@scalebun/react-native 1.13.0 → 2.0.0

package/src/features/ota/crypto/loadEd25519.ts

@@ -1,41 +0,0 @@
-/**
- * Isolated lazy loader for the OPTIONAL `@noble/ed25519` dep.
- *
- * WHY ITS OWN FILE: Metro's dependency collector emits a dependency map one
- * entry short for a module containing TWO OR MORE different-string inline
- * `require()` calls, so the require indices desync and `_dependencyMap[N]`
- * reads `undefined` ("Requiring unknown module 'undefined'"). Exactly ONE
- * inline require per module avoids the miscount. `loadSha512` is a sibling file
- * for the same reason — see `push/adapters/loadNotifee.ts`, which hit this first.
- *
- * The string must still be STATICALLY resolvable at bundle time; hosts that do
- * not install it stub it via `withScaleBun`.
- */
-
-/** The subset of the @noble/ed25519 surface this SDK uses. */
-export interface NobleEd25519 {
-    verifyAsync?: (sig: Uint8Array, msg: Uint8Array, pub: Uint8Array) => Promise<boolean>;
-    verify?: (sig: Uint8Array, msg: Uint8Array, pub: Uint8Array) => boolean;
-    /** v3 shape: `ed.hashes.sha512` */
-    hashes?: { sha512?: unknown; sha512Async?: unknown };
-    /** v2 shape: `ed.etc.sha512Sync` */
-    etc?: { sha512Sync?: unknown; sha512Async?: unknown };
-}
-
-export function loadEd25519(): NobleEd25519 | null {
-    try {
-        const mod = require('@noble/ed25519');
-        const ed = (mod?.default ?? mod) as NobleEd25519;
-        // Validate the API actually used, not mere truthiness: when the package
-        // is absent `withScaleBun` resolves it to an EMPTY STUB MODULE, which is
-        // a perfectly truthy object. A stub must read as "unavailable", because
-        // treating it as available would make every signed update fail with a
-        // crypto error instead of the actionable "no verifier" message.
-        if (typeof ed?.verifyAsync === 'function' || typeof ed?.verify === 'function') {
-            return ed;
-        }
-        return null;
-    } catch {
-        return null;
-    }
-}

package/src/features/ota/crypto/loadSha512.ts

@@ -1,35 +0,0 @@
-/**
- * Isolated lazy loader for the OPTIONAL `@noble/hashes` SHA-512.
- *
- * Separate file from `loadEd25519` because Metro miscounts a module holding two
- * different-string inline `require()` calls — see the comment there.
- *
- * ed25519 is defined in terms of SHA-512, and React Native has no native
- * SHA-512, so @noble/ed25519 cannot verify anything until a hash provider is
- * wired into it. Which property it expects differs by major version, so the
- * wiring lives in `builtinVerifier`, not here; this module only obtains the
- * function.
- */
-
-export type Sha512Fn = (msg: Uint8Array) => Uint8Array;
-
-export function loadSha512(): Sha512Fn | null {
-    try {
-        // The `.js` SUFFIX IS REQUIRED, not stylistic. @noble/hashes v2 declares
-        // its exports map with extensions — `"./sha2.js"`, not `"./sha2"` — so
-        // the extensionless form misses the map entirely. Node still resolves it
-        // by falling back to file-based lookup, which is why it passes here,
-        // but Metro prints
-        //   "Attempted to import … not listed in the exports … Falling back to
-        //    file-based resolution"
-        // on every bundle, and that fallback is exactly what a stricter resolver
-        // (or a future Metro) drops. Caught while bundling a real Expo app.
-        const mod = require('@noble/hashes/sha2.js');
-        const sha512 = (mod?.sha512 ?? mod?.default?.sha512) as Sha512Fn | undefined;
-        // A stubbed module yields undefined here, which correctly reads as
-        // "unavailable" rather than throwing deep inside the curve code later.
-        return typeof sha512 === 'function' ? sha512 : null;
-    } catch {
-        return null;
-    }
-}

package/src/features/ota/crypto/nativeVerifier.ts

@@ -1,117 +0,0 @@
-/**
- * Native ed25519 verifier — platform crypto wrapped as a SignatureVerifier.
- *
- * WHY IT EXISTS. The built-in @noble verifier runs in JS, inside the very
- * bundle it protects: an attacker who lands one malicious bundle can neuter a
- * JS check for every update after it. Platform crypto (CryptoKit on iOS,
- * Android's conscrypt on API 33+) sits outside the bundle's reach — and using
- * it also drops the runtime dependency on the optional @noble peers wherever
- * the OS provides ed25519.
- *
- * WHAT IT DOES NOT FIX, stated plainly: the ORCHESTRATION still lives in JS.
- * A hostile bundle can skip calling any verifier and drive the native staging
- * methods directly. Moving the crypto native shrinks the attack surface (no
- * more tampering with a bundled crypto lib to flip a verdict) but the full
- * close needs native-ENFORCED staging with a natively-pinned key — an
- * architectural change tracked separately, not smuggled into this one.
- *
- * VERDICT CONTRACT (mirrors the spec): the native side resolves
- * 'valid' | 'invalid' | 'unavailable'. 'invalid' is a definitive NO.
- * 'unavailable' (Android < 33, malformed input, machinery failure) means this
- * source cannot answer — the composed verifier below then delegates to the
- * @noble builtin, and when that is absent too it THROWS, which the policy
- * layer converts to a rejection. Every path that cannot verify refuses.
- */
-
-import NativeScaleBunOta from '../../../specs/NativeScaleBunOta';
-import { logger } from '../../../core/logger/internalLogger';
-import { decodeSignature, getBuiltinVerifier } from './builtinVerifier';
-import type { SignatureVerifier } from '../signature';
-
-const ED25519_PUBLIC_KEY_HEX_CHARS = 64;
-
-/** bytes → lowercase hex (the native side takes clean hex only). */
-function bytesToHex(bytes: Uint8Array): string {
-    let out = '';
-    for (const b of bytes) out += b.toString(16).padStart(2, '0');
-    return out;
-}
-
-/** Strict lowercase-hex normalization; null when the value is not hex. */
-function normalizeHex(value: string, expectedChars: number): string | null {
-    const clean = value.trim().toLowerCase().replace(/^0x/, '');
-    if (clean.length !== expectedChars || /[^0-9a-f]/.test(clean)) return null;
-    return clean;
-}
-
-let resolved: SignatureVerifier | null | undefined;
-
-/**
- * The native-first verifier, or null when the native module (or its
- * verifyEd25519 method — an app running new JS against an old binary) is
- * absent. Cached like the builtin: module availability does not change at
- * runtime, and this is consulted on every update check.
- */
-export function getNativeVerifier(): SignatureVerifier | null {
-    if (resolved !== undefined) return resolved;
-
-    const native = NativeScaleBunOta;
-    if (!native || typeof (native as any).verifyEd25519 !== 'function') {
-        // Old binary, Jest, web/SSR — not an error, just not this source.
-        resolved = null;
-        return null;
-    }
-
-    resolved = async ({ messageHex, signature, publicKey }) => {
-        // All decoding and validation happens HERE, in one place, so both
-        // platforms' native code only ever sees clean fixed-length hex. The
-        // signature may arrive hex or base64 (the wire allows both) — reuse
-        // the builtin's decoder rather than growing a second, subtly
-        // different one.
-        const message = normalizeHex(messageHex, 64);
-        const key = normalizeHex(publicKey, ED25519_PUBLIC_KEY_HEX_CHARS);
-        const sigBytes = decodeSignature(signature);
-        if (!message || !key || !sigBytes) {
-            // Same messages-by-symptom philosophy as the builtin: a mistyped
-            // key must not present as "every update is a forgery".
-            logger.error(
-                '[OTA] Signature inputs malformed (bundle hash, signature, or public key) — refusing to stage.',
-            );
-            return false;
-        }
-
-        let verdict: string;
-        try {
-            verdict = await (native as any).verifyEd25519(message, bytesToHex(sigBytes), key);
-        } catch (err: any) {
-            // A rejected promise is machinery failure, not a forgery verdict.
-            logger.warn(`[OTA] Native ed25519 verify failed to run: ${err?.message ?? err}`);
-            verdict = 'unavailable';
-        }
-
-        if (verdict === 'valid') return true;
-        if (verdict === 'invalid') return false;
-
-        // 'unavailable' (Android < 33) — fall back to the JS verifier so those
-        // devices keep verifying rather than losing enforcement.
-        const builtin = getBuiltinVerifier();
-        if (builtin) {
-            return builtin({ messageHex, signature, publicKey });
-        }
-        // No source can verify. Throwing (rather than returning false) keeps
-        // the policy layer's outcome labels honest: this surfaces as machinery
-        // failure with an actionable message, not as "the bundle is forged".
-        throw new Error(
-            'ed25519 unavailable: this OS has no native implementation (Android < 13) and the ' +
-                'optional peers @noble/ed25519 + @noble/hashes are not installed.',
-        );
-    };
-
-    __DEV__ && logger.debug('[OTA] Using native ed25519 verifier (platform crypto).');
-    return resolved;
-}
-
-/** Test seam — clears the cached resolution. */
-export function _resetNativeVerifier(): void {
-    resolved = undefined;
-}

package/src/features/ota/signature.ts

@@ -1,206 +0,0 @@
-import { logger } from '../../core/logger/internalLogger';
-import { getBuiltinVerifier } from './crypto/builtinVerifier';
-import { getNativeVerifier } from './crypto/nativeVerifier';
-
-/**
- * Bundle signature verification (OTA-03).
- *
- * WHAT WAS WRONG. `ota-signing-key.service.ts` documents the intended model
- * exactly: the CLI generates an ed25519 keypair locally, uploads only the public
- * half, and "the device verifies every bundle's signature before install and
- * rejects forgeries." Two of those three steps did not exist. The CLI had no
- * signing code, and this SDK received `bundle.signature` in the check response
- * and never read it. The only client-side check was SHA-256 against a hash
- * delivered in the same response as the URL — which defends against a corrupted
- * download and nothing else. On a platform whose entire purpose is remote code
- * delivery, that is the control that matters most.
- *
- * WHY IT IS SHAPED LIKE THIS. React Native has no built-in ed25519, so the
- * verification primitive has to come from somewhere. It is resolved in order:
- * a host-supplied verifier, else the built-in one assembled from the OPTIONAL
- * `@noble/ed25519` + `@noble/hashes` peers, else nothing — and the SDK's job is
- * to decide, unambiguously, what happens in that last case.
- *
- * The built-in path exists because requiring every adopter to hand-write a
- * verifier put the most security-critical operation in the product in code the
- * SDK could neither test nor audit, and made a routine dependency bump able to
- * silently stop all updates. See `crypto/builtinVerifier.ts`. Signing stays
- * opt-in, and apps that never adopt it carry no curve arithmetic.
- *
- * THE POLICY, which is the important part:
- *
- *   - A bundle carrying a signature, with a configured public key and a
- *     verifier: verified. Failure REJECTS the install. This is the goal state.
- *   - A bundle carrying a signature, with a public key configured, but no
- *     verifier available: REJECT. The app asked for signature enforcement by
- *     configuring a key; silently installing unverified code because a helper is
- *     missing would turn a security feature into a placebo.
- *   - No public key configured: skip, and say so once. Signing is opt-in per app,
- *     and an app that has not adopted it must keep working.
- *
- * The failure mode is the whole design: an app that opts in cannot be
- * accidentally downgraded to unverified installs.
- */
-
-/** Verifies a detached ed25519 signature. Supplied by the host app. */
-export type SignatureVerifier = (input: {
-  /** Hex-encoded SHA-256 of the bundle — what the signature is over. */
-  messageHex: string;
-  /** Hex or base64 detached signature from the check response. */
-  signature: string;
-  /** The app's configured ed25519 public key. */
-  publicKey: string;
-}) => boolean | Promise<boolean>;
-
-export interface SignatureConfig {
-  /**
-   * ed25519 public key(s) shipped in the app binary. Absent = signing not
-   * adopted. An ARRAY pins several keys at once and a bundle is accepted when
-   * ANY of them verifies — this is what makes key rotation possible without an
-   * app-store release: ship a build pinning [old, new], start signing with new,
-   * drop old from the next build. With a single pinnable key, losing the
-   * private key meant no OTA capability until a new binary cleared review —
-   * the exact emergency OTA exists to solve.
-   */
-  publicKey?: string | string[];
-  /** Host-provided ed25519 verification function. */
-  verifier?: SignatureVerifier;
-}
-
-export type SignatureOutcome =
-  | { ok: true; reason: 'verified' | 'not_configured' }
-  | {
-      ok: false;
-      reason: 'no_verifier' | 'invalid_signature' | 'missing_signature' | 'verifier_threw' | 'no_keys';
-    };
-
-let warnedNotConfigured = false;
-
-/**
- * Decide whether a bundle may be staged.
- *
- * Returns a structured outcome rather than a boolean so the caller can emit a
- * precise telemetry reason — "we shipped unverified code because no key was
- * configured" and "we refused because the signature was forged" are very
- * different operational events and must not collapse into one.
- */
-export async function verifyBundleSignature(
-  bundleSha256: string,
-  signature: string | undefined,
-  config: SignatureConfig | undefined,
-): Promise<SignatureOutcome> {
-  const rawKey = config?.publicKey;
-
-  // Normalize to a list. A single non-empty string is the pre-rotation config
-  // shape and behaves exactly as before; an array pins several keys at once.
-  const keys = (Array.isArray(rawKey) ? rawKey : rawKey ? [rawKey] : []).filter(
-    (k): k is string => typeof k === 'string' && k.trim().length > 0,
-  );
-
-  // Signing not adopted by this app — nothing to enforce. Parity note: a
-  // falsy single value (undefined, '') has always meant "not configured" and
-  // still does.
-  if (rawKey === undefined || rawKey === '' || rawKey === null) {
-    if (!warnedNotConfigured) {
-      warnedNotConfigured = true;
-      logger.warn(
-        '[OTA] No signing public key configured — bundles are accepted on SHA-256 ' +
-          'integrity alone. Configure `ota.publicSigningKey` to enforce authenticity.',
-      );
-    }
-    return { ok: true, reason: 'not_configured' };
-  }
-
-  // The host PROVIDED a key config that resolves to zero usable keys — an
-  // empty array, or an array of blank strings. That is a broken attempt to
-  // enable signing, not an absence of one, and the two must not collapse:
-  // treating `publicSigningKeys: []` as "not configured" would let a config
-  // mistake silently downgrade an app to unverified installs. Fail closed.
-  if (keys.length === 0) {
-    logger.error(
-      '[OTA] Signing key config resolves to zero usable keys (empty array or blank ' +
-        'strings) — refusing to stage. Remove the config to disable signing, or pin ' +
-        'at least one real key.',
-    );
-    return { ok: false, reason: 'no_keys' };
-  }
-
-  // The app opted in, so a bundle without a signature is a refusal, not a pass.
-  if (!signature) {
-    logger.error(
-      '[OTA] Bundle has no signature but a signing key is configured — refusing to stage.',
-    );
-    return { ok: false, reason: 'missing_signature' };
-  }
-
-  // Resolution order, and the order matters:
-  //   1. A host-supplied verifier ALWAYS wins. A team with its own crypto
-  //      policy must be able to override whatever the SDK would otherwise pick.
-  //   2. Otherwise the NATIVE verifier (CryptoKit / Android 13+ platform
-  //      ed25519). Preferred over the JS one because it runs outside the
-  //      bundle it protects and needs no optional peers; on OS levels without
-  //      ed25519 it delegates to the builtin internally.
-  //   3. Otherwise the built-in @noble verifier, if the optional peers are
-  //      installed. This is the path that removes ~100 lines of hand-written
-  //      crypto plumbing from every app that adopts signing.
-  //   4. Otherwise reject, because a configured key is a request for
-  //      enforcement and quietly installing unverified code would turn a
-  //      security feature into a placebo.
-  const verifier =
-    typeof config?.verifier === 'function'
-      ? config.verifier
-      : (getNativeVerifier() ?? getBuiltinVerifier());
-
-  if (!verifier) {
-    logger.error(
-      '[OTA] A signing key is configured but no signature verifier is available — ' +
-        'refusing to stage. Either install the optional peers ' +
-        '`@noble/ed25519` and `@noble/hashes` (the SDK then verifies with no ' +
-        'further code), or provide your own `ota.verifySignature`.',
-    );
-    return { ok: false, reason: 'no_verifier' };
-  }
-
-  // Try every pinned key; any single match accepts. The verifier contract is
-  // unchanged (one key per call) so host-supplied verifiers keep working.
-  //
-  // Outcome labelling when nothing matched, and why it matters: if at least
-  // one verifier call RAN TO COMPLETION and said no, the bundle failed
-  // verification — 'invalid_signature'. Only when EVERY call threw is the
-  // machinery itself suspect — 'verifier_threw'. Collapsing those (e.g. by
-  // letting the last key's throw win) would point an investigation at the
-  // host's verifier when the actual event was a forged bundle, or vice versa.
-  let sawThrow = false;
-  let sawCompletion = false;
-  for (const key of keys) {
-    try {
-      const valid = await verifier({
-        messageHex: bundleSha256,
-        signature,
-        publicKey: key,
-      });
-      sawCompletion = true;
-      if (valid) return { ok: true, reason: 'verified' };
-    } catch (err: any) {
-      // A throwing verifier is treated as a failed verification for this key,
-      // never as a pass — but the remaining keys still get their chance.
-      sawThrow = true;
-      logger.error(`[OTA] Signature verifier threw: ${err?.message ?? err}`);
-    }
-  }
-
-  if (sawThrow && !sawCompletion) {
-    return { ok: false, reason: 'verifier_threw' };
-  }
-  logger.error(
-    keys.length > 1
-      ? `[OTA] Bundle signature is INVALID under all ${keys.length} pinned keys — refusing to stage.`
-      : '[OTA] Bundle signature is INVALID — refusing to stage.',
-  );
-  return { ok: false, reason: 'invalid_signature' };
-}
-
-/** Test seam — resets the once-per-process "not configured" warning. */
-export function _resetSignatureWarnings(): void {
-  warnedNotConfigured = false;
-}