@scalebun/react-native 1.11.1 → 2.0.0

package/android/src/main/java/com/scalebun/rn/ota/ScaleBunOtaModule.kt

@@ -96,6 +96,21 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
 
     private val slotManager by lazy { SlotManager(reactApplicationContext.filesDir) }
 
+    /**
+     * Trusted RSA public keys embedded in the APK (docs §9). Non-empty once the
+     * app ships a `scalebun_ota_keys.json` asset — which is what flips staging
+     * into the native-ENFORCED path (see [stageBundle]).
+     */
+    private val keyRegistry by lazy { ScaleBunOtaKeyRegistry.fromAssets(reactApplicationContext) }
+
+    /** Device-derived verification context — never taken from JS. */
+    private fun buildContext(): ExpectedContext = ExpectedContext(
+        projectId = keyRegistry.projectId,
+        applicationId = reactApplicationContext.packageName,
+        currentSequence = slotManager.highestConfirmedSequence(),
+        nowEpochSeconds = System.currentTimeMillis() / 1000,
+    )
+
     override fun getName(): String = NAME
 
     /**
@@ -139,6 +154,12 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
         return slotManager.slotState().toString()
     }
 
+    /** JSON array of the trusted key IDs embedded in this app (SDK trust coverage). */
+    @ReactMethod(isBlockingSynchronousMethod = true)
+    override fun getTrustedKeyIds(): String {
+        return org.json.JSONArray(keyRegistry.keyIds().toList()).toString()
+    }
+
     /**
      * Stage a bundle into the `next` slot.
      *
@@ -154,6 +175,19 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
      */
     @ReactMethod
     override fun stageBundle(sourcePath: String, sha256: String, promise: Promise) {
+        // Native-enforced staging (docs §17): once trusted keys are embedded, the
+        // ONLY way to stage is verifyAndStageRelease, which proves an RSA signature
+        // over the release payload first. A hostile JS bundle can therefore not
+        // drive an unauthenticated bundle onto the device by calling this path —
+        // SHA-256 integrity alone (what this method checks) is not authenticity.
+        if (!keyRegistry.isEmpty()) {
+            android.util.Log.w(
+                NAME,
+                "stageBundle refused: trusted keys are embedded — use verifyAndStageRelease (signature-enforced).",
+            )
+            promise.resolve(false)
+            return
+        }
         var downloaded: File? = null
         try {
             val isRemote = sourcePath.startsWith("http://", true) ||
@@ -214,6 +248,16 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
         expectedSha256: String,
         promise: Promise,
     ) {
+        // Same native-enforcement as stageBundle: a bsdiff patch staged by hash
+        // alone carries no signature, so once trusted keys are embedded this path
+        // is closed. Result-anchored signed patches are a native follow-up
+        // (verifyAndStagePatch); until then the SDK falls back to the verified
+        // full download (verifyAndStageRelease). false = "patch unavailable".
+        if (!keyRegistry.isEmpty()) {
+            android.util.Log.i(NAME, "stagePatch disabled while trusted keys are embedded — full verified download")
+            promise.resolve(false)
+            return
+        }
         var downloadedPatch: File? = null
         var rebuilt: File? = null
         try {
@@ -284,78 +328,89 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
     }
 
     /**
-     * Verify a detached ed25519 signature with PLATFORM crypto.
-     *
-     * Why native: the JS verifier lives inside the very bundle it protects, so
-     * one malicious bundle can neuter it for every update after. Platform
-     * crypto sits outside the bundle's reach. It also drops the runtime need
-     * for the optional @noble peers on Android 13+.
+     * Verify a SB-OTA-RSA-SHA256-V1 release envelope with PLATFORM crypto and the
+     * EMBEDDED trusted-key registry — no download, no side effects. Resolves the
+     * verdict JSON (see [Verdict.toJson]); a failed verification is a verdict with
+     * `ok:false` and a stable `code`, never a rejected promise.
      *
-     * Contract (mirrors the JS spec doc):
-     *   - inputs are lowercase hex, pre-validated by the JS caller
-     *   - the message is the RAW 32 BYTES of the bundle SHA-256 — the CLI
-     *     signs the digest bytes, not their hex text
-     *   - resolves 'valid' / 'invalid' / 'unavailable'; never rejects for a
-     *     wrong signature, and any unexpected throw resolves 'unavailable' so
-     *     machinery failure is distinguishable from a forged bundle
+     * Native because the JS verifier lives inside the very bundle it protects, and
+     * because the trusted key must come from the APK, not from JS or the server.
+     * `SHA256withRSA` + RSA `KeyFactory` are available on every supported Android
+     * API level, so there is no API-33 floor (the reason RSA replaced ed25519).
+     */
+    @ReactMethod
+    override fun verifyRelease(envelopeJson: String, promise: Promise) {
+        try {
+            promise.resolve(ScaleBunOtaReleaseVerifier.verify(envelopeJson, buildContext(), keyRegistry).toJson())
+        } catch (e: Throwable) {
+            promise.resolve(
+                Verdict.fail(OtaFailureCode.INTERNAL_VERIFICATION_ERROR, e.message ?: "internal error").toJson(),
+            )
+        }
+    }
+
+    /**
+     * Native-ENFORCED install (docs §5, §17): verify the RSA signature over the
+     * release payload against an embedded key, THEN download to a temp file,
+     * enforce the signed size + SHA-256, and stage into the `next` slot. JS never
+     * gets to stage bytes that were not proven authentic. Does not activate —
+     * [applyUpdate] promotes per the install mode, unchanged.
      *
-     * Availability: `Signature.getInstance("Ed25519")` ships in Android's
-     * conscrypt from API 33. Below that the JCA lookup throws
-     * NoSuchAlgorithmException — reported as 'unavailable', and JS falls back
-     * to its own verifier. Checked by attempting the lookup rather than by
-     * SDK_INT, because the algorithm's presence is the fact that matters.
+     * Resolves the verdict JSON: `ok:true` once staged, else `ok:false` with the
+     * stage that failed as a stable `code`.
      */
     @ReactMethod
-    override fun verifyEd25519(
-        messageHex: String,
-        signatureHex: String,
-        publicKeyHex: String,
-        promise: Promise,
-    ) {
+    override fun verifyAndStageRelease(envelopeJson: String, promise: Promise) {
+        var downloaded: File? = null
         try {
-            val message = hexToBytes(messageHex)
-            val signature = hexToBytes(signatureHex)
-            val rawKey = hexToBytes(publicKeyHex)
-            if (message == null || signature == null || rawKey == null || rawKey.size != 32) {
-                // Malformed input from our own caller is not a forgery verdict.
-                promise.resolve("unavailable")
+            val verdict = ScaleBunOtaReleaseVerifier.verify(envelopeJson, buildContext(), keyRegistry)
+            val payload = verdict.payload
+            if (!verdict.ok || payload == null) {
+                promise.resolve(verdict.toJson())
                 return
             }
 
-            // JCA takes X.509 SubjectPublicKeyInfo, not raw key bytes: the
-            // 12-byte ed25519 SPKI prefix (OID 1.3.101.112) + the raw 32.
-            val spkiPrefix = byteArrayOf(
-                0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
-            )
-            val verifier = try {
-                java.security.Signature.getInstance("Ed25519")
-            } catch (_: java.security.NoSuchAlgorithmException) {
-                promise.resolve("unavailable") // API < 33
+            val url = JSONObject(envelopeJson).optString("downloadUrl", "")
+            if (url.isEmpty()) {
+                promise.resolve(Verdict.fail(OtaFailureCode.DOWNLOAD_FAILED, "envelope has no downloadUrl").toJson())
                 return
             }
-            val key = java.security.KeyFactory.getInstance("Ed25519")
-                .generatePublic(java.security.spec.X509EncodedKeySpec(spkiPrefix + rawKey))
-
-            verifier.initVerify(key)
-            verifier.update(message)
-            promise.resolve(if (verifier.verify(signature)) "valid" else "invalid")
-        } catch (_: Throwable) {
-            // Fail toward "cannot check", never toward "checked out fine".
-            promise.resolve("unavailable")
-        }
-    }
 
-    /** Hex → bytes; null for odd length or a non-hex character. */
-    private fun hexToBytes(hex: String): ByteArray? {
-        if (hex.isEmpty() || hex.length % 2 != 0) return null
-        val out = ByteArray(hex.length / 2)
-        for (i in out.indices) {
-            val hi = Character.digit(hex[i * 2], 16)
-            val lo = Character.digit(hex[i * 2 + 1], 16)
-            if (hi < 0 || lo < 0) return null
-            out[i] = ((hi shl 4) or lo).toByte()
+            val temp = File(reactApplicationContext.cacheDir, "scalebun_ota_dl_${System.nanoTime()}")
+            downloaded = temp
+            if (!BundleDownloader.download(url, temp, ::emitProgress)) {
+                promise.resolve(Verdict.fail(OtaFailureCode.DOWNLOAD_FAILED, "download failed").toJson())
+                return
+            }
+            // Size first (cheap), against the SIGNED artifactSize.
+            if (temp.length() != payload.artifactSize) {
+                promise.resolve(Verdict.fail(OtaFailureCode.ARTIFACT_SIZE_MISMATCH, "downloaded size mismatch").toJson())
+                return
+            }
+
+            // SlotManager.stage streams a SHA-256 and compares against the signed
+            // artifactSha256 (== resultArtifactSha256 for a full artifact), so a
+            // wrong download cannot be staged. meta carries the sequence used by
+            // the anti-downgrade floor once the bundle is confirmed healthy.
+            val meta = JSONObject()
+                .put("sha256", payload.artifactSha256)
+                .put("releaseSequence", payload.releaseSequence)
+                .put("bundleId", payload.bundleId)
+                .put("releaseId", payload.releaseId)
+                .put("installedAt", System.currentTimeMillis())
+            val staged = slotManager.stage(temp, payload.artifactSha256, meta)
+            if (!staged) {
+                promise.resolve(Verdict.fail(OtaFailureCode.ARTIFACT_HASH_MISMATCH, "staged bytes failed hash check").toJson())
+                return
+            }
+            promise.resolve(verdict.toJson())
+        } catch (e: Throwable) {
+            promise.resolve(
+                Verdict.fail(OtaFailureCode.INTERNAL_VERIFICATION_ERROR, e.message ?: "internal error").toJson(),
+            )
+        } finally {
+            downloaded?.delete()
         }
-        return out
     }
 
     private fun sha256Hex(bytes: ByteArray): String {

package/android/src/main/java/com/scalebun/rn/ota/ScaleBunOtaReleaseVerifier.kt

@@ -0,0 +1,129 @@
+package com.scalebun.rn.ota
+
+import org.json.JSONObject
+import java.security.Signature
+
+/**
+ * SB-OTA-RSA-SHA256-V1 native release verifier (docs §5). Runs the authoritative
+ * order: strict-decode → registry-only key resolution → RSA-SHA256 verify over
+ * the EXACT signed-payload bytes → parse → cross-check the authenticated payload
+ * against the device's own identity + the anti-downgrade floor. Fails closed and
+ * maps every failure to a stable {@link OtaFailureCode}.
+ *
+ * The verify call sequence (Signature("SHA256withRSA") over payload bytes) is the
+ * same JCA surface proven in tools/rsa-ota-parity/RsaOtaParity.java against the
+ * shared fixtures, and available on every supported Android API level (no API-33
+ * floor, unlike ed25519).
+ */
+data class ExpectedContext(
+    /** The ScaleBun project this binary belongs to (from the embedded config). */
+    val projectId: String,
+    /** The native application id — the device's own package name. */
+    val applicationId: String,
+    /** Highest confirmed release sequence for anti-downgrade (0 if none yet). */
+    val currentSequence: Long,
+    /** Seconds since epoch, for the expiry check. */
+    val nowEpochSeconds: Long,
+    val platform: String = "android",
+)
+
+data class Verdict(
+    val ok: Boolean,
+    val code: OtaFailureCode?,
+    val message: String?,
+    val payload: SignedRelease?,
+    val fingerprint: String?,
+) {
+    fun toJson(): String {
+        val o = JSONObject()
+        o.put("ok", ok)
+        if (code != null) o.put("code", code.name)
+        if (message != null) o.put("message", message)
+        if (fingerprint != null) o.put("fingerprint", fingerprint)
+        payload?.let { p ->
+            o.put("keyId", p.keyId)
+            o.put("releaseId", p.releaseId)
+            o.put("bundleId", p.bundleId)
+            o.put("releaseSequence", p.releaseSequence)
+            o.put("artifactSha256", p.artifactSha256)
+            o.put("artifactSize", p.artifactSize)
+            o.put("resultArtifactSha256", p.resultArtifactSha256)
+            o.put("artifactType", p.artifactType)
+        }
+        return o.toString()
+    }
+
+    companion object {
+        fun fail(code: OtaFailureCode, message: String) = Verdict(false, code, message, null, null)
+    }
+}
+
+object ScaleBunOtaReleaseVerifier {
+
+    fun verify(envelopeJson: String, expected: ExpectedContext, registry: ScaleBunOtaKeyRegistry): Verdict {
+        return try {
+            val env = JSONObject(envelopeJson)
+            val protocol = env.optString("protocol", "")
+            if (protocol != OtaProtocol.SIGNATURE_ALGORITHM) {
+                return Verdict.fail(OtaFailureCode.UNSUPPORTED_PROTOCOL, "protocol $protocol")
+            }
+            val signedPayloadB64 = env.optString("signedPayload", "")
+            val signatureB64 = env.optString("signature", "")
+            val envKeyId = env.optString("keyId", "")
+
+            val payloadBytes = OtaProtocol.decodeBase64Strict(
+                signedPayloadB64, OtaProtocol.MAX_SIGNED_PAYLOAD_BYTES, "signedPayload",
+            )
+            val signature = OtaProtocol.decodeBase64Strict(
+                signatureB64, OtaProtocol.MAX_SIGNATURE_BYTES, "signature",
+            )
+
+            val payloadKeyId = OtaProtocol.peekKeyId(payloadBytes)
+            if (envKeyId.isNotEmpty() && envKeyId != payloadKeyId) {
+                return Verdict.fail(OtaFailureCode.INVALID_ENVELOPE, "envelope keyId disagrees with payload")
+            }
+
+            val key = registry.get(payloadKeyId)
+                ?: return Verdict.fail(OtaFailureCode.UNKNOWN_KEY_ID, "no embedded key with id $payloadKeyId")
+
+            // RSA-SHA256 over the EXACT received payload bytes, BEFORE parsing.
+            val verifier = Signature.getInstance("SHA256withRSA")
+            verifier.initVerify(key.publicKey)
+            verifier.update(payloadBytes)
+            if (!verifier.verify(signature)) {
+                return Verdict.fail(OtaFailureCode.INVALID_SIGNATURE, "signature did not verify")
+            }
+
+            val payload = OtaProtocol.parse(payloadBytes)
+
+            // The device only ever verifies a signed FULL release (patches are an
+            // out-of-band optimisation anchored to resultArtifactSha256, docs §8.1).
+            if (payload.artifactType != "full") {
+                return Verdict.fail(OtaFailureCode.INVALID_SIGNED_PAYLOAD, "signed payload is not a full release")
+            }
+            val projectExpected = if (registry.projectId.isNotEmpty()) registry.projectId else expected.projectId
+            if (projectExpected.isNotEmpty() && payload.projectId != projectExpected) {
+                return Verdict.fail(OtaFailureCode.PROJECT_MISMATCH, "projectId")
+            }
+            if (expected.applicationId.isNotEmpty() && payload.applicationId != expected.applicationId) {
+                return Verdict.fail(OtaFailureCode.APPLICATION_MISMATCH, "applicationId")
+            }
+            if (payload.platform != expected.platform) {
+                return Verdict.fail(OtaFailureCode.PLATFORM_MISMATCH, "platform")
+            }
+            if (payload.expiresAtEpochSeconds != 0L && expected.nowEpochSeconds > payload.expiresAtEpochSeconds) {
+                return Verdict.fail(OtaFailureCode.RELEASE_EXPIRED, "release expired")
+            }
+            if (payload.releaseSequence < expected.currentSequence) {
+                return Verdict.fail(OtaFailureCode.RELEASE_DOWNGRADE_REJECTED, "sequence below current")
+            }
+
+            Verdict(true, null, null, payload, key.fingerprint)
+        } catch (e: OtaVerifyException) {
+            Verdict.fail(e.code, e.message ?: "verification failed")
+        } catch (e: Throwable) {
+            // Never let an exception read as success.
+            Verdict.fail(OtaFailureCode.INTERNAL_VERIFICATION_ERROR, e.message ?: "internal error")
+        }
+    }
+}

package/android/src/main/java/com/scalebun/rn/ota/SlotManager.kt

@@ -47,6 +47,22 @@ class SlotManager(private val filesDir: File) {
     private val previousSlot: File get() = File(otaRoot, "previous")
     private val bootMarker: File get() = File(otaRoot, BOOT_MARKER_FILENAME)
     private val revertRecord: File get() = File(otaRoot, REVERT_RECORD_FILENAME)
+    private val sequenceFile: File get() = File(otaRoot, "highest_sequence")
+
+    /**
+     * Highest CONFIRMED release sequence (anti-downgrade floor, docs §15). Only
+     * updated once a bundle is marked healthy, so a failed/rolled-back higher
+     * sequence never raises the floor and never blocks a legitimate re-install.
+     */
+    fun highestConfirmedSequence(): Long =
+        try { sequenceFile.readText().trim().toLong() } catch (_: Exception) { 0L }
+
+    private fun confirmCurrentSequence() {
+        val seq = readMeta(currentSlot)?.optLong("releaseSequence", -1L) ?: -1L
+        if (seq >= 0 && seq > highestConfirmedSequence()) {
+            runCatching { otaRoot.mkdirs(); sequenceFile.writeText(seq.toString()) }
+        }
+    }
 
     /**
      * Returns the absolute path to the active JS bundle, or null if no OTA
@@ -163,6 +179,8 @@ class SlotManager(private val filesDir: File) {
             bootMarker.delete()
             Log.i(TAG, "Boot marker cleared — bundle marked healthy")
         }
+        // A bundle is only trusted for anti-downgrade once it has run healthily.
+        confirmCurrentSequence()
     }
 
     /**

package/android/src/oldarch/java/com/scalebun/rn/ota/ScaleBunOtaSpec.kt

@@ -17,6 +17,7 @@ abstract class ScaleBunOtaSpec(reactContext: ReactApplicationContext) :
 
     abstract fun getActiveBundle(): String?
     abstract fun getSlotState(): String
+    abstract fun getTrustedKeyIds(): String
     abstract fun stageBundle(sourcePath: String, sha256: String, promise: Promise)
     abstract fun stagePatch(
         patchUrl: String,
@@ -32,12 +33,7 @@ abstract class ScaleBunOtaSpec(reactContext: ReactApplicationContext) :
     // Hand-maintained: this file does NOT regenerate from the JS spec. A method
     // added to NativeScaleBunOta.ts that is missing here compiles green on New
     // Arch and breaks EVERY old-arch consumer's build (the ScaleBunCrashModule
-    // incident). Non-null Strings to match the codegen base's signature, so the
-    // one concrete override compiles against either architecture.
-    abstract fun verifyEd25519(
-        messageHex: String,
-        signatureHex: String,
-        publicKeyHex: String,
-        promise: Promise,
-    )
+    // incident). Keep these in lockstep with src/specs/NativeScaleBunOta.ts.
+    abstract fun verifyRelease(envelopeJson: String, promise: Promise)
+    abstract fun verifyAndStageRelease(envelopeJson: String, promise: Promise)
 }