gowalk-cicd 1.0.88 → 1.0.90

package/CLAUDE.md

@@ -155,10 +155,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
   consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
-- Flutter manifest GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
-  It retains the account proxy, retries transient TLS/transport errors within 60 seconds, and emits
-  only complete JSON. Partial responses and private curl stderr never enter action outputs;
-  authentication/certificate failures remain terminal. SDK archive calls retain upstream behavior.
+- Flutter manifest/archive GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
+  It retains the account proxy and allows four attempts within 60 seconds for manifests or 30 minutes
+  for archives, with an 8 GiB archive bound. Interrupted archives resume private bytes with HTTP Range; an origin ignoring
+  Range permits a bounded full restart. Only complete JSON or an archive matching the selected official
+  manifest's SHA-256 enters action outputs. Authentication/certificate refusals remain terminal.
+  `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
 - Web Release selects bundled renderer resources with `--no-web-resources-cdn` inside
   the existing proxied build command. This is not a font or integration offline guarantee;
   preserve app-authored font declarations, bootstrap configuration and other build inputs.

package/README.md

@@ -297,6 +297,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 | `source_maintenance_pending` | `gowalk-cicd/source-maintenance-pending.v1` | `repo`, `base_sha`, `head_sha`, `branch`, `run_id` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
+| `flutter_download_failed` (error) | `gowalk-cicd/flutter-download-failed.v1` | `phase`, `curl_exit`, `http_status`, `proxy_status`, `attempts`, `retained_bytes` |
 
 Add a field by bumping the schema version; never change the meaning of an
 existing one.
@@ -1069,6 +1070,9 @@ different bytes under the same number. Build numbers come from `/builds`,
 reservation is never reused; delete such a reservation only after reading it back.
 All requests and parts still use the Apple proxy.
 
-Flutter SDK setup retries interrupted manifest and archive GETs on the assigned proxy. Archive attempts remain
-bounded, expose only complete bytes to extraction, and never retry authentication or certificate refusals. Cache
-identities remain those of the pinned upstream Flutter action.
+Flutter SDK setup retries interrupted manifest and archive GETs on the assigned proxy, with four attempts
+within 60 seconds for manifests or 30 minutes for archives, with an 8 GiB archive bound. Retries resume private bytes
+with HTTP Range; if the origin ignores Range, a bounded full restart is permitted. The completed archive
+must match the selected official manifest's SHA-256 before extraction. Authentication and certificate
+refusals remain terminal. Exhausted transfers emit `flutter_download_failed` with fixed status codes and
+retained-byte counts, without URLs or private curl stderr. Cache identities remain those of the pinned action.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.88
+1.0.90

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.88
+1.0.90

package/android-action/scripts/flutter_download.py

@@ -0,0 +1,60 @@
+"""Private Flutter transfers publish only complete JSON or an archive matching the manifest digest."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+
+MAX_ARCHIVE_BYTES = 8 * 1024 * 1024 * 1024
+
+
+def archive_digest() -> str:
+    value = os.environ.get("GOWALK_FLUTTER_ARCHIVE_SHA256", "")
+    if not re.fullmatch(r"[a-fA-F0-9]{64}", value):
+        raise ValueError("flutter_archive_digest_required")
+    return value.lower()
+
+
+def transfer(url: str, destination: Path, kind: str, remaining: float, env: dict) -> tuple[int, int, int]:
+    resume = kind == "archive" and destination.stat().st_size > 0
+    command = ["curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
+               "--connect-timeout", "15", "--max-time", str(min(20 if kind == "manifest" else 600, remaining)),
+               "--max-filesize", str(16777216 if kind == "manifest" else MAX_ARCHIVE_BYTES),
+               "--output", str(destination), "--write-out", "%{http_code} %{http_connect}"]
+    if resume:
+        command += ["--continue-at", "-"]
+    try:
+        result = subprocess.run([*command, url], capture_output=True, timeout=remaining, env=env)
+        status = result.stdout.split()
+        http, proxy = (map(int, status) if len(status) == 2 and all(part.isdigit() for part in status) else (0, 0))
+        return result.returncode, http, proxy
+    except subprocess.TimeoutExpired:
+        return 28, 0, 0
+
+
+def publish(destination: Path, kind: str) -> None:
+    if kind == "manifest":
+        json.loads(destination.read_bytes())
+    else:
+        if destination.stat().st_size > MAX_ARCHIVE_BYTES:
+            raise ValueError("flutter_archive_size_exceeded")
+        digest = hashlib.sha256()
+        with destination.open("rb") as source:
+            for chunk in iter(lambda: source.read(1024 * 1024), b""):
+                digest.update(chunk)
+        if digest.hexdigest() != archive_digest():
+            raise ValueError("flutter_archive_checksum_mismatch")
+    with destination.open("rb") as source:
+        shutil.copyfileobj(source, sys.stdout.buffer, length=1024 * 1024)
+
+
+def failure(kind: str, code: int, http: int, proxy: int, attempts: int, retained: int) -> None:
+    print(f"flutter_{kind}_transport_failed curl_exit={code} http_status={http} "
+          f"proxy_status={proxy} attempts={attempts} retained_bytes={retained}", file=sys.stderr)
+    note = {"schema": "gowalk-cicd/flutter-download-failed.v1", "phase": kind,
+            "curl_exit": code, "http_status": http, "proxy_status": proxy,
+            "attempts": attempts, "retained_bytes": retained}
+    print("::error title=flutter_download_failed::" + json.dumps(note, separators=(",", ":")), file=sys.stderr)

package/android-action/scripts/flutter_manifest.py

@@ -1,17 +1,16 @@
 """Retry the official Flutter manifest and SDK archive GETs without exposing partial JSON or proxy secrets."""
 from __future__ import annotations
 
-import json
 import os
 from pathlib import Path
 import re
-import shutil
-import subprocess
 import sys
 import tempfile
 import time
 from urllib.parse import urlsplit
 
+import flutter_download
+
 RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
 RETRY_HTTP = {408, 429, 500, 502, 503, 504}
 
@@ -20,42 +19,36 @@ def download(arguments: list[str], directory: Path) -> int:
     kind = request_kind(arguments)
     if not (os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy")):
         raise ValueError("flutter_download_proxy_required")
+    if kind == "archive":
+        flutter_download.archive_digest()
     child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
-    deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 600), 1, 0, 0
+    deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 1800), 1, 0, 0
+    destination = directory / "download"
+    destination.touch(mode=0o600, exist_ok=False)
+    destination.chmod(0o600)
+    attempted = 0
     for attempt in range(1, 5):
         remaining = deadline - time.monotonic()
         if remaining <= 0:
             break
-        destination = directory / f"download-{attempt}"
-        destination.touch(mode=0o600, exist_ok=False)
-        destination.chmod(0o600)
-        try:
-            result = subprocess.run([
-                "curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
-                "--connect-timeout", "15", "--max-time", str(min(20 if kind == "manifest" else 300, remaining)),
-                "--max-filesize", str(16777216 if kind == "manifest" else 2147483648), "--output", str(destination),
-                "--write-out", "%{http_code} %{http_connect}", arguments[-1],
-            ], capture_output=True, timeout=remaining, env=child_env)
-            code = result.returncode
-            status = result.stdout.split()
-            http, proxy_http = (map(int, status) if len(status) == 2 and all(part.isdigit() for part in status)
-                                else (0, 0))
-        except subprocess.TimeoutExpired:
-            code, http, proxy_http = 28, 0, 0
-        if code == 0 and http == 200:
-            if kind == "manifest":
-                json.loads(destination.read_bytes())
-            with destination.open("rb") as source:
-                shutil.copyfileobj(source, sys.stdout.buffer, length=1024 * 1024)
+        attempted = attempt
+        code, http, proxy_http = flutter_download.transfer(arguments[-1], destination, kind, remaining, child_env)
+        if code == 0 and http in ({200, 206} if kind == "archive" else {200}):
+            flutter_download.publish(destination, kind)
             if attempt > 1:
                 print(f"flutter_{kind}_recovered attempts={attempt}", file=sys.stderr)
             return 0
-        destination.unlink(missing_ok=True)
-        if attempt == 4 or proxy_http in {401, 403, 407} or (code not in RETRY_CODES and http not in RETRY_HTTP):
+        if attempt == 4 or proxy_http in {401, 403, 407} or http in {401, 403}:
+            break
+        restart = kind == "archive" and code == 33 and http == 200
+        if not restart and code not in RETRY_CODES and http not in RETRY_HTTP:
             break
+        if kind == "manifest" or restart:
+            destination.write_bytes(b"")
+        if destination.stat().st_size > flutter_download.MAX_ARCHIVE_BYTES:
+            raise ValueError("flutter_archive_size_exceeded")
         time.sleep(min(2 ** (attempt - 1), max(0, deadline - time.monotonic())))
-    print(f"flutter_{kind}_transport_failed curl_exit={code} http_status={http} "
-          f"proxy_status={proxy_http} attempts={attempt}", file=sys.stderr)
+    flutter_download.failure(kind, code, http, proxy_http, attempted, destination.stat().st_size)
     return code or 1
 
 
@@ -79,8 +72,10 @@ def main() -> int:
     try:
         with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
             return download(sys.argv[1:], Path(scratch))
-    except (ValueError, OSError, KeyError):
-        print("flutter_manifest_invalid_request_or_response", file=sys.stderr)
+    except (ValueError, OSError, KeyError) as error:
+        safe = {"flutter_archive_digest_required", "flutter_archive_size_exceeded", "flutter_archive_checksum_mismatch"}
+        reason = str(error) if str(error) in safe else "flutter_manifest_invalid_request_or_response"
+        print("::error::" + reason, file=sys.stderr)
         return 1
 
 

package/android-action/scripts/flutter_manifest_env.sh

@@ -1,10 +1,14 @@
 # Loaded only by the two pinned Flutter setup invocations, never the whole job.
 curl() {
   case "${!#}" in
-    */flutter_infra_release/releases/releases_*.json|*/flutter_infra_release/releases/*.tar.xz|\
-    */flutter_infra_release/releases/*.tar.gz|*/flutter_infra_release/releases/*.zip)
+    */flutter_infra_release/releases/releases_*.json)
       python3 "${GOWALK_FLUTTER_MANIFEST_HELPER:?}" "$@"
       ;;
+    */flutter_infra_release/releases/*.tar.xz|*/flutter_infra_release/releases/*.tar.gz|\
+    */flutter_infra_release/releases/*.zip)
+      GOWALK_FLUTTER_ARCHIVE_SHA256="$(printf '%s' "${VERSION_MANIFEST:-}" | jq -er '.sha256')" \
+        python3 "${GOWALK_FLUTTER_MANIFEST_HELPER:?}" "$@"
+      ;;
     *) command curl "$@" ;;
   esac
 }

package/android-action/scripts/flutter_manifest_fixture.py

@@ -30,6 +30,26 @@ def official_setup() -> bytes:
     return source
 
 
+def response(server, mode, headers, path):
+    requested = headers.get(b"range", b"").decode()
+    server.ranges.append(requested)
+    complete = server.body[path] if isinstance(server.body, dict) else server.body
+    extra = b""
+    status = b"401 Unauthorized" if mode == "origin_auth" else b"200 OK"
+    if mode.startswith("range"):
+        if not requested.startswith("bytes=") or not requested.endswith("-"):
+            return b"HTTP/1.1 416 Range Not Satisfiable\r\nContent-Length: 0\r\n\r\n"
+        start = int(requested[6:-1])
+        extra = f"Content-Range: bytes {start}-{len(complete) - 1}/{len(complete)}\r\n".encode()
+        complete, status = complete[start:], b"206 Partial Content"
+    body = complete[:31] if mode in {"partial", "range_partial", "large_partial", "too_large"} else complete
+    if mode == "range_corrupt":
+        body = bytes([body[0] ^ 1]) + body[1:]
+    size = {"large_partial": 2 * 1024 ** 3 + 1, "too_large": 9 * 1024 ** 3}.get(mode, len(complete))
+    return (b"HTTP/1.1 " + status + b"\r\n" + extra + b"Content-Length: "
+            + str(size).encode() + b"\r\nConnection: close\r\n\r\n" + body)
+
+
 class Proxy(socketserver.StreamRequestHandler):
     def handle(self):
         first = self.rfile.readline(4096).split()
@@ -53,20 +73,18 @@ class Proxy(socketserver.StreamRequestHandler):
                 stream.settimeout(3)
                 with stream.makefile("rb") as reader:
                     request = reader.readline(4096).split()
-                    while reader.readline(4096) not in (b"\r\n", b"\n", b""):
-                        pass
+                    headers = {}
+                    while (line := reader.readline(4096)) not in (b"\r\n", b"\n", b""):
+                        name, _, value = line.partition(b":")
+                        headers[name.lower()] = value.strip()
                     self.server.requests.append(request[1].decode())
-                    status = b"401 Unauthorized" if mode == "origin_auth" else b"200 OK"
-                    complete = self.server.body
-                    body = complete[:31] if mode == "partial" else complete
-                    stream.sendall(b"HTTP/1.1 " + status + b"\r\nContent-Length: "
-                                   + str(len(complete)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
+                    stream.sendall(response(self.server, mode, headers, request[1].decode()))
         except (OSError, ssl.SSLError):
             pass  # An untrusted fixture certificate must be rejected by the real client.
 
 
 @contextmanager
-def tls_proxy(root: Path, modes: list[str], body: bytes = MANIFEST):
+def tls_proxy(root: Path, modes: list[str], body: bytes | dict[str, bytes] = MANIFEST):
     cert, key = root / "cert.pem", root / "key.pem"
     command = ["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1",
                "-keyout", str(key), "-out", str(cert), "-subj", "/CN=" + HOST,
@@ -78,6 +96,7 @@ def tls_proxy(root: Path, modes: list[str], body: bytes = MANIFEST):
     server.daemon_threads = True
     server.context, server.modes, server.body = context, list(modes), body
     server.connects, server.requests, server.lock = 0, [], threading.Lock()
+    server.ranges = []
     thread = threading.Thread(target=server.serve_forever, daemon=True)
     thread.start()
     try:

package/android-action/scripts/test_flutter_archive.py

@@ -1,4 +1,6 @@
-"""Real proxy/TLS transfers discard interrupted SDK bytes and preserve terminal refusals."""
+"""Real proxy/TLS transfers resume private SDK bytes and verify the official manifest digest."""
+import hashlib
+import json
 import os
 from pathlib import Path
 import subprocess
@@ -12,10 +14,12 @@ ARCHIVE = bytes(range(256)) * 512
 
 
 class ArchiveRecoveryTests(unittest.TestCase):
-    def invoke(self, root, server, cert, hooked=True, trusted=True):
+    def invoke(self, root, server, cert, hooked=True, trusted=True, digest=None):
         proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
         env = {**os.environ, "HOME": str(root), "RUNNER_TEMP": str(root),
-               "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "", "no_proxy": ""}
+               "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "", "no_proxy": "",
+               "VERSION_MANIFEST": json.dumps({"sha256": hashlib.sha256(ARCHIVE).hexdigest()
+                                                if digest is None else digest})}
         for key in ("BASH_ENV", "CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR"):
             env.pop(key, None)
         if trusted:
@@ -37,10 +41,11 @@ class ArchiveRecoveryTests(unittest.TestCase):
             with tls_proxy(root, ["partial"], ARCHIVE) as (server, cert):
                 original = self.invoke(root, server, cert, hooked=False)
                 self.assertEqual(original.returncode, 18)
-            with tls_proxy(root, ["partial", "ok"], ARCHIVE) as (server, cert):
+            with tls_proxy(root, ["partial", "range"], ARCHIVE) as (server, cert):
                 result = self.invoke(root, server, cert)
                 self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
                 self.assertEqual(server.connects, 2)
+                self.assertEqual(server.ranges, ["", "bytes=31-"])
                 self.assertIn(b"flutter_archive_recovered attempts=2", result.stderr)
 
     def test_archive_transport_never_retries_auth_or_untrusted_certificate(self):
@@ -52,12 +57,54 @@ class ArchiveRecoveryTests(unittest.TestCase):
                     self.assertNotEqual(result.returncode, 0)
                     self.assertEqual((result.stdout, server.connects), (b"", 1))
 
+    def test_authentication_refusal_after_partial_transfer_stops_without_publishing(self):
+        for mode in ("proxy_auth", "origin_auth"):
+            with self.subTest(mode=mode), tempfile.TemporaryDirectory() as directory:
+                root = Path(directory)
+                with tls_proxy(root, ["partial", mode], ARCHIVE) as (server, cert):
+                    result = self.invoke(root, server, cert)
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertEqual((result.stdout, server.connects), (b"", 2))
+
     def test_exhausted_archive_retry_never_emits_partial_bytes(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
-            with tls_proxy(root, ["partial"] * 4, ARCHIVE) as (server, cert):
+            modes = ["partial", "range_partial", "range_partial", "range_partial"]
+            with tls_proxy(root, modes, ARCHIVE) as (server, cert):
                 result = self.invoke(root, server, cert)
                 self.assertEqual((result.returncode, result.stdout, server.connects), (18, b"", 4))
+                self.assertEqual(server.ranges, ["", "bytes=31-", "bytes=62-", "bytes=93-"])
+                self.assertIn(b'"retained_bytes":124', result.stderr)
+
+    def test_repeated_disconnects_resume_until_the_verified_archive_is_complete(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial", "range_partial", "range"], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, ["", "bytes=31-", "bytes=62-"])
+
+    def test_origin_ignoring_range_restarts_without_appending_another_full_copy(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial", "ok", "ok"], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, ["", "bytes=31-", ""])
+
+    def test_changed_resumed_bytes_fail_checksum_before_any_output(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial", "range_corrupt"], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (1, b"", 2))
+
+    def test_missing_manifest_digest_refuses_before_download(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, [], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert, digest="")
+                self.assertEqual((result.returncode, result.stdout, server.connects), (1, b"", 0))
 
 
 if __name__ == "__main__":

package/android-action/scripts/test_flutter_archive_setup.py

@@ -0,0 +1,68 @@
+"""The unchanged official setup supplies its selected digest and extracts only verified resumed bytes."""
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import tarfile
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, official_setup, tls_proxy
+
+ROOT = Path(__file__).parent
+PREFIX = "/flutter_infra_release/releases/"
+
+
+def fixture_archive():
+    buffer = io.BytesIO()
+    with tarfile.open(fileobj=buffer, mode="w:gz") as archive:
+        entry = tarfile.TarInfo("flutter/bin/flutter")
+        content = b"#!/bin/sh\nexit 0\n"
+        entry.size, entry.mode = len(content), 0o755
+        archive.addfile(entry, io.BytesIO(content))
+    return buffer.getvalue()
+
+
+class OfficialArchiveSetupTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.source = official_setup()
+
+    def test_cold_setup_resumes_and_extracts_using_its_actual_manifest_scope(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            setup, sdk = root / "setup.sh", root / "sdk"
+            setup.write_bytes(self.source)
+            archive = fixture_archive()
+            manifest = json.dumps({"releases": [{"channel": "stable", "version": "3.44.0",
+                "dart_sdk_arch": "x64", "hash": "a" * 40, "sha256": hashlib.sha256(archive).hexdigest(),
+                "archive": "fixture-sdk.tar.gz"}]}).encode()
+            bodies = {PREFIX + "releases_linux.json": manifest, PREFIX + "fixture-sdk.tar.gz": archive}
+            with tls_proxy(root, ["ok", "partial", "range"], bodies) as (server, cert):
+                proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
+                env = {**os.environ, "HOME": str(root), "RUNNER_TEMP": str(root), "RUNNER_OS": "Linux",
+                       "RUNNER_ARCH": "X64", "RUNNER_TOOL_CACHE": str(root / "tools"),
+                       "PUB_CACHE": str(root / "pub"), "FLUTTER_STORAGE_BASE_URL": "https://" + HOST,
+                       "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "*", "no_proxy": "*",
+                       "CURL_CA_BUNDLE": str(cert), "BASH_ENV": str(ROOT / "flutter_manifest_env.sh"),
+                       "GOWALK_FLUTTER_MANIFEST_HELPER": str(ROOT / "flutter_manifest.py")}
+                for name in ("VERSION_MANIFEST", "GOWALK_FLUTTER_ARCHIVE_SHA256"):
+                    env.pop(name, None)
+                for name in ("GITHUB_ENV", "GITHUB_OUTPUT", "GITHUB_PATH"):
+                    env[name] = str(root / name.lower())
+                result = subprocess.run(["bash", str(setup), "-n", "3.44.0", "-a", "x64",
+                                         "-c", str(sdk), "stable"], env=env, cwd=root,
+                                        capture_output=True, timeout=20)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual((sdk / "flutter/bin/flutter").read_bytes(), b"#!/bin/sh\nexit 0\n")
+                self.assertEqual(server.ranges, ["", "", "bytes=31-"])
+                self.assertEqual(server.requests, [PREFIX + "releases_linux.json"]
+                                 + [PREFIX + "fixture-sdk.tar.gz"] * 2)
+                self.assertNotIn(b"fixture-secret", result.stdout + result.stderr)
+                self.assertFalse(list(root.glob("flutter-manifest-*")))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_archive_size.py

@@ -0,0 +1,28 @@
+"""Current multi-gigabyte SDK response sizes remain recoverable through the real curl transport."""
+from pathlib import Path
+import tempfile
+import unittest
+
+import test_flutter_archive as archive_fixture
+from flutter_manifest_fixture import tls_proxy
+
+
+class ArchiveSizeTests(unittest.TestCase):
+    def test_advertised_sdk_size_above_two_gib_does_not_prevent_recovery(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["large_partial", "range"], archive_fixture.ARCHIVE) as (server, cert):
+                result = archive_fixture.ArchiveRecoveryTests().invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, archive_fixture.ARCHIVE))
+                self.assertEqual(server.ranges, ["", "bytes=31-"])
+
+    def test_archive_size_limit_still_refuses_oversized_transfers(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["too_large"], archive_fixture.ARCHIVE) as (server, cert):
+                result = archive_fixture.ArchiveRecoveryTests().invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (63, b"", 1))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_manifest_scope.py

@@ -20,7 +20,8 @@ class ManifestPathScopeTests(unittest.TestCase):
             parent = root / "parent/flutter-setup"
             scripts = parent.parent / "scripts"
             parent.mkdir(parents=True); scripts.mkdir()
-            for name in ("play_store_proxy.py", "flutter_manifest.py", "flutter_manifest_env.sh"):
+            names = ("play_store_proxy.py", "flutter_manifest.py", "flutter_download.py", "flutter_manifest_env.sh")
+            for name in names:
                 shutil.copyfile(ROOT / "android-action/scripts" / name, scripts / name)
             env_file, output = root / "env", root / "output"
             env = {**os.environ, "GITHUB_ACTION_PATH": str(parent), "GITHUB_ENV": str(env_file),

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.88
+1.0.90

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.88",
+  "version": "1.0.90",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {