bleam 0.0.9 → 0.0.11

package/templates/native/ios/PlatformHelper/main.swift

@@ -1,335 +0,0 @@
-import Foundation
-import CryptoKit
-import Security
-import Darwin
-
-@objc private protocol PlatformHelperProtocol {
-  func health(reply: @escaping (Data?) -> Void)
-  func downloadPlatformUpdate(requestData: Data, reply: @escaping (Data?) -> Void)
-  func applyPlatformUpdate(requestData: Data, reply: @escaping (Bool) -> Void)
-}
-
-private struct DownloadRequest: Decodable {
-  let serviceURL: URL
-  let bundleIdentifier: String
-  let teamIdentifier: String
-}
-
-private struct ApplyRequest: Decodable {
-  let releaseId: String
-  let bundleIdentifier: String
-  let teamIdentifier: String
-  let installedAppPath: String
-  let appPID: Int32
-}
-
-private struct PlatformRelease: Decodable {
-  struct Artifact: Decodable {
-    let format: String
-    let url: URL
-    let sizeBytes: Int
-    let sha256: String
-  }
-
-  let kind: String
-  let releaseId: String
-  let bundleIdentifier: String
-  let teamIdentifier: String
-  let appVersion: String
-  let buildNumber: String
-  let bleamPlatformVersion: String
-  let target: Target
-  let artifact: Artifact
-
-  struct Target: Decodable {
-    let minimumMacOSVersion: String
-  }
-}
-
-private final class PlatformHelper: NSObject, PlatformHelperProtocol {
-  func health(reply: @escaping (Data?) -> Void) {
-    let response: [String: Any] = [
-      "healthy": true,
-      "protocolVersion": 1,
-      "helperVersion": Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown",
-      "platformVersion": Bundle.main.object(forInfoDictionaryKey: "BleamPlatformVersion") as? String ?? "unknown",
-      "capabilities": ["platform-updates"],
-    ]
-    reply(try? JSONSerialization.data(withJSONObject: response))
-  }
-
-  func downloadPlatformUpdate(requestData: Data, reply: @escaping (Data?) -> Void) {
-    guard
-      let request = try? JSONDecoder().decode(DownloadRequest.self, from: requestData),
-      let resolverURL = URL(
-        string: "/v1/apps/\(request.bundleIdentifier)/platform/macos-arm64",
-        relativeTo: request.serviceURL
-      )?.absoluteURL
-    else {
-      reply(nil)
-      return
-    }
-
-    URLSession.shared.dataTask(with: resolverURL) { data, response, _ in
-      guard
-        let data,
-        (response as? HTTPURLResponse)?.statusCode == 200,
-        let release = try? JSONDecoder().decode(PlatformRelease.self, from: data),
-        release.kind == "platform",
-        release.bundleIdentifier == request.bundleIdentifier,
-        release.teamIdentifier == request.teamIdentifier,
-        release.artifact.format == "bleam-macos-app-zip-v1",
-        release.releaseId.range(of: "^[a-z][a-z0-9_-]{2,127}$", options: .regularExpression) != nil
-      else {
-        reply(nil)
-        return
-      }
-
-      URLSession.shared.downloadTask(with: release.artifact.url) { temporaryURL, _, _ in
-        guard let temporaryURL else {
-          reply(nil)
-          return
-        }
-
-        do {
-          let cache = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)[0]
-            .appendingPathComponent("Bleam/Platform", isDirectory: true)
-            .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-            .appendingPathComponent(release.releaseId, isDirectory: true)
-          let completionReceipt = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-            .appendingPathComponent("Library/Application Support/Bleam/Updates", isDirectory: true)
-            .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-            .appendingPathComponent("\(release.releaseId).complete")
-          guard !FileManager.default.fileExists(atPath: completionReceipt.path) else {
-            reply(nil)
-            return
-          }
-          try FileManager.default.createDirectory(at: cache, withIntermediateDirectories: true)
-          let artifactURL = cache.appendingPathComponent("artifact.zip")
-          try? FileManager.default.removeItem(at: artifactURL)
-          try FileManager.default.moveItem(at: temporaryURL, to: artifactURL)
-          let appURL = try self.verify(
-            artifactURL: artifactURL,
-            release: release,
-            request: request,
-            cache: cache
-          )
-          let result: [String: Any] = [
-            "releaseId": release.releaseId,
-            "appVersion": release.appVersion,
-            "buildNumber": release.buildNumber,
-            "platformVersion": release.bleamPlatformVersion,
-            "artifactPath": artifactURL.path,
-            "appPath": appURL.path,
-            "sizeBytes": release.artifact.sizeBytes,
-            "sha256": release.artifact.sha256,
-            "verified": true,
-          ]
-          let receipt: [String: Any] = [
-            "releaseId": release.releaseId,
-            "bundleIdentifier": request.bundleIdentifier,
-            "teamIdentifier": request.teamIdentifier,
-            "appPath": appURL.path,
-          ]
-          let receiptData = try PropertyListSerialization.data(
-            fromPropertyList: receipt,
-            format: .binary,
-            options: 0
-          )
-          try receiptData.write(to: cache.appendingPathComponent("verified.plist"), options: .atomic)
-          reply(try? JSONSerialization.data(withJSONObject: result))
-        } catch {
-          reply(try? JSONSerialization.data(withJSONObject: [
-            "error": String(describing: error),
-          ]))
-        }
-      }.resume()
-    }.resume()
-  }
-
-  func applyPlatformUpdate(requestData: Data, reply: @escaping (Bool) -> Void) {
-    guard
-      let request = try? JSONDecoder().decode(ApplyRequest.self, from: requestData),
-      let installedURL = supportedInstalledURL(path: request.installedAppPath),
-      let candidateURL = verifiedCandidate(request: request)
-    else {
-      reply(false)
-      return
-    }
-
-    reply(true)
-    let activity = ProcessInfo.processInfo.beginActivity(
-      options: [.userInitiated, .idleSystemSleepDisabled, .suddenTerminationDisabled],
-      reason: "Applying a verified Bleam platform update"
-    )
-    DispatchQueue.global(qos: .userInitiated).async {
-      defer { ProcessInfo.processInfo.endActivity(activity) }
-      for _ in 0..<50 where kill(request.appPID, 0) == 0 {
-        usleep(100_000)
-      }
-      if kill(request.appPID, 0) == 0 {
-        _ = kill(request.appPID, SIGTERM)
-        for _ in 0..<50 where kill(request.appPID, 0) == 0 {
-          usleep(100_000)
-        }
-      }
-      guard kill(request.appPID, 0) != 0 else {
-        NSLog("Bleam platform replacement failed: app did not terminate")
-        return
-      }
-
-      let releaseRoot = candidateURL
-        .deletingLastPathComponent().deletingLastPathComponent()
-        .deletingLastPathComponent()
-      let backupURL = releaseRoot.appendingPathComponent("previous.app")
-      do {
-        try? FileManager.default.removeItem(at: backupURL)
-        try FileManager.default.moveItem(at: installedURL, to: backupURL)
-        do {
-          try FileManager.default.moveItem(at: candidateURL, to: installedURL)
-        } catch {
-          try? FileManager.default.moveItem(at: backupURL, to: installedURL)
-          throw error
-        }
-        let receipts = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-          .appendingPathComponent("Library/Application Support/Bleam/Updates", isDirectory: true)
-          .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-        try FileManager.default.createDirectory(at: receipts, withIntermediateDirectories: true)
-        try Data().write(to: receipts.appendingPathComponent("\(request.releaseId).complete"))
-        _ = try self.run("/usr/bin/open", [installedURL.path])
-      } catch {
-        NSLog("Bleam platform replacement failed: %@", error.localizedDescription)
-      }
-    }
-  }
-
-  private func supportedInstalledURL(path: String) -> URL? {
-    let applications = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-      .appendingPathComponent("Applications", isDirectory: true).standardizedFileURL
-    let candidate = URL(fileURLWithPath: path, isDirectory: true).standardizedFileURL
-    guard
-      candidate.deletingLastPathComponent() == applications,
-      candidate.pathExtension == "app"
-    else { return nil }
-    return candidate
-  }
-
-  private func verifiedCandidate(request: ApplyRequest) -> URL? {
-    let root = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)[0]
-      .appendingPathComponent("Bleam/Platform", isDirectory: true)
-      .appendingPathComponent(request.bundleIdentifier, isDirectory: true)
-      .appendingPathComponent(request.releaseId, isDirectory: true)
-    let receiptURL = root.appendingPathComponent("verified.plist")
-    guard
-      let data = try? Data(contentsOf: receiptURL),
-      let receipt = try? PropertyListSerialization.propertyList(from: data, format: nil) as? [String: String],
-      receipt["releaseId"] == request.releaseId,
-      receipt["bundleIdentifier"] == request.bundleIdentifier,
-      receipt["teamIdentifier"] == request.teamIdentifier,
-      let path = receipt["appPath"]
-    else { return nil }
-    return URL(fileURLWithPath: path, isDirectory: true)
-  }
-
-  private func verify(
-    artifactURL: URL,
-    release: PlatformRelease,
-    request: DownloadRequest,
-    cache: URL
-  ) throws -> URL {
-    let data = try Data(contentsOf: artifactURL, options: .mappedIfSafe)
-    guard
-      data.count == release.artifact.sizeBytes,
-      SHA256.hash(data: data).map({ String(format: "%02x", $0) }).joined() == release.artifact.sha256
-    else { throw VerificationError.invalidArtifact }
-
-    let entries = try run("/usr/bin/zipinfo", ["-1", artifactURL.path])
-      .split(separator: "\n").map(String.init)
-    guard !entries.isEmpty, entries.allSatisfy({ entry in
-      !entry.hasPrefix("/") && entry.split(separator: "/").allSatisfy { $0 != ".." }
-    }) else { throw VerificationError.unsafeArchivePath }
-    let appNames = Set(entries.compactMap { entry -> String? in
-      let parts = entry.split(separator: "/")
-      guard parts.count >= 2, parts[0] == "app", parts[1].hasSuffix(".app") else { return nil }
-      return String(parts[1])
-    })
-    guard
-      appNames.count == 1,
-      let appName = appNames.first,
-      entries.allSatisfy({ $0 == "app/" || $0.hasPrefix("app/\(appName)/") })
-    else { throw VerificationError.invalidArchiveLayout }
-
-    let extracted = cache.appendingPathComponent("extracted", isDirectory: true)
-    try? FileManager.default.removeItem(at: extracted)
-    try FileManager.default.createDirectory(at: extracted, withIntermediateDirectories: true)
-    _ = try run("/usr/bin/ditto", ["-x", "-k", artifactURL.path, extracted.path])
-    let appURL = extracted.appendingPathComponent("app/\(appName)")
-    guard
-      let info = NSDictionary(contentsOf: appURL.appendingPathComponent("Contents/Info.plist")),
-      info["CFBundleIdentifier"] as? String == request.bundleIdentifier,
-      info["CFBundleShortVersionString"] as? String == release.appVersion,
-      info["CFBundleVersion"] as? String == release.buildNumber,
-      let executable = info["CFBundleExecutable"] as? String
-    else { throw VerificationError.invalidIdentity }
-
-    var staticCode: SecStaticCode?
-    guard
-      SecStaticCodeCreateWithPath(appURL as CFURL, [], &staticCode) == errSecSuccess,
-      let staticCode,
-      SecStaticCodeCheckValidity(staticCode, SecCSFlags(rawValue: kSecCSStrictValidate), nil) == errSecSuccess
-    else { throw VerificationError.invalidSignature }
-    var signingInfo: CFDictionary?
-    guard
-      SecCodeCopySigningInformation(staticCode, SecCSFlags(rawValue: kSecCSSigningInformation), &signingInfo) == errSecSuccess,
-      (signingInfo as? [String: Any])?[kSecCodeInfoTeamIdentifier as String] as? String == request.teamIdentifier
-    else { throw VerificationError.invalidSignature }
-
-    let architectures = try run(
-      "/usr/bin/lipo",
-      ["-archs", appURL.appendingPathComponent("Contents/MacOS/\(executable)").path]
-    ).trimmingCharacters(in: .whitespacesAndNewlines)
-    guard architectures == "arm64" else { throw VerificationError.invalidArchitecture }
-
-    let required = release.target.minimumMacOSVersion.split(separator: ".").compactMap { Int($0) }
-    let current = ProcessInfo.processInfo.operatingSystemVersion
-    let installed = [current.majorVersion, current.minorVersion, current.patchVersion]
-    guard installed.lexicographicallyPrecedes(required) == false else {
-      throw VerificationError.unsupportedOS
-    }
-    return appURL
-  }
-
-  private func run(_ executable: String, _ arguments: [String]) throws -> String {
-    let process = Process()
-    let output = Pipe()
-    let errors = Pipe()
-    process.executableURL = URL(fileURLWithPath: executable)
-    process.arguments = arguments
-    process.standardOutput = output
-    process.standardError = errors
-    try process.run()
-    process.waitUntilExit()
-    guard process.terminationStatus == 0 else { throw VerificationError.commandFailed }
-    return String(decoding: output.fileHandleForReading.readDataToEndOfFile(), as: UTF8.self)
-  }
-}
-
-private enum VerificationError: Error {
-  case invalidArtifact, unsafeArchivePath, invalidArchiveLayout, invalidIdentity, invalidSignature
-  case invalidArchitecture, unsupportedOS, commandFailed
-}
-
-private final class PlatformHelperDelegate: NSObject, NSXPCListenerDelegate {
-  func listener(_ listener: NSXPCListener, shouldAcceptNewConnection connection: NSXPCConnection) -> Bool {
-    connection.exportedInterface = NSXPCInterface(with: PlatformHelperProtocol.self)
-    connection.exportedObject = PlatformHelper()
-    connection.resume()
-    return true
-  }
-}
-
-private let delegate = PlatformHelperDelegate()
-private let listener = NSXPCListener.service()
-listener.delegate = delegate
-listener.resume()
-RunLoop.main.run()