@scalebun-release/react-native 2.5.0

package/ios/Ota/BundleDownloader.swift

@@ -0,0 +1,249 @@
+import Foundation
+
+/**
+ Downloads an OTA bundle to a local file (OTA-05).
+
+ WHY THIS EXISTS. `OtaOrchestrator.sync()` has always passed `bundle.url` — a
+ presigned HTTPS URL — into `stageBundle()`, while `OtaSlotManager.stage` treated
+ that argument as a filesystem path and called
+ `copyItem(at: URL(fileURLWithPath:))`, which throws for a remote URL. No part of
+ the SDK downloaded the bundle, so OTA could never install an update, and every
+ safety mechanism downstream had only ever run against synthetic events.
+
+ Synchronous by design: `stageBundle` is a promise-returning bridge method that
+ already runs off the main thread, and the slot manager's staging step is
+ synchronous. A semaphore here keeps the call site a straight line rather than
+ threading a completion handler through the bridge for no behavioural gain.
+
+ Delegate-based rather than completion-handler-based, for one reason: the size
+ cap must fire DURING the stream, not after it. The previous implementation
+ checked the file size only once the download completed — by which point a
+ hostile or buggy 5 GB body had already been written to the user's disk. The
+ Android downloader has always cancelled mid-stream; this brings iOS to parity.
+ */
+enum BundleDownloader {
+
+    /// Matches the server-side finalize cap. A larger body is a bug or an attack.
+    fileprivate static let maxBytes: Int64 = 50 * 1024 * 1024
+    fileprivate static let timeout: TimeInterval = 60
+
+    /**
+     Download `urlString` to `destination`. Returns true on success.
+
+     Integrity is NOT checked here — `OtaSlotManager.stage` re-hashes what landed
+     on disk, which is the only measurement that matters. On any failure the
+     destination is removed so a partial body cannot be mistaken for a bundle.
+
+     C2a: `URLSession` advertises and transparently decodes gzip, so what reaches
+     disk is the decompressed bundle — the same bytes the server hashed and the
+     signature covers.
+     */
+    static func download(urlString: String, destination: URL) -> Bool {
+        downloadWithReason(urlString: urlString, destination: destination) == nil
+    }
+
+    /**
+     As `download`, but says WHY it failed: nil on success, otherwise a
+     `DownloadFailure` code. Never a URL, host or error description.
+     */
+    static func downloadWithReason(urlString: String, destination: URL) -> String? {
+        guard let url = URL(string: urlString) else {
+            NSLog("[ScaleBunOta] Download failed: malformed URL")
+            return DownloadFailure.io
+        }
+
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.timeoutIntervalForRequest = timeout
+        configuration.timeoutIntervalForResource = timeout * 4
+
+        let delegate = SizeCappedDownloadDelegate(destination: destination)
+        let session = URLSession(
+            configuration: configuration,
+            delegate: delegate,
+            delegateQueue: nil
+        )
+
+        // downloadTask streams to a temp file rather than buffering the whole
+        // bundle in memory — a 50 MB dataTask spike is enough to get the host app
+        // jetsammed on an older device.
+        session.downloadTask(with: url).resume()
+        let waited = delegate.semaphore.wait(timeout: .now() + timeout * 4)
+
+        // The session retains its delegate until invalidated; without this,
+        // every download across the app's lifetime leaked a session + delegate.
+        session.invalidateAndCancel()
+
+        if delegate.success { return nil }
+        try? FileManager.default.removeItem(at: destination)
+        // Our own deadline passed before URLSession reported anything.
+        if waited == .timedOut { return DownloadFailure.timeout }
+        return delegate.failureReason ?? DownloadFailure.io
+    }
+}
+
+/**
+ URLSession delegate enforcing the byte cap while the body streams in.
+
+ `urlSession(_:downloadTask:didWriteData:...)` fires per chunk; the moment the
+ running total (or the server's own Content-Length claim) exceeds the cap, the
+ task is cancelled — nothing more lands on disk. All terminal paths signal the
+ semaphore exactly once: didFinishDownloading only signals on success, and every
+ completion (success, cancel, error, timeout) also passes through
+ `didCompleteWithError`, where the single signal for failures lives.
+ */
+private final class SizeCappedDownloadDelegate: NSObject, URLSessionDownloadDelegate {
+    let semaphore = DispatchSemaphore(value: 0)
+    private(set) var success = false
+    /// The first failure cause observed (DownloadFailure vocabulary). Later
+    /// signals — didCompleteWithError always follows — never overwrite it.
+    private(set) var failureReason: String?
+    private func fail(_ reason: String) {
+        if failureReason == nil { failureReason = reason }
+    }
+
+    private let destination: URL
+    private var cancelledForSize = false
+
+    init(destination: URL) {
+        self.destination = destination
+    }
+
+    /**
+     Certificate pinning, when the host app ships pins.
+
+     This runs during the TLS handshake — before a single body byte is written
+     and before any redirect is followed — so an intercepted endpoint can neither
+     serve content nor bounce the download somewhere else. No pins configured for
+     the host means `verify` returns true and behaviour is unchanged.
+
+     Rejecting here cancels the task, which reaches `didCompleteWithError` and
+     fails the download exactly like any other transport error. It is not retried
+     against the same endpoint: a pin mismatch is not a transient condition.
+     */
+    func urlSession(
+        _ session: URLSession,
+        didReceive challenge: URLAuthenticationChallenge,
+        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+    ) {
+        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
+              let serverTrust = challenge.protectionSpace.serverTrust else {
+            completionHandler(.performDefaultHandling, nil)
+            return
+        }
+
+        let host = challenge.protectionSpace.host
+        if TlsPinning.verify(serverTrust: serverTrust, host: host) {
+            completionHandler(.useCredential, URLCredential(trust: serverTrust))
+        } else {
+            pinRejected = true
+            completionHandler(.cancelAuthenticationChallenge, nil)
+        }
+    }
+
+    /// Set when a handshake was refused by pinning, so the failure logs honestly.
+    private(set) var pinRejected = false
+
+    /// Emit at most one progress event per this interval — didWriteData is hot.
+    private static let progressIntervalMs: Int64 = 500
+    private var lastProgressAtMs: Int64 = 0
+
+    func urlSession(
+        _ session: URLSession,
+        downloadTask: URLSessionDownloadTask,
+        didWriteData bytesWritten: Int64,
+        totalBytesWritten: Int64,
+        totalBytesExpectedToWrite: Int64
+    ) {
+        let claimed = totalBytesExpectedToWrite // NSURLSessionTransferSizeUnknown (-1) when absent
+        if totalBytesWritten > BundleDownloader.maxBytes ||
+            (claimed > 0 && claimed > BundleDownloader.maxBytes) {
+            cancelledForSize = true
+            NSLog(
+                "[ScaleBunOta] Download rejected: exceeds \(BundleDownloader.maxBytes) bytes " +
+                "(written=\(totalBytesWritten), claimed=\(claimed)) — cancelling mid-stream"
+            )
+            downloadTask.cancel()
+            return
+        }
+
+        // Throttled progress to JS. `claimed` can be the COMPRESSED length on
+        // an encoded response while written bytes are decompressed — JS clamps
+        // the percentage, and -1 (unknown) is passed through as unknown.
+        let nowMs = Int64(Date().timeIntervalSince1970 * 1000)
+        if nowMs - lastProgressAtMs >= SizeCappedDownloadDelegate.progressIntervalMs {
+            lastProgressAtMs = nowMs
+            ScaleBunOtaEventsModule.emitProgress(
+                bytesRead: totalBytesWritten,
+                totalBytes: claimed
+            )
+        }
+    }
+
+    func urlSession(
+        _ session: URLSession,
+        downloadTask: URLSessionDownloadTask,
+        didFinishDownloadingTo location: URL
+    ) {
+        if let http = downloadTask.response as? HTTPURLResponse,
+           !(200...299).contains(http.statusCode) {
+            NSLog("[ScaleBunOta] Download failed: HTTP \(http.statusCode)")
+            fail(DownloadFailure.http(http.statusCode))
+            return // didCompleteWithError still fires and signals
+        }
+
+        let fm = FileManager.default
+
+        // Belt over the streaming brace: a body small enough to never trip the
+        // per-chunk check is re-measured once whole.
+        let attributes = try? fm.attributesOfItem(atPath: location.path)
+        let size = (attributes?[.size] as? NSNumber)?.int64Value ?? 0
+        if size > BundleDownloader.maxBytes {
+            NSLog("[ScaleBunOta] Download rejected: \(size) bytes exceeds \(BundleDownloader.maxBytes)")
+            fail(DownloadFailure.sizeExceeded)
+            return
+        }
+
+        do {
+            try? fm.removeItem(at: destination)
+            try fm.createDirectory(
+                at: destination.deletingLastPathComponent(),
+                withIntermediateDirectories: true
+            )
+            // The system deletes `location` as soon as this handler returns,
+            // so the file must be moved out synchronously, not scheduled.
+            try fm.moveItem(at: location, to: destination)
+            success = true
+            // Terminal tick: read == total signals completion even when the
+            // whole body arrived inside one throttle window.
+            ScaleBunOtaEventsModule.emitProgress(bytesRead: size, totalBytes: size)
+        } catch {
+            NSLog("[ScaleBunOta] Download failed to persist the file")
+            fail(DownloadFailure.io)
+        }
+    }
+
+    func urlSession(
+        _ session: URLSession,
+        task: URLSessionTask,
+        didCompleteWithError error: Error?
+    ) {
+        if cancelledForSize {
+            fail(DownloadFailure.sizeExceeded)
+        } else if pinRejected {
+            fail(DownloadFailure.pinMismatch)
+        } else if let error = error {
+            fail(DownloadFailure.of(error))
+        }
+        if let error = error, !cancelledForSize, !pinRejected {
+            // The code only: the error description and userInfo can carry the
+            // presigned URL, signature included.
+            NSLog("[ScaleBunOta] Download failed: \((error as NSError).code) (\(failureReason ?? DownloadFailure.io))")
+        } else if pinRejected {
+            // TlsPinning.verify already logged which host and how many pins it
+            // weighed. Repeating it as a transport error ("cancelled") would bury
+            // the only line that says why.
+            NSLog("[ScaleBunOta] Download aborted: TLS pin check refused the connection")
+        }
+        semaphore.signal()
+    }
+}

package/ios/Ota/DeviceIntegrity.swift

@@ -0,0 +1,112 @@
+import Foundation
+import MachO
+
+/**
+ Best-effort jailbreak detection.
+
+ The iOS half of `DeviceIntegrity.kt`, and deliberately as modest in what it
+ claims. Jailbreak detection is a signal, never a boundary: anything running
+ outside the sandbox can defeat any check made from inside the app, and an
+ attacker with a jailbroken device has already won that argument. What it IS good
+ for is telling an operator that a fleet's telemetry — crash rates, adoption,
+ rollback rates — includes devices whose OTA slot is writable by other processes,
+ and letting a security-sensitive host app decide to withhold updates on those
+ devices.
+
+ That decision point now exists, in JS rather than here, and identically on both
+ platforms: `ota.onCompromisedDevice` ('allow' by default; 'withhold'
+ short-circuits the check/download path and emits an UPDATE_WITHHELD event
+ naming these indicators). See BootGuardConfig in
+ features/ota/OtaOrchestrator.ts. Nothing in this file enforces anything — it
+ measures, and the measurement is reported either way.
+
+ The checks are the cheap, well-understood ones: known jailbreak paths, a write
+ outside the sandbox, and injected tweak libraries. No heuristics that produce
+ false positives on ordinary devices, because a false positive here means a
+ paying customer stops receiving updates. Nothing here touches UIKit, so it is
+ safe from any thread and inside an app extension.
+
+ `root_manager_installed` is shared with Android where the condition is the same,
+ so the dashboard does not have to special-case a platform to count one fact.
+ */
+enum DeviceIntegrity {
+
+    private static let jailbreakPaths = [
+        "/Applications/Cydia.app",
+        "/Applications/Sileo.app",
+        "/Applications/Zebra.app",
+        "/Library/MobileSubstrate/MobileSubstrate.dylib",
+        "/usr/sbin/sshd",
+        "/usr/bin/ssh",
+        "/etc/apt",
+        "/private/var/lib/apt/",
+        "/var/jb",
+    ]
+
+    /// Substrings of dyld image names that only appear when a tweak is injected.
+    private static let injectedLibraryMarkers = [
+        "mobilesubstrate",
+        "substrate",
+        "substitute",
+        "libhooker",
+        "ellekit",
+        "cycript",
+        "frida",
+    ]
+
+    /**
+     Reasons this device looks jailbroken. Empty list = nothing detected, which
+     is NOT the same as "device is clean" — see the type comment.
+
+     Always empty on the simulator: several of these trip there by construction,
+     and reporting a developer's simulator as compromised is noise that would
+     train operators to ignore the signal.
+     */
+    static func jailbreakIndicators() -> [String] {
+        #if targetEnvironment(simulator)
+        return []
+        #else
+        var found: [String] = []
+        let fm = FileManager.default
+
+        if jailbreakPaths.contains(where: { fm.fileExists(atPath: $0) }) {
+            found.append("jailbreak_path_present")
+        }
+
+        // A sandboxed app cannot write outside its container. Succeeding here
+        // means the sandbox is not being enforced, which is the condition that
+        // actually matters for an OTA slot — it is what lets another process
+        // rewrite the bundle we are about to execute.
+        let probe = "/private/scalebun_sandbox_probe"
+        if (try? "probe".write(toFile: probe, atomically: true, encoding: .utf8)) != nil {
+            found.append("sandbox_escape_writable")
+            try? fm.removeItem(atPath: probe)
+        }
+
+        if hasInjectedLibrary() {
+            found.append("root_manager_installed")
+        }
+
+        return found
+        #endif
+    }
+
+    /**
+     Is a known tweak runtime loaded into this process?
+
+     Walks the dyld image list, which is a read of already-resident process state
+     — no filesystem access, no entitlements, no prompts. This is the check that
+     survives the common trick of hiding the jailbreak paths from `stat`, because
+     a tweak that is actually hooking the app has to be mapped into it.
+     */
+    private static func hasInjectedLibrary() -> Bool {
+        for index in 0..<_dyld_image_count() {
+            guard let raw = _dyld_get_image_name(index) else { continue }
+            let name = String(cString: raw).lowercased()
+            if injectedLibraryMarkers.contains(where: { name.contains($0) }) {
+                return true
+            }
+        }
+        return false
+    }
+}

package/ios/Ota/DownloadFailure.swift

@@ -0,0 +1,56 @@
+import Foundation
+
+/**
+ WHY a bundle download failed, as a code from a FIXED vocabulary — the iOS twin of
+ android/.../DownloadFailure.kt, with the same strings.
+
+ The downloader returned a bare Bool, so every failure reached the dashboard as
+ "DOWNLOAD_FAILED": an expired presigned URL, a DNS failure and a dropped connection
+ were one row.
+
+ NEVER a URL, host or error description. Presigned URLs carry X-Amz-Signature, the
+ object-store host names the account, and NSError's userInfo holds the failing URL.
+ Classification reads the error CODE only; JS re-validates the result against the
+ same list (signedDownload.ts DOWNLOAD_REASON) before anything reaches the wire.
+
+ Pure Foundation so `swift test` compiles it (Package.swift sources list).
+ */
+enum DownloadFailure {
+    static let timeout = "timeout"
+    static let dns = "dns"
+    static let tls = "tls"
+    static let io = "io"
+    static let pinMismatch = "pin_mismatch"
+    static let sizeExceeded = "size_exceeded"
+    static let redirectLimit = "redirect_limit"
+
+    /// `http_404`. A status outside 100...599 is not HTTP at all — reported as io.
+    static func http(_ status: Int) -> String {
+        (100...599).contains(status) ? "http_\(status)" : io
+    }
+
+    /// Classify a transport error by its URLError CODE. Never reads a description.
+    static func of(_ error: Error?) -> String {
+        guard let error = error else { return io }
+        let ns = error as NSError
+        guard ns.domain == NSURLErrorDomain else { return io }
+        switch URLError.Code(rawValue: ns.code) {
+        case .timedOut:
+            return timeout
+        case .cannotFindHost, .dnsLookupFailed:
+            return dns
+        case .secureConnectionFailed,
+             .serverCertificateHasBadDate,
+             .serverCertificateUntrusted,
+             .serverCertificateHasUnknownRoot,
+             .serverCertificateNotYetValid,
+             .clientCertificateRejected,
+             .clientCertificateRequired:
+            return tls
+        case .httpTooManyRedirects, .redirectToNonExistentLocation:
+            return redirectLimit
+        default:
+            return io
+        }
+    }
+}

package/ios/Ota/OtaProtocol.swift

@@ -0,0 +1,246 @@
+import Foundation
+
+/**
+ * SB-OTA-RSA-SHA256-V1 binary codec — the iOS mirror of the TypeScript reference
+ * (`packages/ota-protocol/src/codec.ts`), the Android `OtaProtocol.kt`, and the
+ * JVM parity harness (`tools/rsa-ota-parity/RsaOtaParity.java`). Pure Foundation,
+ * no RN/CryptoKit dependency, so it is unit-testable and cannot be neutered by
+ * the JS bundle it protects. See docs/ota/SB-OTA-RSA-SHA256-V1.md.
+ *
+ * Still not compiled on the development machine (Windows, no macOS toolchain),
+ * but no longer unproven: `Package.swift` at the repo root wraps this file,
+ * ScaleBunOtaKeyRegistry and ScaleBunOtaReleaseVerifier into a Swift package with
+ * no React dependency, and ci.yml's `ios-ota-verifier` job runs `swift test` on a
+ * macOS runner — compiling them and executing ScaleBunOtaVerifierTests
+ * (packages/react-native/ios/OtaTests) against the SAME shared fixtures as the
+ * JVM parity harness, in the same job.
+ */
+
+enum OtaFailureCode: String {
+    case INVALID_ENVELOPE
+    case INVALID_BASE64
+    case UNSUPPORTED_PROTOCOL
+    case UNSUPPORTED_SCHEMA
+    case UNSUPPORTED_SIGNATURE_ALGORITHM
+    case UNSUPPORTED_HASH_ALGORITHM
+    case UNKNOWN_KEY_ID
+    case INVALID_PUBLIC_KEY
+    case INVALID_SIGNATURE
+    case INVALID_SIGNED_PAYLOAD
+    case PROJECT_MISMATCH
+    case APPLICATION_MISMATCH
+    case PLATFORM_MISMATCH
+    case APP_VERSION_MISMATCH
+    case RUNTIME_VERSION_MISMATCH
+    case RELEASE_DOWNGRADE_REJECTED
+    case RELEASE_EXPIRED
+    case DOWNLOAD_FAILED
+    case DOWNLOAD_TOO_LARGE
+    case ARTIFACT_SIZE_MISMATCH
+    case ARTIFACT_HASH_MISMATCH
+    case PATCH_BASE_MISMATCH
+    case PATCH_RESULT_MISMATCH
+    case UNSAFE_ARCHIVE
+    case STAGING_FAILED
+    case ACTIVATION_FAILED
+    case INTERNAL_VERIFICATION_ERROR
+}
+
+struct OtaVerifyError: Error {
+    let code: OtaFailureCode
+    let message: String
+}
+
+struct SignedRelease {
+    let signatureAlgorithm: String
+    let hashAlgorithm: String
+    let keyId: String
+    let projectId: String
+    let applicationId: String
+    let releaseId: String
+    let bundleId: String
+    let platform: String
+    let artifactType: String
+    let targetAppVersion: String
+    let targetRuntimeVersion: String
+    let minimumSdkVersion: String
+    let releaseSequence: Int64
+    let issuedAtEpochSeconds: Int64
+    let expiresAtEpochSeconds: Int64
+    let artifactSize: Int64
+    let artifactSha256: String
+    let baseBundleId: String
+    let baseArtifactSha256: String
+    let resultArtifactSha256: String
+}
+
+enum OtaProtocol {
+    static let magic = "SBOTA001"
+    static let schemaVersion = 1
+    static let signatureAlgorithm = "SB-OTA-RSA-SHA256-V1"
+    static let hashAlgorithm = "SHA-256"
+    static let maxSignedPayloadBytes = 8192
+    static let maxSignatureBytes = 1024
+    static let maxStringFieldBytes = 256
+    static let sha256Len = 32
+    static let maxSafeUint64: Int64 = 9_007_199_254_740_991 // 2^53 - 1
+
+    private static let magicBytes = Array(magic.utf8)
+
+    /// Strict canonical standard-Base64 decode with a hard size cap.
+    static func decodeBase64Strict(_ value: String, _ maxBytes: Int, _ what: String) throws -> [UInt8] {
+        if value.isEmpty { throw OtaVerifyError(code: .INVALID_BASE64, message: "\(what): empty") }
+        if value.count > (maxBytes * 4) / 3 + 4 {
+            throw OtaVerifyError(code: .INVALID_BASE64, message: "\(what): exceeds size limit")
+        }
+        if value.count % 4 != 0 || value.range(of: "^[A-Za-z0-9+/]*={0,2}$", options: .regularExpression) == nil {
+            throw OtaVerifyError(code: .INVALID_BASE64, message: "\(what): not canonical base64")
+        }
+        guard let decoded = Data(base64Encoded: value) else {
+            throw OtaVerifyError(code: .INVALID_BASE64, message: "\(what): invalid base64")
+        }
+        if decoded.base64EncodedString() != value {
+            throw OtaVerifyError(code: .INVALID_BASE64, message: "\(what): non-canonical base64")
+        }
+        if decoded.count > maxBytes {
+            throw OtaVerifyError(code: .INVALID_BASE64, message: "\(what): decoded exceeds limit")
+        }
+        return [UInt8](decoded)
+    }
+
+    /// Parse ONLY enough to obtain the (still-unauthenticated) keyId (docs §5).
+    static func peekKeyId(_ bytes: [UInt8]) throws -> String {
+        if bytes.count > maxSignedPayloadBytes {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "payload too large")
+        }
+        var r = Reader(bytes)
+        if try r.fixed(magicBytes.count) != magicBytes {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "bad magic")
+        }
+        if try r.u16() != schemaVersion { throw OtaVerifyError(code: .UNSUPPORTED_SCHEMA, message: "schema") }
+        _ = try r.str("signatureAlgorithm")
+        _ = try r.str("hashAlgorithm")
+        let keyId = try r.str("keyId")
+        if keyId.isEmpty { throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "empty keyId") }
+        return keyId
+    }
+
+    /// Fully parse + validate an authenticated payload.
+    static func parse(_ bytes: [UInt8]) throws -> SignedRelease {
+        if bytes.count > maxSignedPayloadBytes {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "payload too large")
+        }
+        var r = Reader(bytes)
+        if try r.fixed(magicBytes.count) != magicBytes {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "bad magic")
+        }
+        if try r.u16() != schemaVersion { throw OtaVerifyError(code: .UNSUPPORTED_SCHEMA, message: "schema") }
+        let sigAlg = try r.str("signatureAlgorithm")
+        if sigAlg != signatureAlgorithm { throw OtaVerifyError(code: .UNSUPPORTED_SIGNATURE_ALGORITHM, message: sigAlg) }
+        let hashAlg = try r.str("hashAlgorithm")
+        if hashAlg != hashAlgorithm { throw OtaVerifyError(code: .UNSUPPORTED_HASH_ALGORITHM, message: hashAlg) }
+
+        let keyId = try r.str("keyId")
+        let projectId = try r.str("projectId")
+        let applicationId = try r.str("applicationId")
+        let releaseId = try r.str("releaseId")
+        let bundleId = try r.str("bundleId")
+        for v in [keyId, projectId, applicationId, releaseId, bundleId] where v.isEmpty {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "empty id")
+        }
+        let platform = try r.str("platform")
+        if platform != "android" && platform != "ios" {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "platform")
+        }
+        let artifactType = try r.str("artifactType")
+        if artifactType != "full" && artifactType != "patch" {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "artifactType")
+        }
+        let targetAppVersion = try r.str("targetAppVersion")
+        let targetRuntimeVersion = try r.str("targetRuntimeVersion")
+        let minimumSdkVersion = try r.str("minimumSdkVersion")
+        let releaseSequence = try r.u64()
+        let issuedAt = try r.u64()
+        let expiresAt = try r.u64()
+        let artifactSize = try r.u64()
+        if issuedAt == 0 { throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "issuedAt zero") }
+        if artifactSize == 0 { throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "artifactSize zero") }
+        if expiresAt != 0 && expiresAt < issuedAt {
+            throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "expiresAt < issuedAt")
+        }
+        let artifactSha = try r.fixed(sha256Len)
+        let baseBundleId = try r.str("baseBundleId")
+        let baseSha = try r.lenBytes(sha256Len, "baseArtifactSha256")
+        let resultSha = try r.fixed(sha256Len)
+        if artifactType == "full" {
+            if !baseBundleId.isEmpty || !baseSha.isEmpty {
+                throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "full has base fields")
+            }
+        } else {
+            if baseBundleId.isEmpty || baseSha.count != sha256Len {
+                throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "patch missing base")
+            }
+        }
+        if r.remaining() != 0 { throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "trailing bytes") }
+
+        return SignedRelease(
+            signatureAlgorithm: sigAlg, hashAlgorithm: hashAlg, keyId: keyId, projectId: projectId,
+            applicationId: applicationId, releaseId: releaseId, bundleId: bundleId, platform: platform,
+            artifactType: artifactType, targetAppVersion: targetAppVersion,
+            targetRuntimeVersion: targetRuntimeVersion, minimumSdkVersion: minimumSdkVersion,
+            releaseSequence: releaseSequence, issuedAtEpochSeconds: issuedAt, expiresAtEpochSeconds: expiresAt,
+            artifactSize: artifactSize, artifactSha256: toHex(artifactSha), baseBundleId: baseBundleId,
+            baseArtifactSha256: baseSha.count == sha256Len ? toHex(baseSha) : "", resultArtifactSha256: toHex(resultSha)
+        )
+    }
+
+    static func toHex(_ bytes: [UInt8]) -> String {
+        bytes.map { String(format: "%02x", $0) }.joined()
+    }
+
+    private struct Reader {
+        let b: [UInt8]
+        var pos = 0
+        init(_ b: [UInt8]) { self.b = b }
+
+        mutating func need(_ n: Int) throws {
+            if n < 0 || pos + n > b.count { throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "truncated") }
+        }
+        mutating func fixed(_ n: Int) throws -> [UInt8] {
+            try need(n); let o = Array(b[pos..<pos + n]); pos += n; return o
+        }
+        mutating func u16() throws -> Int {
+            let x = try fixed(2); return (Int(x[0]) << 8) | Int(x[1])
+        }
+        mutating func u32() throws -> Int64 {
+            let x = try fixed(4)
+            return (Int64(x[0]) << 24) | (Int64(x[1]) << 16) | (Int64(x[2]) << 8) | Int64(x[3])
+        }
+        mutating func u64() throws -> Int64 {
+            let x = try fixed(8)
+            var v: Int64 = 0
+            for i in 0..<8 {
+                // guard against overflow into the sign bit before shifting.
+                if v > (Int64.max >> 8) { throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "uint64 overflow") }
+                v = (v << 8) | Int64(x[i])
+            }
+            if v < 0 || v > maxSafeUint64 {
+                throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "uint64 out of safe range")
+            }
+            return v
+        }
+        mutating func lenBytes(_ max: Int, _ field: String) throws -> [UInt8] {
+            let n = try u32()
+            if n > Int64(max) { throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "\(field) length \(n) > \(max)") }
+            return try fixed(Int(n))
+        }
+        mutating func str(_ field: String = "string") throws -> String {
+            let raw = try lenBytes(maxStringFieldBytes, field)
+            guard let s = String(bytes: raw, encoding: .utf8) else {
+                throw OtaVerifyError(code: .INVALID_SIGNED_PAYLOAD, message: "\(field): invalid UTF-8")
+            }
+            return s
+        }
+        func remaining() -> Int { b.count - pos }
+    }
+}