePlan({
+      plan,
+      leaseRef: `${executor}-resource-lease`,
+      artifacts: [
+        {
+          artifactId: 'resource',
+          artifact: archiveArtifact,
+          materializedEntries: [{ entryName: 'images/logo.bin', artifact: entryArtifact }],
+        },
+      ],
+    }),
+  };
+};
+
+describe.each(['v2', 'v3'] as const)('%s prepared resource archive binding', executor => {
+  test('uses canonical bytes extracted from the approved ZIP', async () => {
+    const entryBinary = Uint8Array.from([1, 2, 3, 4]).buffer;
+    const zip = new JSZip();
+    zip.file('images/logo.bin', entryBinary);
+    const archiveBinary = await zip.generateAsync({ type: 'arraybuffer' });
+    const { archiveArtifact, preparedPlan } = createPreparedResourcePlan({
+      executor,
+      archiveBinary,
+      entryBinary,
+    });
+
+    const result = await readVerifiedPreparedResourceArchive({
+      preparedPlan,
+      reader: createReader(new Map([[archiveArtifact.artifactRef, archiveBinary]])),
+    });
+
+    expect(result).toHaveLength(1);
+    expect(result[0].entryName).toBe('logo.bin');
+    expect(new Uint8Array(result[0].binary)).toEqual(new Uint8Array(entryBinary));
+  });
+
+  test('rejects entries that are not derived from the approved ZIP', async () => {
+    const approvedEntry = Uint8Array.from([1, 2, 3, 4]).buffer;
+    const substitutedEntry = Uint8Array.from([9, 9, 9, 9]).buffer;
+    const zip = new JSZip();
+    zip.file('images/logo.bin', approvedEntry);
+    const archiveBinary = await zip.generateAsync({ type: 'arraybuffer' });
+    const { archiveArtifact, preparedPlan } = createPreparedResourcePlan({
+      executor,
+      archiveBinary,
+      entryBinary: substitutedEntry,
+    });
+
+    await expect(
+      readVerifiedPreparedResourceArchive({
+        preparedPlan,
+        reader: createReader(new Map([[archiveArtifact.artifactRef, archiveBinary]])),
+      })
+    ).rejects.toMatchObject({
+      params: { firmwareUpdateCode: 'FirmwareArtifactReceiptMismatch' },
+    });
+  });
+});

package/__tests__/firmware-update/firmware-update-plan.test.ts

@@ -1,6 +1,10 @@
 import { EDeviceType, EFirmwareType } from '@onekeyfe/hd-shared';
 
 import { buildFirmwareUpdatePlan } from '../../src/api/firmware/FirmwareUpdatePlan';
+import {
+  assertFirmwareUpdatePreparedPlanDeviceIdentity,
+  prepareFirmwareUpdatePlan,
+} from '../../src/api/firmware/FirmwareUpdatePreparedPlan';
 
 import type { Features } from '../../src/types';
 
@@ -50,6 +54,8 @@ const createLegacyForceInput = (
   release: Record<string, unknown> = {
     url: 'https://firmware.onekey.so/pro/firmware.bin',
     version: [4, 21, 0],
+    expectedSize: 1024,
+    fingerprint: '1'.repeat(64),
   }
 ): BuildPlanInput => ({
   features: createFeatures({
@@ -168,6 +174,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           url: 'https://firmware.onekey.so/pro/firmware.bin',
           version: [4, 0, 0],
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
         },
       },
       ble: noUpdate,
@@ -193,7 +201,11 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           url: 'https://firmware.onekey.so/pro/firmware.bin',
           version: [4, 21, 0],
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
           resource: 'https://firmware.onekey.so/pro/resource.zip',
+          resourceExpectedSize: 4096,
+          resourceFingerprint: '1'.repeat(64),
         },
       },
       ble: {
@@ -201,6 +213,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           webUpdate: 'https://firmware.onekey.so/pro/ble.bin',
           version: [2, 3, 7],
+          expectedSize: 512,
+          fingerprintWeb: '2'.repeat(64),
         },
       },
       bootloader: {
@@ -208,6 +222,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           bootloaderResource: 'https://firmware.onekey.so/pro/bootloader.bin',
           bootloaderVersion: [2, 8, 4],
+          bootloaderExpectedSize: 768,
+          bootloaderFingerprint: '3'.repeat(64),
         },
       },
       forceUpdateTargets: ['firmware', 'resource', 'ble', 'bootloader'],
@@ -237,6 +253,8 @@ describe('buildFirmwareUpdatePlan', () => {
         release: {
           url: 'https://firmware.onekey.so/pro/firmware.bin',
           version: [4, 21, 0],
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
           resource: 'https://firmware.onekey.so/pro/resource.zip',
         },
       },
@@ -249,6 +267,32 @@ describe('buildFirmwareUpdatePlan', () => {
     expect(plan.targetsToUpdate).toEqual(['firmware']);
   });
 
+  test('does not approve an unexecutable V2 resource during bootloader recovery', () => {
+    const features = createFeatures({ deviceType: EDeviceType.Classic1s });
+    features.bootloaderMode = true;
+    const plan = buildFirmwareUpdatePlan({
+      features,
+      firmwareType: EFirmwareType.Universal,
+      platform: 'desktop',
+      firmware: {
+        status: 'none',
+        release: {
+          url: 'https://firmware.onekey.so/classic/firmware.bin',
+          expectedSize: 1024,
+          fingerprint: '1'.repeat(64),
+          resource: 'https://firmware.onekey.so/classic/resource.zip',
+          resourceExpectedSize: 4096,
+          resourceFingerprint: '2'.repeat(64),
+        },
+      },
+      ble: noUpdate,
+      bootloader: noUpdate,
+    });
+
+    expect(plan.artifacts.map(artifact => artifact.artifactId)).toEqual(['firmware']);
+    expect(plan.targetsToUpdate).toEqual(['firmware']);
+  });
+
   test.each([
     {
       label: 'a non-array value',
@@ -272,6 +316,65 @@ describe('buildFirmwareUpdatePlan', () => {
     expectFirmwarePlanInvalid(() => buildFirmwareUpdatePlan(createLegacyForceInput(['resource'])));
   });
 
+  test('rejects a legacy resource archive without complete integrity metadata', () => {
+    expectFirmwarePlanInvalid(
+      () =>
+        buildFirmwareUpdatePlan(
+          createLegacyForceInput(['resource'], {
+            url: 'https://firmware.onekey.so/pro/firmware.bin',
+            resource: 'https://firmware.onekey.so/pro/resource.zip',
+            resourceExpectedSize: 4096,
+          })
+        ),
+      'integrity metadata is invalid'
+    );
+  });
+
+  test.each(['firmware', 'ble', 'bootloader'] as const)(
+    'rejects a remote legacy %s artifact without complete integrity metadata',
+    target => {
+      expectFirmwarePlanInvalid(
+        () =>
+          buildFirmwareUpdatePlan({
+            features: createFeatures({ deviceType: EDeviceType.Classic1s }),
+            firmwareType: EFirmwareType.Universal,
+            platform: 'desktop',
+            firmware:
+              target === 'firmware'
+                ? {
+                    status: 'outdated',
+                    release: {
+                      url: 'https://firmware.onekey.so/classic/firmware.bin',
+                      expectedSize: 1024,
+                    },
+                  }
+                : noUpdate,
+            ble:
+              target === 'ble'
+                ? {
+                    status: 'outdated',
+                    release: {
+                      webUpdate: 'https://firmware.onekey.so/classic/ble.bin',
+                      expectedSize: 512,
+                    },
+                  }
+                : noUpdate,
+            bootloader:
+              target === 'bootloader'
+                ? {
+                    status: 'outdated',
+                    release: {
+                      bootloaderResource: 'https://firmware.onekey.so/classic/bootloader.bin',
+                      bootloaderExpectedSize: 768,
+                    },
+                  }
+                : noUpdate,
+          }),
+        'integrity metadata is invalid'
+      );
+    }
+  );
+
   test.each(['ble', 'bootloader'] as const)(
     'rejects the unsupported Pro2 %s force target',
     forceTarget => {
@@ -297,12 +400,6 @@ describe('buildFirmwareUpdatePlan', () => {
       forceTarget: 'firmware' as const,
       release: {
         components: {},
-        resourceBundles: [
-          {
-            name: 'images',
-            url: 'https://firmware.onekey.so/pro2/images.okpkg',
-          },
-        ],
       },
     },
     {
@@ -312,6 +409,8 @@ describe('buildFirmwareUpdatePlan', () => {
           applicationP1: {
             target: 'APPLICATION_P1',
             url: 'https://firmware.onekey.so/pro2/application-p1.bin',
+            expectedSize: 1024,
+            fingerprint: '1111111111111111111111111111111111111111111111111111111111111111',
           },
         },
       },
@@ -325,41 +424,23 @@ describe('buildFirmwareUpdatePlan', () => {
     }
   );
 
-  test.each([
-    {
-      forceTarget: 'firmware' as const,
-      expectedArtifactIds: ['component:app_v1'],
-      expectedTargets: ['app_v1'],
-    },
-    {
-      forceTarget: 'resource' as const,
-      expectedArtifactIds: ['resourceBundle:images'],
-      expectedTargets: ['resource'],
-    },
-  ])(
-    'limits a Pro2 $forceTarget force to the selected artifact role',
-    ({ forceTarget, expectedArtifactIds, expectedTargets }) => {
-      const plan = buildFirmwareUpdatePlan(
-        createProtocolV2ForceInput([forceTarget], {
-          components: {
-            applicationP1: {
-              target: 'APPLICATION_P1',
-              url: 'https://firmware.onekey.so/pro2/application-p1.bin',
-            },
+  test('limits a Pro2 firmware force to component artifacts', () => {
+    const plan = buildFirmwareUpdatePlan(
+      createProtocolV2ForceInput(['firmware'], {
+        components: {
+          applicationP1: {
+            target: 'APPLICATION_P1',
+            url: 'https://firmware.onekey.so/pro2/application-p1.bin',
+            expectedSize: 1024,
+            fingerprint: '1111111111111111111111111111111111111111111111111111111111111111',
           },
-          resourceBundles: [
-            {
-              name: 'images',
-              url: 'https://firmware.onekey.so/pro2/images.okpkg',
-            },
-          ],
-        })
-      );
+        },
+      })
+    );
 
-      expect(plan.artifacts.map(artifact => artifact.artifactId)).toEqual(expectedArtifactIds);
-      expect(plan.targetsToUpdate).toEqual(expectedTargets);
-    }
-  );
+    expect(plan.artifacts.map(artifact => artifact.artifactId)).toEqual(['component:app_v1']);
+    expect(plan.targetsToUpdate).toEqual(['app_v1']);
+  });
 
   test('rejects a prepared native plan without a stable device identity', () => {
     const features = createFeatures({
@@ -376,6 +457,8 @@ describe('buildFirmwareUpdatePlan', () => {
           status: 'outdated',
           release: {
             url: 'https://firmware.onekey.so/classic/firmware.bin',
+            expectedSize: 1024,
+            fingerprint: '1'.repeat(64),
           },
         },
         ble: noUpdate,
@@ -384,7 +467,72 @@ describe('buildFirmwareUpdatePlan', () => {
     ).toThrow('requires a stable device identity');
   });
 
-  test('maps the Pro2 component order and resource bundles without downloading them', () => {
+  test('allows an identity-less Protocol V2 device while retaining the model binding', () => {
+    const features = createFeatures({
+      deviceType: EDeviceType.Pro2,
+    });
+    delete (features as Partial<Features>).serialNo;
+
+    const plan = buildFirmwareUpdatePlan({
+      features,
+      firmwareType: EFirmwareType.Universal,
+      platform: 'desktop',
+      firmware: {
+        status: 'outdated',
+        release: {
+          components: {
+            applicationP1: {
+              target: 'APPLICATION_P1',
+              url: 'https://firmware.onekey.so/pro2/application-p1.bin',
+              expectedSize: 1024,
+              fingerprint: '1111111111111111111111111111111111111111111111111111111111111111',
+            },
+          },
+        },
+      },
+      ble: noUpdate,
+      bootloader: noUpdate,
+    });
+
+    expect(plan).toMatchObject({
+      executor: 'v4',
+      deviceIdentity: 'unavailable',
+      deviceModel: String(EDeviceType.Pro2),
+    });
+
+    const preparedPlan = prepareFirmwareUpdatePlan({
+      plan,
+      leaseRef: 'fwlease:00000000-0000-4000-8000-000000000004',
+      artifacts: [
+        {
+          artifactId: 'component:app_v1',
+          artifact: {
+            artifactRef: `fw:${'1'.repeat(64)}`,
+            size: 1024,
+            sha256: '1'.repeat(64),
+          },
+        },
+      ],
+    });
+    expect(() =>
+      assertFirmwareUpdatePreparedPlanDeviceIdentity({
+        preparedPlan,
+        deviceIdentity: undefined,
+        bootloaderMode: false,
+        deviceModel: String(EDeviceType.Pro2),
+      })
+    ).not.toThrow();
+    expect(() =>
+      assertFirmwareUpdatePreparedPlanDeviceIdentity({
+        preparedPlan,
+        deviceIdentity: undefined,
+        bootloaderMode: false,
+        deviceModel: String(EDeviceType.Neo),
+      })
+    ).toThrow();
+  });
+
+  test('maps the Pro2 component order without downloading artifacts', () => {
     const plan = buildFirmwareUpdatePlan({
       features: createFeatures({ deviceType: EDeviceType.Pro2 }),
       firmwareType: EFirmwareType.Universal,
@@ -403,18 +551,16 @@ describe('buildFirmwareUpdatePlan', () => {
             bootloader: {
               target: 'BOOTLOADER',
               url: 'https://firmware.onekey.so/pro2/bootloader.bin',
+              expectedSize: 2048,
+              fingerprint: '2222222222222222222222222222222222222222222222222222222222222222',
             },
             se01: {
               target: 'SE01',
               url: 'https://firmware.onekey.so/pro2/se01.bin',
+              expectedSize: 512,
+              fingerprint: '3333333333333333333333333333333333333333333333333333333333333333',
             },
           },
-          resourceBundles: [
-            {
-              name: 'images',
-              url: 'https://firmware.onekey.so/pro2/images.okpkg',
-            },
-          ],
         },
       },
       ble: noUpdate,
@@ -426,9 +572,8 @@ describe('buildFirmwareUpdatePlan', () => {
       'component:boot',
       'component:app_v1',
       'component:se01',
-      'resourceBundle:images',
     ]);
-    expect(plan.targetsToUpdate).toEqual(['boot', 'app_v1', 'se01', 'resource']);
+    expect(plan.targetsToUpdate).toEqual(['boot', 'app_v1', 'se01']);
     expect(plan.artifacts[1]).toEqual(
       expect.objectContaining({
         expectedSize: 1024,
@@ -437,6 +582,41 @@ describe('buildFirmwareUpdatePlan', () => {
     );
   });
 
+  test.each([
+    {
+      expectedSize: undefined,
+      fingerprint: '1'.repeat(64),
+    },
+    {
+      expectedSize: 1024,
+      fingerprint: undefined,
+    },
+  ])('rejects a remote Pro2 component without complete integrity metadata', integrity => {
+    expectFirmwarePlanInvalid(
+      () =>
+        buildFirmwareUpdatePlan({
+          features: createFeatures({ deviceType: EDeviceType.Pro2 }),
+          firmwareType: EFirmwareType.Universal,
+          platform: 'desktop',
+          firmware: {
+            status: 'required',
+            release: {
+              components: {
+                applicationP1: {
+                  target: 'APPLICATION_P1',
+                  url: 'https://firmware.onekey.so/pro2/application-p1.bin',
+                  ...integrity,
+                },
+              },
+            },
+          },
+          ble: noUpdate,
+          bootloader: noUpdate,
+        }),
+      'integrity metadata is invalid'
+    );
+  });
+
   test('rejects Pro2 ROMLOADER because it requires a separate loader flow', () => {
     expect(() =>
       buildFirmwareUpdatePlan({
@@ -468,37 +648,19 @@ describe('buildFirmwareUpdatePlan', () => {
           application: {
             target: 'APPLICATION_P1',
             url: 'https://firmware.onekey.so/pro2/application.bin',
+            expectedSize: 1024,
+            fingerprint: '1111111111111111111111111111111111111111111111111111111111111111',
           },
           applicationDuplicate: {
             target: 'APPLICATION_P1',
             url: 'https://firmware.onekey.so/pro2/application-duplicate.bin',
+            expectedSize: 1024,
+            fingerprint: '2222222222222222222222222222222222222222222222222222222222222222',
           },
         },
       },
       expectedError: 'duplicates target app_v1',
     },
-    {
-      label: 'resource bundle name',
-      release: {
-        components: {
-          application: {
-            target: 'APPLICATION_P1',
-            url: 'https://firmware.onekey.so/pro2/application.bin',
-          },
-        },
-        resourceBundles: [
-          {
-            name: 'images',
-            url: 'https://firmware.onekey.so/pro2/images.okpkg',
-          },
-          {
-            name: 'images',
-            url: 'https://firmware.onekey.so/pro2/images-duplicate.okpkg',
-          },
-        ],
-      },
-      expectedError: 'duplicates name images',
-    },
   ])('rejects a duplicate Pro2 $label', ({ release, expectedError }) => {
     expect(() =>
       buildFirmwareUpdatePlan({

package/__tests__/firmware-update/firmware-update-prepared-plan.test.ts

@@ -1,6 +1,9 @@
 import { EDeviceType, EFirmwareType } from '@onekeyfe/hd-shared';
 
-import { buildFirmwareUpdatePlan } from '../../src/api/firmware/FirmwareUpdatePlan';
+import {
+  buildFirmwareUpdatePlan,
+  digestFirmwareUpdateContract,
+} from '../../src/api/firmware/FirmwareUpdatePlan';
 import {
   assertFirmwareUpdatePreparedPlanBinding,
   assertFirmwareUpdatePreparedPlanDeviceIdentity,
@@ -209,6 +212,55 @@ describe('FirmwareUpdatePreparedPlan', () => {
     ).toThrow('entry name is invalid');
   });
 
+  test('rejects duplicate materialized entry names during standalone validation', () => {
+    const plan = buildPlan();
+    const prepared = prepareFirmwareUpdatePlan({
+      plan,
+      leaseRef: 'fwlease:00000000-0000-4000-8000-000000000001',
+      artifacts: [
+        {
+          artifactId: 'firmware',
+          artifact: artifact('a'.repeat(64), 4),
+        },
+        {
+          artifactId: 'resource',
+          artifact: artifact('b'.repeat(64), 8),
+          materializedEntries: [
+            {
+              entryName: 'resource/index.bin',
+              artifact: artifact('c'.repeat(64), 2),
+            },
+          ],
+        },
+      ],
+    });
+    const resourceArtifact = prepared.artifacts.find(item => item.target === 'resource')!;
+    const tamperedWithoutDigest = {
+      ...prepared,
+      artifacts: prepared.artifacts.map(item =>
+        item === resourceArtifact
+          ? {
+              ...item,
+              materializedEntries: [
+                ...resourceArtifact.materializedEntries!,
+                {
+                  entryName: 'other/index.bin',
+                  artifact: artifact('d'.repeat(64), 2),
+                },
+              ],
+            }
+          : item
+      ),
+    };
+    const { preparedPlanDigest: _preparedPlanDigest, ...digestInput } = tamperedWithoutDigest;
+    const tampered = {
+      ...tamperedWithoutDigest,
+      preparedPlanDigest: digestFirmwareUpdateContract(digestInput),
+    };
+
+    expect(() => validateFirmwareUpdatePreparedPlan(tampered)).toThrow('duplicate entry names');
+  });
+
   test('rejects unknown fields even when a caller presents a plan-shaped object', () => {
     const plan = buildPlan();
     expect(() =>