@onekeyfe/react-native-app-update 3.0.53 → 3.0.55

package/android/src/main/java/com/margelo/nitro/reactnativeappupdate/ConcurrentRangeDownloader.kt

@@ -18,8 +18,14 @@ import java.util.concurrent.atomic.AtomicReference
  *
  * Mirrors the desktop DesktopApiBundleUpdate concurrent path. This class is
  * intentionally free of Android/OneKey dependencies (logging is injected) so
- * it can be unit/type-checked standalone; the whole-file SHA256 check the
- * caller already performs after promotion is the final correctness backstop.
+ * it can be unit/type-checked standalone.
+ *
+ * LOAD-BEARING: the caller's whole-file SHA256 + GPG verify performed AFTER
+ * promotion is the final correctness backstop for this concurrent path and must
+ * NEVER be skipped. Resume here is best-effort (ETag-gated; no ETag => fresh
+ * start), and concurrent stitching of ranges has no per-segment integrity
+ * check — a mismatched or mixed file is only ever caught by that downstream
+ * whole-file verify. Removing it would let a corrupt/mixed APK reach install.
  *
  * Invariant: the manifest is only meaningful as metadata for an existing
  * `.partial`. Either both exist (resume) or neither does (fresh) — any other
@@ -147,8 +153,13 @@ internal class ConcurrentRangeDownloader(
     }
 
     // Single round-trip probe: a one-byte Range request that confirms Range
-    // support and captures total size + ETag. OkHttp follows redirects (the
-    // caller's client enforces HTTPS on each hop).
+    // support and captures total size + ETag. The caller's OkHttp client has
+    // redirects DISABLED (followRedirects(false)/followSslRedirects(false)), so
+    // a 3xx is not a 200/206 and probe() returns null -> Outcome.FALLBACK; the
+    // single-stream path (also redirect-disabled) then handles it.
+    // TODO: if APK origins ever start issuing redirects, decide deliberately
+    // whether to enable followSslRedirects(true) (HTTPS-only) here; until then
+    // redirecting origins simply fall back to single-stream.
     private fun probe(url: String): Probe? {
         return try {
             val req = Request.Builder().url(url).addHeader("Range", "bytes=0-0").build()
@@ -249,7 +260,18 @@ internal class ConcurrentRangeDownloader(
             val savedEtag = head.getOrNull(1)?.takeIf { it.isNotEmpty() }
             // Object must be identical to what's on disk and on the CDN.
             if (savedSize != total || partialSize != total) return null
-            if (etag != null && savedEtag != null && etag != savedEtag) return null
+            // Without an ETag we have no strong validator that the bytes already
+            // on disk belong to the SAME build as the one the CDN is serving now.
+            // A same-size-but-different build (common during a staged rollout)
+            // would otherwise resume by stitching old + new bytes into one file.
+            // The downstream whole-file SHA256 + GPG verify WOULD reject that
+            // mixed file, but only after we've wasted the whole download. So treat
+            // an ETag-less manifest as untrustworthy across restarts: bail out
+            // here and let the caller start fresh.
+            // (If a weaker validator is ever wanted, persist+compare Last-Modified
+            // instead of dropping outright.)
+            if (etag == null || savedEtag == null) return null
+            if (etag != savedEtag) return null
             val parts = ArrayList<Part>()
             for (idx in 1 until lines.size) {
                 val cols = lines[idx].split(',')

package/android/src/main/java/com/margelo/nitro/reactnativeappupdate/ReactNativeAppUpdate.kt

@@ -25,6 +25,7 @@ import java.io.InputStreamReader
 import java.util.concurrent.CopyOnWriteArrayList
 import java.util.concurrent.TimeUnit
 import java.util.concurrent.atomic.AtomicBoolean
+import java.util.concurrent.atomic.AtomicInteger
 import java.util.concurrent.atomic.AtomicLong
 import com.margelo.nitro.reactnativebundlecrypto.BundleCryptoCore
 
@@ -518,8 +519,24 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 }
 
                 // Phase 2 — pick up an in-flight partial.
+                //
+                // A concurrent (multi-range) partial is pre-allocated to the FULL
+                // size up front (RandomAccessFile.setLength(total)) and tracks the
+                // real, durably-written cursor only in its sidecar
+                // "<partial>.progress" manifest — the .partial itself is zero-filled
+                // past the real data. The size-based classification below is blind
+                // to that: it would see partialSize == expectedSize and try to
+                // promote+SHA-verify a mostly-zeroed file, hit HashMismatch, and
+                // DELETE it — nuking every interrupted concurrent download back to
+                // byte 0. So when the manifest exists, skip the size-based
+                // promote/discard branches entirely and let the concurrent
+                // downloader below own the file: it resumes from the manifest (or
+                // returns FALLBACK and hands the bytes back to single-stream).
+                // The path must match exactly what ConcurrentRangeDownloader writes:
+                // File("$partialFilePath.progress").
+                val hasConcurrentManifest = buildFile("$partialFilePath.progress").exists()
                 var partialBytes = 0L
-                if (partialFile.exists()) {
+                if (partialFile.exists() && !hasConcurrentManifest) {
                     val partialSize = partialFile.length()
                     when {
                         expectedSize > 0 && partialSize == expectedSize -> {
@@ -575,23 +592,36 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                         .followRedirects(false)
                         .followSslRedirects(false)
                         .build()
-                    var concurrentProgress = -1
+                    // onProgress is invoked concurrently from all 8 worker
+                    // threads. concurrentProgress must be an AtomicInteger so the
+                    // "did the percent advance?" check is race-free, and the
+                    // NotificationCompat.Builder (shared, NOT thread-safe) plus the
+                    // notify() call must be guarded by a single lock so two threads
+                    // never mutate/build it at once. We emit at most once per
+                    // percent step: getAndSet returns the previous value, and only
+                    // the thread that actually moved the percent forward proceeds.
+                    val concurrentProgress = AtomicInteger(-1)
+                    val notifyLock = Any()
                     val concurrentOutcome = ConcurrentRangeDownloader(
                         httpClient = concurrentClient,
                         log = { msg -> OneKeyLog.info("AppUpdate", msg) },
                     ).download(url, partialFilePath) { transferred, total ->
                         if (total > 0) {
                             val p = ((transferred * 100) / total).toInt().coerceIn(0, 100)
-                            if (p != concurrentProgress) {
+                            // Only the thread that advances the percent emits; a
+                            // stale/lower p (out-of-order delivery) is dropped.
+                            val prev = concurrentProgress.get()
+                            if (p > prev && concurrentProgress.compareAndSet(prev, p)) {
                                 sendEvent("update/downloading", progress = p)
-                                builder.setProgress(100, p, false)
-                                if (ActivityCompat.checkSelfPermission(
-                                        context, android.Manifest.permission.POST_NOTIFICATIONS
-                                    ) == PackageManager.PERMISSION_GRANTED
-                                ) {
-                                    notifyManager.notify(NOTIFICATION_ID, builder.build())
+                                synchronized(notifyLock) {
+                                    builder.setProgress(100, p, false)
+                                    if (ActivityCompat.checkSelfPermission(
+                                            context, android.Manifest.permission.POST_NOTIFICATIONS
+                                        ) == PackageManager.PERMISSION_GRANTED
+                                    ) {
+                                        notifyManager.notify(NOTIFICATION_ID, builder.build())
+                                    }
                                 }
-                                concurrentProgress = p
                             }
                         }
                     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-app-update",
-  "version": "3.0.53",
+  "version": "3.0.55",
   "description": "react-native-app-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",