bleam 0.0.10 → 0.0.12

package/templates/native/ios/PlatformHelper/main.swift

@@ -1,726 +0,0 @@
-import Foundation
-import CryptoKit
-import Security
-import Darwin
-
-@objc private protocol PlatformHelperProtocol {
-  func health(reply: @escaping (Data?) -> Void)
-  func downloadPlatformUpdate(requestData: Data, reply: @escaping (Data?) -> Void)
-  func applyPlatformUpdate(requestData: Data, reply: @escaping (Bool) -> Void)
-}
-
-private struct DownloadRequest: Decodable {
-  let serviceURL: URL
-  let bundleIdentifier: String
-  let teamIdentifier: String
-  let platformVersion: String
-  let platformFingerprint: String
-}
-
-private struct ApplyRequest: Codable {
-  let releaseId: String
-  let bundleIdentifier: String
-  let teamIdentifier: String
-  let installedAppPath: String
-  let appPID: Int32
-}
-
-private struct ApplyTransaction: Codable {
-  enum Stage: String, Codable {
-    case accepted, waitingForExit, verifying, replacing, failed
-  }
-
-  let request: ApplyRequest
-  var stage: Stage
-  var updatedAt: Date
-  var failure: String?
-}
-
-private struct VerifiedReceipt: Codable {
-  let releaseId: String
-  let bundleIdentifier: String
-  let teamIdentifier: String
-  let appVersion: String
-  let buildNumber: String
-  let platformVersion: String
-  let platformFingerprint: String
-  let executable: String
-  let architecture: String
-  let appPath: String
-}
-
-private struct PlatformRelease: Decodable {
-  struct Artifact: Decodable {
-    let format: String
-    let url: URL
-    let sizeBytes: Int
-    let sha256: String
-  }
-
-  let kind: String
-  let releaseId: String
-  let bundleIdentifier: String
-  let teamIdentifier: String
-  let appVersion: String
-  let buildNumber: String
-  let bleamPlatformVersion: String
-  let platformFingerprint: String
-  let redeploy: Bool?
-  let target: Target
-  let artifact: Artifact
-
-  struct Target: Decodable {
-    let minimumMacOSVersion: String
-  }
-}
-
-private final class PlatformHelper: NSObject {
-  private let bundleIdentifier: String
-  private let teamIdentifier: String
-  private let applyQueue = DispatchQueue(label: "dev.bleam.platform-helper.apply", qos: .userInitiated)
-
-  init(bundleIdentifier: String, teamIdentifier: String) {
-    self.bundleIdentifier = bundleIdentifier
-    self.teamIdentifier = teamIdentifier
-    super.init()
-    applyQueue.async { [weak self] in
-      self?.resumePendingApplies()
-    }
-  }
-
-  func health(reply: @escaping (Data?) -> Void) {
-    let environment = ProcessInfo.processInfo.environment
-    let response: [String: Any] = [
-      "healthy": true,
-      "protocolVersion": 1,
-      "helperVersion": environment["BLEAM_HELPER_VERSION"] ?? "unknown",
-      "platformVersion": environment["BLEAM_PLATFORM_VERSION"] ?? "unknown",
-      "capabilities": ["platform-updates"],
-    ]
-    reply(try? JSONSerialization.data(withJSONObject: response))
-  }
-
-  func downloadPlatformUpdate(requestData: Data, reply: @escaping (Data?) -> Void) {
-    guard
-      let request = try? JSONDecoder().decode(DownloadRequest.self, from: requestData),
-      request.bundleIdentifier == bundleIdentifier,
-      request.teamIdentifier == teamIdentifier,
-      let resolverURL = URL(
-        string: "/v1/apps/\(request.bundleIdentifier)/platform/macos-arm64",
-        relativeTo: request.serviceURL
-      )?.absoluteURL
-    else {
-      reply(nil)
-      return
-    }
-
-    URLSession.shared.dataTask(with: resolverURL) { data, response, _ in
-      guard
-        let data,
-        (response as? HTTPURLResponse)?.statusCode == 200,
-        let release = try? JSONDecoder().decode(PlatformRelease.self, from: data),
-        release.kind == "platform",
-        release.bundleIdentifier == request.bundleIdentifier,
-        release.teamIdentifier == request.teamIdentifier,
-        release.bleamPlatformVersion.compare(request.platformVersion, options: .numeric) != .orderedAscending,
-        release.platformFingerprint != request.platformFingerprint || release.redeploy == true,
-        release.artifact.format == "bleam-macos-app-zip-v1",
-        release.releaseId.range(of: "^[a-z][a-z0-9_-]{2,127}$", options: .regularExpression) != nil
-      else {
-        reply(nil)
-        return
-      }
-
-      URLSession.shared.downloadTask(with: release.artifact.url) { temporaryURL, _, _ in
-        guard let temporaryURL else {
-          reply(nil)
-          return
-        }
-
-        do {
-          let cache = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)[0]
-            .appendingPathComponent("Bleam/Platform", isDirectory: true)
-            .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-            .appendingPathComponent(release.releaseId, isDirectory: true)
-          let completionReceipt = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-            .appendingPathComponent("Library/Application Support/Bleam/Updates", isDirectory: true)
-            .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-            .appendingPathComponent("\(release.releaseId).complete")
-          guard !FileManager.default.fileExists(atPath: completionReceipt.path) else {
-            reply(nil)
-            return
-          }
-          try FileManager.default.createDirectory(at: cache, withIntermediateDirectories: true)
-          let artifactURL = cache.appendingPathComponent("artifact.zip")
-          try? FileManager.default.removeItem(at: artifactURL)
-          try FileManager.default.moveItem(at: temporaryURL, to: artifactURL)
-          let appURL = try self.verify(
-            artifactURL: artifactURL,
-            release: release,
-            request: request,
-            cache: cache
-          )
-          let result: [String: Any] = [
-            "releaseId": release.releaseId,
-            "appVersion": release.appVersion,
-            "buildNumber": release.buildNumber,
-            "platformVersion": release.bleamPlatformVersion,
-            "platformFingerprint": release.platformFingerprint,
-            "redeploy": release.redeploy == true,
-            "artifactPath": artifactURL.path,
-            "appPath": appURL.path,
-            "sizeBytes": release.artifact.sizeBytes,
-            "sha256": release.artifact.sha256,
-            "verified": true,
-          ]
-          let receiptData = try PropertyListEncoder().encode(
-            self.verifiedReceipt(appURL: appURL, release: release, request: request)
-          )
-          try receiptData.write(to: cache.appendingPathComponent("verified.plist"), options: .atomic)
-          reply(try? JSONSerialization.data(withJSONObject: result))
-        } catch {
-          NSLog("Bleam platform download failed: %@", String(describing: error))
-          reply(try? JSONSerialization.data(withJSONObject: [
-            "error": String(describing: error),
-          ]))
-        }
-      }.resume()
-    }.resume()
-  }
-
-  func applyPlatformUpdate(
-    requestData: Data,
-    clientProcessIdentifier: pid_t,
-    reply: @escaping (Bool) -> Void
-  ) {
-    guard let request = try? JSONDecoder().decode(ApplyRequest.self, from: requestData) else {
-      NSLog("Bleam platform apply rejected: invalid request")
-      reply(false)
-      return
-    }
-    guard
-      request.bundleIdentifier == bundleIdentifier,
-      request.teamIdentifier == teamIdentifier,
-      clientProcessIdentifier == request.appPID,
-      validReleaseId(request.releaseId)
-    else {
-      NSLog("Bleam platform apply rejected: request identity mismatch")
-      reply(false)
-      return
-    }
-    guard
-      let installedURL = supportedInstalledURL(path: request.installedAppPath),
-      (try? validateInstalledBundle(at: installedURL)) != nil
-    else {
-      NSLog("Bleam platform apply rejected: installed app identity mismatch")
-      reply(false)
-      return
-    }
-    guard
-      let candidate = verifiedCandidate(request: request),
-      let destinationURL = replacementURL(installedURL: installedURL, candidateURL: candidate.appURL),
-      destinationURL == installedURL || !FileManager.default.fileExists(atPath: destinationURL.path)
-    else {
-      NSLog("Bleam platform apply rejected: verified candidate unavailable")
-      reply(false)
-      return
-    }
-    guard acceptTransaction(request) else {
-      NSLog("Bleam platform apply rejected: transaction could not be persisted")
-      reply(false)
-      return
-    }
-    reply(true)
-    applyQueue.async { [weak self] in
-      self?.performApply(request)
-    }
-  }
-
-  private func resumePendingApplies() {
-    let receipts = receiptsURL(bundleIdentifier: bundleIdentifier)
-    guard let files = try? FileManager.default.contentsOfDirectory(
-      at: receipts,
-      includingPropertiesForKeys: nil
-    ) else {
-      clearPendingMarkerIfIdle()
-      return
-    }
-    for file in files where file.pathExtension == "applying" {
-      guard
-        let data = try? Data(contentsOf: file),
-        let transaction = try? PropertyListDecoder().decode(ApplyTransaction.self, from: data),
-        transaction.request.bundleIdentifier == bundleIdentifier,
-        validReleaseId(transaction.request.releaseId),
-        transaction.stage != .failed
-      else { continue }
-      performApply(transaction.request)
-    }
-    clearPendingMarkerIfIdle()
-  }
-
-  private func performApply(_ request: ApplyRequest) {
-    let completionURL = receiptsURL(bundleIdentifier: request.bundleIdentifier)
-      .appendingPathComponent("\(request.releaseId).complete")
-    if FileManager.default.fileExists(atPath: completionURL.path) {
-      try? FileManager.default.removeItem(at: transactionURL(for: request))
-      clearPendingMarkerIfIdle()
-      return
-    }
-
-    let activity = ProcessInfo.processInfo.beginActivity(
-      options: [.userInitiated, .idleSystemSleepDisabled],
-      reason: "Applying a verified Bleam platform update"
-    )
-    defer { ProcessInfo.processInfo.endActivity(activity) }
-
-    guard
-      request.bundleIdentifier == bundleIdentifier,
-      request.teamIdentifier == teamIdentifier,
-      let installedURL = supportedInstalledURL(path: request.installedAppPath),
-      let candidate = verifiedCandidate(request: request),
-      let destinationURL = replacementURL(installedURL: installedURL, candidateURL: candidate.appURL)
-    else {
-      recordFailure(request, error: VerificationError.invalidTransaction)
-      return
-    }
-    let candidateURL = candidate.appURL
-    let releaseRoot = candidateURL
-      .deletingLastPathComponent().deletingLastPathComponent()
-      .deletingLastPathComponent()
-    let backupURL = releaseRoot.appendingPathComponent("previous.app")
-
-    do {
-      try writeTransaction(request: request, stage: .waitingForExit)
-      for _ in 0..<50 where isApplicationProcessRunning(request) {
-        usleep(100_000)
-      }
-      if isApplicationProcessRunning(request) {
-        _ = kill(request.appPID, SIGTERM)
-        for _ in 0..<50 where isApplicationProcessRunning(request) {
-          usleep(100_000)
-        }
-      }
-      guard !isApplicationProcessRunning(request) else {
-        throw VerificationError.appDidNotTerminate
-      }
-
-      try writeTransaction(request: request, stage: .verifying)
-      if isValidBundle(at: destinationURL, expected: candidate.receipt) {
-        try finishApply(request: request, destinationURL: destinationURL)
-        return
-      }
-
-      try validateBundle(at: candidateURL, expected: candidate.receipt)
-      if FileManager.default.fileExists(atPath: installedURL.path) {
-        try validateInstalledBundle(at: installedURL)
-        try? FileManager.default.removeItem(at: backupURL)
-        try FileManager.default.moveItem(at: installedURL, to: backupURL)
-      } else if !FileManager.default.fileExists(atPath: backupURL.path) {
-        throw VerificationError.invalidTransaction
-      }
-
-      try writeTransaction(request: request, stage: .replacing)
-      try FileManager.default.moveItem(at: candidateURL, to: destinationURL)
-      try validateBundle(at: destinationURL, expected: candidate.receipt)
-      try finishApply(request: request, destinationURL: destinationURL)
-    } catch {
-      if FileManager.default.fileExists(atPath: backupURL.path) {
-        try? FileManager.default.removeItem(at: destinationURL)
-        if !FileManager.default.fileExists(atPath: installedURL.path) {
-          try? FileManager.default.moveItem(at: backupURL, to: installedURL)
-          _ = try? run("/usr/bin/open", [installedURL.path])
-        }
-      }
-      recordFailure(request, error: error)
-    }
-  }
-
-  private func finishApply(request: ApplyRequest, destinationURL: URL) throws {
-    let receipts = receiptsURL(bundleIdentifier: request.bundleIdentifier)
-    try FileManager.default.createDirectory(at: receipts, withIntermediateDirectories: true)
-    try Data().write(
-      to: receipts.appendingPathComponent("\(request.releaseId).complete"),
-      options: .atomic
-    )
-    try? FileManager.default.removeItem(at: transactionURL(for: request))
-    try? FileManager.default.removeItem(at: failureURL(for: request))
-    clearPendingMarkerIfIdle()
-    _ = try? run("/usr/bin/open", [destinationURL.path])
-  }
-
-  private func recordFailure(_ request: ApplyRequest, error: Error) {
-    NSLog("Bleam platform replacement failed: %@", String(describing: error))
-    do {
-      try writeTransaction(
-        request: request,
-        stage: .failed,
-        failure: String(describing: error),
-        destination: failureURL(for: request)
-      )
-      try? FileManager.default.removeItem(at: transactionURL(for: request))
-      clearPendingMarkerIfIdle()
-    } catch {
-      NSLog("Bleam platform failure receipt could not be written: %@", String(describing: error))
-    }
-  }
-
-  private func acceptTransaction(_ request: ApplyRequest) -> Bool {
-    do {
-      try writeTransaction(request: request, stage: .accepted)
-      try Data().write(to: pendingMarkerURL(), options: .atomic)
-      return true
-    } catch {
-      try? FileManager.default.removeItem(at: transactionURL(for: request))
-      clearPendingMarkerIfIdle()
-      return false
-    }
-  }
-
-  @discardableResult
-  private func writeTransaction(
-    request: ApplyRequest,
-    stage: ApplyTransaction.Stage,
-    failure: String? = nil,
-    destination: URL? = nil
-  ) throws -> URL {
-    let url = destination ?? transactionURL(for: request)
-    try FileManager.default.createDirectory(
-      at: url.deletingLastPathComponent(),
-      withIntermediateDirectories: true
-    )
-    let data = try PropertyListEncoder().encode(
-      ApplyTransaction(request: request, stage: stage, updatedAt: Date(), failure: failure)
-    )
-    try data.write(to: url, options: .atomic)
-    return url
-  }
-
-  private func transactionURL(for request: ApplyRequest) -> URL {
-    receiptsURL(bundleIdentifier: request.bundleIdentifier)
-      .appendingPathComponent("\(request.releaseId).applying")
-  }
-
-  private func failureURL(for request: ApplyRequest) -> URL {
-    receiptsURL(bundleIdentifier: request.bundleIdentifier)
-      .appendingPathComponent("\(request.releaseId).failed")
-  }
-
-  private func pendingMarkerURL() -> URL {
-    receiptsURL(bundleIdentifier: bundleIdentifier).appendingPathComponent("platform-apply.pending")
-  }
-
-  private func clearPendingMarkerIfIdle() {
-    let receipts = receiptsURL(bundleIdentifier: bundleIdentifier)
-    let hasPendingTransaction = (try? FileManager.default.contentsOfDirectory(
-      at: receipts,
-      includingPropertiesForKeys: nil
-    ).contains(where: { $0.pathExtension == "applying" })) == true
-    if !hasPendingTransaction {
-      try? FileManager.default.removeItem(at: pendingMarkerURL())
-    }
-  }
-
-  private func receiptsURL(bundleIdentifier: String) -> URL {
-    URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-      .appendingPathComponent("Library/Application Support/Bleam/Updates", isDirectory: true)
-      .appendingPathComponent(bundleIdentifier, isDirectory: true)
-  }
-
-  private func validReleaseId(_ releaseId: String) -> Bool {
-    releaseId.range(of: "^[a-z][a-z0-9_-]{2,127}$", options: .regularExpression) != nil
-  }
-
-  private func supportedInstalledURL(path: String) -> URL? {
-    let applications = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-      .appendingPathComponent("Applications", isDirectory: true).standardizedFileURL
-    let candidate = URL(fileURLWithPath: path, isDirectory: true).standardizedFileURL
-    guard
-      candidate.deletingLastPathComponent() == applications,
-      candidate.pathExtension == "app"
-    else { return nil }
-    return candidate
-  }
-
-  private func replacementURL(installedURL: URL, candidateURL: URL) -> URL? {
-    let replacement = installedURL.deletingLastPathComponent()
-      .appendingPathComponent(candidateURL.lastPathComponent, isDirectory: true)
-      .standardizedFileURL
-    guard
-      replacement.pathExtension == "app",
-      replacement.deletingLastPathComponent() == installedURL.deletingLastPathComponent()
-    else { return nil }
-    return replacement
-  }
-
-  private func isApplicationProcessRunning(_ request: ApplyRequest) -> Bool {
-    var path = [CChar](repeating: 0, count: Int(MAXPATHLEN) * 4)
-    guard proc_pidpath(request.appPID, &path, UInt32(path.count)) > 0 else { return false }
-    let executablePath = String(cString: path)
-    return executablePath.hasPrefix(request.installedAppPath + "/Contents/MacOS/")
-  }
-
-  private func verifiedCandidate(request: ApplyRequest) -> (appURL: URL, receipt: VerifiedReceipt)? {
-    let root = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)[0]
-      .appendingPathComponent("Bleam/Platform", isDirectory: true)
-      .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-      .appendingPathComponent(request.releaseId, isDirectory: true)
-    let receiptURL = root.appendingPathComponent("verified.plist")
-    guard
-      let data = try? Data(contentsOf: receiptURL),
-      let receipt = try? PropertyListDecoder().decode(VerifiedReceipt.self, from: data),
-      receipt.releaseId == request.releaseId,
-      receipt.bundleIdentifier == request.bundleIdentifier,
-      receipt.teamIdentifier == request.teamIdentifier
-    else { return nil }
-    let appURL = URL(fileURLWithPath: receipt.appPath, isDirectory: true).standardizedFileURL
-    let appRoot = root.appendingPathComponent("extracted/app", isDirectory: true).standardizedFileURL
-    guard
-      appURL.pathExtension == "app",
-      appURL.deletingLastPathComponent() == appRoot
-    else { return nil }
-    return (appURL, receipt)
-  }
-
-  private func verify(
-    artifactURL: URL,
-    release: PlatformRelease,
-    request: DownloadRequest,
-    cache: URL
-  ) throws -> URL {
-    let data = try Data(contentsOf: artifactURL, options: .mappedIfSafe)
-    guard
-      data.count == release.artifact.sizeBytes,
-      SHA256.hash(data: data).map({ String(format: "%02x", $0) }).joined() == release.artifact.sha256
-    else { throw VerificationError.invalidArtifact }
-
-    let entries = try run("/usr/bin/zipinfo", ["-1", artifactURL.path])
-      .split(separator: "\n").map(String.init)
-    guard !entries.isEmpty, entries.allSatisfy({ entry in
-      !entry.hasPrefix("/") && entry.split(separator: "/").allSatisfy { $0 != ".." }
-    }) else { throw VerificationError.unsafeArchivePath }
-    let appNames = Set(entries.compactMap { entry -> String? in
-      let parts = entry.split(separator: "/")
-      guard parts.count >= 2, parts[0] == "app", parts[1].hasSuffix(".app") else { return nil }
-      return String(parts[1])
-    })
-    guard
-      appNames.count == 1,
-      let appName = appNames.first,
-      entries.allSatisfy({ $0 == "app/" || $0.hasPrefix("app/\(appName)/") })
-    else { throw VerificationError.invalidArchiveLayout }
-
-    let extracted = cache.appendingPathComponent("extracted", isDirectory: true)
-    try? FileManager.default.removeItem(at: extracted)
-    try FileManager.default.createDirectory(at: extracted, withIntermediateDirectories: true)
-    _ = try run("/usr/bin/ditto", ["-x", "-k", artifactURL.path, extracted.path])
-    let appURL = extracted.appendingPathComponent("app/\(appName)")
-    try validateBundle(at: appURL, expected: verifiedReceipt(appURL: appURL, release: release, request: request))
-
-    let required = release.target.minimumMacOSVersion.split(separator: ".").compactMap { Int($0) }
-    let current = ProcessInfo.processInfo.operatingSystemVersion
-    let installed = [current.majorVersion, current.minorVersion, current.patchVersion]
-    guard installed.lexicographicallyPrecedes(required) == false else {
-      throw VerificationError.unsupportedOS
-    }
-    return appURL
-  }
-
-  private func verifiedReceipt(
-    appURL: URL,
-    release: PlatformRelease,
-    request: DownloadRequest
-  ) throws -> VerifiedReceipt {
-    guard
-      let info = NSDictionary(contentsOf: appURL.appendingPathComponent("Contents/Info.plist")),
-      let executable = info["CFBundleExecutable"] as? String
-    else { throw VerificationError.invalidIdentity }
-    return VerifiedReceipt(
-      releaseId: release.releaseId,
-      bundleIdentifier: request.bundleIdentifier,
-      teamIdentifier: request.teamIdentifier,
-      appVersion: release.appVersion,
-      buildNumber: release.buildNumber,
-      platformVersion: release.bleamPlatformVersion,
-      platformFingerprint: release.platformFingerprint,
-      executable: executable,
-      architecture: "arm64",
-      appPath: appURL.path
-    )
-  }
-
-  private func validateArchiveSymlinks(in appURL: URL) throws {
-    let root = appURL.resolvingSymlinksInPath().standardizedFileURL
-    let rootValues = try appURL.resourceValues(forKeys: [.isDirectoryKey, .isSymbolicLinkKey])
-    var enumerationFailed = false
-    guard rootValues.isDirectory == true,
-      rootValues.isSymbolicLink != true,
-      let enumerator = FileManager.default.enumerator(
-        at: appURL,
-        includingPropertiesForKeys: [.isSymbolicLinkKey],
-        errorHandler: { _, _ in enumerationFailed = true; return false }
-      )
-    else { throw VerificationError.unsafeArchivePath }
-    for case let url as URL in enumerator {
-      guard (try url.resourceValues(forKeys: [.isSymbolicLinkKey])).isSymbolicLink == true else { continue }
-      let target = url.resolvingSymlinksInPath().standardizedFileURL
-      guard
-        target == root || target.path.hasPrefix(root.path + "/"),
-        FileManager.default.fileExists(atPath: target.path)
-      else {
-        throw VerificationError.unsafeArchivePath
-      }
-    }
-    guard !enumerationFailed else { throw VerificationError.unsafeArchivePath }
-  }
-
-  private func validateBundle(at appURL: URL, expected: VerifiedReceipt) throws {
-    try validateArchiveSymlinks(in: appURL)
-    guard
-      let info = NSDictionary(contentsOf: appURL.appendingPathComponent("Contents/Info.plist")),
-      info["CFBundleIdentifier"] as? String == expected.bundleIdentifier,
-      info["CFBundleShortVersionString"] as? String == expected.appVersion,
-      info["CFBundleVersion"] as? String == expected.buildNumber,
-      info["BleamRuntimeVersion"] as? String == expected.platformVersion,
-      info["BleamPlatformFingerprint"] as? String == expected.platformFingerprint,
-      info["CFBundleExecutable"] as? String == expected.executable
-    else { throw VerificationError.invalidIdentity }
-
-    var staticCode: SecStaticCode?
-    guard
-      SecStaticCodeCreateWithPath(appURL as CFURL, [], &staticCode) == errSecSuccess,
-      let staticCode,
-      SecStaticCodeCheckValidity(staticCode, SecCSFlags(rawValue: kSecCSStrictValidate), nil) == errSecSuccess
-    else { throw VerificationError.invalidSignature }
-    var signingInfo: CFDictionary?
-    guard
-      SecCodeCopySigningInformation(staticCode, SecCSFlags(rawValue: kSecCSSigningInformation), &signingInfo) == errSecSuccess,
-      (signingInfo as? [String: Any])?[kSecCodeInfoTeamIdentifier as String] as? String == expected.teamIdentifier
-    else { throw VerificationError.invalidSignature }
-
-    let architectures = try run(
-      "/usr/bin/lipo",
-      ["-archs", appURL.appendingPathComponent("Contents/MacOS/\(expected.executable)").path]
-    ).trimmingCharacters(in: .whitespacesAndNewlines)
-    guard architectures == expected.architecture else { throw VerificationError.invalidArchitecture }
-  }
-
-  private func validateInstalledBundle(at appURL: URL) throws {
-    guard
-      let info = NSDictionary(contentsOf: appURL.appendingPathComponent("Contents/Info.plist")),
-      info["CFBundleIdentifier"] as? String == bundleIdentifier
-    else { throw VerificationError.invalidIdentity }
-
-    var staticCode: SecStaticCode?
-    guard
-      SecStaticCodeCreateWithPath(appURL as CFURL, [], &staticCode) == errSecSuccess,
-      let staticCode,
-      SecStaticCodeCheckValidity(staticCode, SecCSFlags(rawValue: kSecCSStrictValidate), nil) == errSecSuccess
-    else { throw VerificationError.invalidSignature }
-    var signingInfo: CFDictionary?
-    guard
-      SecCodeCopySigningInformation(staticCode, SecCSFlags(rawValue: kSecCSSigningInformation), &signingInfo) == errSecSuccess,
-      (signingInfo as? [String: Any])?[kSecCodeInfoTeamIdentifier as String] as? String == teamIdentifier
-    else { throw VerificationError.invalidSignature }
-  }
-
-  private func isValidBundle(at appURL: URL, expected: VerifiedReceipt) -> Bool {
-    guard FileManager.default.fileExists(atPath: appURL.path) else { return false }
-    do {
-      try validateBundle(at: appURL, expected: expected)
-      return true
-    } catch {
-      return false
-    }
-  }
-
-  private func run(_ executable: String, _ arguments: [String]) throws -> String {
-    let process = Process()
-    let output = Pipe()
-    let errors = Pipe()
-    process.executableURL = URL(fileURLWithPath: executable)
-    process.arguments = arguments
-    process.standardOutput = output
-    process.standardError = errors
-    try process.run()
-    process.waitUntilExit()
-    guard process.terminationStatus == 0 else { throw VerificationError.commandFailed }
-    return String(decoding: output.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self)
-  }
-}
-
-private final class PlatformHelperConnection: NSObject, PlatformHelperProtocol {
-  private let helper: PlatformHelper
-  private let processIdentifier: pid_t
-
-  init(helper: PlatformHelper, processIdentifier: pid_t) {
-    self.helper = helper
-    self.processIdentifier = processIdentifier
-  }
-
-  func health(reply: @escaping (Data?) -> Void) {
-    helper.health(reply: reply)
-  }
-
-  func downloadPlatformUpdate(requestData: Data, reply: @escaping (Data?) -> Void) {
-    helper.downloadPlatformUpdate(requestData: requestData, reply: reply)
-  }
-
-  func applyPlatformUpdate(requestData: Data, reply: @escaping (Bool) -> Void) {
-    helper.applyPlatformUpdate(
-      requestData: requestData,
-      clientProcessIdentifier: processIdentifier,
-      reply: reply
-    )
-  }
-}
-
-private enum VerificationError: Error {
-  case invalidArtifact, unsafeArchivePath, invalidArchiveLayout, invalidIdentity, invalidSignature
-  case invalidArchitecture, unsupportedOS, commandFailed, invalidTransaction, appDidNotTerminate
-}
-
-private final class PlatformHelperDelegate: NSObject, NSXPCListenerDelegate {
-  private let helper: PlatformHelper
-  private let codeSigningRequirement: String
-
-  init(helper: PlatformHelper, bundleIdentifier: String, teamIdentifier: String) {
-    self.helper = helper
-    self.codeSigningRequirement = "anchor apple generic and identifier \"\(bundleIdentifier)\" and certificate leaf[subject.OU] = \"\(teamIdentifier)\""
-  }
-
-  func listener(_ listener: NSXPCListener, shouldAcceptNewConnection connection: NSXPCConnection) -> Bool {
-    guard
-      connection.processIdentifier > 0,
-      connection.effectiveUserIdentifier == getuid()
-    else { return false }
-    connection.setCodeSigningRequirement(codeSigningRequirement)
-    connection.exportedInterface = NSXPCInterface(with: PlatformHelperProtocol.self)
-    connection.exportedObject = PlatformHelperConnection(
-      helper: helper,
-      processIdentifier: connection.processIdentifier
-    )
-    connection.resume()
-    return true
-  }
-}
-
-let environment = ProcessInfo.processInfo.environment
-guard
-  let serviceName = environment["XPC_SERVICE_NAME"],
-  let bundleIdentifier = environment["BLEAM_BUNDLE_IDENTIFIER"],
-  bundleIdentifier.range(of: "^[A-Za-z0-9.-]+$", options: .regularExpression) != nil,
-  let teamIdentifier = environment["BLEAM_TEAM_IDENTIFIER"],
-  teamIdentifier.range(of: "^[A-Z0-9]{10}$", options: .regularExpression) != nil
-else {
-  fatalError("Bleam platform helper requires launchd service metadata")
-}
-private let helper = PlatformHelper(bundleIdentifier: bundleIdentifier, teamIdentifier: teamIdentifier)
-private let delegate = PlatformHelperDelegate(
-  helper: helper,
-  bundleIdentifier: bundleIdentifier,
-  teamIdentifier: teamIdentifier
-)
-private let listener = NSXPCListener(machServiceName: serviceName)
-listener.delegate = delegate
-listener.resume()
-RunLoop.main.run()