@rovq/react-native 0.0.0-stage → 0.2.0

package/ios/Engine/SafePackageExtractor.swift

@@ -0,0 +1,107 @@
+import Foundation
+
+/// Extracts a package without trusting it, even though its signature was already verified.
+/// If a signing key ever leaks, this keeps an attacker inside the package folder, so the
+/// files of the app itself stay out of reach.
+struct SafePackageExtractor {
+    /// - Parameter destination: an empty folder that only this extraction uses.
+    func extract(packageFile: URL, destination: URL) throws {
+        do {
+            let reader = try ZipReader(url: packageFile)
+            try extractEntries(reader, destination: destination)
+        } catch let error as ZipError {
+            throw invalid(error.message)
+        }
+    }
+
+    private func extractEntries(_ reader: ZipReader, destination: URL) throws {
+        let root = destination.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+        var seen = Set<String>()
+        var hasBundle = false
+        var totalSize: Int64 = 0
+
+        if reader.entries.count > PackageRules.maxEntries { throw invalid("Too many files") }
+
+        for entry in reader.entries {
+            if entry.isFolder { throw invalid("Folder entries are not allowed") }
+            if let problem = PackageRules.findPathProblem(entry.name) {
+                throw invalid("The file \(entry.name) \(problem)")
+            }
+            if !seen.insert(PackageRules.pathIdentity(entry.name)).inserted {
+                throw invalid("The file \(entry.name) appears more than once")
+            }
+
+            let target = destination.appendingPathComponent(entry.name)
+            // A second, independent check: whatever the rules allow, the real path must stay
+            // inside the folder.
+            let parent = target.deletingLastPathComponent()
+            try createFolder(parent)
+            let resolved = parent.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+            if !resolved.hasPrefix(root) { throw invalid("The file \(entry.name) leaves the folder") }
+
+            let written = try write(
+                entry,
+                from: reader,
+                to: target,
+                allowance: PackageRules.maxTotalSize - totalSize
+            )
+            totalSize += written
+            if entry.name == PackageRules.bundleFileName {
+                if written == 0 { throw invalid("The bundle file is empty") }
+                hasBundle = true
+            }
+        }
+        if !hasBundle { throw invalid("The bundle file is missing") }
+    }
+
+    private func write(
+        _ entry: ZipEntry,
+        from reader: ZipReader,
+        to target: URL,
+        allowance: Int64
+    ) throws -> Int64 {
+        guard FileManager.default.createFile(atPath: target.path, contents: nil) else {
+            throw RovqError(.storageFailed, "Could not create \(entry.name)")
+        }
+        let output: FileHandle
+        do {
+            output = try FileHandle(forWritingTo: target)
+        } catch {
+            throw RovqError(.storageFailed, "Could not create \(entry.name)")
+        }
+        defer { try? output.close() }
+
+        let written: Int64
+        do {
+            written = try reader.extract(entry, allowance: allowance) { chunk in
+                do {
+                    try output.write(contentsOf: chunk)
+                } catch {
+                    throw RovqError(.storageFailed, "Could not write \(entry.name)")
+                }
+            }
+            // Forces the bytes to disk, because the release becomes active by renaming its
+            // folder, and that rename must not outrun the data.
+            try output.synchronize()
+        } catch let error as RovqError {
+            throw error
+        } catch let error as ZipError {
+            throw error
+        } catch {
+            throw RovqError(.storageFailed, "Could not write \(entry.name)")
+        }
+        return written
+    }
+
+    private func createFolder(_ url: URL) throws {
+        do {
+            try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
+        } catch {
+            throw RovqError(.storageFailed, "Could not create \(url.lastPathComponent)")
+        }
+    }
+
+    private func invalid(_ message: String) -> RovqError {
+        RovqError(.invalidPackage, message)
+    }
+}

package/ios/Engine/UpdateInstaller.swift

@@ -0,0 +1,348 @@
+import CryptoKit
+import Foundation
+
+// Download links last an hour, so they are fetched a few files at a time, just before use.
+private let linkBatchSize = 20
+private let emptyFileHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+
+/// What the server offered. None of this is trusted until the manifest has been verified.
+public struct OfferedUpdate: Equatable {
+    public let manifest: String
+    public let signature: String
+    public let keyId: String
+    /// Only for a ZIP package. A release made of files is fetched file by file.
+    public let downloadURL: String?
+
+    public init(manifest: String, signature: String, keyId: String, downloadURL: String?) {
+        self.manifest = manifest
+        self.signature = signature
+        self.keyId = keyId
+        self.downloadURL = downloadURL
+    }
+}
+
+/// A verified release, fully extracted in its own folder.
+public struct InstalledRelease: Equatable {
+    public let manifest: VerifiedManifest
+    public let folder: URL
+    public let bundleFile: URL
+}
+
+/// Asks the server for download links, by hash, for files of one release.
+public typealias FileLinks = (_ releaseId: String, _ hashes: [String]) throws -> [String: String]
+
+/// Takes an offered update to a verified folder on disk, without activating it.
+///
+/// Each release gets its own folder, which keeps the design the same as Android, and makes
+/// the final rename what decides that a release is complete.
+public final class UpdateInstaller {
+    private let updatesFolder: URL
+    private let workFolder: URL
+    // Outside the work folder, because a partial download must survive a failure or a restart.
+    private let partialFolder: URL
+    /// The app's own files, where assets sit at the same paths as in a package.
+    private let builtInFolder: URL?
+    private let verifier: ManifestVerifier
+    private let downloader: PackageDownloader
+    private let extractor = SafePackageExtractor()
+    private let lock = NSLock()
+
+    /// - Parameters:
+    ///   - rootFolder: a folder only the engine uses, inside the app's private storage.
+    ///   - builtInFolder: the app bundle, whose files can be reused instead of downloaded.
+    public init(
+        rootFolder: URL,
+        verifier: ManifestVerifier,
+        downloader: PackageDownloader,
+        builtInFolder: URL? = nil
+    ) {
+        updatesFolder = rootFolder.appendingPathComponent("updates")
+        workFolder = rootFolder.appendingPathComponent("work")
+        partialFolder = rootFolder.appendingPathComponent("partial")
+        self.builtInFolder = builtInFolder
+        self.verifier = verifier
+        self.downloader = downloader
+    }
+
+    /// - Parameters:
+    ///   - highestSequence: the highest sequence this device has accepted in this stream.
+    ///   - fileLinks: download links for a release made of files.
+    /// - Throws: `RovqError` if any step fails. Nothing is left behind in that case.
+    public func install(
+        offer: OfferedUpdate,
+        highestSequence: Int64,
+        fileLinks: FileLinks = { _, _ in throw RovqError(.downloadFailed, "No way to fetch files") },
+        onProgress: @escaping (Int64, Int64) -> Void = { _, _ in }
+    ) throws -> InstalledRelease {
+        lock.lock()
+        defer { lock.unlock() }
+
+        // Verified first, so an unsigned update causes no network traffic or disk use.
+        let manifest = try verifier.verify(
+            manifest: offer.manifest,
+            signature: offer.signature,
+            keyId: offer.keyId,
+            highestSequence: highestSequence
+        )
+
+        let folder = updatesFolder.appendingPathComponent(manifest.releaseId, isDirectory: true)
+        // Folders appear only through the atomic rename below, so one that exists is complete.
+        var isFolder: ObjCBool = false
+        if !FileManager.default.fileExists(atPath: folder.path, isDirectory: &isFolder) || !isFolder.boolValue {
+            if let files = manifest.files {
+                try installFileList(
+                    files, releaseId: manifest.releaseId, folder: folder, fileLinks: fileLinks,
+                    onProgress: onProgress)
+            } else {
+                try installZip(offer: offer, manifest: manifest, folder: folder, onProgress: onProgress)
+            }
+        }
+        return InstalledRelease(
+            manifest: manifest,
+            folder: folder,
+            bundleFile: folder.appendingPathComponent(PackageRules.bundleFileName)
+        )
+    }
+
+    /// Creates an empty work folder for assembling a release, and the folders around it.
+    private func startWork() throws -> URL {
+        let files = FileManager.default
+        // Removes anything an earlier run left when the app was killed or the phone lost power.
+        try? files.removeItem(at: workFolder)
+        let assembled = workFolder.appendingPathComponent("extracted", isDirectory: true)
+        do {
+            try files.createDirectory(at: assembled, withIntermediateDirectories: true)
+            try files.createDirectory(at: updatesFolder, withIntermediateDirectories: true)
+            try files.createDirectory(at: partialFolder, withIntermediateDirectories: true)
+        } catch {
+            throw RovqError(.storageFailed, "Could not create the engine folders")
+        }
+        return assembled
+    }
+
+    /// Only the current offer is worth finishing.
+    private func removePartialFiles(except keep: Set<String>) {
+        let files = FileManager.default
+        for file in (try? files.contentsOfDirectory(at: partialFolder, includingPropertiesForKeys: nil)) ?? []
+        where !keep.contains(file.lastPathComponent) {
+            try? files.removeItem(at: file)
+        }
+    }
+
+    private func moveIntoPlace(_ assembled: URL, _ folder: URL) throws {
+        do {
+            try FileManager.default.moveItem(at: assembled, to: folder)
+        } catch {
+            throw RovqError(.storageFailed, "Could not move the release into place")
+        }
+    }
+
+    private func installZip(
+        offer: OfferedUpdate,
+        manifest: VerifiedManifest,
+        folder: URL,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        guard let downloadURL = offer.downloadURL else {
+            throw RovqError(.downloadFailed, "The server sent no download URL")
+        }
+        let extracted = try startWork()
+        defer { try? FileManager.default.removeItem(at: workFolder) }
+
+        let packageFile = partialFolder.appendingPathComponent("\(manifest.packageHash).zip")
+        removePartialFiles(except: [packageFile.lastPathComponent])
+        do {
+            // Extracting needs room too, and its size is unknown until then, so this asks for
+            // the package twice. A package can still expand further, and extraction reports that.
+            try downloader.download(
+                url: downloadURL,
+                hash: manifest.packageHash,
+                size: manifest.packageSize,
+                target: packageFile,
+                extraSpace: manifest.packageSize,
+                onProgress: onProgress
+            )
+            try extractor.extract(packageFile: packageFile, destination: extracted)
+            try moveIntoPlace(extracted, folder)
+            try? FileManager.default.removeItem(at: packageFile)
+        } catch {
+            // A file that failed anything but the network is not worth continuing from.
+            if (error as? RovqError)?.code != .downloadFailed {
+                try? FileManager.default.removeItem(at: packageFile)
+            }
+            throw error
+        }
+    }
+
+    /// Builds a release from its files: each comes from a kept release, from the app itself,
+    /// or from the network, in that order, and only after its content matches the signed hash.
+    /// See docs/file-packages.md.
+    private func installFileList(
+        _ list: [ManifestFile],
+        releaseId: String,
+        folder: URL,
+        fileLinks: FileLinks,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        let files = FileManager.default
+        let assembled = try startWork()
+        defer { try? files.removeItem(at: workFolder) }
+        removePartialFiles(except: Set(list.map(\.hash)))
+        let root = assembled.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+
+        // A hash already placed, so the same content at another path is linked, not fetched.
+        var placed: [String: URL] = [:]
+        // Files with no local copy at their own path. Another path may still provide them.
+        var unresolved: [(file: ManifestFile, target: URL)] = []
+
+        for file in list {
+            let target = assembled.appendingPathComponent(file.path)
+            let parent = target.deletingLastPathComponent()
+            do {
+                try files.createDirectory(at: parent, withIntermediateDirectories: true)
+            } catch {
+                throw RovqError(.storageFailed, "Could not create a folder")
+            }
+            // A second, independent check: whatever the rules allow, the real path must stay
+            // inside the folder.
+            let resolved = parent.resolvingSymlinksInPath().standardizedFileURL.path + "/"
+            if !resolved.hasPrefix(root) {
+                throw RovqError(.invalidPackage, "The file \(file.path) leaves the folder")
+            }
+
+            if let source = placed[file.hash] {
+                try link(source, to: target)
+            } else if file.size == 0 {
+                guard file.hash == emptyFileHash else {
+                    throw RovqError(.hashMismatch, "An empty file does not match its signed hash")
+                }
+                guard files.createFile(atPath: target.path, contents: nil) else {
+                    throw RovqError(.storageFailed, "Could not create the file")
+                }
+                placed[file.hash] = target
+            } else if let local = findLocalCopy(of: file, excluding: folder) {
+                if local.isOwn {
+                    try link(local.url, to: target)
+                } else {
+                    // On APFS a copy shares the blocks until either side changes, so it is free.
+                    try copy(local.url, to: target)
+                }
+                placed[file.hash] = target
+            } else {
+                unresolved.append((file, target))
+            }
+        }
+
+        // Files to download, by hash, with every path that needs each one, in manifest order.
+        var targets: [String: [URL]] = [:]
+        var missing: [ManifestFile] = []
+        for (file, target) in unresolved {
+            if let source = placed[file.hash] {
+                try link(source, to: target)
+            } else if targets[file.hash] != nil {
+                targets[file.hash]!.append(target)
+            } else {
+                targets[file.hash] = [target]
+                missing.append(file)
+            }
+        }
+
+        try download(missing, targets: targets, releaseId: releaseId, fileLinks: fileLinks, onProgress: onProgress)
+
+        try moveIntoPlace(assembled, folder)
+        // Linked into the release, so the content stays where it is needed.
+        for file in missing {
+            try? files.removeItem(at: partialFolder.appendingPathComponent(file.hash))
+        }
+    }
+
+    private func download(
+        _ missing: [ManifestFile],
+        targets: [String: [URL]],
+        releaseId: String,
+        fileLinks: FileLinks,
+        onProgress: @escaping (Int64, Int64) -> Void
+    ) throws {
+        if missing.isEmpty { return }
+        let total = missing.reduce(Int64(0)) { $0 + $1.size }
+        // Checked for the whole release first, so a full disk fails before any download.
+        var remaining: Int64 = 0
+        for file in missing {
+            let partial = partialFolder.appendingPathComponent(file.hash)
+            remaining += file.size - min(fileSize(partial) ?? 0, file.size)
+        }
+        if downloader.freeSpace(partialFolder) < remaining {
+            throw RovqError(.storageFailed, "Not enough free space for this update")
+        }
+
+        var finished: Int64 = 0
+        onProgress(0, total)
+        for start in stride(from: 0, to: missing.count, by: linkBatchSize) {
+            let batch = Array(missing[start..<min(start + linkBatchSize, missing.count)])
+            let links = try fileLinks(releaseId, batch.map(\.hash))
+            for file in batch {
+                guard let url = links[file.hash] else {
+                    throw RovqError(.downloadFailed, "The server sent no link for a file")
+                }
+                let partial = partialFolder.appendingPathComponent(file.hash)
+                let before = finished
+                try downloader.download(url: url, hash: file.hash, size: file.size, target: partial) {
+                    received, _ in onProgress(before + received, total)
+                }
+                finished += file.size
+                for target in targets[file.hash] ?? [] { try link(partial, to: target) }
+            }
+        }
+    }
+
+    /// The same path in a kept release, or in the app itself, if its content is the signed one.
+    /// Hashed every time, because reusing a damaged file would break the new release.
+    private func findLocalCopy(of file: ManifestFile, excluding folder: URL) -> (url: URL, isOwn: Bool)? {
+        let releases =
+            (try? FileManager.default.contentsOfDirectory(at: updatesFolder, includingPropertiesForKeys: nil)) ?? []
+        var candidates = releases
+            .filter { $0.lastPathComponent != folder.lastPathComponent }
+            .map { ($0.appendingPathComponent(file.path), true) }
+        if let builtIn = builtInFolder {
+            candidates.append((builtIn.appendingPathComponent(file.path), false))
+        }
+        for (url, isOwn) in candidates where fileSize(url) == file.size && hashOf(url) == file.hash {
+            return (url, isOwn)
+        }
+        return nil
+    }
+
+    private func fileSize(_ url: URL) -> Int64? {
+        guard let attributes = try? FileManager.default.attributesOfItem(atPath: url.path),
+            attributes[.type] as? FileAttributeType == .typeRegular
+        else { return nil }
+        return (attributes[.size] as? NSNumber)?.int64Value
+    }
+
+    private func hashOf(_ url: URL) -> String? {
+        guard let input = try? FileHandle(forReadingFrom: url) else { return nil }
+        defer { try? input.close() }
+        var digest = SHA256()
+        while let chunk = try? input.read(upToCount: 1024 * 1024), !chunk.isEmpty {
+            digest.update(data: chunk)
+        }
+        return digest.finalize().map { String(format: "%02x", $0) }.joined()
+    }
+
+    /// A hard link costs no space. Files in a release never change, so sharing them is safe.
+    private func link(_ source: URL, to target: URL) throws {
+        do {
+            try FileManager.default.linkItem(at: source, to: target)
+        } catch {
+            try copy(source, to: target)
+        }
+    }
+
+    private func copy(_ source: URL, to target: URL) throws {
+        do {
+            try FileManager.default.copyItem(at: source, to: target)
+        } catch {
+            throw RovqError(.storageFailed, "Could not place a file")
+        }
+    }
+}

package/ios/Engine/UpdateService.swift

@@ -0,0 +1,185 @@
+import Foundation
+
+private let requestTimeout: TimeInterval = 30
+
+/// What the device tells the server when asking for updates.
+public struct CheckRequest: Equatable {
+    public let deploymentKey: String
+    public let deviceId: String
+    public let runtimeVersion: String
+    public let binaryVersion: String
+    public let currentReleaseId: String?
+    public let highestSequence: Int64
+}
+
+/// The server's answer. It is advice only, because `OfferedUpdate` is verified before use.
+public enum CheckResponse: Equatable {
+    case none
+    case rollback
+    case update(OfferedUpdate)
+}
+
+/// A key's signed statement that it must no longer be trusted. The engine verifies it.
+public struct KeyRevocation: Equatable {
+    public let keyId: String
+    public let statement: String
+    public let signature: String
+}
+
+public struct CheckAnswer: Equatable {
+    public let response: CheckResponse
+    public let revocations: [KeyRevocation]
+
+    public init(response: CheckResponse, revocations: [KeyRevocation] = []) {
+        self.response = response
+        self.revocations = revocations
+    }
+}
+
+/// The server API the engine needs, kept separate so tests can replace it.
+public protocol UpdateService {
+    /// - Throws: if the server cannot be reached or answers with an error.
+    func check(_ request: CheckRequest) throws -> CheckAnswer
+
+    /// - Throws: if the events could not be delivered.
+    func report(deploymentKey: String, deviceId: String, events: [QueuedEvent]) throws
+
+    /// Download links for files of a release made of files, by hash. Each file is checked
+    /// against the signed manifest, so the links are trusted for nothing.
+    ///
+    /// - Throws: if the server cannot be reached or answers with an error.
+    func fileLinks(deploymentKey: String, deviceId: String, releaseId: String, hashes: [String]) throws
+        -> [String: String]
+}
+
+public final class HTTPUpdateService: UpdateService {
+    private let apiURL: String
+    private let allowInsecureURLs: Bool
+
+    public init(apiURL: String, allowInsecureURLs: Bool = false) {
+        self.apiURL = apiURL
+        self.allowInsecureURLs = allowInsecureURLs
+    }
+
+    public func check(_ request: CheckRequest) throws -> CheckAnswer {
+        var body: [String: Any] = [
+            "deploymentKey": request.deploymentKey,
+            "deviceId": request.deviceId,
+            "platform": "IOS",
+            "runtimeVersion": request.runtimeVersion,
+            "binaryVersion": request.binaryVersion,
+            "highestSequence": request.highestSequence,
+            // Both a ZIP package and a list of files. See docs/file-packages.md.
+            "packageFormats": [1, 2],
+        ]
+        if let current = request.currentReleaseId { body["currentReleaseId"] = current }
+
+        let response = try post("/device/updates/check", body: body)
+        let revocations = readRevocations(response)
+        switch response["action"] as? String {
+        case "NONE":
+            return CheckAnswer(response: .none, revocations: revocations)
+        case "ROLLBACK":
+            return CheckAnswer(response: .rollback, revocations: revocations)
+        case "UPDATE":
+            // A release made of files has no single download URL.
+            guard let update = response["update"] as? [String: Any],
+                let manifest = update["manifest"] as? String,
+                let signature = update["signature"] as? String,
+                let keyId = update["keyId"] as? String
+            else { throw RovqError(.downloadFailed, "The server sent an unreadable response") }
+            let downloadURL = update["downloadUrl"] as? String
+            return CheckAnswer(
+                response: .update(
+                    OfferedUpdate(manifest: manifest, signature: signature, keyId: keyId, downloadURL: downloadURL)),
+                revocations: revocations
+            )
+        default:
+            throw RovqError(.downloadFailed, "The server sent an unknown action")
+        }
+    }
+
+    private func readRevocations(_ response: [String: Any]) -> [KeyRevocation] {
+        let list = response["revokedKeys"] as? [[String: Any]] ?? []
+        return list.compactMap { item in
+            guard let keyId = item["keyId"] as? String,
+                let statement = item["statement"] as? String,
+                let signature = item["signature"] as? String
+            else { return nil }
+            return KeyRevocation(keyId: keyId, statement: statement, signature: signature)
+        }
+    }
+
+    public func report(deploymentKey: String, deviceId: String, events: [QueuedEvent]) throws {
+        let list: [[String: Any]] = events.map { event in
+            var json: [String: Any] = [
+                "clientEventId": event.clientEventId,
+                "type": event.type,
+                "occurredAt": event.occurredAt,
+            ]
+            if let releaseId = event.releaseId { json["releaseId"] = releaseId }
+            if let errorCode = event.errorCode { json["errorCode"] = errorCode }
+            return json
+        }
+        _ = try post(
+            "/device/events",
+            body: ["deploymentKey": deploymentKey, "deviceId": deviceId, "events": list]
+        )
+    }
+
+    public func fileLinks(deploymentKey: String, deviceId: String, releaseId: String, hashes: [String]) throws
+        -> [String: String]
+    {
+        let response = try post(
+            "/device/updates/files",
+            body: ["deploymentKey": deploymentKey, "deviceId": deviceId, "releaseId": releaseId, "hashes": hashes]
+        )
+        guard let files = response["files"] as? [[String: Any]] else {
+            throw RovqError(.downloadFailed, "The server sent an unreadable response")
+        }
+        var links: [String: String] = [:]
+        for file in files {
+            if let hash = file["hash"] as? String, let url = file["url"] as? String { links[hash] = url }
+        }
+        return links
+    }
+
+    /// Blocks until finished, so call it away from the main thread.
+    private func post(_ path: String, body: [String: Any]) throws -> [String: Any] {
+        let base = apiURL.hasSuffix("/") ? String(apiURL.dropLast()) : apiURL
+        guard let url = URL(string: base + path), let scheme = url.scheme?.lowercased() else {
+            throw RovqError(.downloadFailed, "The API URL is not valid")
+        }
+        if scheme != "https" && !allowInsecureURLs {
+            throw RovqError(.insecureURL, "The API URL must use HTTPS")
+        }
+
+        var request = URLRequest(url: url, timeoutInterval: requestTimeout)
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "content-type")
+        request.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        let finished = DispatchSemaphore(value: 0)
+        var answer: Data?
+        var status = 0
+        var failure: Error?
+        let session = URLSession(configuration: .ephemeral)
+        session.dataTask(with: request) { data, response, error in
+            answer = data
+            status = (response as? HTTPURLResponse)?.statusCode ?? 0
+            failure = error
+            finished.signal()
+        }.resume()
+        finished.wait()
+        session.finishTasksAndInvalidate()
+
+        if let failure {
+            throw RovqError(.downloadFailed, failure.localizedDescription)
+        }
+        guard status == 200 else { throw RovqError(.downloadFailed, "The server answered \(status)") }
+        guard let answer, let json = try? JSONSerialization.jsonObject(with: answer) as? [String: Any] else {
+            throw RovqError(.downloadFailed, "The server sent an unreadable response")
+        }
+        return json
+    }
+}