@shipvo/runtime 0.1.2 → 0.1.3

package/README.md

@@ -5,7 +5,7 @@ The native half of Shipvo's over-the-air updates, as an Expo module.
 - Verifies every release pointer (Ed25519) and bundle (SHA-256 + size) against a public key built into the shell.
 - Downloads bsdiff patches when it has the previous release, full bundles otherwise; stages atomically.
 - Applies without restart, marks the release healthy when the app says so, and discards a release that fails to boot 3 times.
-- Android and iOS. iOS downloads full bundles (patches are Android-only for now) and is verified on the iOS Simulator in CI; in the web simulator the app runs the same release as the web build.
+- Android and iOS. iOS applies patches from the bundle it is running (not yet from the app's embedded bundle) and downloads the full bundle otherwise. It is verified on the iOS Simulator in CI; in the web simulator the app runs the same release as the web build.
 
 ```json
 { "expo": { "plugins": [["@shipvo/runtime", { "baseUrl": "https://<your control plane>", "publicKey": "<base64 Ed25519 public key>", "appId": "myshop" }]] } }

package/ios/Patch.swift

@@ -0,0 +1,70 @@
+import Foundation
+
+/// bspatch for the standard BSDIFF40 format (same as Android `Patch.kt`): a 32-byte header, then bzip2 ctrl, diff and extra blocks.
+/// bzip2 comes from the system libbz2 (present in the iOS SDK and on macOS), loaded at run time so no build setting changes.
+enum Patch {
+  private typealias BuffDecompress = @convention(c) (UnsafeMutablePointer<CChar>?, UnsafeMutablePointer<UInt32>?, UnsafeMutablePointer<CChar>?, UInt32, Int32, Int32) -> Int32
+
+  private static let decompressFn: BuffDecompress? = {
+    let handle = dlopen("libbz2.1.0.dylib", RTLD_NOW) ?? dlopen("libbz2.so.1.0", RTLD_NOW) ?? dlopen(nil, RTLD_NOW)
+    guard let h = handle, let sym = dlsym(h, "BZ2_bzBuffToBuffDecompress") else { return nil }
+    return unsafeBitCast(sym, to: BuffDecompress.self)
+  }()
+
+  private static let maxOutput = 64 << 20
+
+  private static func offtin(_ b: [UInt8], _ o: Int) -> Int64 {
+    var y = Int64(b[o + 7] & 0x7F)
+    for i in stride(from: 6, through: 0, by: -1) { y = (y << 8) | Int64(b[o + i]) }
+    return (b[o + 7] & 0x80) != 0 ? -y : y
+  }
+
+  /// Decompress one whole bzip2 stream. Grows the output buffer until it fits, up to `maxOutput`.
+  private static func bunzip(_ src: [UInt8], expectAtLeast: Int) throws -> [UInt8] {
+    guard let fn = decompressFn else { throw UpdateError("bzip2 unavailable") }
+    var cap = max(expectAtLeast, 4096)
+    var input = src
+    while true {
+      var out = [UInt8](repeating: 0, count: cap)
+      var outLen = UInt32(cap)
+      let rc: Int32 = out.withUnsafeMutableBytes { o in
+        input.withUnsafeMutableBytes { i in
+          fn(o.baseAddress!.assumingMemoryBound(to: CChar.self), &outLen, i.baseAddress?.assumingMemoryBound(to: CChar.self), UInt32(i.count), 0, 0)
+        }
+      }
+      if rc == 0 { return Array(out[0..<Int(outLen)]) }
+      if rc == -8 /* BZ_OUTBUFF_FULL */ && cap < maxOutput * 4 { cap *= 4; continue }
+      throw UpdateError("patch block is not valid bzip2 (\(rc))")
+    }
+  }
+
+  static func apply(old: Data, patch: Data) throws -> Data {
+    let p = [UInt8](patch)
+    guard p.count >= 32, String(decoding: p[0..<8], as: UTF8.self) == "BSDIFF40" else { throw UpdateError("not a BSDIFF40 patch") }
+    let ctrlLen = offtin(p, 8), diffLen = offtin(p, 16), newSize = offtin(p, 24)
+    guard ctrlLen >= 0, diffLen >= 0, newSize >= 0, newSize <= Int64(maxOutput), 32 + ctrlLen + diffLen <= Int64(p.count) else { throw UpdateError("bad patch header") }
+    let n = Int(newSize), c0 = 32, d0 = 32 + Int(ctrlLen), e0 = d0 + Int(diffLen)
+    let ctrl = try bunzip(Array(p[c0..<d0]), expectAtLeast: 24)
+    let diff = try bunzip(Array(p[d0..<e0]), expectAtLeast: n)
+    let extra = try bunzip(Array(p[e0...]), expectAtLeast: 16)
+    let oldBytes = [UInt8](old)
+
+    var out = [UInt8](repeating: 0, count: n)
+    var oldPos: Int64 = 0, newPos = 0, ci = 0, di = 0, ei = 0
+    while newPos < n {
+      guard ci + 24 <= ctrl.count else { throw UpdateError("patch truncated") }
+      let x = offtin(ctrl, ci), y = offtin(ctrl, ci + 8), z = offtin(ctrl, ci + 16)
+      ci += 24
+      guard x >= 0, y >= 0, Int64(newPos) + x + y <= newSize, di + Int(x) <= diff.count, ei + Int(y) <= extra.count else { throw UpdateError("corrupt patch control") }
+      for i in 0..<Int(x) {
+        let op = oldPos + Int64(i)
+        let base: UInt8 = (op >= 0 && op < Int64(oldBytes.count)) ? oldBytes[Int(op)] : 0
+        out[newPos + i] = diff[di + i] &+ base
+      }
+      di += Int(x); newPos += Int(x); oldPos += x
+      for i in 0..<Int(y) { out[newPos + i] = extra[ei + i] }
+      ei += Int(y); newPos += Int(y); oldPos += z
+    }
+    return Data(out)
+  }
+}

package/ios/Updater.swift

@@ -3,7 +3,7 @@ import Foundation
 struct UpdateError: Error { let message: String; init(_ m: String) { message = m } }
 
 /// Fetch, verify and stage the newest signed release for this device's band. Mirrors Android `check()`.
-/// iOS downloads full bundles only for now; a pointer's `patches` are ignored (an Android-only optimisation).
+/// Uses a bsdiff patch when the pointer lists one from the bundle this device runs; any patch problem falls back to the full bundle.
 enum Updater {
   private static func require(_ cond: Bool, _ msg: @autoclosure () -> String) throws { if !cond { throw UpdateError(msg()) } }
 
@@ -41,15 +41,26 @@ enum Updater {
     let tmp = s.dir.appendingPathComponent("dl-\(release).tmp")
     try? FileManager.default.removeItem(at: tmp)
 
+    var via = "full", downloadedBytes = 0
     let d0 = Store.now()
-    let (fileURL, dresp) = try await URLSession.shared.download(for: request(resolve(s, url), etag: nil))
-    let dcode = (dresp as? HTTPURLResponse)?.statusCode ?? 0
-    try require(dcode == 200, "bundle HTTP \(dcode)")
-    try FileManager.default.moveItem(at: fileURL, to: tmp)
-    let downloadMs = (Store.now() - d0) * 1000
+    var ready = false
+    if let patch = try? await patched(s, core: core, wantSha: wantSha, wantSize: wantSize, to: tmp) {
+      ready = true; via = "patch"; downloadedBytes = patch
+    }
+    var downloadMs = (Store.now() - d0) * 1000
+    if !ready {
+      let f0 = Store.now()
+      let (fileURL, dresp) = try await URLSession.shared.download(for: request(resolve(s, url), etag: nil))
+      let dcode = (dresp as? HTTPURLResponse)?.statusCode ?? 0
+      try require(dcode == 200, "bundle HTTP \(dcode)")
+      try? FileManager.default.removeItem(at: tmp)
+      try FileManager.default.moveItem(at: fileURL, to: tmp)
+      downloadMs += (Store.now() - f0) * 1000
+    }
 
     let v0 = Store.now()
     let size = (try? FileManager.default.attributesOfItem(atPath: tmp.path)[.size] as? Int) ?? -1
+    if via == "full" { downloadedBytes = size }
     let ok = try (size == wantSize && Verify.sha256Hex(file: tmp) == wantSha)
     if !ok { try? FileManager.default.removeItem(at: tmp); s.addEvent("verify_failed:\(release)"); throw UpdateError("bundle hash/size mismatch") }
     let verifyMs = (Store.now() - v0) * 1000 + verifyPointerMs
@@ -58,10 +69,32 @@ enum Updater {
     try? FileManager.default.removeItem(at: dest)
     try FileManager.default.moveItem(at: tmp, to: dest)
     stage(s, dest: dest, release: release, sha: wantSha, issuedAt: body["issued_at"] as? String)
-    return ["status": "staged", "release": release, "bytes": size, "via": "full", "bundleBytes": size,
+    return ["status": "staged", "release": release, "bytes": downloadedBytes, "via": via, "bundleBytes": size,
             "downloadMs": Int(downloadMs), "verifyMs": Int(verifyMs), "issuedAt": body["issued_at"] as? String ?? ""]
   }
 
+  /// Try the patch from the bundle this device runs. Writes the rebuilt bundle to `tmp` and returns the patch size,
+  /// or throws (nothing left behind) so the caller can fetch the full bundle. The caller still checks the signed hash.
+  private static func patched(_ s: Store, core: [String: Any], wantSha: String, wantSize: Int, to tmp: URL) async throws -> Int {
+    guard let base = s.currentPath, s.currentSha != nil, FileManager.default.fileExists(atPath: base),
+          let list = core["patches"] as? [[String: Any]],
+          let entry = list.first(where: { $0["from_sha256"] as? String == s.currentSha }),
+          let purl = entry["url"] as? String, let psha = entry["sha256"] as? String, let psize = (entry["size"] as? NSNumber)?.intValue,
+          psize > 0, psize < wantSize else { throw UpdateError("no usable patch") }
+    do {
+      let (data, resp) = try await URLSession.shared.data(for: request(resolve(s, purl), etag: nil))
+      try require((resp as? HTTPURLResponse)?.statusCode == 200 && data.count == psize && Verify.sha256Hex(data) == psha, "patch download invalid")
+      let old = try Data(contentsOf: URL(fileURLWithPath: base))
+      try require(Verify.sha256Hex(old) == s.currentSha, "current bundle changed on disk")
+      let new = try Patch.apply(old: old, patch: data)
+      try require(new.count == wantSize && Verify.sha256Hex(new) == wantSha, "patched bundle does not match")
+      try new.write(to: tmp)
+      return psize
+    } catch {
+      try? FileManager.default.removeItem(at: tmp); s.addEvent("patch_failed"); throw error
+    }
+  }
+
   /// Synchronous so the lock is never held across a suspension point.
   private static func stage(_ s: Store, dest: URL, release: Int, sha: String, issuedAt: String?) {
     Store.lock.lock(); defer { Store.lock.unlock() }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipvo/runtime",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "license": "Apache-2.0",
   "description": "The Shipvo native runtime: a tiny Expo module that verifies (Ed25519 + SHA-256), downloads (bsdiff patches), stages and applies signed over-the-air releases, with crash-loop rollback. Plus the config plugin that pins the trust root in the native shell.",
   "main": "src/index.ts",