bleam 0.0.9 → 0.0.10

package/templates/native/ios/Bleam/AppDelegate.swift

@@ -4,6 +4,7 @@ import ReactAppDependencyProvider
 import UIKit
 import CryptoKit
 import Darwin
+import Security
 
 func launchArgument(_ name: String) -> String? {
   let arguments = ProcessInfo.processInfo.arguments
@@ -75,43 +76,68 @@ private enum PlatformHelperInstaller {
     guard let bundleIdentifier = Bundle.main.bundleIdentifier else { return }
 
     let serviceName = "PlatformHelper"
-    let bundledService = Bundle.main.bundleURL
-      .appendingPathComponent("Contents/XPCServices/\(serviceName).xpc", isDirectory: true)
-    guard FileManager.default.fileExists(atPath: bundledService.path) else {
+    let bundledHelper = Bundle.main.bundleURL
+      .appendingPathComponent("Contents/Helpers/\(serviceName)")
+    guard FileManager.default.isExecutableFile(atPath: bundledHelper.path) else {
       NSLog("Bleam helper unavailable: bundled executable is missing")
       return
     }
+    guard
+      let teamIdentifier = Bundle.main.object(forInfoDictionaryKey: "BleamTeamIdentifier") as? String,
+      let platformVersion = Bundle.main.object(forInfoDictionaryKey: "BleamRuntimeVersion") as? String,
+      validSignature(at: bundledHelper, teamIdentifier: teamIdentifier)
+    else {
+      NSLog("Bleam helper unavailable: bundled executable has an invalid identity")
+      return
+    }
 
     let label = "\(bundleIdentifier).PlatformHelper"
     let domain = "gui/\(getuid())"
-    _ = runLaunchctl(["bootout", "\(domain)/\(label)"])
-
     let helperRoot = homeDirectory
       .appendingPathComponent("Library/Application Support/Bleam/Helpers", isDirectory: true)
       .appendingPathComponent(bundleIdentifier, isDirectory: true)
-    let installedService = helperRoot.appendingPathComponent("\(serviceName).xpc", isDirectory: true)
-    let executable = installedService
-      .appendingPathComponent("Contents/MacOS/\(serviceName)")
+    let installedHelper = helperRoot.appendingPathComponent(serviceName)
+    let stagedHelper = helperRoot.appendingPathComponent(".\(serviceName).\(UUID().uuidString)")
+    let backupHelper = helperRoot.appendingPathComponent(".\(serviceName).previous.\(UUID().uuidString)")
+    let failedHelper = helperRoot.appendingPathComponent(".\(serviceName).failed.\(UUID().uuidString)")
+    let pendingApply = homeDirectory
+      .appendingPathComponent("Library/Application Support/Bleam/Updates", isDirectory: true)
+      .appendingPathComponent(bundleIdentifier, isDirectory: true)
+      .appendingPathComponent("platform-apply.pending")
     let launchAgents = homeDirectory
       .appendingPathComponent("Library/LaunchAgents", isDirectory: true)
     let plistURL = launchAgents.appendingPathComponent("\(label).plist")
     let propertyList: [String: Any] = [
       "Label": label,
-      "ProgramArguments": [executable.path],
-      "RunAtLoad": true,
-      "KeepAlive": true,
+      "ProgramArguments": [installedHelper.path],
       "ProcessType": "Background",
-      "MachServices": ["\(bundleIdentifier).PlatformHelper": true],
-      "EnvironmentVariables": ["XPC_SERVICE_NAME": "\(bundleIdentifier).PlatformHelper"],
+      "MachServices": [label: true],
+      "KeepAlive": [
+        "SuccessfulExit": false,
+        "PathState": [pendingApply.path: true],
+      ],
+      "EnvironmentVariables": [
+        "XPC_SERVICE_NAME": label,
+        "BLEAM_BUNDLE_IDENTIFIER": bundleIdentifier,
+        "BLEAM_TEAM_IDENTIFIER": teamIdentifier,
+        "BLEAM_HELPER_VERSION": platformVersion,
+        "BLEAM_PLATFORM_VERSION": platformVersion,
+      ],
     ]
 
     do {
+      defer { try? FileManager.default.removeItem(at: stagedHelper) }
       try FileManager.default.createDirectory(
         at: helperRoot,
         withIntermediateDirectories: true
       )
-      try? FileManager.default.removeItem(at: installedService)
-      try FileManager.default.copyItem(at: bundledService, to: installedService)
+      try FileManager.default.copyItem(at: bundledHelper, to: stagedHelper)
+      guard
+        FileManager.default.isExecutableFile(atPath: stagedHelper.path),
+        validSignature(at: stagedHelper, teamIdentifier: teamIdentifier)
+      else {
+        throw HelperInstallError.invalidSignature
+      }
       try FileManager.default.createDirectory(
         at: launchAgents,
         withIntermediateDirectories: true
@@ -121,18 +147,97 @@ private enum PlatformHelperInstaller {
         format: .xml,
         options: 0
       )
-      try data.write(to: plistURL, options: .atomic)
+      let previousPlist = try? Data(contentsOf: plistURL)
+      let wasRegistered = runLaunchctl(["print", "\(domain)/\(label)"]) == 0
+      if wasRegistered, runLaunchctl(["bootout", "\(domain)/\(label)"]) != 0 {
+        throw HelperInstallError.registrationFailed
+      }
+
+      do {
+        if FileManager.default.fileExists(atPath: installedHelper.path),
+          rename(installedHelper.path, backupHelper.path) != 0
+        {
+          throw HelperInstallError.replacementFailed
+        }
+        guard rename(stagedHelper.path, installedHelper.path) == 0 else {
+          throw HelperInstallError.replacementFailed
+        }
+        try data.write(to: plistURL, options: .atomic)
+        let bootstrapStatus = runLaunchctl(["bootstrap", domain, plistURL.path])
+        guard
+          bootstrapStatus == 0 || runLaunchctl(["print", "\(domain)/\(label)"]) == 0
+        else {
+          throw HelperInstallError.registrationFailed
+        }
+        try? FileManager.default.removeItem(at: backupHelper)
+        try? FileManager.default.removeItem(
+          at: helperRoot.appendingPathComponent("PlatformHelper.xpc", isDirectory: true)
+        )
+      } catch let installError {
+        do {
+          let newJobRegistered = runLaunchctl(["print", "\(domain)/\(label)"]) == 0
+          if newJobRegistered,
+            runLaunchctl(["bootout", "\(domain)/\(label)"]) != 0
+          {
+            throw HelperInstallError.rollbackFailed
+          }
+          if FileManager.default.fileExists(atPath: installedHelper.path),
+            rename(installedHelper.path, failedHelper.path) != 0
+          {
+            throw HelperInstallError.rollbackFailed
+          }
+          if FileManager.default.fileExists(atPath: backupHelper.path),
+            rename(backupHelper.path, installedHelper.path) != 0
+          {
+            throw HelperInstallError.rollbackFailed
+          }
+          if let previousPlist {
+            try previousPlist.write(to: plistURL, options: .atomic)
+            if wasRegistered,
+              runLaunchctl(["bootstrap", domain, plistURL.path]) != 0
+            {
+              throw HelperInstallError.rollbackFailed
+            }
+          } else {
+            try? FileManager.default.removeItem(at: plistURL)
+          }
+          try? FileManager.default.removeItem(at: failedHelper)
+        } catch {
+          NSLog("Bleam helper rollback failed: %@", error.localizedDescription)
+          throw error
+        }
+        throw installError
+      }
     } catch {
       NSLog("Bleam helper install failed: %@", error.localizedDescription)
       return
     }
-
-    if runLaunchctl(["bootstrap", domain, plistURL.path]) != 0 {
-      NSLog("Bleam helper registration failed")
-    }
 #endif
   }
 
+  private static func validSignature(at url: URL, teamIdentifier: String) -> Bool {
+    var staticCode: SecStaticCode?
+    guard
+      SecStaticCodeCreateWithPath(url as CFURL, [], &staticCode) == errSecSuccess,
+      let staticCode,
+      SecStaticCodeCheckValidity(
+        staticCode,
+        SecCSFlags(rawValue: kSecCSStrictValidate),
+        nil
+      ) == errSecSuccess
+    else { return false }
+
+    var signingInfo: CFDictionary?
+    guard
+      SecCodeCopySigningInformation(
+        staticCode,
+        SecCSFlags(rawValue: kSecCSSigningInformation),
+        &signingInfo
+      ) == errSecSuccess
+    else { return false }
+    return (signingInfo as? [String: Any])?[kSecCodeInfoTeamIdentifier as String] as? String == teamIdentifier
+  }
+
   private static func runLaunchctl(_ arguments: [String]) -> Int32 {
     let values = ["launchctl"] + arguments
     var argv = values.map { strdup($0) }
@@ -148,6 +253,10 @@ private enum PlatformHelperInstaller {
   }
 }
 
+private enum HelperInstallError: Error {
+  case invalidSignature, registrationFailed, replacementFailed, rollbackFailed
+}
+
 class ReactNativeDelegate: ExpoReactNativeFactoryDelegate {
   private let bundleOverrideURL: URL?
 

package/templates/native/ios/Bleam.xcodeproj/project.pbxproj

@@ -62,7 +62,7 @@
 		F11748422D0307B40044C1D9 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = F11748412D0307B40044C1D9 /* AppDelegate.swift */; };
 		F3E19B0AABF791129F5C2531 /* Flux2KVCache.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8D1000122F00000000000012 /* Flux2KVCache.swift */; };
 		A10000000000000000000001 /* main.swift in Sources */ = {isa = PBXBuildFile; fileRef = A10000000000000000000005 /* main.swift */; };
-		A10000000000000000000002 /* PlatformHelper.xpc in Embed XPC Services */ = {isa = PBXBuildFile; fileRef = A10000000000000000000006 /* PlatformHelper.xpc */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
+		A10000000000000000000002 /* PlatformHelper in Embed Platform Helper */ = {isa = PBXBuildFile; fileRef = A10000000000000000000006 /* PlatformHelper */; settings = {ATTRIBUTES = (CodeSignOnCopy, ); }; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -104,11 +104,21 @@
 			dstSubfolderSpec = 16;
 			files = (
 				8BEA0DE1098E9F3D9607D785 /* GenerationService.xpc in Embed XPC Services */,
-				A10000000000000000000002 /* PlatformHelper.xpc in Embed XPC Services */,
 			);
 			name = "Embed XPC Services";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		A10000000000000000000010 /* Embed Platform Helper */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "$(CONTENTS_FOLDER_PATH)/Helpers";
+			dstSubfolderSpec = 16;
+			files = (
+				A10000000000000000000002 /* PlatformHelper in Embed Platform Helper */,
+			);
+			name = "Embed Platform Helper";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
@@ -172,9 +182,8 @@
 		F11748412D0307B40044C1D9 /* AppDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; name = AppDelegate.swift; path = bleam/AppDelegate.swift; sourceTree = "<group>"; };
 		F11748442D0722820044C1D9 /* Bridging-Header.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = "Bridging-Header.h"; path = "bleam/Bridging-Header.h"; sourceTree = "<group>"; };
 		FB433ED9D990D1F5BEAC2C93 /* GenerationService.xpc */ = {isa = PBXFileReference; explicitFileType = "wrapper.xpc-service"; includeInIndex = 0; name = GenerationService.xpc; path = GenerationService.xpc; sourceTree = BUILT_PRODUCTS_DIR; };
-		A10000000000000000000004 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		A10000000000000000000005 /* main.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = main.swift; sourceTree = "<group>"; };
-		A10000000000000000000006 /* PlatformHelper.xpc */ = {isa = PBXFileReference; explicitFileType = "wrapper.xpc-service"; includeInIndex = 0; path = PlatformHelper.xpc; sourceTree = BUILT_PRODUCTS_DIR; };
+		A10000000000000000000006 /* PlatformHelper */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = PlatformHelper; sourceTree = BUILT_PRODUCTS_DIR; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -280,7 +289,7 @@
 			children = (
 				13B07F961A680F5B00A75B9A /* bleam.app */,
 				FB433ED9D990D1F5BEAC2C93 /* GenerationService.xpc */,
-				A10000000000000000000006 /* PlatformHelper.xpc */,
+				A10000000000000000000006 /* PlatformHelper */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -338,7 +347,6 @@
 		A1000000000000000000000F /* PlatformHelper */ = {
 			isa = PBXGroup;
 			children = (
-				A10000000000000000000004 /* Info.plist */,
 				A10000000000000000000005 /* main.swift */,
 			);
 			path = PlatformHelper;
@@ -414,6 +422,7 @@
 				84C420C0881684F1F1EB77FB /* [bleam] Normalize Catalyst prebuilt frameworks */,
 				BEC473809D63946EDB256C9A /* [CP] Embed Pods Frameworks */,
 				CA12AFD569B8A5A458B4F36A /* Embed XPC Services */,
+				A10000000000000000000010 /* Embed Platform Helper */,
 			);
 			buildRules = (
 			);
@@ -458,8 +467,8 @@
 			);
 			name = PlatformHelper;
 			productName = PlatformHelper;
-			productReference = A10000000000000000000006 /* PlatformHelper.xpc */;
-			productType = "com.apple.product-type.xpc-service";
+			productReference = A10000000000000000000006 /* PlatformHelper */;
+			productType = "com.apple.product-type.tool";
 		};
 /* End PBXNativeTarget section */
 
@@ -1061,17 +1070,13 @@
 		A1000000000000000000000C /* Debug */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				ARCHS = arm64;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 5SZ3H5P69M;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
-				GENERATE_INFOPLIST_FILE = NO;
-				INFOPLIST_FILE = PlatformHelper/Info.plist;
 				MACOSX_DEPLOYMENT_TARGET = 13.4;
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = dev.bleam.app.PlatformHelper;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = macosx;
 				SKIP_INSTALL = YES;
@@ -1083,17 +1088,13 @@
 		A1000000000000000000000D /* Release */ = {
 			isa = XCBuildConfiguration;
 			buildSettings = {
+				ARCHS = arm64;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_TEAM = 5SZ3H5P69M;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_HARDENED_RUNTIME = YES;
-				GENERATE_INFOPLIST_FILE = NO;
-				INFOPLIST_FILE = PlatformHelper/Info.plist;
 				MACOSX_DEPLOYMENT_TARGET = 13.4;
-				MARKETING_VERSION = 1.0;
-				PRODUCT_BUNDLE_IDENTIFIER = dev.bleam.app.PlatformHelper;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = macosx;
 				SKIP_INSTALL = YES;