bleam 0.0.9 → 0.0.10

package/templates/native/ios/PlatformHelper/main.swift

@@ -13,9 +13,11 @@ private struct DownloadRequest: Decodable {
   let serviceURL: URL
   let bundleIdentifier: String
   let teamIdentifier: String
+  let platformVersion: String
+  let platformFingerprint: String
 }
 
-private struct ApplyRequest: Decodable {
+private struct ApplyRequest: Codable {
   let releaseId: String
   let bundleIdentifier: String
   let teamIdentifier: String
@@ -23,6 +25,30 @@ private struct ApplyRequest: Decodable {
   let appPID: Int32
 }
 
+private struct ApplyTransaction: Codable {
+  enum Stage: String, Codable {
+    case accepted, waitingForExit, verifying, replacing, failed
+  }
+
+  let request: ApplyRequest
+  var stage: Stage
+  var updatedAt: Date
+  var failure: String?
+}
+
+private struct VerifiedReceipt: Codable {
+  let releaseId: String
+  let bundleIdentifier: String
+  let teamIdentifier: String
+  let appVersion: String
+  let buildNumber: String
+  let platformVersion: String
+  let platformFingerprint: String
+  let executable: String
+  let architecture: String
+  let appPath: String
+}
+
 private struct PlatformRelease: Decodable {
   struct Artifact: Decodable {
     let format: String
@@ -38,6 +64,8 @@ private struct PlatformRelease: Decodable {
   let appVersion: String
   let buildNumber: String
   let bleamPlatformVersion: String
+  let platformFingerprint: String
+  let redeploy: Bool?
   let target: Target
   let artifact: Artifact
 
@@ -46,13 +74,27 @@ private struct PlatformRelease: Decodable {
   }
 }
 
-private final class PlatformHelper: NSObject, PlatformHelperProtocol {
+private final class PlatformHelper: NSObject {
+  private let bundleIdentifier: String
+  private let teamIdentifier: String
+  private let applyQueue = DispatchQueue(label: "dev.bleam.platform-helper.apply", qos: .userInitiated)
+
+  init(bundleIdentifier: String, teamIdentifier: String) {
+    self.bundleIdentifier = bundleIdentifier
+    self.teamIdentifier = teamIdentifier
+    super.init()
+    applyQueue.async { [weak self] in
+      self?.resumePendingApplies()
+    }
+  }
+
   func health(reply: @escaping (Data?) -> Void) {
+    let environment = ProcessInfo.processInfo.environment
     let response: [String: Any] = [
       "healthy": true,
       "protocolVersion": 1,
-      "helperVersion": Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown",
-      "platformVersion": Bundle.main.object(forInfoDictionaryKey: "BleamPlatformVersion") as? String ?? "unknown",
+      "helperVersion": environment["BLEAM_HELPER_VERSION"] ?? "unknown",
+      "platformVersion": environment["BLEAM_PLATFORM_VERSION"] ?? "unknown",
       "capabilities": ["platform-updates"],
     ]
     reply(try? JSONSerialization.data(withJSONObject: response))
@@ -61,6 +103,8 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
   func downloadPlatformUpdate(requestData: Data, reply: @escaping (Data?) -> Void) {
     guard
       let request = try? JSONDecoder().decode(DownloadRequest.self, from: requestData),
+      request.bundleIdentifier == bundleIdentifier,
+      request.teamIdentifier == teamIdentifier,
       let resolverURL = URL(
         string: "/v1/apps/\(request.bundleIdentifier)/platform/macos-arm64",
         relativeTo: request.serviceURL
@@ -78,6 +122,8 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
         release.kind == "platform",
         release.bundleIdentifier == request.bundleIdentifier,
         release.teamIdentifier == request.teamIdentifier,
+        release.bleamPlatformVersion.compare(request.platformVersion, options: .numeric) != .orderedAscending,
+        release.platformFingerprint != request.platformFingerprint || release.redeploy == true,
         release.artifact.format == "bleam-macos-app-zip-v1",
         release.releaseId.range(of: "^[a-z][a-z0-9_-]{2,127}$", options: .regularExpression) != nil
       else {
@@ -119,26 +165,21 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
             "appVersion": release.appVersion,
             "buildNumber": release.buildNumber,
             "platformVersion": release.bleamPlatformVersion,
+            "platformFingerprint": release.platformFingerprint,
+            "redeploy": release.redeploy == true,
             "artifactPath": artifactURL.path,
             "appPath": appURL.path,
             "sizeBytes": release.artifact.sizeBytes,
             "sha256": release.artifact.sha256,
             "verified": true,
           ]
-          let receipt: [String: Any] = [
-            "releaseId": release.releaseId,
-            "bundleIdentifier": request.bundleIdentifier,
-            "teamIdentifier": request.teamIdentifier,
-            "appPath": appURL.path,
-          ]
-          let receiptData = try PropertyListSerialization.data(
-            fromPropertyList: receipt,
-            format: .binary,
-            options: 0
+          let receiptData = try PropertyListEncoder().encode(
+            self.verifiedReceipt(appURL: appURL, release: release, request: request)
           )
           try receiptData.write(to: cache.appendingPathComponent("verified.plist"), options: .atomic)
           reply(try? JSONSerialization.data(withJSONObject: result))
         } catch {
+          NSLog("Bleam platform download failed: %@", String(describing: error))
           reply(try? JSONSerialization.data(withJSONObject: [
             "error": String(describing: error),
           ]))
@@ -147,62 +188,248 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
     }.resume()
   }
 
-  func applyPlatformUpdate(requestData: Data, reply: @escaping (Bool) -> Void) {
+  func applyPlatformUpdate(
+    requestData: Data,
+    clientProcessIdentifier: pid_t,
+    reply: @escaping (Bool) -> Void
+  ) {
+    guard let request = try? JSONDecoder().decode(ApplyRequest.self, from: requestData) else {
+      NSLog("Bleam platform apply rejected: invalid request")
+      reply(false)
+      return
+    }
+    guard
+      request.bundleIdentifier == bundleIdentifier,
+      request.teamIdentifier == teamIdentifier,
+      clientProcessIdentifier == request.appPID,
+      validReleaseId(request.releaseId)
+    else {
+      NSLog("Bleam platform apply rejected: request identity mismatch")
+      reply(false)
+      return
+    }
     guard
-      let request = try? JSONDecoder().decode(ApplyRequest.self, from: requestData),
       let installedURL = supportedInstalledURL(path: request.installedAppPath),
-      let candidateURL = verifiedCandidate(request: request)
+      (try? validateInstalledBundle(at: installedURL)) != nil
     else {
+      NSLog("Bleam platform apply rejected: installed app identity mismatch")
+      reply(false)
+      return
+    }
+    guard
+      let candidate = verifiedCandidate(request: request),
+      let destinationURL = replacementURL(installedURL: installedURL, candidateURL: candidate.appURL),
+      destinationURL == installedURL || !FileManager.default.fileExists(atPath: destinationURL.path)
+    else {
+      NSLog("Bleam platform apply rejected: verified candidate unavailable")
+      reply(false)
+      return
+    }
+    guard acceptTransaction(request) else {
+      NSLog("Bleam platform apply rejected: transaction could not be persisted")
       reply(false)
       return
     }
-
     reply(true)
+    applyQueue.async { [weak self] in
+      self?.performApply(request)
+    }
+  }
+
+  private func resumePendingApplies() {
+    let receipts = receiptsURL(bundleIdentifier: bundleIdentifier)
+    guard let files = try? FileManager.default.contentsOfDirectory(
+      at: receipts,
+      includingPropertiesForKeys: nil
+    ) else {
+      clearPendingMarkerIfIdle()
+      return
+    }
+    for file in files where file.pathExtension == "applying" {
+      guard
+        let data = try? Data(contentsOf: file),
+        let transaction = try? PropertyListDecoder().decode(ApplyTransaction.self, from: data),
+        transaction.request.bundleIdentifier == bundleIdentifier,
+        validReleaseId(transaction.request.releaseId),
+        transaction.stage != .failed
+      else { continue }
+      performApply(transaction.request)
+    }
+    clearPendingMarkerIfIdle()
+  }
+
+  private func performApply(_ request: ApplyRequest) {
+    let completionURL = receiptsURL(bundleIdentifier: request.bundleIdentifier)
+      .appendingPathComponent("\(request.releaseId).complete")
+    if FileManager.default.fileExists(atPath: completionURL.path) {
+      try? FileManager.default.removeItem(at: transactionURL(for: request))
+      clearPendingMarkerIfIdle()
+      return
+    }
+
     let activity = ProcessInfo.processInfo.beginActivity(
-      options: [.userInitiated, .idleSystemSleepDisabled, .suddenTerminationDisabled],
+      options: [.userInitiated, .idleSystemSleepDisabled],
       reason: "Applying a verified Bleam platform update"
     )
-    DispatchQueue.global(qos: .userInitiated).async {
-      defer { ProcessInfo.processInfo.endActivity(activity) }
-      for _ in 0..<50 where kill(request.appPID, 0) == 0 {
+    defer { ProcessInfo.processInfo.endActivity(activity) }
+
+    guard
+      request.bundleIdentifier == bundleIdentifier,
+      request.teamIdentifier == teamIdentifier,
+      let installedURL = supportedInstalledURL(path: request.installedAppPath),
+      let candidate = verifiedCandidate(request: request),
+      let destinationURL = replacementURL(installedURL: installedURL, candidateURL: candidate.appURL)
+    else {
+      recordFailure(request, error: VerificationError.invalidTransaction)
+      return
+    }
+    let candidateURL = candidate.appURL
+    let releaseRoot = candidateURL
+      .deletingLastPathComponent().deletingLastPathComponent()
+      .deletingLastPathComponent()
+    let backupURL = releaseRoot.appendingPathComponent("previous.app")
+
+    do {
+      try writeTransaction(request: request, stage: .waitingForExit)
+      for _ in 0..<50 where isApplicationProcessRunning(request) {
         usleep(100_000)
       }
-      if kill(request.appPID, 0) == 0 {
+      if isApplicationProcessRunning(request) {
         _ = kill(request.appPID, SIGTERM)
-        for _ in 0..<50 where kill(request.appPID, 0) == 0 {
+        for _ in 0..<50 where isApplicationProcessRunning(request) {
           usleep(100_000)
         }
       }
-      guard kill(request.appPID, 0) != 0 else {
-        NSLog("Bleam platform replacement failed: app did not terminate")
+      guard !isApplicationProcessRunning(request) else {
+        throw VerificationError.appDidNotTerminate
+      }
+
+      try writeTransaction(request: request, stage: .verifying)
+      if isValidBundle(at: destinationURL, expected: candidate.receipt) {
+        try finishApply(request: request, destinationURL: destinationURL)
         return
       }
 
-      let releaseRoot = candidateURL
-        .deletingLastPathComponent().deletingLastPathComponent()
-        .deletingLastPathComponent()
-      let backupURL = releaseRoot.appendingPathComponent("previous.app")
-      do {
+      try validateBundle(at: candidateURL, expected: candidate.receipt)
+      if FileManager.default.fileExists(atPath: installedURL.path) {
+        try validateInstalledBundle(at: installedURL)
         try? FileManager.default.removeItem(at: backupURL)
         try FileManager.default.moveItem(at: installedURL, to: backupURL)
-        do {
-          try FileManager.default.moveItem(at: candidateURL, to: installedURL)
-        } catch {
+      } else if !FileManager.default.fileExists(atPath: backupURL.path) {
+        throw VerificationError.invalidTransaction
+      }
+
+      try writeTransaction(request: request, stage: .replacing)
+      try FileManager.default.moveItem(at: candidateURL, to: destinationURL)
+      try validateBundle(at: destinationURL, expected: candidate.receipt)
+      try finishApply(request: request, destinationURL: destinationURL)
+    } catch {
+      if FileManager.default.fileExists(atPath: backupURL.path) {
+        try? FileManager.default.removeItem(at: destinationURL)
+        if !FileManager.default.fileExists(atPath: installedURL.path) {
           try? FileManager.default.moveItem(at: backupURL, to: installedURL)
-          throw error
+          _ = try? run("/usr/bin/open", [installedURL.path])
         }
-        let receipts = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-          .appendingPathComponent("Library/Application Support/Bleam/Updates", isDirectory: true)
-          .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-        try FileManager.default.createDirectory(at: receipts, withIntermediateDirectories: true)
-        try Data().write(to: receipts.appendingPathComponent("\(request.releaseId).complete"))
-        _ = try self.run("/usr/bin/open", [installedURL.path])
-      } catch {
-        NSLog("Bleam platform replacement failed: %@", error.localizedDescription)
       }
+      recordFailure(request, error: error)
+    }
+  }
+
+  private func finishApply(request: ApplyRequest, destinationURL: URL) throws {
+    let receipts = receiptsURL(bundleIdentifier: request.bundleIdentifier)
+    try FileManager.default.createDirectory(at: receipts, withIntermediateDirectories: true)
+    try Data().write(
+      to: receipts.appendingPathComponent("\(request.releaseId).complete"),
+      options: .atomic
+    )
+    try? FileManager.default.removeItem(at: transactionURL(for: request))
+    try? FileManager.default.removeItem(at: failureURL(for: request))
+    clearPendingMarkerIfIdle()
+    _ = try? run("/usr/bin/open", [destinationURL.path])
+  }
+
+  private func recordFailure(_ request: ApplyRequest, error: Error) {
+    NSLog("Bleam platform replacement failed: %@", String(describing: error))
+    do {
+      try writeTransaction(
+        request: request,
+        stage: .failed,
+        failure: String(describing: error),
+        destination: failureURL(for: request)
+      )
+      try? FileManager.default.removeItem(at: transactionURL(for: request))
+      clearPendingMarkerIfIdle()
+    } catch {
+      NSLog("Bleam platform failure receipt could not be written: %@", String(describing: error))
+    }
+  }
+
+  private func acceptTransaction(_ request: ApplyRequest) -> Bool {
+    do {
+      try writeTransaction(request: request, stage: .accepted)
+      try Data().write(to: pendingMarkerURL(), options: .atomic)
+      return true
+    } catch {
+      try? FileManager.default.removeItem(at: transactionURL(for: request))
+      clearPendingMarkerIfIdle()
+      return false
+    }
+  }
+
+  @discardableResult
+  private func writeTransaction(
+    request: ApplyRequest,
+    stage: ApplyTransaction.Stage,
+    failure: String? = nil,
+    destination: URL? = nil
+  ) throws -> URL {
+    let url = destination ?? transactionURL(for: request)
+    try FileManager.default.createDirectory(
+      at: url.deletingLastPathComponent(),
+      withIntermediateDirectories: true
+    )
+    let data = try PropertyListEncoder().encode(
+      ApplyTransaction(request: request, stage: stage, updatedAt: Date(), failure: failure)
+    )
+    try data.write(to: url, options: .atomic)
+    return url
+  }
+
+  private func transactionURL(for request: ApplyRequest) -> URL {
+    receiptsURL(bundleIdentifier: request.bundleIdentifier)
+      .appendingPathComponent("\(request.releaseId).applying")
+  }
+
+  private func failureURL(for request: ApplyRequest) -> URL {
+    receiptsURL(bundleIdentifier: request.bundleIdentifier)
+      .appendingPathComponent("\(request.releaseId).failed")
+  }
+
+  private func pendingMarkerURL() -> URL {
+    receiptsURL(bundleIdentifier: bundleIdentifier).appendingPathComponent("platform-apply.pending")
+  }
+
+  private func clearPendingMarkerIfIdle() {
+    let receipts = receiptsURL(bundleIdentifier: bundleIdentifier)
+    let hasPendingTransaction = (try? FileManager.default.contentsOfDirectory(
+      at: receipts,
+      includingPropertiesForKeys: nil
+    ).contains(where: { $0.pathExtension == "applying" })) == true
+    if !hasPendingTransaction {
+      try? FileManager.default.removeItem(at: pendingMarkerURL())
     }
   }
 
+  private func receiptsURL(bundleIdentifier: String) -> URL {
+    URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
+      .appendingPathComponent("Library/Application Support/Bleam/Updates", isDirectory: true)
+      .appendingPathComponent(bundleIdentifier, isDirectory: true)
+  }
+
+  private func validReleaseId(_ releaseId: String) -> Bool {
+    releaseId.range(of: "^[a-z][a-z0-9_-]{2,127}$", options: .regularExpression) != nil
+  }
+
   private func supportedInstalledURL(path: String) -> URL? {
     let applications = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
       .appendingPathComponent("Applications", isDirectory: true).standardizedFileURL
@@ -214,7 +441,25 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
     return candidate
   }
 
-  private func verifiedCandidate(request: ApplyRequest) -> URL? {
+  private func replacementURL(installedURL: URL, candidateURL: URL) -> URL? {
+    let replacement = installedURL.deletingLastPathComponent()
+      .appendingPathComponent(candidateURL.lastPathComponent, isDirectory: true)
+      .standardizedFileURL
+    guard
+      replacement.pathExtension == "app",
+      replacement.deletingLastPathComponent() == installedURL.deletingLastPathComponent()
+    else { return nil }
+    return replacement
+  }
+
+  private func isApplicationProcessRunning(_ request: ApplyRequest) -> Bool {
+    var path = [CChar](repeating: 0, count: Int(MAXPATHLEN) * 4)
+    guard proc_pidpath(request.appPID, &path, UInt32(path.count)) > 0 else { return false }
+    let executablePath = String(cString: path)
+    return executablePath.hasPrefix(request.installedAppPath + "/Contents/MacOS/")
+  }
+
+  private func verifiedCandidate(request: ApplyRequest) -> (appURL: URL, receipt: VerifiedReceipt)? {
     let root = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)[0]
       .appendingPathComponent("Bleam/Platform", isDirectory: true)
       .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
@@ -222,13 +467,18 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
     let receiptURL = root.appendingPathComponent("verified.plist")
     guard
       let data = try? Data(contentsOf: receiptURL),
-      let receipt = try? PropertyListSerialization.propertyList(from: data, format: nil) as? [String: String],
-      receipt["releaseId"] == request.releaseId,
-      receipt["bundleIdentifier"] == request.bundleIdentifier,
-      receipt["teamIdentifier"] == request.teamIdentifier,
-      let path = receipt["appPath"]
+      let receipt = try? PropertyListDecoder().decode(VerifiedReceipt.self, from: data),
+      receipt.releaseId == request.releaseId,
+      receipt.bundleIdentifier == request.bundleIdentifier,
+      receipt.teamIdentifier == request.teamIdentifier
     else { return nil }
-    return URL(fileURLWithPath: path, isDirectory: true)
+    let appURL = URL(fileURLWithPath: receipt.appPath, isDirectory: true).standardizedFileURL
+    let appRoot = root.appendingPathComponent("extracted/app", isDirectory: true).standardizedFileURL
+    guard
+      appURL.pathExtension == "app",
+      appURL.deletingLastPathComponent() == appRoot
+    else { return nil }
+    return (appURL, receipt)
   }
 
   private func verify(
@@ -264,13 +514,76 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
     try FileManager.default.createDirectory(at: extracted, withIntermediateDirectories: true)
     _ = try run("/usr/bin/ditto", ["-x", "-k", artifactURL.path, extracted.path])
     let appURL = extracted.appendingPathComponent("app/\(appName)")
+    try validateBundle(at: appURL, expected: verifiedReceipt(appURL: appURL, release: release, request: request))
+
+    let required = release.target.minimumMacOSVersion.split(separator: ".").compactMap { Int($0) }
+    let current = ProcessInfo.processInfo.operatingSystemVersion
+    let installed = [current.majorVersion, current.minorVersion, current.patchVersion]
+    guard installed.lexicographicallyPrecedes(required) == false else {
+      throw VerificationError.unsupportedOS
+    }
+    return appURL
+  }
+
+  private func verifiedReceipt(
+    appURL: URL,
+    release: PlatformRelease,
+    request: DownloadRequest
+  ) throws -> VerifiedReceipt {
     guard
       let info = NSDictionary(contentsOf: appURL.appendingPathComponent("Contents/Info.plist")),
-      info["CFBundleIdentifier"] as? String == request.bundleIdentifier,
-      info["CFBundleShortVersionString"] as? String == release.appVersion,
-      info["CFBundleVersion"] as? String == release.buildNumber,
       let executable = info["CFBundleExecutable"] as? String
     else { throw VerificationError.invalidIdentity }
+    return VerifiedReceipt(
+      releaseId: release.releaseId,
+      bundleIdentifier: request.bundleIdentifier,
+      teamIdentifier: request.teamIdentifier,
+      appVersion: release.appVersion,
+      buildNumber: release.buildNumber,
+      platformVersion: release.bleamPlatformVersion,
+      platformFingerprint: release.platformFingerprint,
+      executable: executable,
+      architecture: "arm64",
+      appPath: appURL.path
+    )
+  }
+
+  private func validateArchiveSymlinks(in appURL: URL) throws {
+    let root = appURL.resolvingSymlinksInPath().standardizedFileURL
+    let rootValues = try appURL.resourceValues(forKeys: [.isDirectoryKey, .isSymbolicLinkKey])
+    var enumerationFailed = false
+    guard rootValues.isDirectory == true,
+      rootValues.isSymbolicLink != true,
+      let enumerator = FileManager.default.enumerator(
+        at: appURL,
+        includingPropertiesForKeys: [.isSymbolicLinkKey],
+        errorHandler: { _, _ in enumerationFailed = true; return false }
+      )
+    else { throw VerificationError.unsafeArchivePath }
+    for case let url as URL in enumerator {
+      guard (try url.resourceValues(forKeys: [.isSymbolicLinkKey])).isSymbolicLink == true else { continue }
+      let target = url.resolvingSymlinksInPath().standardizedFileURL
+      guard
+        target == root || target.path.hasPrefix(root.path + "/"),
+        FileManager.default.fileExists(atPath: target.path)
+      else {
+        throw VerificationError.unsafeArchivePath
+      }
+    }
+    guard !enumerationFailed else { throw VerificationError.unsafeArchivePath }
+  }
+
+  private func validateBundle(at appURL: URL, expected: VerifiedReceipt) throws {
+    try validateArchiveSymlinks(in: appURL)
+    guard
+      let info = NSDictionary(contentsOf: appURL.appendingPathComponent("Contents/Info.plist")),
+      info["CFBundleIdentifier"] as? String == expected.bundleIdentifier,
+      info["CFBundleShortVersionString"] as? String == expected.appVersion,
+      info["CFBundleVersion"] as? String == expected.buildNumber,
+      info["BleamRuntimeVersion"] as? String == expected.platformVersion,
+      info["BleamPlatformFingerprint"] as? String == expected.platformFingerprint,
+      info["CFBundleExecutable"] as? String == expected.executable
+    else { throw VerificationError.invalidIdentity }
 
     var staticCode: SecStaticCode?
     guard
@@ -281,22 +594,43 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
     var signingInfo: CFDictionary?
     guard
       SecCodeCopySigningInformation(staticCode, SecCSFlags(rawValue: kSecCSSigningInformation), &signingInfo) == errSecSuccess,
-      (signingInfo as? [String: Any])?[kSecCodeInfoTeamIdentifier as String] as? String == request.teamIdentifier
+      (signingInfo as? [String: Any])?[kSecCodeInfoTeamIdentifier as String] as? String == expected.teamIdentifier
     else { throw VerificationError.invalidSignature }
 
     let architectures = try run(
       "/usr/bin/lipo",
-      ["-archs", appURL.appendingPathComponent("Contents/MacOS/\(executable)").path]
+      ["-archs", appURL.appendingPathComponent("Contents/MacOS/\(expected.executable)").path]
     ).trimmingCharacters(in: .whitespacesAndNewlines)
-    guard architectures == "arm64" else { throw VerificationError.invalidArchitecture }
+    guard architectures == expected.architecture else { throw VerificationError.invalidArchitecture }
+  }
 
-    let required = release.target.minimumMacOSVersion.split(separator: ".").compactMap { Int($0) }
-    let current = ProcessInfo.processInfo.operatingSystemVersion
-    let installed = [current.majorVersion, current.minorVersion, current.patchVersion]
-    guard installed.lexicographicallyPrecedes(required) == false else {
-      throw VerificationError.unsupportedOS
+  private func validateInstalledBundle(at appURL: URL) throws {
+    guard
+      let info = NSDictionary(contentsOf: appURL.appendingPathComponent("Contents/Info.plist")),
+      info["CFBundleIdentifier"] as? String == bundleIdentifier
+    else { throw VerificationError.invalidIdentity }
+
+    var staticCode: SecStaticCode?
+    guard
+      SecStaticCodeCreateWithPath(appURL as CFURL, [], &staticCode) == errSecSuccess,
+      let staticCode,
+      SecStaticCodeCheckValidity(staticCode, SecCSFlags(rawValue: kSecCSStrictValidate), nil) == errSecSuccess
+    else { throw VerificationError.invalidSignature }
+    var signingInfo: CFDictionary?
+    guard
+      SecCodeCopySigningInformation(staticCode, SecCSFlags(rawValue: kSecCSSigningInformation), &signingInfo) == errSecSuccess,
+      (signingInfo as? [String: Any])?[kSecCodeInfoTeamIdentifier as String] as? String == teamIdentifier
+    else { throw VerificationError.invalidSignature }
+  }
+
+  private func isValidBundle(at appURL: URL, expected: VerifiedReceipt) -> Bool {
+    guard FileManager.default.fileExists(atPath: appURL.path) else { return false }
+    do {
+      try validateBundle(at: appURL, expected: expected)
+      return true
+    } catch {
+      return false
     }
-    return appURL
   }
 
   private func run(_ executable: String, _ arguments: [String]) throws -> String {
@@ -314,22 +648,79 @@ private final class PlatformHelper: NSObject, PlatformHelperProtocol {
   }
 }
 
+private final class PlatformHelperConnection: NSObject, PlatformHelperProtocol {
+  private let helper: PlatformHelper
+  private let processIdentifier: pid_t
+
+  init(helper: PlatformHelper, processIdentifier: pid_t) {
+    self.helper = helper
+    self.processIdentifier = processIdentifier
+  }
+
+  func health(reply: @escaping (Data?) -> Void) {
+    helper.health(reply: reply)
+  }
+
+  func downloadPlatformUpdate(requestData: Data, reply: @escaping (Data?) -> Void) {
+    helper.downloadPlatformUpdate(requestData: requestData, reply: reply)
+  }
+
+  func applyPlatformUpdate(requestData: Data, reply: @escaping (Bool) -> Void) {
+    helper.applyPlatformUpdate(
+      requestData: requestData,
+      clientProcessIdentifier: processIdentifier,
+      reply: reply
+    )
+  }
+}
+
 private enum VerificationError: Error {
   case invalidArtifact, unsafeArchivePath, invalidArchiveLayout, invalidIdentity, invalidSignature
-  case invalidArchitecture, unsupportedOS, commandFailed
+  case invalidArchitecture, unsupportedOS, commandFailed, invalidTransaction, appDidNotTerminate
 }
 
 private final class PlatformHelperDelegate: NSObject, NSXPCListenerDelegate {
+  private let helper: PlatformHelper
+  private let codeSigningRequirement: String
+
+  init(helper: PlatformHelper, bundleIdentifier: String, teamIdentifier: String) {
+    self.helper = helper
+    self.codeSigningRequirement = "anchor apple generic and identifier \"\(bundleIdentifier)\" and certificate leaf[subject.OU] = \"\(teamIdentifier)\""
+  }
+
   func listener(_ listener: NSXPCListener, shouldAcceptNewConnection connection: NSXPCConnection) -> Bool {
+    guard
+      connection.processIdentifier > 0,
+      connection.effectiveUserIdentifier == getuid()
+    else { return false }
+    connection.setCodeSigningRequirement(codeSigningRequirement)
     connection.exportedInterface = NSXPCInterface(with: PlatformHelperProtocol.self)
-    connection.exportedObject = PlatformHelper()
+    connection.exportedObject = PlatformHelperConnection(
+      helper: helper,
+      processIdentifier: connection.processIdentifier
+    )
     connection.resume()
     return true
   }
 }
 
-private let delegate = PlatformHelperDelegate()
-private let listener = NSXPCListener.service()
+let environment = ProcessInfo.processInfo.environment
+guard
+  let serviceName = environment["XPC_SERVICE_NAME"],
+  let bundleIdentifier = environment["BLEAM_BUNDLE_IDENTIFIER"],
+  bundleIdentifier.range(of: "^[A-Za-z0-9.-]+$", options: .regularExpression) != nil,
+  let teamIdentifier = environment["BLEAM_TEAM_IDENTIFIER"],
+  teamIdentifier.range(of: "^[A-Z0-9]{10}$", options: .regularExpression) != nil
+else {
+  fatalError("Bleam platform helper requires launchd service metadata")
+}
+private let helper = PlatformHelper(bundleIdentifier: bundleIdentifier, teamIdentifier: teamIdentifier)
+private let delegate = PlatformHelperDelegate(
+  helper: helper,
+  bundleIdentifier: bundleIdentifier,
+  teamIdentifier: teamIdentifier
+)
+private let listener = NSXPCListener(machServiceName: serviceName)
 listener.delegate = delegate
 listener.resume()
 RunLoop.main.run()