react-native-update 10.53.1 → 10.54.0

package/android/src/main/java/cn/reactnative/modules/update/DownloadTask.java

@@ -48,6 +48,18 @@ class DownloadTask implements Runnable {
         NativeUpdateCore.ensureLoaded();
     }
 
+    // Two-phase install (cpp/patch_core/install_record.h): all unpack/patch
+    // work happens in <hash>.staging; the final <hash> directory only ever
+    // appears through an atomic rename after the completion record was
+    // written, so a crash or failure can never leave a half-installed
+    // directory that looks like a version.
+    private File stagingDirectory() {
+        return InstallRecord.stagingDirectoryFor(params.unzipDirectory);
+    }
+
+    // SHA-256 of the downloaded archive, computed right before extraction.
+    private String artifactSha256 = "";
+
     private static final class PatchArchiveContents {
         final ArrayList<String> entryNames = new ArrayList<String>();
         final ArrayList<String> copyFroms = new ArrayList<String>();
@@ -287,6 +299,7 @@ class DownloadTask implements Runnable {
         }
 
         try (Response response = requestClient.newCall(builder.build()).execute()) {
+            rejectProtocolDowngrade(url, response);
             if (response.code() == 416) {
                 long total = resumeMeta == null ? 0 : resumeMeta.optLong("total", 0);
                 if (total > 0 && writePath.length() == total) {
@@ -333,6 +346,11 @@ class DownloadTask implements Runnable {
             } else {
                 totalAll = contentLength > 0 ? contentLength : 0;
             }
+            if (totalAll > ArchiveLimits.MAX_ARCHIVE_BYTES) {
+                throw new IOException("archive too large: " + totalAll + " bytes");
+            }
+            ArchiveLimits.ensureFreeSpace(
+                writePath, totalAll > 0 ? totalAll - baseOffset : 0);
             if (!append) {
                 // Destroy the old bytes before the sidecar can vouch for
                 // them with the new validators (a crash between the two
@@ -364,6 +382,11 @@ class DownloadTask implements Runnable {
                     sink.emit();
 
                     long overall = baseOffset + received;
+                    if (overall > ArchiveLimits.MAX_ARCHIVE_BYTES) {
+                        // Unknown/chunked length backstop.
+                        throw new IOException(
+                            "archive too large: exceeded " + ArchiveLimits.MAX_ARCHIVE_BYTES);
+                    }
                     if (totalAll > 0) {
                         int percentage = (int) (overall * 100.0 / totalAll + 0.5);
                         if (percentage > currentPercentage) {
@@ -396,12 +419,21 @@ class DownloadTask implements Runnable {
     }
 
     private byte[] readBytes(InputStream input) throws IOException {
+        return readBytes(input, Long.MAX_VALUE);
+    }
+
+    private byte[] readBytes(InputStream input, long maxBytes) throws IOException {
         try (
             InputStream in = input;
             ByteArrayOutputStream out = new ByteArrayOutputStream()
         ) {
             int count;
+            long total = 0;
             while ((count = in.read(buffer)) != -1) {
+                total += count;
+                if (total > maxBytes) {
+                    throw new IOException("content exceeds " + maxBytes + " bytes");
+                }
                 out.write(buffer, 0, count);
             }
             return out.toByteArray();
@@ -486,6 +518,7 @@ class DownloadTask implements Runnable {
 
         PatchArchiveContents contents = new PatchArchiveContents();
         try (SafeZipFile zipFile = new SafeZipFile(archiveFile)) {
+            ensureArchiveWithinLimits(archiveFile, zipFile, unzipDirectory);
             Enumeration<? extends ZipEntry> entries = zipFile.entries();
             while (entries.hasMoreElements()) {
                 ZipEntry entry = entries.nextElement();
@@ -493,7 +526,11 @@ class DownloadTask implements Runnable {
                 contents.entryNames.add(name);
 
                 if (name.equals("__diff.json")) {
-                    byte[] bytes = readBytes(zipFile.getInputStream(entry));
+                    if (entry.getSize() > ArchiveLimits.MAX_MANIFEST_BYTES) {
+                        throw new IOException("patch manifest too large: " + entry.getSize());
+                    }
+                    byte[] bytes = readBytes(
+                        zipFile.getInputStream(entry), ArchiveLimits.MAX_MANIFEST_BYTES);
                     String json = new String(bytes, StandardCharsets.UTF_8);
                     JSONObject manifest = (JSONObject) new JSONTokener(json).nextValue();
                     appendManifestEntries(
@@ -516,19 +553,61 @@ class DownloadTask implements Runnable {
     private void doFullPatch() throws IOException {
         downloadFile();
 
-        UpdateFileUtils.removeDirectory(params.unzipDirectory);
-        UpdateFileUtils.ensureDirectory(params.unzipDirectory);
+        File work = stagingDirectory();
+        UpdateFileUtils.removeDirectory(work);
+        UpdateFileUtils.ensureDirectory(work);
+        artifactSha256 = UpdateFileUtils.sha256Hex(params.targetFile);
 
         try (SafeZipFile zipFile = new SafeZipFile(params.targetFile)) {
+            ensureArchiveWithinLimits(params.targetFile, zipFile, work);
             Enumeration<? extends ZipEntry> entries = zipFile.entries();
             while (entries.hasMoreElements()) {
-                zipFile.unzipToPath(entries.nextElement(), params.unzipDirectory);
+                zipFile.unzipToPath(entries.nextElement(), work);
             }
         }
 
         deleteConsumedArchive();
     }
 
+    /**
+     * Last step of a successful patch task: the completion record (with the
+     * final bundle's digest) goes into the staging directory, which is then
+     * renamed over the version directory in one atomic step.
+     */
+    private void promoteStaging() throws IOException, JSONException {
+        File work = stagingDirectory();
+        File bundle = new File(work, "index.bundlejs");
+        if (!bundle.isFile()) {
+            throw new IOException("bundle missing after install: " + bundle);
+        }
+        String bundleSha256 = UpdateFileUtils.sha256Hex(bundle);
+        InstallRecord.write(
+            work, InstallRecord.build(params.hash, bundleSha256, artifactSha256));
+        if (params.unzipDirectory.exists()) {
+            UpdateFileUtils.removeDirectory(params.unzipDirectory);
+        }
+        if (!work.renameTo(params.unzipDirectory)) {
+            throw new IOException("failed to promote staging directory to " + params.unzipDirectory);
+        }
+    }
+
+    /**
+     * Resource caps before extraction (cpp/patch_core/archive_limits.h): the
+     * archive itself, the central directory's declared contents, and the
+     * free space the expansion needs. Failing here is a PATCH_FAILED (the
+     * bytes arrived; they cannot be applied).
+     */
+    private static void ensureArchiveWithinLimits(
+        File archiveFile, SafeZipFile zipFile, File unzipDirectory
+    ) throws IOException {
+        long archiveBytes = archiveFile.length();
+        if (archiveBytes > ArchiveLimits.MAX_ARCHIVE_BYTES) {
+            throw new IOException("archive too large: " + archiveBytes + " bytes");
+        }
+        SafeZipFile.Inspection inspection = zipFile.inspect();
+        ArchiveLimits.ensureFreeSpace(unzipDirectory, inspection.totalUncompressed);
+    }
+
     // The archive and its resume sidecar live and die together: once the
     // archive is consumed (or classified as poisoned) the sidecar must not
     // survive to vouch for a file that no longer exists or cannot be trusted.
@@ -541,7 +620,9 @@ class DownloadTask implements Runnable {
 
     private void doPatchFromApk() throws IOException, JSONException {
         downloadFile();
-        PatchArchiveContents contents = extractPatchArchive(params.targetFile, params.unzipDirectory);
+        File work = stagingDirectory();
+        artifactSha256 = UpdateFileUtils.sha256Hex(params.targetFile);
+        PatchArchiveContents contents = extractPatchArchive(params.targetFile, work);
 
         buildArchivePatchPlan(
             DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK,
@@ -552,22 +633,22 @@ class DownloadTask implements Runnable {
         );
 
         HashMap<String, ArrayList<File>> copyList = buildCopyList(
-            params.unzipDirectory,
+            work,
             buildCopyGroups(
                 contents.copyFroms.toArray(new String[0]),
                 contents.copyTos.toArray(new String[0])
             )
         );
 
-        File originBundleFile = new File(params.unzipDirectory, ".origin.bundle");
+        File originBundleFile = new File(work, ".origin.bundle");
         copyBundledAssetToFile("index.android.bundle", originBundleFile);
         try {
             applyPatchFromFileSource(
-                params.unzipDirectory.getAbsolutePath(),
-                params.unzipDirectory.getAbsolutePath(),
+                work.getAbsolutePath(),
+                work.getAbsolutePath(),
                 originBundleFile.getAbsolutePath(),
-                new File(params.unzipDirectory, "index.bundlejs.patch").getAbsolutePath(),
-                new File(params.unzipDirectory, "index.bundlejs").getAbsolutePath(),
+                new File(work, "index.bundlejs.patch").getAbsolutePath(),
+                new File(work, "index.bundlejs").getAbsolutePath(),
                 "",
                 false,
                 new String[0],
@@ -585,7 +666,9 @@ class DownloadTask implements Runnable {
 
     private void doPatchFromPpk() throws IOException, JSONException {
         downloadFile();
-        PatchArchiveContents contents = extractPatchArchive(params.targetFile, params.unzipDirectory);
+        File work = stagingDirectory();
+        artifactSha256 = UpdateFileUtils.sha256Hex(params.targetFile);
+        PatchArchiveContents contents = extractPatchArchive(params.targetFile, work);
 
         ArchivePatchPlanResult plan = buildArchivePatchPlan(
             DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK,
@@ -597,10 +680,10 @@ class DownloadTask implements Runnable {
 
         applyPatchFromFileSource(
             params.originDirectory.getAbsolutePath(),
-            params.unzipDirectory.getAbsolutePath(),
+            work.getAbsolutePath(),
             new File(params.originDirectory, "index.bundlejs").getAbsolutePath(),
-            new File(params.unzipDirectory, "index.bundlejs.patch").getAbsolutePath(),
-            new File(params.unzipDirectory, "index.bundlejs").getAbsolutePath(),
+            new File(work, "index.bundlejs.patch").getAbsolutePath(),
+            new File(work, "index.bundlejs").getAbsolutePath(),
             plan.mergeSourceSubdir,
             plan.enableMerge,
             contents.copyFroms.toArray(new String[0]),
@@ -625,10 +708,12 @@ class DownloadTask implements Runnable {
             case DownloadTaskParams.TASK_TYPE_PATCH_FULL:
             case DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK:
             case DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK:
+                // Only the staging directory is ours to drop: the final
+                // version directory is never touched by a failed install.
                 try {
-                    UpdateFileUtils.removeDirectory(params.unzipDirectory);
+                    UpdateFileUtils.removeDirectory(stagingDirectory());
                 } catch (IOException ioException) {
-                    Log.e(UpdateContext.TAG, "Failed to clean patched directory", ioException);
+                    Log.e(UpdateContext.TAG, "Failed to clean staging directory", ioException);
                 }
                 if (downloadPhaseCompleted) {
                     // Fully received but failed to unzip/patch: the archive is
@@ -653,6 +738,23 @@ class DownloadTask implements Runnable {
         }
     }
 
+    /**
+     * An https artifact URL must stay on https through every redirect: the
+     * package is the supply-chain boundary and TLS is what authenticates
+     * it. OkHttp follows cross-scheme redirects by default, so the final
+     * request is checked here (the redirected bytes are discarded).
+     */
+    static void rejectProtocolDowngrade(String requestedUrl, Response response)
+        throws IOException {
+        if (requestedUrl != null
+            && requestedUrl.regionMatches(true, 0, "https:", 0, 6)
+            && !response.request().url().isHttps()) {
+            throw new IOException(
+                "https download redirected to plaintext http: "
+                    + response.request().url());
+        }
+    }
+
     private boolean isPatchTask(int taskType) {
         return taskType == DownloadTaskParams.TASK_TYPE_PATCH_FULL
             || taskType == DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK
@@ -661,11 +763,9 @@ class DownloadTask implements Runnable {
 
     private boolean hasCompletedPatchDirectory() {
         return params.unzipDirectory != null
+            && params.hash != null
             && new File(params.unzipDirectory, "index.bundlejs").isFile()
-            && new File(
-                params.unzipDirectory,
-                UpdateContext.VERSION_COMPLETE_FILE
-            ).isFile();
+            && InstallRecord.isComplete(params.unzipDirectory, params.hash);
     }
 
     @Override
@@ -681,12 +781,15 @@ class DownloadTask implements Runnable {
                 switch (taskType) {
                     case DownloadTaskParams.TASK_TYPE_PATCH_FULL:
                         doFullPatch();
+                        promoteStaging();
                         break;
                     case DownloadTaskParams.TASK_TYPE_PATCH_FROM_APK:
                         doPatchFromApk();
+                        promoteStaging();
                         break;
                     case DownloadTaskParams.TASK_TYPE_PATCH_FROM_PPK:
                         doPatchFromPpk();
+                        promoteStaging();
                         break;
                     case DownloadTaskParams.TASK_TYPE_CLEANUP:
                         doCleanUp();
@@ -731,25 +834,6 @@ class DownloadTask implements Runnable {
             deleteResumeSidecar(params.targetFile);
         }
 
-        if (isPatchTask(taskType) && !alreadyCompleted) {
-            try {
-                File marker = new File(
-                    params.unzipDirectory,
-                    UpdateContext.VERSION_COMPLETE_FILE
-                );
-                if (!marker.createNewFile() && !marker.isFile()) {
-                    throw new IOException("Failed to mark completed update: " + marker);
-                }
-            } catch (Throwable error) {
-                Log.e(UpdateContext.TAG, "failed to mark completed update", error);
-                cleanUpAfterFailure(taskType);
-                if (params.listener != null) {
-                    params.listener.onDownloadFailed(error);
-                }
-                return;
-            }
-        }
-
         // The task itself succeeded. Run the completion callback outside the
         // try/catch above so an exception thrown by the callback (e.g. a
         // PackageInstaller failure during APK staging) is not mistaken for

package/android/src/main/java/cn/reactnative/modules/update/InstallRecord.java

@@ -0,0 +1,125 @@
+package cn.reactnative.modules.update;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+/**
+ * Java mirror of cpp/patch_core/install_record.h — keep in sync by hand.
+ * The completion record written as the last step of a two-phase install and
+ * read back before a version directory is trusted.
+ */
+final class InstallRecord {
+    static final int SCHEMA = 1;
+    static final String FILE_NAME = ".pushy-complete";
+    static final String STAGING_SUFFIX = ".staging";
+
+    private InstallRecord() {
+    }
+
+    static File stagingDirectoryFor(File versionDir) {
+        return new File(versionDir.getPath() + STAGING_SUFFIX);
+    }
+
+    static String build(String versionHash, String bundleSha256, String artifactSha256)
+        throws JSONException {
+        JSONObject record = new JSONObject();
+        record.put("schema", SCHEMA);
+        record.put("versionHash", versionHash);
+        if (bundleSha256 != null && !bundleSha256.isEmpty()) {
+            record.put("bundleSha256", bundleSha256);
+        }
+        if (artifactSha256 != null && !artifactSha256.isEmpty()) {
+            record.put("artifactSha256", artifactSha256);
+        }
+        return record.toString();
+    }
+
+    /** Writes the record and fsyncs it: the rename that follows must find it on disk. */
+    static void write(File versionDir, String recordJson) throws IOException {
+        File file = new File(versionDir, FILE_NAME);
+        try (FileOutputStream out = new FileOutputStream(file)) {
+            out.write(recordJson.getBytes(StandardCharsets.UTF_8));
+            out.flush();
+            out.getFD().sync();
+        }
+    }
+
+    /**
+     * Parsed record, or null when the file is absent or malformed. An empty
+     * file (legacy marker) yields an empty JSONObject.
+     */
+    static JSONObject read(File versionDir) {
+        File file = new File(versionDir, FILE_NAME);
+        if (!file.isFile()) {
+            return null;
+        }
+        if (file.length() == 0) {
+            return new JSONObject();
+        }
+        if (file.length() > 64 * 1024) {
+            return null;
+        }
+        try (FileInputStream in = new FileInputStream(file)) {
+            byte[] bytes = new byte[(int) file.length()];
+            int offset = 0;
+            while (offset < bytes.length) {
+                int read = in.read(bytes, offset, bytes.length - offset);
+                if (read < 0) {
+                    break;
+                }
+                offset += read;
+            }
+            return new JSONObject(new String(bytes, 0, offset, StandardCharsets.UTF_8));
+        } catch (IOException | JSONException e) {
+            return null;
+        }
+    }
+
+    /**
+     * Presence check: the record exists and, unless legacy-empty, names this
+     * version. No digest work — this runs on launch / dedup paths.
+     */
+    static boolean isComplete(File versionDir, String versionHash) {
+        JSONObject record = read(versionDir);
+        if (record == null) {
+            return false;
+        }
+        if (record.length() == 0) {
+            return true;
+        }
+        return record.optInt("schema", 0) == SCHEMA
+            && versionHash.equals(record.optString("versionHash", ""));
+    }
+
+    /**
+     * Activation check: re-hashes the bundle when the record carries a digest.
+     * Throws with the reason when the directory must not be activated.
+     */
+    static void verifyForActivation(File versionDir, String versionHash, File bundleFile)
+        throws IOException {
+        JSONObject record = read(versionDir);
+        if (record == null) {
+            throw new IOException("Bundle version " + versionHash + " has no valid completion record.");
+        }
+        if (record.length() == 0) {
+            return;
+        }
+        if (record.optInt("schema", 0) != SCHEMA
+            || !versionHash.equals(record.optString("versionHash", ""))) {
+            throw new IOException("Bundle version " + versionHash + " completion record mismatch.");
+        }
+        String expected = record.optString("bundleSha256", "");
+        if (expected.isEmpty()) {
+            return;
+        }
+        String actual = UpdateFileUtils.sha256Hex(bundleFile);
+        if (!expected.equalsIgnoreCase(actual)) {
+            throw new IOException("Bundle version " + versionHash + " bundle digest mismatch.");
+        }
+    }
+}

package/android/src/main/java/cn/reactnative/modules/update/NativeCheckOrchestrator.java

@@ -58,6 +58,25 @@ final class NativeCheckOrchestrator {
     private static volatile long unactivatedGeneration;
     private static volatile UpdateContext sContext;
     private static volatile String sLaunchRolledBackVersion;
+    // Config JSON for which JS reported a completed check in this process
+    // (markJsCheckCompleted). Process-scoped by design: the next launch
+    // starts with no signal and the cold-start round runs again.
+    private static volatile String sJsCompletedConfig;
+
+    static void markJsCheckCompleted(String config) {
+        sJsCompletedConfig = config;
+    }
+
+    /**
+     * True when JS already obtained a valid response in this process for the
+     * exact config the native round would use: the delayed round is then a
+     * duplicate request. Only the scheduled round consults this — the
+     * crash-rescue path still runs, JS is dead by then.
+     */
+    private static boolean isJsCheckCompleted(UpdateContext context) {
+        String jsConfig = sJsCompletedConfig;
+        return jsConfig != null && jsConfig.equals(context.getKv(KEY_CONFIG));
+    }
 
     private NativeCheckOrchestrator() {
     }
@@ -86,6 +105,13 @@ final class NativeCheckOrchestrator {
                     if (context.getKv(KEY_ROUND_INCOMPLETE) == null) {
                         Thread.sleep(5000);
                     }
+                    if (isJsCheckCompleted(context)) {
+                        // Not consuming the round: a later crash rescue may
+                        // still need it.
+                        Log.i(UpdateContext.TAG,
+                            "native check skipped: JS check completed in this process");
+                        return;
+                    }
                     startRound(0);
                 } catch (Throwable e) {
                     // The rescue path must never take the app down with it.
@@ -211,13 +237,21 @@ final class NativeCheckOrchestrator {
         }
         // From here on the round does real work: leave the breadcrumb that
         // the next launch reads to skip its 5s delay if we die mid-round.
-        context.setKv(KEY_ROUND_INCOMPLETE, "1");
+        // Best-effort: a lost breadcrumb costs one 5s delay, it must not
+        // abort the rescue round itself.
+        try {
+            context.setKv(KEY_ROUND_INCOMPLETE, "1");
+        } catch (IllegalStateException ignored) {
+        }
         try {
             runConfiguredRound(
                 context, launchRolledBackVersion, deadlineNanos,
                 resetGeneration, configJson, config, appKey);
         } finally {
-            context.removeKv(KEY_ROUND_INCOMPLETE);
+            try {
+                context.removeKv(KEY_ROUND_INCOMPLETE);
+            } catch (IllegalStateException ignored) {
+            }
         }
     }
 
@@ -430,6 +464,9 @@ final class NativeCheckOrchestrator {
                 }
             }
             try (Response response = client.newCall(builder.build()).execute()) {
+                // Same rule as the artifact download: an https endpoint that
+                // redirects to plaintext http is a failed endpoint.
+                DownloadTask.rejectProtocolDowngrade(url, response);
                 if (!response.isSuccessful() || response.body() == null) {
                     return null;
                 }
@@ -440,16 +477,11 @@ final class NativeCheckOrchestrator {
         }
     }
 
+    // Shared schema rule (update_flow_core::IsValidCheckResponse): a 200 with
+    // `{"error": ...}` is a failed endpoint, not a verdict, and must not stop
+    // the endpoint fallback.
     private static boolean isValidCheckResponse(String responseText) {
-        if (responseText == null) {
-            return false;
-        }
-        try {
-            new JSONObject(responseText);
-            return true;
-        } catch (JSONException e) {
-            return false;
-        }
+        return responseText != null && NativeUpdateFlow.isValidCheckResponse(responseText);
     }
 
     private static String normalizeEndpointBase(String base) {

package/android/src/main/java/cn/reactnative/modules/update/NativeUpdateFlow.java

@@ -18,6 +18,8 @@ final class NativeUpdateFlow {
 
     static native String orderEndpointCandidates(String endpointsJson, double randomSample);
 
+    static native boolean isValidCheckResponse(String responseText);
+
     static native String handleCheckResponse(
         String responseText, String identityJson, String afterDownload);
 }

package/android/src/main/java/cn/reactnative/modules/update/SafeZipFile.java

@@ -19,6 +19,73 @@ public class SafeZipFile extends ZipFile {
 
     private static final int BUFFER_SIZE = 8192;
 
+    // Bytes written by unzipToFile across the archive: the sum of the central
+    // directory's declared sizes is checked up front (inspect), the actual
+    // stream is re-checked here — headers can lie.
+    private long totalWritten = 0;
+
+    static final class Inspection {
+        long entries;
+        long totalUncompressed;
+    }
+
+    /**
+     * Walks the central directory once, enforcing the archive_limits caps
+     * (entry count, per-entry size, total size, compression ratio) and the
+     * reserved-name / traversal rules, before a single byte is extracted.
+     */
+    Inspection inspect() throws IOException {
+        Inspection result = new Inspection();
+        Enumeration<? extends ZipEntry> entries = entries();
+        while (entries.hasMoreElements()) {
+            ZipEntry entry = entries.nextElement();
+            result.entries++;
+            if (result.entries > ArchiveLimits.MAX_ENTRIES) {
+                throw new IOException(
+                    "archive has too many entries (> " + ArchiveLimits.MAX_ENTRIES + ")");
+            }
+            long size = entry.getSize();
+            long compressed = entry.getCompressedSize();
+            if (size > ArchiveLimits.MAX_ENTRY_BYTES) {
+                throw new IOException(
+                    "archive entry too large: " + entry.getName() + " (" + size + " bytes)");
+            }
+            if (size > 0) {
+                result.totalUncompressed += size;
+                if (result.totalUncompressed > ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES) {
+                    throw new IOException("archive expands beyond "
+                        + ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES + " bytes");
+                }
+                if (compressed > 0 && size > ArchiveLimits.RATIO_CHECK_MIN_BYTES
+                    && size / compressed > ArchiveLimits.MAX_COMPRESSION_RATIO) {
+                    throw new IOException(
+                        "archive entry compression ratio too high: " + entry.getName());
+                }
+            }
+        }
+        return result;
+    }
+
+    // Files the SDK itself writes into a version directory to record its own
+    // decisions (the ".pushy-complete" install marker today). An archive
+    // must never be able to ship one: a package that unzips its own marker
+    // next to a bundle would be trusted as a finished install even when the
+    // patch step that follows fails.
+    static final String RESERVED_ENTRY_PREFIX = ".pushy-";
+
+    static boolean isReservedEntryName(String name) {
+        if (name == null) {
+            return false;
+        }
+        String normalized = name.replace('\\', '/');
+        while (normalized.endsWith("/")) {
+            normalized = normalized.substring(0, normalized.length() - 1);
+        }
+        int slash = normalized.lastIndexOf('/');
+        String baseName = slash >= 0 ? normalized.substring(slash + 1) : normalized;
+        return baseName.startsWith(RESERVED_ENTRY_PREFIX);
+    }
+
     @Override
     public Enumeration<? extends ZipEntry> entries() {
         return new SafeZipEntryIterator(super.entries());
@@ -48,6 +115,9 @@ public class SafeZipFile extends ZipFile {
                 if (null != name && (name.contains("../") || name.contains("..\\"))) {
                     throw new SecurityException("illegal entry: " + name);
                 }
+                if (isReservedEntryName(name)) {
+                    throw new SecurityException("reserved entry: " + name);
+                }
             }
             return entry;
         }
@@ -63,6 +133,9 @@ public class SafeZipFile extends ZipFile {
         if (!canonicalPath.startsWith(targetPath.getCanonicalPath() + File.separator)) {
             throw new SecurityException("Illegal name: " + name);
         }
+        if (isReservedEntryName(name)) {
+            throw new SecurityException("reserved entry: " + name);
+        }
 
         if (ze.isDirectory()) {
             target.mkdirs();
@@ -77,12 +150,29 @@ public class SafeZipFile extends ZipFile {
             throw new IOException("Failed to create parent dir for " + target);
         }
 
+        // The declared size is the budget when known; otherwise the global
+        // per-entry cap. Either way the stream may not exceed it.
+        long declared = ze.getSize();
+        long budget = declared >= 0
+            ? Math.min(declared, ArchiveLimits.MAX_ENTRY_BYTES)
+            : ArchiveLimits.MAX_ENTRY_BYTES;
+        long written = 0;
         try (InputStream inputStream = getInputStream(ze)) {
             try (BufferedOutputStream output = new BufferedOutputStream(new FileOutputStream(target));
                  BufferedInputStream input = new BufferedInputStream(inputStream)) {
                 byte[] buffer = new byte[BUFFER_SIZE];
                 int n;
                 while ((n = input.read(buffer, 0, BUFFER_SIZE)) >= 0) {
+                    written += n;
+                    totalWritten += n;
+                    if (written > budget) {
+                        throw new IOException(
+                            "archive entry exceeds its declared size: " + ze.getName());
+                    }
+                    if (totalWritten > ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES) {
+                        throw new IOException("archive expands beyond "
+                            + ArchiveLimits.MAX_TOTAL_UNCOMPRESSED_BYTES + " bytes");
+                    }
                     output.write(buffer, 0, n);
                 }
             }