@otakit/capacitor-updater 1.0.0

package/android/src/main/java/com/updatekit/updater/HashUtils.java

@@ -0,0 +1,32 @@
+package com.updatekit.updater;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.security.MessageDigest;
+
+final class HashUtils {
+
+  private HashUtils() {}
+
+  static String sha256(File file) throws Exception {
+    MessageDigest digest = MessageDigest.getInstance("SHA-256");
+    try (FileInputStream input = new FileInputStream(file)) {
+      byte[] buffer = new byte[1024 * 1024];
+      int read;
+      while ((read = input.read(buffer)) > 0) {
+        digest.update(buffer, 0, read);
+      }
+    }
+
+    byte[] hash = digest.digest();
+    StringBuilder builder = new StringBuilder();
+    for (byte b : hash) {
+      builder.append(String.format("%02x", b));
+    }
+    return builder.toString();
+  }
+
+  static boolean verify(File file, String expectedSha256) throws Exception {
+    return sha256(file).equalsIgnoreCase(expectedSha256);
+  }
+}

package/android/src/main/java/com/updatekit/updater/HostedManifestKeys.java

@@ -0,0 +1,37 @@
+package com.updatekit.updater;
+
+import android.util.Base64;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+
+final class HostedManifestKeys {
+
+  private static final String MANAGED_SERVER_URL = "https://www.otakit.app/api/v1";
+
+  private HostedManifestKeys() {}
+
+  static boolean matchesManagedServer(String updateUrl) {
+    if (updateUrl == null) {
+      return false;
+    }
+
+    String normalized = updateUrl.trim().replaceAll("/+$", "").toLowerCase(Locale.ROOT);
+    return normalized.equals(MANAGED_SERVER_URL)
+        || normalized.equals("https://otakit.app/api/v1");
+  }
+
+  static List<ManifestVerifier.KeyEntry> createDefaultKeys() {
+    ArrayList<ManifestVerifier.KeyEntry> keys = new ArrayList<>();
+    keys.add(
+      new ManifestVerifier.KeyEntry(
+        "hosted-2026-04-02-ce611e6d",
+        Base64.decode(
+          "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELg6eAj2+7aZ1FJnYUNMjOtWuQLJMomXkPvmeTQ3gXyabpLTDX0m3iWYO3cEOXqIR6NphGC6csS2T5bCtXwIBFw==",
+          Base64.DEFAULT
+        )
+      )
+    );
+    return keys;
+  }
+}

package/android/src/main/java/com/updatekit/updater/ManifestClient.java

@@ -0,0 +1,209 @@
+package com.updatekit.updater;
+
+import java.io.ByteArrayOutputStream;
+import java.io.InputStream;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import org.json.JSONObject;
+
+final class ManifestClient {
+
+  static final class ManifestSignature {
+
+    final String kid;
+    final String sig;
+    final int iat;
+    final int exp;
+
+    ManifestSignature(String kid, String sig, int iat, int exp) {
+      this.kid = kid;
+      this.sig = sig;
+      this.iat = iat;
+      this.exp = exp;
+    }
+  }
+
+  static final class LatestManifest {
+
+    final String version;
+    final String url;
+    final String sha256;
+    final int size;
+    final Integer minNativeBuild;
+    final String releaseId;
+    final ManifestSignature signature;
+
+    LatestManifest(
+      String version,
+      String url,
+      String sha256,
+      int size,
+      Integer minNativeBuild,
+      String releaseId,
+      ManifestSignature signature
+    ) {
+      this.version = version;
+      this.url = url;
+      this.sha256 = sha256;
+      this.size = size;
+      this.minNativeBuild = minNativeBuild;
+      this.releaseId = releaseId;
+      this.signature = signature;
+    }
+  }
+
+  private ManifestClient() {}
+
+  static void requireHTTPS(URL url, boolean allowInsecure) throws Exception {
+    String protocol = url.getProtocol().toLowerCase();
+    if ("https".equals(protocol)) return;
+    if (allowInsecure) {
+      String host = url.getHost().toLowerCase();
+      if ("localhost".equals(host) || "127.0.0.1".equals(host)) return;
+    }
+    throw new IllegalStateException("URL must use HTTPS: " + url.toString());
+  }
+
+  static LatestManifest fetchLatest(
+    String updateUrl,
+    String appId,
+    String channel,
+    String currentVersion,
+    String currentReleaseId,
+    String nativeBuild,
+    String platform,
+    boolean allowInsecureUrls,
+    java.util.List<ManifestVerifier.KeyEntry> manifestKeys
+  ) throws Exception {
+    String base = updateUrl.replaceAll("/+$", "");
+    URL url = new URL(base + "/manifest");
+
+    requireHTTPS(url, allowInsecureUrls);
+
+    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
+    try {
+      connection.setRequestMethod("GET");
+      connection.setRequestProperty("X-App-Id", appId);
+      connection.setRequestProperty("X-Platform", platform);
+      if (channel != null && !channel.trim().isEmpty()) {
+        connection.setRequestProperty("X-Channel", channel);
+      }
+      connection.setRequestProperty("X-Current-Version", currentVersion);
+      if (currentReleaseId != null && !currentReleaseId.trim().isEmpty()) {
+        connection.setRequestProperty("X-Release-Id", currentReleaseId);
+      }
+      connection.setRequestProperty("X-Native-Build", nativeBuild);
+      connection.setConnectTimeout(15_000);
+      connection.setReadTimeout(30_000);
+
+      int status = connection.getResponseCode();
+      if (status == 204) {
+        return null;
+      }
+      if (status != 200) {
+        String body = readStream(
+          connection.getErrorStream() != null
+            ? connection.getErrorStream()
+            : connection.getInputStream()
+        );
+        throw new IllegalStateException("Latest request failed (" + status + "): " + body);
+      }
+
+      String payload = readStream(connection.getInputStream());
+      JSONObject json = new JSONObject(payload);
+
+      String version = json.getString("version");
+      String downloadUrl = json.getString("url");
+      String sha256 = json.getString("sha256");
+      int size = json.getInt("size");
+
+      Integer minNativeBuild = null;
+      if (json.has("minNativeBuild") && !json.isNull("minNativeBuild")) {
+        Object raw = json.get("minNativeBuild");
+        if (raw instanceof Number) {
+          minNativeBuild = ((Number) raw).intValue();
+        } else if (raw instanceof String) {
+          String value = ((String) raw).trim();
+          if (!value.isEmpty()) {
+            minNativeBuild = Integer.parseInt(value);
+          }
+        }
+      }
+
+      ManifestSignature signature = null;
+      if (json.has("signature") && !json.isNull("signature")) {
+        JSONObject sigObj = json.getJSONObject("signature");
+        if (sigObj.has("kid") && sigObj.has("sig") && sigObj.has("iat") && sigObj.has("exp")) {
+          signature = new ManifestSignature(
+            sigObj.getString("kid"),
+            sigObj.getString("sig"),
+            sigObj.getInt("iat"),
+            sigObj.getInt("exp")
+          );
+        }
+      }
+
+      String releaseId = null;
+      if (json.has("releaseId") && !json.isNull("releaseId")) {
+        releaseId = json.getString("releaseId");
+      }
+
+      // Validate download URL scheme
+      requireHTTPS(new URL(downloadUrl), allowInsecureUrls);
+
+      if (manifestKeys == null || manifestKeys.isEmpty()) {
+        android.util.Log.w(
+          "UpdateKit",
+          "No manifest signing keys configured — signature verification is disabled for this request."
+        );
+      }
+
+      // Verify manifest signature if signing keys are configured
+      if (manifestKeys != null && !manifestKeys.isEmpty()) {
+        if (signature == null) {
+          throw new IllegalStateException(
+            "Manifest signature missing but signing keys are configured"
+          );
+        }
+        ManifestVerifier.verify(
+          appId,
+          channel,
+          platform,
+          version,
+          sha256,
+          size,
+          minNativeBuild,
+          signature,
+          manifestKeys
+        );
+      }
+
+      return new LatestManifest(
+        version,
+        downloadUrl,
+        sha256,
+        size,
+        minNativeBuild,
+        releaseId,
+        signature
+      );
+    } finally {
+      connection.disconnect();
+    }
+  }
+
+  private static String readStream(InputStream input) throws Exception {
+    if (input == null) {
+      return "";
+    }
+    try (InputStream stream = input; ByteArrayOutputStream out = new ByteArrayOutputStream()) {
+      byte[] buffer = new byte[8192];
+      int read;
+      while ((read = stream.read(buffer)) > 0) {
+        out.write(buffer, 0, read);
+      }
+      return new String(out.toByteArray(), StandardCharsets.UTF_8);
+    }
+  }
+}

package/android/src/main/java/com/updatekit/updater/ManifestVerifier.java

@@ -0,0 +1,146 @@
+package com.updatekit.updater;
+
+import android.util.Base64;
+import java.security.KeyFactory;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.List;
+
+final class ManifestVerifier {
+
+  static final class KeyEntry {
+
+    final String kid;
+    final byte[] derData;
+
+    KeyEntry(String kid, byte[] derData) {
+      this.kid = kid;
+      this.derData = derData;
+    }
+  }
+
+  private ManifestVerifier() {}
+
+  /**
+   * Verify a manifest signature using ES256 (ECDSA P-256 + SHA-256).
+   *
+   * @throws Exception on verification failure (unknown kid, expired, invalid signature).
+   */
+  static void verify(
+    String appId,
+    String channel,
+    String platform,
+    String version,
+    String sha256,
+    int size,
+    Integer minNativeBuild,
+    ManifestClient.ManifestSignature signature,
+    List<KeyEntry> trustedKeys
+  ) throws Exception {
+    // Check expiry
+    long now = System.currentTimeMillis() / 1000;
+    if (signature.exp <= now) {
+      throw new IllegalStateException("Manifest signature expired");
+    }
+
+    // Find matching key
+    KeyEntry keyEntry = null;
+    for (KeyEntry entry : trustedKeys) {
+      if (entry.kid.equals(signature.kid)) {
+        keyEntry = entry;
+        break;
+      }
+    }
+    if (keyEntry == null) {
+      throw new IllegalStateException("Unknown signing key ID: " + signature.kid);
+    }
+
+    // Build canonical payload (must match server exactly)
+    String payload = buildCanonicalPayload(
+      appId,
+      channel,
+      platform,
+      version,
+      sha256,
+      size,
+      minNativeBuild,
+      signature.kid,
+      signature.iat,
+      signature.exp
+    );
+
+    // Decode base64url signature
+    byte[] sigBytes = base64UrlDecode(signature.sig);
+
+    // Verify with java.security
+    X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyEntry.derData);
+    KeyFactory keyFactory = KeyFactory.getInstance("EC");
+    PublicKey verificationKey = keyFactory.generatePublic(keySpec);
+
+    Signature verifier = Signature.getInstance("SHA256withECDSA");
+    verifier.initVerify(verificationKey);
+    verifier.update(payload.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+
+    if (!verifier.verify(sigBytes)) {
+      throw new IllegalStateException("Manifest signature verification failed");
+    }
+  }
+
+  private static String buildCanonicalPayload(
+    String appId,
+    String channel,
+    String platform,
+    String version,
+    String sha256,
+    int size,
+    Integer minNativeBuild,
+    String kid,
+    int iat,
+    int exp
+  ) {
+    String minBuildStr = minNativeBuild != null ? String.valueOf(minNativeBuild) : "null";
+    return (
+      "MANIFEST_V1\n" +
+      "appId:" +
+      appId +
+      "\n" +
+      "channel:" +
+      (channel != null ? channel : "null") +
+      "\n" +
+      "platform:" +
+      platform +
+      "\n" +
+      "version:" +
+      version +
+      "\n" +
+      "sha256:" +
+      sha256 +
+      "\n" +
+      "size:" +
+      size +
+      "\n" +
+      "minNativeBuild:" +
+      minBuildStr +
+      "\n" +
+      "kid:" +
+      kid +
+      "\n" +
+      "iat:" +
+      iat +
+      "\n" +
+      "exp:" +
+      exp
+    );
+  }
+
+  private static byte[] base64UrlDecode(String input) {
+    // Convert base64url to standard base64
+    String base64 = input.replace('-', '+').replace('_', '/');
+    int remainder = base64.length() % 4;
+    if (remainder > 0) {
+      base64 += "====".substring(remainder);
+    }
+    return Base64.decode(base64, Base64.DEFAULT);
+  }
+}

package/android/src/main/java/com/updatekit/updater/StatsClient.java

@@ -0,0 +1,80 @@
+package com.updatekit.updater;
+
+import java.io.OutputStream;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import org.json.JSONObject;
+
+final class StatsClient {
+
+  private static final ExecutorService executor = Executors.newSingleThreadExecutor();
+
+  private StatsClient() {}
+
+  static void send(
+    String updateUrl,
+    String appId,
+    String platform,
+    String action,
+    String bundleVersion,
+    String channel,
+    String releaseId,
+    String nativeBuild,
+    String errorMessage
+  ) {
+    executor.execute(() -> {
+      HttpURLConnection connection = null;
+      try {
+        String base = updateUrl.replaceAll("/+$", "");
+        URL url = new URL(base + "/stats");
+
+        JSONObject payload = new JSONObject();
+        payload.put("platform", platform);
+        payload.put("action", action);
+        if (bundleVersion != null) {
+          payload.put("bundleVersion", bundleVersion);
+        }
+        if (channel != null && !channel.isEmpty()) {
+          payload.put("channel", channel);
+        }
+        if (releaseId != null && !releaseId.isEmpty()) {
+          payload.put("releaseId", releaseId);
+        }
+        if (nativeBuild != null) {
+          payload.put("nativeBuild", nativeBuild);
+        }
+        if (errorMessage != null) {
+          String truncated =
+            errorMessage.length() > 500 ? errorMessage.substring(0, 500) : errorMessage;
+          payload.put("errorMessage", truncated);
+        }
+
+        byte[] body = payload.toString().getBytes(StandardCharsets.UTF_8);
+
+        connection = (HttpURLConnection) url.openConnection();
+        connection.setRequestMethod("POST");
+        connection.setRequestProperty("X-App-Id", appId);
+        connection.setRequestProperty("Content-Type", "application/json");
+        connection.setConnectTimeout(10_000);
+        connection.setReadTimeout(10_000);
+        connection.setDoOutput(true);
+
+        try (OutputStream output = connection.getOutputStream()) {
+          output.write(body);
+        }
+
+        // Fire and forget - just trigger the request
+        connection.getResponseCode();
+      } catch (Exception ignored) {
+        // Stats are best-effort, don't fail on errors
+      } finally {
+        if (connection != null) {
+          connection.disconnect();
+        }
+      }
+    });
+  }
+}