gowalk-cicd 1.0.84 → 1.0.86

package/CLAUDE.md

@@ -123,6 +123,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Version source staged before signing is preserved separately with its original index bytes.
 - Never revoke a distribution certificate automatically, including legacy caches.
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
+  A certificate POST's HTTP 409 alone does not prove a full cap. `certificate_failure.py`
+  emits fixed reason/code evidence in `apple_certificate_rejected`; raw provider details stay private.
 - Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
   under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
   authenticated account exit without credentials in JVM options. The child HTTP_PROXY

package/README.md

@@ -852,6 +852,12 @@ common ones:
 | `ai-metadata` | `false` to disable AI auto-fill of empty ASC metadata |
 | `ai-metadata-model` | GitHub Models model id (default `openai/gpt-4o`) |
 
+Certificate creation refusals emit `apple_certificate_rejected` with schema
+`gowalk-cicd/apple-certificate-rejected.v1`, `operation`, `http_status`, `reason` and `error_codes`.
+HTTP 409 is classified as `certificate_limit` only when Apple's returned detail identifies the limit;
+otherwise it remains `unclassified_conflict`. Codes come from a fixed allowlist. Raw provider text and
+CSR data are excluded. Neither outcome permits automatic certificate deletion or another creation attempt.
+
 ## First-time app setup
 
 The app record must exist in App Store Connect before the first CI upload.
@@ -1052,3 +1058,7 @@ different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.
 All requests and parts still use the Apple proxy.
+
+Flutter SDK setup retries interrupted manifest and archive GETs on the assigned proxy. Archive attempts remain
+bounded, expose only complete bytes to extraction, and never retry authentication or certificate refusals. Cache
+identities remain those of the pinned upstream Flutter action.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.84
+1.0.86

package/action/scripts/cert_factory.py

@@ -18,6 +18,7 @@ import base64
 import os
 
 from asc_common import request
+import certificate_failure
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
@@ -76,10 +77,7 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
         "POST", "/certificates", token, json_body=body, allow_status={409}
     )
     if resp.status_code == 409:
-        raise SystemExit(
-            "distribution certificate cap reached; policy=fail preserves all "
-            "existing certificates and refuses automatic revocation; reconcile the account registry"
-        )
+        certificate_failure.refuse(resp)
     data = resp.json()["data"]
     cert_id = data["id"]
     cert_der = base64.b64decode(data["attributes"]["certificateContent"])

package/action/scripts/certificate_failure.py

@@ -0,0 +1,47 @@
+"""A certificate POST conflict is not proof of quota exhaustion."""
+from __future__ import annotations
+
+import json
+
+_CODES = frozenset({"ENTITY_ERROR", "ENTITY_ERROR.ATTRIBUTE.INVALID", "ENTITY_ERROR.ATTRIBUTE.REQUIRED",
+                    "ENTITY_ERROR.RELATIONSHIP.INVALID", "ENTITY_ERROR.RELATIONSHIP.REQUIRED",
+                    "STATE_ERROR", "FORBIDDEN_ERROR", "UNEXPECTED_ERROR"})
+_CAP_DETAILS = (
+    "maximum number of certificates",
+    "maximum allowed number of certificates",
+    "you already have a current distribution certificate or a pending certificate request",
+    "certificate limit has been reached",
+    "certificate limit reached",
+)
+
+
+def conflict(response) -> dict:
+    """Use fixed labels and code allowlists; never return provider text, URLs or CSR data."""
+    try:
+        payload = response.json()
+    except (ValueError, TypeError):
+        payload = {}
+    errors = payload.get("errors", []) if isinstance(payload, dict) else []
+    errors = errors[:32] if isinstance(errors, list) else []
+    codes, capped = set(), False
+    for error in errors:
+        if not isinstance(error, dict):
+            continue
+        code = error.get("code")
+        if isinstance(code, str) and code in _CODES:
+            codes.add(code)
+        detail = error.get("detail")
+        if isinstance(detail, str):
+            capped |= any(marker in detail[:8192].lower() for marker in _CAP_DETAILS)
+    return {"schema": "gowalk-cicd/apple-certificate-rejected.v1", "operation": "certificates_createInstance",
+            "http_status": 409, "reason": "certificate_limit" if capped else "unclassified_conflict",
+            "error_codes": sorted(codes)}
+
+
+def refuse(response) -> None:
+    result = conflict(response)
+    print("::error title=apple_certificate_rejected::" + json.dumps(result, separators=(",", ":")))
+    raise SystemExit(
+        f"Apple certificate request rejected (HTTP 409; reason={result['reason']}); "
+        "policy=fail preserves all existing certificates and refuses automatic revocation"
+    )

package/action/scripts/test_certificate_cap_policy.py

@@ -5,6 +5,8 @@ from __future__ import annotations
 import os
 import sys
 import unittest
+from contextlib import redirect_stdout
+from io import StringIO
 from pathlib import Path
 from unittest import mock
 
@@ -27,7 +29,8 @@ class CertificateCapPolicyTests(unittest.TestCase):
     def test_fail_policy_preserves_every_certificate_on_cap(self):
         response = mock.MagicMock(status_code=409)
         with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
-            with mock.patch.object(cert_factory, "request", return_value=response) as request:
+            with (mock.patch.object(cert_factory, "request", return_value=response) as request,
+                  redirect_stdout(StringIO())):
                 with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
                     cert_factory.create_distribution_cert("token", "csr")
         request.assert_called_once()
@@ -36,7 +39,8 @@ class CertificateCapPolicyTests(unittest.TestCase):
     def test_default_policy_never_revokes_or_retries_a_full_cap(self):
         capped = mock.MagicMock(status_code=409)
         with mock.patch.dict(os.environ, {}, clear=True):
-            with mock.patch.object(cert_factory, "request", return_value=capped) as request:
+            with (mock.patch.object(cert_factory, "request", return_value=capped) as request,
+                  redirect_stdout(StringIO())):
                 with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
                     cert_factory.create_distribution_cert("token", "csr")
         request.assert_called_once()

package/action/scripts/test_certificate_failure.py

@@ -0,0 +1,64 @@
+"""Retain useful Apple refusal evidence without inventing a cap or exposing response data."""
+import contextlib
+import io
+import json
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import cert_factory  # noqa: E402
+
+
+class CertificateFailureTests(unittest.TestCase):
+    def request(self, body):
+        response = requests.Response()
+        response.status_code = 409
+        response._content = body.encode()
+        output = io.StringIO()
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
+            with mock.patch.object(cert_factory, "request", return_value=response) as request:
+                with contextlib.redirect_stdout(output), self.assertRaises(SystemExit) as failed:
+                    cert_factory.create_distribution_cert("private-token", "private-csr")
+        request.assert_called_once()
+        self.assertEqual(request.call_args.args[:2], ("POST", "/certificates"))
+        text = output.getvalue() + str(failed.exception)
+        self.assertNotIn("private-", text)
+        return json.loads(output.getvalue().split("::", 2)[2]), str(failed.exception)
+
+    def test_limit_requires_the_provider_limit_detail(self):
+        for detail in ["Maximum number of certificates generated.",
+                       "You already have a current Distribution certificate or a pending certificate request."]:
+            with self.subTest(detail=detail):
+                result, message = self.request(json.dumps({"errors": [{
+                    "code": "ENTITY_ERROR.ATTRIBUTE.INVALID", "detail": detail,
+                    "source": {"pointer": "private-source"}, "links": {"about": "private-url"}}]}))
+                self.assertEqual(result["reason"], "certificate_limit")
+                self.assertEqual(result["error_codes"], ["ENTITY_ERROR.ATTRIBUTE.INVALID"])
+                self.assertIn("refuses automatic revocation", message)
+
+    def test_other_conflicts_are_not_reported_as_quota(self):
+        cases = [{"errors": [{"code": "ENTITY_ERROR.ATTRIBUTE.INVALID", "detail": "Invalid private-csr"}]},
+                 {"errors": [{"code": "private-secret", "detail": "private-response"}]},
+                 {"errors": [{"code": ["private-value"]}]}, {"errors": "private-response"},
+                 {"errors": ["private-response"]}, [], None]
+        for case in cases:
+            with self.subTest(case=case):
+                result, message = self.request(json.dumps(case))
+                self.assertEqual(result["reason"], "unclassified_conflict")
+                self.assertNotIn("cap reached", message)
+                self.assertEqual(result["http_status"], 409)
+                self.assertEqual(result["operation"], "certificates_createInstance")
+
+    def test_non_json_response_is_an_unclassified_conflict(self):
+        result, _ = self.request("<html>private-response</html>")
+        self.assertEqual(result["reason"], "unclassified_conflict")
+        self.assertEqual(result["error_codes"], [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.84
+1.0.86

package/android-action/scripts/flutter_manifest.py

@@ -1,10 +1,11 @@
-"""Retry the official Flutter manifest GET without exposing partial JSON or proxy secrets."""
+"""Retry the official Flutter manifest and SDK archive GETs without exposing partial JSON or proxy secrets."""
 from __future__ import annotations
 
 import json
 import os
 from pathlib import Path
 import re
+import shutil
 import subprocess
 import sys
 import tempfile
@@ -16,30 +17,23 @@ RETRY_HTTP = {408, 429, 500, 502, 503, 504}
 
 
 def download(arguments: list[str], directory: Path) -> int:
-    # This is the exact GET made by the pinned upstream setup.sh. Refuse new semantics.
-    if arguments[:-1] != ["--silent", "--connect-timeout", "15", "--retry", "5"]:
-        raise ValueError("flutter_manifest_arguments_unrecognized")
-    url = urlsplit(arguments[-1])
-    if (url.scheme != "https" or not url.hostname or url.username or url.password
-            or url.query or url.fragment or not re.fullmatch(
-                r"/flutter_infra_release/releases/releases_(linux|macos|windows)\.json", url.path)):
-        raise ValueError("flutter_manifest_url_unrecognized")
+    kind = request_kind(arguments)
     if not (os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy")):
-        raise ValueError("flutter_manifest_proxy_required")
+        raise ValueError("flutter_download_proxy_required")
     child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
-    deadline, code, http, proxy_http = time.monotonic() + 60, 1, 0, 0
+    deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 600), 1, 0, 0
     for attempt in range(1, 5):
         remaining = deadline - time.monotonic()
         if remaining <= 0:
             break
-        destination = directory / f"manifest-{attempt}.json"
+        destination = directory / f"download-{attempt}"
         destination.touch(mode=0o600, exist_ok=False)
         destination.chmod(0o600)
         try:
             result = subprocess.run([
                 "curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
-                "--connect-timeout", "15", "--max-time", str(min(20, remaining)),
-                "--max-filesize", "16777216", "--output", str(destination),
+                "--connect-timeout", "15", "--max-time", str(min(20 if kind == "manifest" else 300, remaining)),
+                "--max-filesize", str(16777216 if kind == "manifest" else 2147483648), "--output", str(destination),
                 "--write-out", "%{http_code} %{http_connect}", arguments[-1],
             ], capture_output=True, timeout=remaining, env=child_env)
             code = result.returncode
@@ -49,20 +43,38 @@ def download(arguments: list[str], directory: Path) -> int:
         except subprocess.TimeoutExpired:
             code, http, proxy_http = 28, 0, 0
         if code == 0 and http == 200:
-            body = destination.read_bytes()
-            json.loads(body)  # A successful transport must deliver complete JSON.
-            sys.stdout.buffer.write(body)
+            if kind == "manifest":
+                json.loads(destination.read_bytes())
+            with destination.open("rb") as source:
+                shutil.copyfileobj(source, sys.stdout.buffer, length=1024 * 1024)
             if attempt > 1:
-                print(f"flutter_manifest_recovered attempts={attempt}", file=sys.stderr)
+                print(f"flutter_{kind}_recovered attempts={attempt}", file=sys.stderr)
             return 0
+        destination.unlink(missing_ok=True)
         if attempt == 4 or proxy_http in {401, 403, 407} or (code not in RETRY_CODES and http not in RETRY_HTTP):
             break
         time.sleep(min(2 ** (attempt - 1), max(0, deadline - time.monotonic())))
-    print(f"flutter_manifest_transport_failed curl_exit={code} http_status={http} "
+    print(f"flutter_{kind}_transport_failed curl_exit={code} http_status={http} "
           f"proxy_status={proxy_http} attempts={attempt}", file=sys.stderr)
     return code or 1
 
 
+def request_kind(arguments):
+    if not arguments:
+        raise ValueError("flutter_download_arguments_missing")
+    url = urlsplit(arguments[-1])
+    if (url.scheme != "https" or not url.hostname or url.username or url.password
+            or url.query or url.fragment or ".." in url.path):
+        raise ValueError("flutter_download_url_unrecognized")
+    if arguments[:-1] == ["--silent", "--connect-timeout", "15", "--retry", "5"] and re.fullmatch(
+            r"/flutter_infra_release/releases/releases_(linux|macos|windows)\.json", url.path):
+        return "manifest"
+    if arguments[:-1] == ["--connect-timeout", "15", "--retry", "5"] and re.fullmatch(
+            r"/flutter_infra_release/releases/[A-Za-z0-9_./+-]+\.(tar\.xz|tar\.gz|zip)", url.path):
+        return "archive"
+    raise ValueError("flutter_download_arguments_unrecognized")
+
+
 def main() -> int:
     try:
         with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:

package/android-action/scripts/flutter_manifest_env.sh

@@ -1,7 +1,8 @@
 # Loaded only by the two pinned Flutter setup invocations, never the whole job.
 curl() {
   case "${!#}" in
-    */flutter_infra_release/releases/releases_*.json)
+    */flutter_infra_release/releases/releases_*.json|*/flutter_infra_release/releases/*.tar.xz|\
+    */flutter_infra_release/releases/*.tar.gz|*/flutter_infra_release/releases/*.zip)
       python3 "${GOWALK_FLUTTER_MANIFEST_HELPER:?}" "$@"
       ;;
     *) command curl "$@" ;;

package/android-action/scripts/flutter_manifest_fixture.py

@@ -57,15 +57,16 @@ class Proxy(socketserver.StreamRequestHandler):
                         pass
                     self.server.requests.append(request[1].decode())
                     status = b"401 Unauthorized" if mode == "origin_auth" else b"200 OK"
-                    body = MANIFEST[:31] if mode == "partial" else MANIFEST
+                    complete = self.server.body
+                    body = complete[:31] if mode == "partial" else complete
                     stream.sendall(b"HTTP/1.1 " + status + b"\r\nContent-Length: "
-                                   + str(len(MANIFEST)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
+                                   + str(len(complete)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
         except (OSError, ssl.SSLError):
             pass  # An untrusted fixture certificate must be rejected by the real client.
 
 
 @contextmanager
-def tls_proxy(root: Path, modes: list[str]):
+def tls_proxy(root: Path, modes: list[str], body: bytes = MANIFEST):
     cert, key = root / "cert.pem", root / "key.pem"
     command = ["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1",
                "-keyout", str(key), "-out", str(cert), "-subj", "/CN=" + HOST,
@@ -75,7 +76,7 @@ def tls_proxy(root: Path, modes: list[str]):
     context.load_cert_chain(cert, key)
     server = socketserver.ThreadingTCPServer(("127.0.0.1", 0), Proxy)
     server.daemon_threads = True
-    server.context, server.modes = context, list(modes)
+    server.context, server.modes, server.body = context, list(modes), body
     server.connects, server.requests, server.lock = 0, [], threading.Lock()
     thread = threading.Thread(target=server.serve_forever, daemon=True)
     thread.start()

package/android-action/scripts/test_flutter_archive.py

@@ -0,0 +1,64 @@
+"""Real proxy/TLS transfers discard interrupted SDK bytes and preserve terminal refusals."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, tls_proxy
+
+ROOT = Path(__file__).parent
+ARCHIVE = bytes(range(256)) * 512
+
+
+class ArchiveRecoveryTests(unittest.TestCase):
+    def invoke(self, root, server, cert, hooked=True, trusted=True):
+        proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
+        env = {**os.environ, "HOME": str(root), "RUNNER_TEMP": str(root),
+               "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "", "no_proxy": ""}
+        for key in ("BASH_ENV", "CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR"):
+            env.pop(key, None)
+        if trusted:
+            env["CURL_CA_BUNDLE"] = str(cert)
+        if hooked:
+            env.update(BASH_ENV=str(ROOT / "flutter_manifest_env.sh"), NO_PROXY="*", no_proxy="*",
+                       GOWALK_FLUTTER_MANIFEST_HELPER=str(ROOT / "flutter_manifest.py"))
+            (root / ".curlrc").write_text('noproxy = "*"\ninsecure\n')
+        url = f"https://{HOST}/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz"
+        result = subprocess.run(["bash", "-c", 'curl --connect-timeout 15 --retry 5 "$1"', "bash", url],
+                                env=env, capture_output=True, timeout=20)
+        self.assertNotIn(b"fixture-secret", result.stdout + result.stderr)
+        self.assertFalse(list(root.glob("flutter-manifest-*")))
+        return result
+
+    def test_original_partial_exit18_recovers_to_only_the_complete_archive(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial"], ARCHIVE) as (server, cert):
+                original = self.invoke(root, server, cert, hooked=False)
+                self.assertEqual(original.returncode, 18)
+            with tls_proxy(root, ["partial", "ok"], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.connects, 2)
+                self.assertIn(b"flutter_archive_recovered attempts=2", result.stderr)
+
+    def test_archive_transport_never_retries_auth_or_untrusted_certificate(self):
+        for mode, trusted in [("proxy_auth", True), ("origin_auth", True), ("ok", False)]:
+            with self.subTest(mode=mode), tempfile.TemporaryDirectory() as directory:
+                root = Path(directory)
+                with tls_proxy(root, [mode], ARCHIVE) as (server, cert):
+                    result = self.invoke(root, server, cert, trusted=trusted)
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertEqual((result.stdout, server.connects), (b"", 1))
+
+    def test_exhausted_archive_retry_never_emits_partial_bytes(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial"] * 4, ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (18, b"", 4))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.84
+1.0.86

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.84",
+  "version": "1.0.86",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {