react-native-update 10.48.3 → 10.50.0

package/android/src/main/java/cn/reactnative/modules/update/DownloadTask.java

@@ -77,6 +77,9 @@ class DownloadTask implements Runnable {
     private final byte[] buffer = new byte[DOWNLOAD_CHUNK_SIZE];
     private final BundledResourceCopier bundledResourceCopier;
     private String hash;
+    // Set once downloadFile() returns: failures after this point in a patch
+    // task are patch-application failures, not download failures.
+    private boolean downloadPhaseCompleted = false;
 
     DownloadTask(Context context, DownloadTaskParams params) {
         this.context = context.getApplicationContext();
@@ -160,6 +163,7 @@ class DownloadTask implements Runnable {
             }
         }
 
+        downloadPhaseCompleted = true;
     }
 
     private byte[] readBytes(InputStream input) throws IOException {
@@ -408,6 +412,12 @@ class DownloadTask implements Runnable {
         }
     }
 
+    private boolean isPatchTask(int taskType) {
+        return taskType == DownloadTaskParams.TASK_TYPE_PATCH_FULL
+            || taskType == DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK
+            || taskType == DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK;
+    }
+
     @Override
     public void run() {
         int taskType = params.type;
@@ -436,7 +446,18 @@ class DownloadTask implements Runnable {
             cleanUpAfterFailure(taskType);
 
             if (params.listener != null) {
-                params.listener.onDownloadFailed(error);
+                // A patch task that failed after its artifact was fully
+                // downloaded (unzip / hdiff / resource copy, incl. copiesCrc
+                // verification) is a patch failure, not a download failure —
+                // the module maps the exception type to PATCH_FAILED.
+                Throwable classified = error;
+                if (downloadPhaseCompleted
+                    && isPatchTask(taskType)
+                    && !(error instanceof PatchFailedException)) {
+                    classified = new PatchFailedException(
+                        String.valueOf(error.getMessage()), error);
+                }
+                params.listener.onDownloadFailed(classified);
             }
             return;
         }

package/android/src/main/java/cn/reactnative/modules/update/PatchFailedException.java

@@ -0,0 +1,16 @@
+package cn.reactnative.modules.update;
+
+import java.io.IOException;
+
+/**
+ * A download task failure that happened after the artifact was fully
+ * downloaded — unzip, hdiff apply, or bundled-resource copy (including the
+ * copiesCrc content verification). UpdateModuleImpl rejects these with
+ * PATCH_FAILED instead of DOWNLOAD_FAILED so the JS layer and server-side
+ * telemetry can separate patch health from network health.
+ */
+class PatchFailedException extends IOException {
+    PatchFailedException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}

package/android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -9,6 +9,10 @@ import android.os.Environment;
 import android.util.Log;
 import com.facebook.react.ReactInstanceManager;
 import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.util.concurrent.Executor;
 import java.util.concurrent.Executors;
 
@@ -118,16 +122,125 @@ public class UpdateContext {
         return isUsingBundleUrl;
     }
 
+    // bundleHash cache: "<packageVersion>|<lastUpdateTime>|<sha256hex>". The
+    // key identifies the installed binary; every (re)install changes
+    // lastUpdateTime, so the hash is recomputed once per install.
+    private static final String KEY_BUNDLE_HASH_CACHE = "bundleHashCache";
+
+    public interface BundleHashListener {
+        void onBundleHash(String hash);
+    }
+
+    /**
+     * bundleHash = sha256 of the JS bundle embedded in the binary — the
+     * identity of the binary itself, not of whatever hot update is currently
+     * running. Hashes exactly the bytes pdiff patches from: the hardcoded
+     * "index.android.bundle" asset read via AssetManager, same as
+     * DownloadTask.copyBundledAssetToFile. Runs on the download executor;
+     * never fails — an empty string means "unknown" and the server falls back
+     * to the buildTime heuristic.
+     *
+     * Deliberately java.security.MessageDigest instead of the C++
+     * pushy::digest: librnupdate.so is a prebuilt artifact and this must not
+     * force a rebuild. The NIST vectors in the patch_core tests anchor both
+     * implementations to the same standard.
+     */
+    public void getBundleHash(final BundleHashListener listener) {
+        if (DEBUG) {
+            // Metro serves the bundle in debug; mirror the dev buildTime behaviour.
+            listener.onBundleHash("");
+            return;
+        }
+        executor.execute(new Runnable() {
+            @Override
+            public void run() {
+                listener.onBundleHash(computeBundleHash());
+            }
+        });
+    }
+
+    private String computeBundleHash() {
+        String cachePrefix = getPackageVersion() + "|" + getPackageLastUpdateTime() + "|";
+        String cached = sp.getString(KEY_BUNDLE_HASH_CACHE, null);
+        if (cached != null && cached.startsWith(cachePrefix)) {
+            return cached.substring(cachePrefix.length());
+        }
+        String hash = sha256OfBundledAsset("index.android.bundle");
+        if (!hash.isEmpty()) {
+            SharedPreferences.Editor editor = sp.edit();
+            editor.putString(KEY_BUNDLE_HASH_CACHE, cachePrefix + hash);
+            persistEditor(editor, "cache bundle hash");
+        }
+        return hash;
+    }
+
+    private long getPackageLastUpdateTime() {
+        try {
+            PackageInfo pi = context.getPackageManager()
+                .getPackageInfo(context.getPackageName(), 0);
+            return pi.lastUpdateTime;
+        } catch (PackageManager.NameNotFoundException e) {
+            return 0;
+        }
+    }
+
+    private String sha256OfBundledAsset(String assetName) {
+        try (InputStream in = context.getAssets().open(assetName)) {
+            MessageDigest md = MessageDigest.getInstance("SHA-256");
+            byte[] buffer = new byte[64 * 1024];
+            int read;
+            while ((read = in.read(buffer)) != -1) {
+                md.update(buffer, 0, read);
+            }
+            byte[] digest = md.digest();
+            StringBuilder hex = new StringBuilder(digest.length * 2);
+            for (byte b : digest) {
+                hex.append(Character.forDigit((b >> 4) & 0xf, 16));
+                hex.append(Character.forDigit(b & 0xf, 16));
+            }
+            return hex.toString();
+        } catch (IOException | NoSuchAlgorithmException e) {
+            // Expected when there is no embedded bundle (custom name, no
+            // release bundle); "unknown" is a valid answer, not an error.
+            Log.i(TAG, "Cannot hash bundled asset " + assetName + ": " + e);
+            return "";
+        }
+    }
+
     private void enqueue(DownloadTaskParams params) {
         executor.execute(new DownloadTask(context, params));
     }
 
+    // Server-provided identifiers (hash/originHash/fileName) become child
+    // names under rootDir; anything that could resolve outside of it (path
+    // separators, "..", ".") must be rejected before touching the filesystem.
+    static boolean isSafePathComponent(String name) {
+        return name != null
+                && !name.isEmpty()
+                && !name.equals(".")
+                && !name.equals("..")
+                && !name.contains("/")
+                && !name.contains("\\")
+                && name.indexOf('\0') < 0;
+    }
+
+    private static boolean rejectUnsafeComponent(String name, DownloadFileListener listener) {
+        if (isSafePathComponent(name)) {
+            return false;
+        }
+        listener.onDownloadFailed(new IllegalArgumentException("Invalid path component: " + name));
+        return true;
+    }
+
     public interface DownloadFileListener {
         void onDownloadCompleted(DownloadTaskParams params);
         void onDownloadFailed(Throwable error);
     }
 
     public void downloadFullUpdate(String url, String hash, DownloadFileListener listener) {
+        if (rejectUnsafeComponent(hash, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PATCH_FULL;
         params.url = url;
@@ -139,6 +252,9 @@ public class UpdateContext {
     }
 
     public void downloadFile(String url, String hash, String fileName, DownloadFileListener listener) {
+        if (rejectUnsafeComponent(fileName, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PLAIN_DOWNLOAD;
         params.url = url;
@@ -157,6 +273,9 @@ public class UpdateContext {
     }
 
     public void downloadPatchFromApk(String url, String hash, DownloadFileListener listener) {
+        if (rejectUnsafeComponent(hash, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK;
         params.url = url;
@@ -168,6 +287,9 @@ public class UpdateContext {
     }
 
     public void downloadPatchFromPpk(String url, String hash, String originHash, DownloadFileListener listener) {
+        if (rejectUnsafeComponent(hash, listener) || rejectUnsafeComponent(originHash, listener)) {
+            return;
+        }
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK;
         params.url = url;
@@ -223,6 +345,9 @@ public class UpdateContext {
     }
 
     public void switchVersion(String hash) {
+        if (!isSafePathComponent(hash)) {
+            throw new IllegalArgumentException("Invalid hash: " + hash);
+        }
         if (!new File(rootDir, hash+"/index.bundlejs").exists()) {
             throw new IllegalStateException("Bundle version " + hash + " not found.");
         }

package/android/src/main/java/cn/reactnative/modules/update/UpdateModuleImpl.java

@@ -41,11 +41,20 @@ public class UpdateModuleImpl {
 
             @Override
             public void onDownloadFailed(Throwable error) {
-                promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
+                promise.reject(downloadErrorCode(error), error);
             }
         });
     }
 
+    // Post-download failures (unzip / hdiff / resource copy, incl. copiesCrc
+    // verification) reject as PATCH_FAILED so JS-side telemetry can separate
+    // patch health from network health. DownloadTask wraps them.
+    private static String downloadErrorCode(Throwable error) {
+        return error instanceof PatchFailedException
+            ? ErrorCodes.PATCH_FAILED
+            : ErrorCodes.DOWNLOAD_FAILED;
+    }
+
     public static void downloadAndInstallApk(
         final ReactApplicationContext reactContext,
         UpdateContext updateContext,
@@ -84,7 +93,7 @@ public class UpdateModuleImpl {
 
             @Override
             public void onDownloadFailed(Throwable error) {
-                promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
+                promise.reject(downloadErrorCode(error), error);
             }
         });
     }
@@ -107,7 +116,7 @@ public class UpdateModuleImpl {
 
                 @Override
                 public void onDownloadFailed(Throwable error) {
-                    promise.reject(ErrorCodes.DOWNLOAD_FAILED, error);
+                    promise.reject(downloadErrorCode(error), error);
                 }
             });
         } catch (Exception e) {
@@ -191,6 +200,17 @@ public class UpdateModuleImpl {
         });
     }
 
+    public static void getBundleHash(final UpdateContext updateContext, final Promise promise) {
+        // Threading lives in UpdateContext (download executor); resolve is
+        // thread-safe. Never rejects — empty string means "unknown".
+        updateContext.getBundleHash(new UpdateContext.BundleHashListener() {
+            @Override
+            public void onBundleHash(String hash) {
+                promise.resolve(hash);
+            }
+        });
+    }
+
     public static void resetToPackagedBundle(
         final UpdateContext updateContext,
         final Promise promise

package/android/src/newarch/cn/reactnative/modules/update/UpdateModule.java

@@ -73,6 +73,11 @@ public class UpdateModule extends NativePushySpec {
         UpdateModuleImpl.markSuccess(updateContext, promise);
     }
 
+    @Override
+    public void getBundleHash(Promise promise) {
+        UpdateModuleImpl.getBundleHash(updateContext, promise);
+    }
+
     @Override
     public void resetToPackagedBundle(Promise promise) {
         UpdateModuleImpl.resetToPackagedBundle(updateContext, promise);

package/android/src/oldarch/cn/reactnative/modules/update/UpdateModule.java

@@ -75,6 +75,11 @@ public class UpdateModule extends ReactContextBaseJavaModule {
         UpdateModuleImpl.markSuccess(updateContext);
     }
 
+    @ReactMethod
+    public void getBundleHash(Promise promise) {
+        UpdateModuleImpl.getBundleHash(updateContext, promise);
+    }
+
     @ReactMethod
     public void resetToPackagedBundle(Promise promise) {
         UpdateModuleImpl.resetToPackagedBundle(updateContext, promise);

package/cpp/patch_core/digest.cpp

@@ -0,0 +1,230 @@
+#include "digest.h"
+
+#include <cstdio>
+#include <cstring>
+
+namespace pushy {
+namespace digest {
+
+namespace {
+
+// FIPS 180-4 SHA-256 round constants.
+constexpr uint32_t kRoundConstants[64] = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+};
+
+inline uint32_t RotateRight(uint32_t value, uint32_t bits) {
+  return (value >> bits) | (value << (32 - bits));
+}
+
+}  // namespace
+
+Sha256::Sha256() {
+  state_[0] = 0x6a09e667;
+  state_[1] = 0xbb67ae85;
+  state_[2] = 0x3c6ef372;
+  state_[3] = 0xa54ff53a;
+  state_[4] = 0x510e527f;
+  state_[5] = 0x9b05688c;
+  state_[6] = 0x1f83d9ab;
+  state_[7] = 0x5be0cd19;
+}
+
+void Sha256::ProcessBlock(const uint8_t* block) {
+  uint32_t w[64];
+  for (int i = 0; i < 16; i++) {
+    w[i] = (static_cast<uint32_t>(block[i * 4]) << 24) |
+           (static_cast<uint32_t>(block[i * 4 + 1]) << 16) |
+           (static_cast<uint32_t>(block[i * 4 + 2]) << 8) |
+           static_cast<uint32_t>(block[i * 4 + 3]);
+  }
+  for (int i = 16; i < 64; i++) {
+    const uint32_t s0 = RotateRight(w[i - 15], 7) ^ RotateRight(w[i - 15], 18) ^
+                        (w[i - 15] >> 3);
+    const uint32_t s1 = RotateRight(w[i - 2], 17) ^ RotateRight(w[i - 2], 19) ^
+                        (w[i - 2] >> 10);
+    w[i] = w[i - 16] + s0 + w[i - 7] + s1;
+  }
+
+  uint32_t a = state_[0];
+  uint32_t b = state_[1];
+  uint32_t c = state_[2];
+  uint32_t d = state_[3];
+  uint32_t e = state_[4];
+  uint32_t f = state_[5];
+  uint32_t g = state_[6];
+  uint32_t h = state_[7];
+
+  for (int i = 0; i < 64; i++) {
+    const uint32_t s1 =
+        RotateRight(e, 6) ^ RotateRight(e, 11) ^ RotateRight(e, 25);
+    const uint32_t ch = (e & f) ^ (~e & g);
+    const uint32_t temp1 = h + s1 + ch + kRoundConstants[i] + w[i];
+    const uint32_t s0 =
+        RotateRight(a, 2) ^ RotateRight(a, 13) ^ RotateRight(a, 22);
+    const uint32_t maj = (a & b) ^ (a & c) ^ (b & c);
+    const uint32_t temp2 = s0 + maj;
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + temp1;
+    d = c;
+    c = b;
+    b = a;
+    a = temp1 + temp2;
+  }
+
+  state_[0] += a;
+  state_[1] += b;
+  state_[2] += c;
+  state_[3] += d;
+  state_[4] += e;
+  state_[5] += f;
+  state_[6] += g;
+  state_[7] += h;
+}
+
+void Sha256::Update(const uint8_t* data, size_t length) {
+  total_length_ += length;
+
+  if (buffer_length_ > 0) {
+    const size_t fill = 64 - buffer_length_;
+    const size_t take = length < fill ? length : fill;
+    std::memcpy(buffer_ + buffer_length_, data, take);
+    buffer_length_ += take;
+    data += take;
+    length -= take;
+    if (buffer_length_ < 64) {
+      return;
+    }
+    ProcessBlock(buffer_);
+    buffer_length_ = 0;
+  }
+
+  while (length >= 64) {
+    ProcessBlock(data);
+    data += 64;
+    length -= 64;
+  }
+
+  if (length > 0) {
+    std::memcpy(buffer_, data, length);
+    buffer_length_ = length;
+  }
+}
+
+std::string Sha256::HexDigest() {
+  // Padding: 0x80, zeros, then the 64-bit big-endian bit length.
+  const uint64_t bit_length = total_length_ * 8;
+  const uint8_t pad_byte = 0x80;
+  Update(&pad_byte, 1);
+  const uint8_t zero = 0x00;
+  // total_length_ is mutated by the padding updates; the final length field is
+  // captured above, so this loop only needs to reach the 56-byte boundary.
+  while (buffer_length_ != 56) {
+    Update(&zero, 1);
+  }
+  uint8_t length_bytes[8];
+  for (int i = 0; i < 8; i++) {
+    length_bytes[i] = static_cast<uint8_t>(bit_length >> (56 - i * 8));
+  }
+  Update(length_bytes, 8);
+
+  static const char kHex[] = "0123456789abcdef";
+  std::string out;
+  out.reserve(64);
+  for (int i = 0; i < 8; i++) {
+    for (int shift = 24; shift >= 0; shift -= 8) {
+      const uint8_t byte = static_cast<uint8_t>(state_[i] >> shift);
+      out.push_back(kHex[byte >> 4]);
+      out.push_back(kHex[byte & 0x0f]);
+    }
+  }
+  return out;
+}
+
+std::string Sha256File(const std::string& path) {
+  std::FILE* file = std::fopen(path.c_str(), "rb");
+  if (file == nullptr) {
+    return std::string();
+  }
+  Sha256 hasher;
+  uint8_t buffer[64 * 1024];
+  size_t read = 0;
+  while ((read = std::fread(buffer, 1, sizeof(buffer), file)) > 0) {
+    hasher.Update(buffer, read);
+  }
+  const bool failed = std::ferror(file) != 0;
+  std::fclose(file);
+  if (failed) {
+    return std::string();
+  }
+  return hasher.HexDigest();
+}
+
+namespace {
+
+struct Crc32TableHolder {
+  uint32_t table[256];
+
+  Crc32TableHolder() {
+    for (uint32_t i = 0; i < 256; i++) {
+      uint32_t value = i;
+      for (int bit = 0; bit < 8; bit++) {
+        value = (value & 1u) ? (value >> 1) ^ 0xEDB88320u : value >> 1;
+      }
+      table[i] = value;
+    }
+  }
+};
+
+const uint32_t* Crc32Table() {
+  // Function-local static: thread-safe one-time construction (C++11).
+  static const Crc32TableHolder holder;
+  return holder.table;
+}
+
+}  // namespace
+
+void Crc32::Update(const uint8_t* data, size_t length) {
+  const uint32_t* table = Crc32Table();
+  uint32_t state = state_;
+  for (size_t i = 0; i < length; i++) {
+    state = table[(state ^ data[i]) & 0xFFu] ^ (state >> 8);
+  }
+  state_ = state;
+}
+
+bool Crc32File(const std::string& path, uint32_t* out) {
+  std::FILE* file = std::fopen(path.c_str(), "rb");
+  if (file == nullptr) {
+    return false;
+  }
+  Crc32 crc;
+  uint8_t buffer[64 * 1024];
+  size_t read = 0;
+  while ((read = std::fread(buffer, 1, sizeof(buffer), file)) > 0) {
+    crc.Update(buffer, read);
+  }
+  const bool failed = std::ferror(file) != 0;
+  std::fclose(file);
+  if (failed) {
+    return false;
+  }
+  *out = crc.Value();
+  return true;
+}
+
+}  // namespace digest
+}  // namespace pushy

package/cpp/patch_core/digest.h

@@ -0,0 +1,61 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace pushy {
+namespace digest {
+
+// Streaming SHA-256 (FIPS 180-4). Used for bundleHash (the identity of the
+// bundle embedded in the binary) and, later, download artifact verification
+// (IO-6). Streaming because Android/Harmony read the bundle from the package
+// (AssetManager / rawfile) rather than from a plain file.
+//
+// Android intentionally does NOT use this implementation: librnupdate.so is a
+// prebuilt artifact, so the Java layer hashes with java.security.MessageDigest
+// instead. The NIST vectors in the tests anchor both implementations to the
+// same standard.
+class Sha256 {
+ public:
+  Sha256();
+
+  void Update(const uint8_t* data, size_t length);
+
+  // Finalizes and returns the lowercase hex digest. The instance must not be
+  // reused afterwards.
+  std::string HexDigest();
+
+ private:
+  void ProcessBlock(const uint8_t* block);
+
+  uint32_t state_[8];
+  uint64_t total_length_ = 0;
+  uint8_t buffer_[64];
+  size_t buffer_length_ = 0;
+};
+
+// Hashes a file on disk (streaming, bounded memory). Returns the lowercase hex
+// digest, or an empty string if the file cannot be read.
+std::string Sha256File(const std::string& path);
+
+// Streaming CRC32 (IEEE 802.3, reflected polynomial 0xEDB88320 — the zip /
+// zlib checksum). Used to verify pdiff copy sources against the CRCs the CLI
+// records from the origin package's zip entries (copiesCrc in __diff.json):
+// the values must be byte-compatible with what any zip tool would report.
+class Crc32 {
+ public:
+  void Update(const uint8_t* data, size_t length);
+
+  uint32_t Value() const { return state_ ^ 0xFFFFFFFFu; }
+
+ private:
+  uint32_t state_ = 0xFFFFFFFFu;
+};
+
+// CRC32 of a file on disk (streaming, bounded memory). Returns false if the
+// file cannot be read.
+bool Crc32File(const std::string& path, uint32_t* out);
+
+}  // namespace digest
+}  // namespace pushy

package/cpp/patch_core/patch_core.cpp

@@ -1,5 +1,7 @@
 #include "patch_core.h"
 
+#include "digest.h"
+
 #include <cerrno>
 #include <cstdio>
 #include <cstring>
@@ -532,8 +534,22 @@ Status ApplyPatchFromFileSource(
   }
 
   for (const CopyOperation& copy : options.manifest.copies) {
+    const std::string source_path = JoinPath(options.source_root, copy.from);
+    if (copy.has_expected_crc) {
+      uint32_t actual_crc = 0;
+      if (!digest::Crc32File(source_path, &actual_crc)) {
+        return Status::Error("Failed to read copy source " + source_path);
+      }
+      if (actual_crc != copy.expected_crc) {
+        // Rebuilt binary with drifted content at an unchanged path. Fail the
+        // patch — the caller falls back to the full package; never install a
+        // resource whose bytes differ from what the diff was generated against.
+        return Status::Error(
+            "Copy source content mismatch (crc32): " + copy.from);
+      }
+    }
     Status copy_status = CopyFile(
-        JoinPath(options.source_root, copy.from),
+        source_path,
         JoinPath(options.target_root, copy.to),
         true);
     if (!copy_status) {

package/cpp/patch_core/patch_core.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <cstdint>
 #include <ctime>
 #include <string>
 #include <vector>
@@ -20,6 +21,13 @@ struct Status {
 struct CopyOperation {
   std::string from;
   std::string to;
+  // Manifest-declared CRC32 of the source content (__diff.json copiesCrc,
+  // present in pdiff manifests from CLI >= 2.21.2). When set, the copy source
+  // is verified before copying; a mismatch fails the whole patch so the JS
+  // strategy chain falls back to the full package instead of installing a
+  // wrong resource from a rebuilt binary.
+  bool has_expected_crc = false;
+  uint32_t expected_crc = 0;
 };
 
 struct PatchManifest {