@rovq/react-native 0.0.0-stage → 0.2.0

package/ios/Engine/EngineState.swift

@@ -0,0 +1,119 @@
+import Foundation
+
+/// A release on the device, identified by its folder name and its signed sequence.
+public struct ReleaseRef: Codable, Equatable {
+    public let id: String
+    public let sequence: Int64
+}
+
+/// Waiting to be sent to the server. Device events are retried, so each has its own ID.
+public struct QueuedEvent: Codable, Equatable {
+    public let clientEventId: String
+    public let type: String
+    public let releaseId: String?
+    public let errorCode: String?
+    public let occurredAt: String
+}
+
+/// A release that failed its checks after downloading, and when it may be tried again.
+struct PostponedDownload: Codable, Equatable {
+    let releaseId: String
+    let attempts: Int
+    let until: TimeInterval
+}
+
+/// Everything the engine must remember across process deaths. It holds IDs and never full
+/// paths, because iOS moves an app's container whenever the app is updated.
+///
+/// A release moves from `downloaded` to `pending` to `trying` to `current`:
+/// - `downloaded`: verified and on disk, but nothing will load it until the app installs it.
+/// - `pending`: installed, and loads on the next JavaScript start.
+/// - `trying`: being loaded right now. If the next start finds it still here, it never
+///   confirmed that it works, so it is abandoned.
+/// - `current`: confirmed to work.
+/// - `previous`: the confirmed release before `current`, kept to go back to.
+struct EngineState: Codable, Equatable {
+    var deviceId: String
+    var binaryId: String
+    var runtimeVersion: String
+    var highestSequence: Int64 = 0
+    var current: ReleaseRef?
+    var previous: ReleaseRef?
+    var downloaded: ReleaseRef?
+    var pending: ReleaseRef?
+    var trying: ReleaseRef?
+    /// True if the app went to the background while `trying`, so a person probably closed it.
+    var backgroundedWhileTrying = false
+    /// How many more starts `trying` was given because it was closed before confirming.
+    var tryingRetries = 0
+    var postponed: PostponedDownload?
+    var revokedPublicKeys: Set<String> = []
+    var events: [QueuedEvent] = []
+
+    enum CodingKeys: String, CodingKey {
+        case deviceId, binaryId, runtimeVersion, highestSequence, current, previous, downloaded
+        case pending, trying, backgroundedWhileTrying, tryingRetries, postponed, revokedPublicKeys
+        case events
+    }
+
+    init(deviceId: String, binaryId: String, runtimeVersion: String) {
+        self.deviceId = deviceId
+        self.binaryId = binaryId
+        self.runtimeVersion = runtimeVersion
+    }
+
+    /// Fields added after the first version are optional, so an older saved state still loads.
+    init(from decoder: Decoder) throws {
+        let values = try decoder.container(keyedBy: CodingKeys.self)
+        deviceId = try values.decode(String.self, forKey: .deviceId)
+        binaryId = try values.decode(String.self, forKey: .binaryId)
+        runtimeVersion = try values.decode(String.self, forKey: .runtimeVersion)
+        highestSequence = try values.decode(Int64.self, forKey: .highestSequence)
+        current = try values.decodeIfPresent(ReleaseRef.self, forKey: .current)
+        previous = try values.decodeIfPresent(ReleaseRef.self, forKey: .previous)
+        downloaded = try values.decodeIfPresent(ReleaseRef.self, forKey: .downloaded)
+        pending = try values.decodeIfPresent(ReleaseRef.self, forKey: .pending)
+        trying = try values.decodeIfPresent(ReleaseRef.self, forKey: .trying)
+        backgroundedWhileTrying =
+            try values.decodeIfPresent(Bool.self, forKey: .backgroundedWhileTrying) ?? false
+        tryingRetries = try values.decodeIfPresent(Int.self, forKey: .tryingRetries) ?? 0
+        postponed = try values.decodeIfPresent(PostponedDownload.self, forKey: .postponed)
+        revokedPublicKeys =
+            try values.decodeIfPresent(Set<String>.self, forKey: .revokedPublicKeys) ?? []
+        events = try values.decode([QueuedEvent].self, forKey: .events)
+    }
+}
+
+/// Saves the state so that a crash at any moment leaves either the old state or the new one,
+/// never a mixture. The app's first screen depends on this file being readable.
+struct EngineStateStore {
+    private let file: URL
+    private let temporary: URL
+
+    init(rootFolder: URL) {
+        file = rootFolder.appendingPathComponent("state.json")
+        temporary = rootFolder.appendingPathComponent("state.json.tmp")
+    }
+
+    /// Returns nil if there is no state, or if it is unreadable.
+    func read() -> EngineState? {
+        guard let data = try? Data(contentsOf: file) else { return nil }
+        return try? JSONDecoder().decode(EngineState.self, from: data)
+    }
+
+    func write(_ state: EngineState) throws {
+        // Writing to another file first means a crash cannot leave a half-written state.
+        let data = try JSONEncoder().encode(state)
+        guard FileManager.default.createFile(atPath: temporary.path, contents: nil) else {
+            throw RovqError(.storageFailed, "Could not save the engine state")
+        }
+        let handle = try FileHandle(forWritingTo: temporary)
+        defer { try? handle.close() }
+        try handle.write(contentsOf: data)
+        try handle.synchronize()
+        // POSIX rename replaces the old file atomically.
+        guard rename(temporary.path, file.path) == 0 else {
+            throw RovqError(.storageFailed, "Could not save the engine state")
+        }
+    }
+}

package/ios/Engine/ManifestVerifier.swift

@@ -0,0 +1,279 @@
+import CryptoKit
+import Foundation
+
+private let publicKeySize = 32
+private let signatureSize = 64
+private let platform = "IOS"
+private let streamFields: Set<String> = [
+    "version", "releaseId", "deploymentKey", "platform", "runtimeVersion", "binaryVersion",
+    "sequence", "mandatory",
+]
+/// Version 1 names one ZIP package. Version 2 lists files. See docs/file-packages.md.
+private let zipManifestFields = streamFields.union(["package"])
+private let filesManifestFields = streamFields.union(["files"])
+private let packageFields: Set<String> = ["hash", "size"]
+private let fileFields: Set<String> = ["path", "hash", "size"]
+private let uuidPattern = "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+private let hashPattern = "^[0-9a-f]{64}$"
+
+/// One file of a release made of files, from a verified manifest.
+public struct ManifestFile: Equatable {
+    public let path: String
+    public let hash: String
+    public let size: Int64
+}
+
+/// Facts from a manifest whose signature has been verified. Nothing else should be trusted.
+public struct VerifiedManifest: Equatable {
+    public let releaseId: String
+    public let sequence: Int64
+    public let mandatory: Bool
+    /// The ZIP package's hash. Empty for a release made of files.
+    public let packageHash: String
+    /// The ZIP package's size, or all files together.
+    public let packageSize: Int64
+    /// Set for a release made of files, sorted by path. Nil for a ZIP package.
+    public let files: [ManifestFile]?
+
+    init(
+        releaseId: String,
+        sequence: Int64,
+        mandatory: Bool,
+        packageHash: String,
+        packageSize: Int64,
+        files: [ManifestFile]? = nil
+    ) {
+        self.releaseId = releaseId
+        self.sequence = sequence
+        self.mandatory = mandatory
+        self.packageHash = packageHash
+        self.packageSize = packageSize
+        self.files = files
+    }
+}
+
+/// Decodes standard Base64, accepting only one spelling of each value, as the server does.
+func decodeStrictBase64(_ value: String, expectedSize: Int) -> Data? {
+    guard let data = Data(base64Encoded: value), data.count == expectedSize,
+        data.base64EncodedString() == value
+    else { return nil }
+    return data
+}
+
+/// The device's own security check. It trusts only the public keys built into the app, so
+/// a compromised server cannot get code onto the device.
+public final class ManifestVerifier {
+    private let keys: [String: Curve25519.Signing.PublicKey]
+    private let trustedKeys: [String: String]
+    private let revokedLock = NSLock()
+    private var revoked: Set<String> = []
+    private let deploymentKey: String
+    private let runtimeVersion: String
+
+    /// - Parameter trustedKeys: key IDs and their Base64 Ed25519 public keys, built into the app.
+    /// - Throws: if a built-in key is malformed, which is a mistake in the app itself.
+    public init(trustedKeys: [String: String], deploymentKey: String, runtimeVersion: String) throws {
+        keys = try trustedKeys.mapValues { publicKey in
+            guard let bytes = decodeStrictBase64(publicKey, expectedSize: publicKeySize) else {
+                throw RovqError(.invalidManifest, "A built-in public key is not a Base64 Ed25519 key")
+            }
+            return try Curve25519.Signing.PublicKey(rawRepresentation: bytes)
+        }
+        self.trustedKeys = trustedKeys
+        self.deploymentKey = deploymentKey
+        self.runtimeVersion = runtimeVersion
+    }
+
+    /// Public keys, not IDs, so a later version of the app can reuse an ID with a new key.
+    public var revokedPublicKeys: Set<String> {
+        get {
+            revokedLock.lock()
+            defer { revokedLock.unlock() }
+            return revoked
+        }
+        set {
+            revokedLock.lock()
+            defer { revokedLock.unlock() }
+            revoked = newValue
+        }
+    }
+
+    /// Checks a key's statement that it must no longer be trusted, and returns its public key.
+    /// Only the key's own signature counts, so a stolen key can revoke only itself. Comparing the
+    /// exact text means nothing unsigned reaches a parser.
+    ///
+    /// - Returns: nil if the statement is not valid, in which case it must be ignored.
+    public func verifyRevocation(keyId: String, statement: String, signature: String) -> String? {
+        guard let publicKey = trustedKeys[keyId],
+            statement == "{\"version\":1,\"type\":\"key-revocation\",\"publicKey\":\"\(publicKey)\"}",
+            (try? verifySignature(manifest: statement, signature: signature, keyId: keyId)) != nil
+        else { return nil }
+        return publicKey
+    }
+
+    /// - Parameter highestSequence: the highest sequence this device has accepted in this stream.
+    /// - Throws: `RovqError` if anything fails. The device must then ignore the update.
+    public func verify(
+        manifest: String,
+        signature: String,
+        keyId: String,
+        highestSequence: Int64
+    ) throws -> VerifiedManifest {
+        if let publicKey = trustedKeys[keyId], revokedPublicKeys.contains(publicKey) {
+            throw RovqError(.revokedSigningKey, "Signing key \(keyId) was revoked")
+        }
+        try verifySignature(manifest: manifest, signature: signature, keyId: keyId)
+        // Only signed text reaches the JSON parser.
+        let verified = try parseAndCheck(manifest)
+        if verified.sequence <= highestSequence {
+            throw RovqError(.staleSequence, "Sequence \(verified.sequence) is not above \(highestSequence)")
+        }
+        return verified
+    }
+
+    private func verifySignature(manifest: String, signature: String, keyId: String) throws {
+        guard let key = keys[keyId] else {
+            throw RovqError(.unknownSigningKey, "Unknown signing key \(keyId)")
+        }
+        guard let bytes = decodeStrictBase64(signature, expectedSize: signatureSize) else {
+            throw RovqError(.invalidSignature, "Malformed signature")
+        }
+        guard key.isValidSignature(bytes, for: Data(manifest.utf8)) else {
+            throw RovqError(.invalidSignature, "Signature does not match")
+        }
+    }
+
+    private func parseAndCheck(_ manifest: String) throws -> VerifiedManifest {
+        let parsed = try? JSONSerialization.jsonObject(with: Data(manifest.utf8))
+        guard let root = parsed as? [String: Any] else {
+            throw invalid("Manifest is not a JSON object")
+        }
+        let version = try integerField(root, "version")
+        guard version == 1 || version == 2 else { throw invalid("Unknown manifest version") }
+        try requireOnlyFields(root, allowed: version == 1 ? zipManifestFields : filesManifestFields)
+
+        let releaseId = try stringField(root, "releaseId")
+        // Later used as a folder name, so it must be exactly a UUID.
+        guard matches(releaseId, uuidPattern) else { throw invalid("releaseId is not a UUID") }
+
+        let sequence = try integerField(root, "sequence")
+        guard sequence > 0 else { throw invalid("sequence must be positive") }
+
+        guard let mandatoryNumber = root["mandatory"] as? NSNumber, isBoolean(mandatoryNumber) else {
+            throw invalid("mandatory must be a boolean")
+        }
+        _ = try stringField(root, "binaryVersion")
+
+        // A valid signature for another deployment, platform or runtime must not install here.
+        try requireMatch("deploymentKey", try stringField(root, "deploymentKey"), deploymentKey)
+        try requireMatch("platform", try stringField(root, "platform"), platform)
+        try requireMatch("runtimeVersion", try stringField(root, "runtimeVersion"), runtimeVersion)
+
+        if version == 2 {
+            let files = try fileList(root["files"])
+            return VerifiedManifest(
+                releaseId: releaseId,
+                sequence: sequence,
+                mandatory: mandatoryNumber.boolValue,
+                packageHash: "",
+                packageSize: files.reduce(0) { $0 + $1.size },
+                files: files
+            )
+        }
+
+        guard let package = root["package"] as? [String: Any] else {
+            throw invalid("package must be an object")
+        }
+        try requireOnlyFields(package, allowed: packageFields)
+        let hash = try stringField(package, "hash")
+        guard matches(hash, hashPattern) else { throw invalid("package hash is malformed") }
+        let size = try integerField(package, "size")
+        guard size > 0 else { throw invalid("package size must be positive") }
+
+        return VerifiedManifest(
+            releaseId: releaseId,
+            sequence: sequence,
+            mandatory: mandatoryNumber.boolValue,
+            packageHash: hash,
+            packageSize: size
+        )
+    }
+
+    /// The same rules as a ZIP package, because each path is written to disk the same way.
+    /// Sorted by UTF-16 code units, as JavaScript sorts, so one set of files has one signed form.
+    private func fileList(_ value: Any?) throws -> [ManifestFile] {
+        guard let list = value as? [Any] else { throw invalid("files must be an array") }
+        if list.isEmpty || list.count > PackageRules.maxEntries {
+            throw invalid("A package must have from 1 to \(PackageRules.maxEntries) files")
+        }
+        var files: [ManifestFile] = []
+        var seen = Set<String>()
+        var total: Int64 = 0
+        for item in list {
+            guard let entry = item as? [String: Any] else { throw invalid("Each file must be an object") }
+            try requireOnlyFields(entry, allowed: fileFields)
+            let path = try stringField(entry, "path")
+            if let problem = PackageRules.findPathProblem(path) {
+                throw invalid("The file \(path) \(problem)")
+            }
+            if let previous = files.last, !Array(previous.path.utf16).lexicographicallyPrecedes(path.utf16) {
+                throw invalid("The files must be sorted by path, each path once")
+            }
+            if !seen.insert(PackageRules.pathIdentity(path)).inserted {
+                throw invalid("The file \(path) differs from another only by letter case")
+            }
+            let hash = try stringField(entry, "hash")
+            guard matches(hash, hashPattern) else { throw invalid("The file \(path) has a malformed hash") }
+            let size = try integerField(entry, "size")
+            // Bounded before adding, because an overflow would stop the app.
+            guard size >= 0, size <= PackageRules.maxTotalSize else {
+                throw invalid("The file \(path) has an invalid size")
+            }
+            total += size
+            if total > PackageRules.maxTotalSize { throw invalid("The files are larger than the allowed total") }
+            files.append(ManifestFile(path: path, hash: hash, size: size))
+        }
+        guard let bundle = files.first(where: { $0.path == PackageRules.bundleFileName }) else {
+            throw invalid("The bundle file is missing")
+        }
+        if bundle.size == 0 { throw invalid("The bundle file is empty") }
+        return files
+    }
+
+    private func matches(_ value: String, _ pattern: String) -> Bool {
+        value.range(of: pattern, options: .regularExpression) != nil
+    }
+
+    private func requireOnlyFields(_ value: [String: Any], allowed: Set<String>) throws {
+        if let unknown = value.keys.first(where: { !allowed.contains($0) }) {
+            throw invalid("Unknown field \(unknown)")
+        }
+    }
+
+    private func stringField(_ value: [String: Any], _ name: String) throws -> String {
+        guard let text = value[name] as? String else { throw invalid("\(name) must be a string") }
+        return text
+    }
+
+    // JSON numbers and booleans both arrive as NSNumber, so they must be told apart.
+    private func integerField(_ value: [String: Any], _ name: String) throws -> Int64 {
+        guard let number = value[name] as? NSNumber, !isBoolean(number),
+            number.doubleValue == Double(number.int64Value)
+        else { throw invalid("\(name) must be a whole number") }
+        return number.int64Value
+    }
+
+    private func isBoolean(_ number: NSNumber) -> Bool {
+        CFGetTypeID(number) == CFBooleanGetTypeID()
+    }
+
+    private func requireMatch(_ name: String, _ actual: String, _ expected: String) throws {
+        if actual != expected {
+            throw RovqError(.manifestMismatch, "\(name) does not match this app")
+        }
+    }
+
+    private func invalid(_ message: String) -> RovqError {
+        RovqError(.invalidManifest, message)
+    }
+}

package/ios/Engine/PackageDownloader.swift

@@ -0,0 +1,249 @@
+import CryptoKit
+import Foundation
+
+private let requestTimeout: TimeInterval = 30
+
+/// Downloads a package and proves it is the signed one. HTTPS protects the transfer, but the
+/// hash is what makes the file trustworthy.
+public final class PackageDownloader {
+    private let allowInsecureURLs: Bool
+    /// Room left in a folder. Replaced in tests.
+    let freeSpace: (URL) -> Int64
+
+    /// - Parameter allowInsecureURLs: allows http:// for local development only.
+    public init(
+        allowInsecureURLs: Bool = false,
+        freeSpace: @escaping (URL) -> Int64 = PackageDownloader.availableSpace
+    ) {
+        self.allowInsecureURLs = allowInsecureURLs
+        self.freeSpace = freeSpace
+    }
+
+    public static func availableSpace(in folder: URL) -> Int64 {
+        let values = try? folder.resourceValues(forKeys: [.volumeAvailableCapacityForImportantUsageKey])
+        return values?.volumeAvailableCapacityForImportantUsage ?? Int64.max
+    }
+
+    /// Blocks until finished, so call it away from the main thread. Continues from what `target`
+    /// already holds, because on a poor connection a large file might otherwise never finish. A
+    /// network failure keeps the file for that reason. Any other failure deletes it. It counts as
+    /// good only once the whole file matches the signed hash, so a partial or wrong file can
+    /// never be mistaken for a good one.
+    ///
+    /// - Parameters:
+    ///   - hash: the signed SHA-256 of the whole file.
+    ///   - size: the signed size of the whole file.
+    ///   - extraSpace: room needed beyond the file itself, such as for extracting it.
+    ///   - onProgress: receives bytes received so far and the total.
+    func download(
+        url: String,
+        hash: String,
+        size: Int64,
+        target: URL,
+        extraSpace: Int64 = 0,
+        onProgress: @escaping (Int64, Int64) -> Void = { _, _ in }
+    ) throws {
+        let expected = Expected(hash: hash, size: size)
+        do {
+            try downloadToFile(
+                url: url, expected: expected, target: target, extraSpace: extraSpace, onProgress: onProgress)
+        } catch {
+            if (error as? RovqError)?.code != .downloadFailed {
+                try? FileManager.default.removeItem(at: target)
+            }
+            throw error
+        }
+    }
+
+    /// The signed facts a download must end up matching.
+    private struct Expected {
+        let hash: String
+        let size: Int64
+    }
+
+    private func downloadToFile(
+        url: String,
+        expected: Expected,
+        target: URL,
+        extraSpace: Int64,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        guard let parsed = URL(string: url), let scheme = parsed.scheme?.lowercased() else {
+            throw RovqError(.downloadFailed, "Malformed download URL")
+        }
+        if scheme != "https" && !allowInsecureURLs {
+            throw RovqError(.insecureURL, "Download URL must use HTTPS")
+        }
+
+        var digest = SHA256()
+        let existing = try readExisting(target: target, expected: expected, digest: &digest)
+        let needed = expected.size - existing + extraSpace
+        if freeSpace(target.deletingLastPathComponent()) < needed {
+            throw RovqError(.storageFailed, "Not enough free space for this update")
+        }
+        if existing == expected.size {
+            // An empty file has nothing to download, but must still exist.
+            if existing == 0, !FileManager.default.createFile(atPath: target.path, contents: nil) {
+                throw RovqError(.storageFailed, "Could not create the file")
+            }
+            try verifyHash(digest, expected: expected)
+            return
+        }
+        if existing == 0, !FileManager.default.createFile(atPath: target.path, contents: nil) {
+            throw RovqError(.storageFailed, "Could not create the file")
+        }
+        guard let output = try? FileHandle(forWritingTo: target) else {
+            throw RovqError(.storageFailed, "Could not create the file")
+        }
+        defer { try? output.close() }
+
+        let delegate = DownloadDelegate(
+            expectedSize: expected.size,
+            existing: existing,
+            digest: digest,
+            output: output,
+            onProgress: onProgress
+        )
+        var request = URLRequest(url: parsed)
+        if existing > 0 { request.setValue("bytes=\(existing)-", forHTTPHeaderField: "Range") }
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.timeoutIntervalForRequest = requestTimeout
+        let session = URLSession(configuration: configuration, delegate: delegate, delegateQueue: nil)
+        session.dataTask(with: request).resume()
+        delegate.finished.wait()
+        session.finishTasksAndInvalidate()
+
+        if delegate.discardFile { try? FileManager.default.removeItem(at: target) }
+        if let failure = delegate.failure { throw failure }
+
+        do {
+            // Forces the bytes to disk, so power loss cannot leave a file that looks complete.
+            try output.synchronize()
+        } catch {
+            throw RovqError(.storageFailed, "Could not write the file")
+        }
+        // A lost connection can look like a normal end of file, so a short download counts as
+        // a network failure, which is worth retrying.
+        if delegate.received < expected.size {
+            throw RovqError(.downloadFailed, "The download ended early")
+        }
+        try verifyHash(delegate.digest, expected: expected)
+    }
+
+    /// Returns how many bytes are already there, after adding them to `digest`.
+    private func readExisting(target: URL, expected: Expected, digest: inout SHA256) throws -> Int64 {
+        let files = FileManager.default
+        guard files.fileExists(atPath: target.path),
+            let size = (try? files.attributesOfItem(atPath: target.path))?[.size] as? Int64
+        else { return 0 }
+        if size > expected.size {
+            try? files.removeItem(at: target)
+            return 0
+        }
+        guard let input = try? FileHandle(forReadingFrom: target) else { return 0 }
+        defer { try? input.close() }
+        while let chunk = try? input.read(upToCount: 64 * 1024), !chunk.isEmpty {
+            digest.update(data: chunk)
+        }
+        return size
+    }
+
+    private func verifyHash(_ digest: SHA256, expected: Expected) throws {
+        let hash = digest.finalize().map { String(format: "%02x", $0) }.joined()
+        if hash != expected.hash {
+            throw RovqError(.hashMismatch, "Download does not match the signed hash")
+        }
+    }
+}
+
+/// Handles the bytes as they arrive, which allows stopping as soon as something is wrong.
+private final class DownloadDelegate: NSObject, URLSessionDataDelegate {
+    let finished = DispatchSemaphore(value: 0)
+    private(set) var failure: RovqError?
+    private(set) var received: Int64
+    private(set) var digest: SHA256
+    /// True when appending to the existing file could only produce a wrong file.
+    private(set) var discardFile = false
+    private let existing: Int64
+    private let expectedSize: Int64
+    private let output: FileHandle
+    private let onProgress: (Int64, Int64) -> Void
+
+    init(
+        expectedSize: Int64,
+        existing: Int64,
+        digest: SHA256,
+        output: FileHandle,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) {
+        self.expectedSize = expectedSize
+        self.existing = existing
+        self.received = existing
+        self.digest = digest
+        self.output = output
+        self.onProgress = onProgress
+    }
+
+    func urlSession(
+        _ session: URLSession,
+        dataTask: URLSessionDataTask,
+        didReceive response: URLResponse,
+        completionHandler: @escaping (URLSession.ResponseDisposition) -> Void
+    ) {
+        let http = response as? HTTPURLResponse
+        let status = http?.statusCode ?? 0
+        do {
+            if existing > 0 && status == 206 {
+                let range = http?.value(forHTTPHeaderField: "Content-Range") ?? ""
+                guard range.hasPrefix("bytes \(existing)-") else {
+                    discardFile = true
+                    failure = RovqError(.downloadFailed, "The server continued from the wrong place")
+                    completionHandler(.cancel)
+                    return
+                }
+                try output.seekToEnd()
+                completionHandler(.allow)
+            } else if status == 200 {
+                // The server sent the whole file, whether or not a part was asked for.
+                digest = SHA256()
+                received = 0
+                try output.truncate(atOffset: 0)
+                completionHandler(.allow)
+            } else {
+                if status == 416 { discardFile = true }
+                failure = RovqError(.downloadFailed, "Server answered \(status)")
+                completionHandler(.cancel)
+            }
+        } catch {
+            failure = RovqError(.storageFailed, "Could not write the file")
+            completionHandler(.cancel)
+        }
+    }
+
+    func urlSession(_ session: URLSession, dataTask: URLSessionDataTask, didReceive data: Data) {
+        guard failure == nil else { return }
+        received += Int64(data.count)
+        // Stops at once, so a wrong server cannot fill the disk.
+        if received > expectedSize {
+            failure = RovqError(.sizeMismatch, "Download is larger than the signed size")
+            dataTask.cancel()
+            return
+        }
+        digest.update(data: data)
+        do {
+            try output.write(contentsOf: data)
+        } catch {
+            failure = RovqError(.storageFailed, "Could not write the file")
+            dataTask.cancel()
+            return
+        }
+        onProgress(received, expectedSize)
+    }
+
+    func urlSession(_ session: URLSession, task: URLSessionTask, didCompleteWithError error: Error?) {
+        if failure == nil, let error {
+            failure = RovqError(.downloadFailed, "Connection lost: \(error.localizedDescription)")
+        }
+        finished.signal()
+    }
+}

package/ios/Engine/PackageRules.swift

@@ -0,0 +1,38 @@
+import Foundation
+
+/// The same rules as packages/package-format/src/format.ts. The file
+/// packages/package-format/test/path-rules.json is checked against both, so a change on one
+/// side fails the tests until the other side matches.
+enum PackageRules {
+    static let bundleFileName = "main.jsbundle"
+    static let maxEntries = 10_000
+    static let maxTotalSize: Int64 = 2 * 1024 * 1024 * 1024
+    private static let maxPathLength = 512
+
+    /// Returns why a path is not allowed, or nil if it is fine.
+    static func findPathProblem(_ path: String) -> String? {
+        // Counted in UTF-16 units, as JavaScript does.
+        if path.isEmpty || path.utf16.count > maxPathLength { return "has an invalid length" }
+        if path.unicodeScalars.contains(where: { $0.value <= 0x1f || $0.value == 0x7f }) {
+            return "contains a control character"
+        }
+        if path.contains("\\") { return "contains a backslash" }
+        if path.hasPrefix("/") || path.range(of: "^[A-Za-z]:", options: .regularExpression) != nil {
+            return "is an absolute path"
+        }
+
+        let segments = path.components(separatedBy: "/")
+        if segments.contains(where: { $0.isEmpty || $0 == "." || $0 == ".." }) {
+            return "contains an empty, \".\" or \"..\" segment"
+        }
+        if path == bundleFileName { return nil }
+        if segments.count < 2 { return "is not the bundle file" }
+        return segments[0] == "assets" ? nil : "is outside the assets folder"
+    }
+
+    /// The same name in another letter case or Unicode form is one file on some file systems.
+    /// The default iOS file system is one of them.
+    static func pathIdentity(_ path: String) -> String {
+        path.precomposedStringWithCanonicalMapping.lowercased()
+    }
+}