@zogien/native-sdk 0.11.0-fork.3 → 0.11.0-fork.4

package/src/updater/feed.zig

@@ -1,4 +1,5 @@
 const std = @import("std");
+const builtin = @import("builtin");
 
 const Ed25519 = std.crypto.sign.Ed25519;
 
@@ -7,6 +8,59 @@ pub const max_payload_bytes: usize = 32 * 1024;
 pub const max_release_notes_bytes: usize = 16 * 1024;
 pub const max_archive_url_bytes: usize = 4096;
 pub const max_archive_bytes: u64 = 8 * 1024 * 1024 * 1024;
+pub const max_feed_url_bytes: usize = 4096;
+/// A manifest trusts its `public_key` plus up to three `public_keys`, so
+/// a release can still be verified by installs that only know the key it
+/// is rotating away from.
+pub const max_public_keys: usize = 4;
+
+/// The release targets a feed may name, one per installable build.
+pub const targets = [_][]const u8{ "macos-aarch64", "macos-x86_64", "windows-x86_64", "windows-aarch64" };
+
+pub fn isTarget(value: []const u8) bool {
+    for (targets) |target| {
+        if (std.mem.eql(u8, value, target)) return true;
+    }
+    return false;
+}
+
+/// The target this build installs, or null where the updater has no
+/// release format.
+pub fn currentTarget() ?[]const u8 {
+    return comptime switch (builtin.os.tag) {
+        .macos => switch (builtin.cpu.arch) {
+            .aarch64 => "macos-aarch64",
+            .x86_64 => "macos-x86_64",
+            else => null,
+        },
+        .windows => switch (builtin.cpu.arch) {
+            .x86_64 => "windows-x86_64",
+            .aarch64 => "windows-aarch64",
+            else => null,
+        },
+        else => null,
+    };
+}
+
+/// Loosens the HTTPS rule for local testing: with `allow_loopback_http`,
+/// http:// URLs to 127.0.0.1, [::1] or localhost pass as well. The Ed25519
+/// signature stays the authority over what installs.
+pub const UrlPolicy = struct {
+    allow_loopback_http: bool = false,
+};
+
+pub fn urlAllowed(value: []const u8, policy: UrlPolicy) bool {
+    if (archiveUrlIsValid(value)) return true;
+    if (!policy.allow_loopback_http) return false;
+    if (value.len == 0 or value.len > max_archive_url_bytes) return false;
+    for (value) |byte| if (byte <= 0x20 or byte == 0x7f) return false;
+    const uri = std.Uri.parse(value) catch return false;
+    if (!std.mem.eql(u8, uri.scheme, "http")) return false;
+    const host = uri.host orelse return false;
+    var host_buffer: [64]u8 = undefined;
+    const host_name = host.toRaw(&host_buffer) catch return false;
+    return std.mem.eql(u8, host_name, "127.0.0.1") or std.mem.eql(u8, host_name, "[::1]") or std.mem.eql(u8, host_name, "::1") or std.ascii.eqlIgnoreCase(host_name, "localhost");
+}
 
 pub const Envelope = struct {
     payload: []const u8,
@@ -34,15 +88,32 @@ pub const VerifiedRelease = struct {
     }
 };
 
+/// Verifies a feed envelope against the app's trusted keys:
+/// `public_keys_base64` is one base64 Ed25519 public key, or several
+/// joined with commas (the manifest's `public_key` followed by its
+/// `public_keys`). The feed verifies when any of them signed the payload;
+/// a malformed key fails closed. Fields this version does not know are
+/// ignored, in the envelope and in the signed payload, so feeds can grow
+/// without breaking installed apps.
 pub fn verifyEnvelope(
     allocator: std.mem.Allocator,
     envelope_bytes: []const u8,
-    public_key_base64: []const u8,
+    public_keys_base64: []const u8,
+) !VerifiedRelease {
+    return verifyEnvelopeWithPolicy(allocator, envelope_bytes, public_keys_base64, .{});
+}
+
+/// `verifyEnvelope` with the release's archive URL held to `policy`.
+pub fn verifyEnvelopeWithPolicy(
+    allocator: std.mem.Allocator,
+    envelope_bytes: []const u8,
+    public_keys_base64: []const u8,
+    policy: UrlPolicy,
 ) !VerifiedRelease {
     if (envelope_bytes.len == 0 or envelope_bytes.len > max_envelope_bytes) return error.InvalidUpdateFeed;
     var arena = std.heap.ArenaAllocator.init(allocator);
     defer arena.deinit();
-    const envelope = std.json.parseFromSliceLeaky(Envelope, arena.allocator(), envelope_bytes, .{ .ignore_unknown_fields = false }) catch return error.InvalidUpdateFeed;
+    const envelope = std.json.parseFromSliceLeaky(Envelope, arena.allocator(), envelope_bytes, .{ .ignore_unknown_fields = true }) catch return error.InvalidUpdateFeed;
 
     const payload_size = std.base64.standard.Decoder.calcSizeForSlice(envelope.payload) catch return error.InvalidUpdateFeed;
     if (payload_size == 0 or payload_size > max_payload_bytes) return error.InvalidUpdateFeed;
@@ -55,17 +126,18 @@ pub fn verifyEnvelope(
     if (signature_size != signature_bytes.len) return error.InvalidUpdateSignature;
     std.base64.standard.Decoder.decode(&signature_bytes, envelope.signature) catch return error.InvalidUpdateSignature;
 
-    var public_key_bytes: [Ed25519.PublicKey.encoded_length]u8 = undefined;
-    const public_key_size = std.base64.standard.Decoder.calcSizeForSlice(public_key_base64) catch return error.InvalidUpdateKey;
-    if (public_key_size != public_key_bytes.len) return error.InvalidUpdateKey;
-    std.base64.standard.Decoder.decode(&public_key_bytes, public_key_base64) catch return error.InvalidUpdateKey;
-    const public_key = Ed25519.PublicKey.fromBytes(public_key_bytes) catch return error.InvalidUpdateKey;
+    var public_keys: [max_public_keys]Ed25519.PublicKey = undefined;
+    const public_key_count = try parsePublicKeys(public_keys_base64, &public_keys);
     const signature = Ed25519.Signature.fromBytes(signature_bytes);
-    signature.verifyStrict(payload, public_key) catch return error.InvalidUpdateSignature;
+    const signed = for (public_keys[0..public_key_count]) |public_key| {
+        signature.verifyStrict(payload, public_key) catch continue;
+        break true;
+    } else false;
+    if (!signed) return error.InvalidUpdateSignature;
 
-    var parsed = std.json.parseFromSlice(Release, allocator, payload, .{ .ignore_unknown_fields = false }) catch return error.InvalidUpdatePayload;
+    var parsed = std.json.parseFromSlice(Release, allocator, payload, .{ .ignore_unknown_fields = true }) catch return error.InvalidUpdatePayload;
     errdefer parsed.deinit();
-    try validateRelease(parsed.value);
+    try validateReleaseWithPolicy(parsed.value, policy);
     return .{
         .payload = payload,
         .release = parsed.value,
@@ -73,11 +145,79 @@ pub fn verifyEnvelope(
     };
 }
 
+/// Decodes a comma-separated list of base64 Ed25519 public keys.
+pub fn parsePublicKeys(list: []const u8, output: *[max_public_keys]Ed25519.PublicKey) !usize {
+    if (list.len == 0) return error.InvalidUpdateKey;
+    var count: usize = 0;
+    var parts = std.mem.splitScalar(u8, list, ',');
+    while (parts.next()) |part| {
+        if (count == output.len) return error.InvalidUpdateKey;
+        var key_bytes: [Ed25519.PublicKey.encoded_length]u8 = undefined;
+        const key_size = std.base64.standard.Decoder.calcSizeForSlice(part) catch return error.InvalidUpdateKey;
+        if (key_size != key_bytes.len) return error.InvalidUpdateKey;
+        std.base64.standard.Decoder.decode(&key_bytes, part) catch return error.InvalidUpdateKey;
+        output[count] = Ed25519.PublicKey.fromBytes(key_bytes) catch return error.InvalidUpdateKey;
+        count += 1;
+    }
+    return count;
+}
+
+/// Expands a manifest feed_url for one installed app: `{target}` becomes
+/// the release target the build installs (for example `macos-aarch64`)
+/// and `{current_version}` its version, so one manifest serves a feed
+/// per target, or lets a feed server answer per version. Placeholders
+/// belong to the path and query; any other brace, or one in the scheme
+/// or host, is invalid.
+pub fn expandFeedUrl(output: []u8, template: []const u8, target: []const u8, current_version: []const u8) ![]const u8 {
+    return expandFeedUrlWithPolicy(output, template, target, current_version, .{});
+}
+
+/// `expandFeedUrl` with the result held to `policy`.
+pub fn expandFeedUrlWithPolicy(output: []u8, template: []const u8, target: []const u8, current_version: []const u8, policy: UrlPolicy) ![]const u8 {
+    const scheme_len: usize = if (std.mem.startsWith(u8, template, "https://"))
+        "https://".len
+    else if (policy.allow_loopback_http and std.mem.startsWith(u8, template, "http://"))
+        "http://".len
+    else
+        return error.InvalidUpdateFeedUrl;
+    const authority_end = std.mem.findAnyPos(u8, template, scheme_len, "/?#") orelse template.len;
+    if (std.mem.findAny(u8, template[0..authority_end], "{}") != null) return error.InvalidUpdateFeedUrl;
+    if (!isTarget(target)) return error.InvalidUpdateFeedUrl;
+    _ = try parseVersion(current_version);
+
+    var length: usize = 0;
+    var index: usize = 0;
+    while (index < template.len) {
+        var replacement: []const u8 = template[index .. index + 1];
+        var consumed: usize = 1;
+        if (template[index] == '{') {
+            if (std.mem.startsWith(u8, template[index..], "{target}")) {
+                replacement = target;
+                consumed = "{target}".len;
+            } else if (std.mem.startsWith(u8, template[index..], "{current_version}")) {
+                replacement = current_version;
+                consumed = "{current_version}".len;
+            } else return error.InvalidUpdateFeedUrl;
+        } else if (template[index] == '}') return error.InvalidUpdateFeedUrl;
+        if (replacement.len > output.len - length) return error.InvalidUpdateFeedUrl;
+        @memcpy(output[length..][0..replacement.len], replacement);
+        length += replacement.len;
+        index += consumed;
+    }
+    const expanded = output[0..length];
+    if (expanded.len > max_feed_url_bytes or !urlAllowed(expanded, policy)) return error.InvalidUpdateFeedUrl;
+    return expanded;
+}
+
 pub fn validateRelease(release: Release) !void {
+    return validateReleaseWithPolicy(release, .{});
+}
+
+pub fn validateReleaseWithPolicy(release: Release, policy: UrlPolicy) !void {
     if (release.bundle_id.len == 0 or release.bundle_id.len > 128) return error.InvalidUpdatePayload;
     _ = try parseVersion(release.version);
-    if (!std.mem.eql(u8, release.target, "macos-aarch64") and !std.mem.eql(u8, release.target, "macos-x86_64")) return error.InvalidUpdatePayload;
-    if (!archiveUrlIsValid(release.archive_url)) return error.InvalidUpdatePayload;
+    if (!isTarget(release.target)) return error.InvalidUpdatePayload;
+    if (!urlAllowed(release.archive_url, policy)) return error.InvalidUpdatePayload;
     if (release.archive_bytes == 0 or release.archive_bytes > max_archive_bytes) return error.InvalidUpdatePayload;
     if (release.sha256.len != 64) return error.InvalidUpdatePayload;
     for (release.sha256) |byte| if (!(std.ascii.isDigit(byte) or (byte >= 'a' and byte <= 'f'))) return error.InvalidUpdatePayload;
@@ -213,3 +353,112 @@ test "archive URLs fit the runtime output buffer" {
     try std.testing.expect(!archiveUrlIsValid("http://example.com/release.zip"));
     try std.testing.expect(archiveUrlIsValid("https://example.com/releases/demo.zip?channel=stable"));
 }
+
+fn testEnvelopeAlloc(allocator: std.mem.Allocator, key_pair: Ed25519.KeyPair, payload: []const u8) ![]u8 {
+    const signature = try key_pair.sign(payload, null);
+    const payload_base64 = try allocator.alloc(u8, std.base64.standard.Encoder.calcSize(payload.len));
+    defer allocator.free(payload_base64);
+    var signature_base64: [std.base64.standard.Encoder.calcSize(Ed25519.Signature.encoded_length)]u8 = undefined;
+    return std.fmt.allocPrint(allocator, "{{\"payload\":\"{s}\",\"signature\":\"{s}\"}}", .{
+        std.base64.standard.Encoder.encode(payload_base64, payload),
+        std.base64.standard.Encoder.encode(&signature_base64, &signature.toBytes()),
+    });
+}
+
+fn testPublicKey(key_pair: Ed25519.KeyPair, buffer: *[std.base64.standard.Encoder.calcSize(Ed25519.PublicKey.encoded_length)]u8) []const u8 {
+    return std.base64.standard.Encoder.encode(buffer, &key_pair.public_key.toBytes());
+}
+
+const test_payload =
+    \\{"bundle_id":"com.example.demo","version":"1.2.3","target":"macos-aarch64","archive_url":"https://example.com/demo.zip","archive_bytes":42,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}
+;
+
+test "a feed verifies when any trusted key signed it" {
+    const allocator = std.testing.allocator;
+    const old_key = try Ed25519.KeyPair.generateDeterministic([_]u8{0x11} ** Ed25519.KeyPair.seed_length);
+    const new_key = try Ed25519.KeyPair.generateDeterministic([_]u8{0x22} ** Ed25519.KeyPair.seed_length);
+    var old_buffer: [44]u8 = undefined;
+    var new_buffer: [44]u8 = undefined;
+    const old_public = testPublicKey(old_key, &old_buffer);
+    const new_public = testPublicKey(new_key, &new_buffer);
+    const envelope = try testEnvelopeAlloc(allocator, old_key, test_payload);
+    defer allocator.free(envelope);
+
+    const both = try std.fmt.allocPrint(allocator, "{s},{s}", .{ new_public, old_public });
+    defer allocator.free(both);
+    var verified = try verifyEnvelope(allocator, envelope, both);
+    verified.deinit(allocator);
+    try std.testing.expectError(error.InvalidUpdateSignature, verifyEnvelope(allocator, envelope, new_public));
+
+    const malformed = try std.fmt.allocPrint(allocator, "{s},not-a-key", .{old_public});
+    defer allocator.free(malformed);
+    try std.testing.expectError(error.InvalidUpdateKey, verifyEnvelope(allocator, envelope, malformed));
+    const trailing = try std.fmt.allocPrint(allocator, "{s},", .{old_public});
+    defer allocator.free(trailing);
+    try std.testing.expectError(error.InvalidUpdateKey, verifyEnvelope(allocator, envelope, trailing));
+    const too_many = try std.fmt.allocPrint(allocator, "{s},{s},{s},{s},{s}", .{ new_public, new_public, new_public, new_public, old_public });
+    defer allocator.free(too_many);
+    try std.testing.expectError(error.InvalidUpdateKey, verifyEnvelope(allocator, envelope, too_many));
+}
+
+test "fields a newer feed adds are ignored" {
+    const allocator = std.testing.allocator;
+    const key_pair = try Ed25519.KeyPair.generateDeterministic([_]u8{0x33} ** Ed25519.KeyPair.seed_length);
+    var key_buffer: [44]u8 = undefined;
+    const payload =
+        \\{"bundle_id":"com.example.demo","version":"1.2.3","target":"macos-x86_64","archive_url":"https://example.com/demo.zip","archive_bytes":42,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","channel":"beta"}
+    ;
+    const envelope = try testEnvelopeAlloc(allocator, key_pair, payload);
+    defer allocator.free(envelope);
+    const extended = try std.fmt.allocPrint(allocator, "{s},\"format\":2}}", .{envelope[0 .. envelope.len - 1]});
+    defer allocator.free(extended);
+    var verified = try verifyEnvelope(allocator, extended, testPublicKey(key_pair, &key_buffer));
+    defer verified.deinit(allocator);
+    try std.testing.expectEqualStrings("macos-x86_64", verified.release.target);
+}
+
+test "feed URLs expand the target and installed version" {
+    var buffer: [max_feed_url_bytes]u8 = undefined;
+    try std.testing.expectEqualStrings(
+        "https://example.com/releases/macos-aarch64/native-update.json?from=1.2.3",
+        try expandFeedUrl(&buffer, "https://example.com/releases/{target}/native-update.json?from={current_version}", "macos-aarch64", "1.2.3"),
+    );
+    try std.testing.expectEqualStrings(
+        "https://example.com/native-update.json",
+        try expandFeedUrl(&buffer, "https://example.com/native-update.json", "macos-x86_64", "1.0.0"),
+    );
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&buffer, "https://example.com/{arch}/feed.json", "macos-aarch64", "1.2.3"));
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&buffer, "https://example.com/{target/feed.json", "macos-aarch64", "1.2.3"));
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&buffer, "https://example.com/target}/feed.json", "macos-aarch64", "1.2.3"));
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&buffer, "https://{target}.example.com/feed.json", "macos-aarch64", "1.2.3"));
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&buffer, "http://example.com/{target}/feed.json", "macos-aarch64", "1.2.3"));
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&buffer, "https://example.com/{target}/feed.json", "linux-x86_64", "1.2.3"));
+    try std.testing.expectError(error.InvalidVersion, expandFeedUrl(&buffer, "https://example.com/{target}/feed.json", "macos-aarch64", "1.02.3"));
+    var small: [24]u8 = undefined;
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&small, "https://example.com/{target}/feed.json", "macos-aarch64", "1.2.3"));
+}
+
+test "only builds with a release format have an update target" {
+    const target = currentTarget();
+    if ((builtin.os.tag == .macos or builtin.os.tag == .windows) and (builtin.cpu.arch == .aarch64 or builtin.cpu.arch == .x86_64)) {
+        try std.testing.expect(isTarget(target.?));
+    } else {
+        try std.testing.expect(target == null);
+    }
+}
+
+test "plain HTTP passes only to loopback hosts and only when testing asks for it" {
+    try std.testing.expect(!urlAllowed("http://127.0.0.1:8080/feed.json", .{}));
+    try std.testing.expect(urlAllowed("http://127.0.0.1:8080/feed.json", .{ .allow_loopback_http = true }));
+    try std.testing.expect(urlAllowed("http://localhost/feed.json", .{ .allow_loopback_http = true }));
+    try std.testing.expect(urlAllowed("http://[::1]:9000/feed.json", .{ .allow_loopback_http = true }));
+    try std.testing.expect(!urlAllowed("http://example.com/feed.json", .{ .allow_loopback_http = true }));
+    try std.testing.expect(!urlAllowed("http://127.0.0.1.example.com/feed.json", .{ .allow_loopback_http = true }));
+    try std.testing.expect(urlAllowed("https://example.com/feed.json", .{}));
+    var buffer: [max_feed_url_bytes]u8 = undefined;
+    try std.testing.expectEqualStrings(
+        "http://127.0.0.1:8080/windows-x86_64/feed.json",
+        try expandFeedUrlWithPolicy(&buffer, "http://127.0.0.1:8080/{target}/feed.json", "windows-x86_64", "1.0.0", .{ .allow_loopback_http = true }),
+    );
+    try std.testing.expectError(error.InvalidUpdateFeedUrl, expandFeedUrl(&buffer, "http://127.0.0.1:8080/{target}/feed.json", "windows-x86_64", "1.0.0"));
+}

package/src/updater/macos.zig

@@ -0,0 +1,187 @@
+//! The macOS half of the updater (engine.zig) for apps whose manifest sets
+//! `updates.mode` to `app`. The AppKit host does the Cocoa work
+//! (appkit_host.m, `native_sdk_macos_updates_*`): fetching through the
+//! user's network settings, unpacking with ditto, checking the bundle and
+//! its signing team, and the helper that swaps the bundle once this
+//! process exits. This file checks the archive's signed size and SHA-256
+//! and maps results onto the engine's.
+//!
+//! A release stages beside the app as `.<App.app>.native-update/` and
+//! installs when the app restarts into it or quits; the version that
+//! starts next reports `last updated`.
+
+const std = @import("std");
+const engine = @import("engine.zig");
+const feed = @import("feed.zig");
+
+extern fn native_sdk_macos_updates_eligibility() c_int;
+extern fn native_sdk_macos_updates_staged_version(bundle_id: [*]const u8, bundle_id_len: usize, output: [*]u8, capacity: usize) usize;
+extern fn native_sdk_macos_updates_take_last(bundle_id: [*]const u8, bundle_id_len: usize, output: [*]u8, capacity: usize) usize;
+extern fn native_sdk_macos_updates_fetch(url: [*]const u8, url_len: usize, allow_loopback_http: c_int, output: [*]u8, capacity: usize, output_len: *usize) c_int;
+extern fn native_sdk_macos_updates_download(url: [*]const u8, url_len: usize, allow_loopback_http: c_int, limit: u64, path_output: [*]u8, path_capacity: usize, path_len: *usize, context: ?*anyopaque, progress: *const fn (?*anyopaque, u64) callconv(.c) void, cancelled: *const fn (?*anyopaque) callconv(.c) c_int) c_int;
+extern fn native_sdk_macos_updates_stage(archive_path: [*]const u8, archive_path_len: usize, bundle_id: [*]const u8, bundle_id_len: usize, version: [*]const u8, version_len: usize) c_int;
+extern fn native_sdk_macos_updates_discard() void;
+extern fn native_sdk_macos_updates_install(bundle_id: [*]const u8, bundle_id_len: usize, from_version: [*]const u8, from_version_len: usize, relaunch: c_int) c_int;
+
+// Transfer results, as appkit_host.m numbers them.
+const transfer_network = 1;
+const transfer_http_status = 2;
+const transfer_too_large = 3;
+const transfer_cancelled = 4;
+
+const Install = struct {
+    bundle_buffer: [128]u8 = undefined,
+    bundle_len: usize = 0,
+    version_buffer: [64]u8 = undefined,
+    version_len: usize = 0,
+
+    fn bundleId(self: *const Install) []const u8 {
+        return self.bundle_buffer[0..self.bundle_len];
+    }
+    fn version(self: *const Install) []const u8 {
+        return self.version_buffer[0..self.version_len];
+    }
+};
+
+var install: Install = .{};
+
+/// The backend for this app; `version` is the running version, which the
+/// install records as the one it replaced.
+pub fn backend(bundle_id: []const u8, version: []const u8) engine.Backend {
+    install = .{};
+    install.bundle_len = copyInto(&install.bundle_buffer, bundle_id);
+    install.version_len = copyInto(&install.version_buffer, version);
+    return .{
+        .context = &install,
+        .eligibility = eligibility,
+        .staged_version = stagedVersion,
+        .take_last_update = takeLastUpdate,
+        .fetch = fetch,
+        .stage = stage,
+        .discard = discard,
+        .prepare_restart = prepareRestart,
+        .install_on_exit = installOnExit,
+    };
+}
+
+fn get(context: *anyopaque) *Install {
+    return @ptrCast(@alignCast(context));
+}
+
+fn eligibility(context: *anyopaque) ?engine.Unsupported {
+    _ = context;
+    return switch (native_sdk_macos_updates_eligibility()) {
+        0 => null,
+        1 => .not_installed,
+        else => .read_only,
+    };
+}
+
+fn stagedVersion(context: *anyopaque, output: []u8) ?[]const u8 {
+    const bundle_id = get(context).bundleId();
+    const length = native_sdk_macos_updates_staged_version(bundle_id.ptr, bundle_id.len, output.ptr, output.len);
+    return if (length == 0) null else output[0..length];
+}
+
+fn takeLastUpdate(context: *anyopaque, output: []u8) ?[]const u8 {
+    const bundle_id = get(context).bundleId();
+    const length = native_sdk_macos_updates_take_last(bundle_id.ptr, bundle_id.len, output.ptr, output.len);
+    return if (length == 0) null else output[0..length];
+}
+
+fn fetch(context: *anyopaque, url: []const u8, policy: feed.UrlPolicy, output: []u8) engine.FetchError![]const u8 {
+    _ = context;
+    var length: usize = 0;
+    return switch (native_sdk_macos_updates_fetch(url.ptr, url.len, @intFromBool(policy.allow_loopback_http), output.ptr, output.len, &length)) {
+        0 => output[0..length],
+        transfer_http_status => error.HttpStatus,
+        transfer_too_large => error.TooLarge,
+        else => error.Network,
+    };
+}
+
+fn stage(context: *anyopaque, release: *const engine.Release, policy: feed.UrlPolicy, progress: *engine.Progress) engine.StageError!void {
+    const self = get(context);
+    const url = release.url();
+    var path_buffer: [std.Io.Dir.max_path_bytes]u8 = undefined;
+    var path_len: usize = 0;
+    switch (native_sdk_macos_updates_download(url.ptr, url.len, @intFromBool(policy.allow_loopback_http), release.archive_bytes, &path_buffer, path_buffer.len, &path_len, progress, reportProgress, isCancelled)) {
+        0 => {},
+        transfer_network => return error.Network,
+        transfer_http_status => return error.HttpStatus,
+        transfer_too_large => return error.ArchiveSize,
+        transfer_cancelled => return error.Cancelled,
+        else => return error.Disk,
+    }
+    const path = path_buffer[0..path_len];
+
+    var threaded: std.Io.Threaded = .init(std.heap.page_allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+    defer std.Io.Dir.cwd().deleteFile(io, path) catch {};
+    try verifyArchive(io, path, release);
+
+    const version = release.version();
+    const bundle_id = self.bundleId();
+    return switch (native_sdk_macos_updates_stage(path.ptr, path.len, bundle_id.ptr, bundle_id.len, version.ptr, version.len)) {
+        0 => {},
+        1 => error.ArchiveInvalid,
+        else => error.Disk,
+    };
+}
+
+/// The archive must be exactly the size and SHA-256 the signed feed named.
+fn verifyArchive(io: std.Io, path: []const u8, release: *const engine.Release) engine.StageError!void {
+    var file = std.Io.Dir.cwd().openFile(io, path, .{}) catch return error.Disk;
+    defer file.close(io);
+    const size = (file.stat(io) catch return error.Disk).size;
+    if (size != release.archive_bytes) return error.ArchiveSize;
+    var buffer: [64 * 1024]u8 = undefined;
+    var reader = file.reader(io, &buffer);
+    var hasher = std.crypto.hash.sha2.Sha256.init(.{});
+    var chunk: [64 * 1024]u8 = undefined;
+    while (true) {
+        const count = reader.interface.readSliceShort(&chunk) catch return error.Disk;
+        if (count == 0) break;
+        hasher.update(chunk[0..count]);
+    }
+    var digest: [32]u8 = undefined;
+    hasher.final(&digest);
+    const actual = std.fmt.bytesToHex(digest, .lower);
+    if (!std.crypto.timing_safe.eql([64]u8, actual, release.sha256)) return error.ArchiveDigest;
+}
+
+fn discard(context: *anyopaque) void {
+    _ = context;
+    native_sdk_macos_updates_discard();
+}
+
+fn prepareRestart(context: *anyopaque) bool {
+    return startInstall(get(context), true);
+}
+
+fn installOnExit(context: *anyopaque) void {
+    _ = startInstall(get(context), false);
+}
+
+fn startInstall(self: *const Install, relaunch: bool) bool {
+    const bundle_id = self.bundleId();
+    const from = self.version();
+    return native_sdk_macos_updates_install(bundle_id.ptr, bundle_id.len, from.ptr, from.len, @intFromBool(relaunch)) == 1;
+}
+
+fn reportProgress(context: ?*anyopaque, received: u64) callconv(.c) void {
+    const progress: *engine.Progress = @ptrCast(@alignCast(context.?));
+    progress.report(received);
+}
+
+fn isCancelled(context: ?*anyopaque) callconv(.c) c_int {
+    const progress: *engine.Progress = @ptrCast(@alignCast(context.?));
+    return @intFromBool(progress.cancelled());
+}
+
+fn copyInto(buffer: []u8, value: []const u8) usize {
+    const length = @min(buffer.len, value.len);
+    @memcpy(buffer[0..length], value[0..length]);
+    return length;
+}

package/src/updater/root.zig

@@ -1,5 +1,46 @@
+const std = @import("std");
+const platform_types = @import("../platform/types.zig");
+
 pub const feed = @import("feed.zig");
 pub const c_api = @import("c_api.zig");
+pub const engine = @import("engine.zig");
+/// The Windows backend for SDK-installed apps; analyzed only by Windows builds.
+pub const windows = @import("windows.zig");
+/// The macOS backend for app-driven updates; analyzed only by builds that
+/// link the AppKit host.
+pub const macos = @import("macos.zig");
+
+/// The desktop host a runner was built for.
+pub const Host = enum { windows, macos_appkit, other };
+
+/// Points the app-driven updater at this installation; each runner calls
+/// it once at startup. Windows installs, and macOS apps whose manifest sets
+/// `updates.mode` to `app`, get a backend; elsewhere the updater reports
+/// why it cannot update. App mode on macOS also turns the host's own update
+/// UI off. Setting NATIVE_SDK_UPDATES_FEED_URL replaces the manifest's feed
+/// URL to test an update end to end, and may then name a loopback http://
+/// server; the manifest's Ed25519 keys stay the authority over what
+/// installs.
+pub fn configureApp(comptime host: Host, app_info: *platform_types.AppInfo, environ_map: *std.process.Environ.Map) void {
+    const override = environ_map.get("NATIVE_SDK_UPDATES_FEED_URL");
+    const app_mode = app_info.update_mode == .app;
+    const backend: ?engine.Backend = switch (host) {
+        .windows => windows.backend(app_info.bundle_id),
+        .macos_appkit => if (app_mode) macos.backend(app_info.bundle_id, app_info.version) else null,
+        .other => null,
+    };
+    engine.configure(.{
+        .feed_url = override orelse app_info.update_feed_url,
+        .public_keys = app_info.update_public_key,
+        .bundle_id = app_info.bundle_id,
+        .version = app_info.version,
+        .target = feed.currentTarget(),
+        .policy = .{ .allow_loopback_http = override != null },
+        .backend = backend,
+        .check_on_start = app_info.update_check_on_start,
+    });
+    if (host == .macos_appkit and app_mode) app_info.update_feed_url = "";
+}
 
 pub const Envelope = feed.Envelope;
 pub const Release = feed.Release;