react-native-update 10.59.2 → 10.61.0

package/cpp/patch_core/native_texts.h

@@ -0,0 +1,102 @@
+#ifndef PUSHY_PATCH_CORE_NATIVE_TEXTS_H_
+#define PUSHY_PATCH_CORE_NATIVE_TEXTS_H_
+
+#include <string>
+#include <vector>
+
+#include "obscured_text.h"
+
+// The plain text shipped native code needs but must not carry in its string
+// tables (update wording, service addresses), stored encoded and decoded on
+// first use. Shared by the C++ cores and iOS; Android and Harmony get their
+// copies in Texts.java / Texts.ts. All generated from scripts/contract.ts.
+// Keep the core internal to whichever binary links it (see podspec Core).
+#pragma GCC visibility push(hidden)
+
+namespace pushy {
+namespace texts {
+
+// <generated:texts> (scripts/contract.ts; bun scripts/generate-contract.ts)
+// The round status / decision reason when nothing is to be installed.
+inline const std::string& StatusNone() {
+  static const std::string value = text::Reveal("3418c1c1aa8a7c40");
+  return value;
+}
+// Version-info flag of a version a crash hold installed (read by JS).
+inline const std::string& InfoCrashHold() {
+  static const std::string value = text::Reveal("3905f5c2a6b96d56212a19");
+  return value;
+}
+// Version-info flag of a version the server forceBoot-activated.
+inline const std::string& InfoForceBoot() {
+  static const std::string value = text::Reveal("3c18e6d2aba9674a360d19ead5a695");
+  return value;
+}
+inline const std::string& QueryPath() {
+  static const std::string value = text::Reveal("7514fcd4ad805d55263e08fc99");
+  return value;
+}
+// The afterDownload policy that activates for the next launch.
+inline const std::string& PolicyNextLaunch() {
+  static const std::string value = text::Reveal("2912e0ffab8e6c70323b1dedd3");
+  return value;
+}
+inline const std::string& FieldAvailable() {
+  static const std::string value = text::Reveal("2f07f0d0ba8e");
+  return value;
+}
+// The bundle patch entry inside a patch archive.
+inline const std::string& BundleDeltaEntry() {
+  static const std::string value = text::Reveal("3319f0d4b6c56a502c3b10fcdca0de7d4b3307e9");
+  return value;
+}
+inline const std::string& OptionUrlKey() {
+  static const std::string value = text::Reveal("2f07f0d0ba8e5d572e");
+  return value;
+}
+inline const std::string& PpkDeltaSuffix() {
+  static const std::string value = text::Reveal("7407e4dae09b69512137");
+  return value;
+}
+// Archive suffix of a patch against the installed package.
+inline const std::string& PackageDeltaSuffix() {
+  static const std::string value = text::Reveal("741ee4d0e09b69512137");
+  return value;
+}
+inline const std::string& PackageUpdatedMarkedKey() {
+  static const std::string value = text::Reveal("0832d5f29aa549710b0939daf88ca058790f3dded7e888b451640d2ec3f69099bb43711523cafa8ea7bb4372132a");
+  return value;
+}
+inline const std::string& LogTag() {
+  static const std::string value = text::Reveal("2812f5d2bac6664436360afc9ba680694b3301");
+  return value;
+}
+inline const std::string& StateResultClass() {
+  static const std::string value = text::Reveal("3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c93a99b63511201f9cd97878c695522");
+  return value;
+}
+inline const std::string& CopyGroupResultClass() {
+  static const std::string value = text::Reveal("3919bbc3ab8a6b512c3e08f0c0b6df60452311edfbc8f780624b2d1de38c83b28a6e732301fed897878c695522");
+  return value;
+}
+// Pushy's own service addresses, configure()'s defaults.
+inline std::vector<std::string> DefaultEndpoints() {
+  return {
+      text::Reveal("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5b3d5b9817b592947e5cdefbc8a7e"),
+      text::Reveal("3203e0c1bdd1270a372f18f8c2b6de7f4f2607f5f0daac9c644a620ae88ca1ad93"),
+  };
+}
+inline std::vector<std::string> DefaultQueryUrls() {
+  return {
+      text::Reveal("3203e0c1bdd1270a253608fcd3fd9362476817f4f0d5a1996342631be3c2a3a9d779552507fdcde8928a6f512f5ce2ccbdc869404d2f1de79daa826d562c0913eec4fa9b7d4426"),
+      text::Reveal("3203e0c1bdd1270a213b12b7dca09468462e12f3b0d5bd813d482446f4c6a1be8e79552507fdcda68cd06e5c3710e480a4867048483e55e0c2ab8d7d43030d1ce9c3b183214e2601f2f0d5b782601e2719e8ca"),
+  };
+}
+// </generated:texts>
+
+}  // namespace texts
+}  // namespace pushy
+
+#pragma GCC visibility pop
+
+#endif  // PUSHY_PATCH_CORE_NATIVE_TEXTS_H_

package/cpp/patch_core/patch_core.cpp

@@ -21,7 +21,10 @@
 #include "hbc_transform_wire.h"
 
 extern "C" {
-#include "hpatch.h"
+// Relative to this file: under use_frameworks! a bare "hpatch.h" resolves
+// to the flattened framework PrivateHeaders copy, whose own HDiffPatch/
+// includes then fail.
+#include "../hpatch/hpatch.h"
 }
 
 namespace pushy {
@@ -487,14 +490,6 @@ Status MergeDirectoryRecursively(
 
 }  // namespace
 
-Status Status::Ok() {
-  return Status{true, std::string()};
-}
-
-Status Status::Error(const std::string& message) {
-  return Status{false, message};
-}
-
 Status ValidateManifest(const PatchManifest& manifest) {
   return ValidateManifestImpl(manifest);
 }
@@ -580,7 +575,7 @@ Status ApplyBundlePatchWithHbcTransform(
     const FileSourcePatchOptions& options,
     const BundleRebuilder& bundle_patcher) {
   hbc::HbcTransformMeta meta;
-  if (!hbc::ParseHbcTransformMeta(options.bundle_hbc_transform_meta, &meta)) {
+  if (!hbc::ParseHbcTransformMeta(options.manifest.bundle_hbc_transform_meta, &meta)) {
     return Status::Error("Invalid hbcTransform metadata");
   }
   if (meta.v != hbc::kHbcTransformSupportedVersion) {
@@ -654,7 +649,7 @@ Status ApplyPatchFromFileSource(
   }
 
   Status bundle_status =
-      options.bundle_hbc_transform_meta.empty()
+      options.manifest.bundle_hbc_transform_meta.empty()
           ? bundle_patcher.Apply(
                 options.origin_bundle_path,
                 options.bundle_patch_path,
@@ -727,11 +722,16 @@ Status CleanupOldEntries(
       max_age_days, now);
 }
 
-Status CleanupOldEntries(
+namespace {
+
+// Lists the non-dot entries of root_dir that are not kept and are at least
+// max_age_days old: the one selection rule shared by delete and trash.
+Status SelectOldEntries(
     const std::string& root_dir,
     const std::vector<std::string>& keep_names,
     int max_age_days,
-    std::time_t now) {
+    std::time_t now,
+    std::vector<std::string>* out) {
   DIR* dir = opendir(root_dir.c_str());
   if (!dir) {
     if (errno == ENOENT) {
@@ -765,15 +765,61 @@ Status CleanupOldEntries(
     if (effective_now - st.st_mtime < max_age_seconds) {
       continue;
     }
+    out->push_back(name);
+  }
 
-    Status remove_status = RemovePathRecursively(entry_path);
+  closedir(dir);
+  return Status::Ok();
+}
+
+}  // namespace
+
+Status CleanupOldEntries(
+    const std::string& root_dir,
+    const std::vector<std::string>& keep_names,
+    int max_age_days,
+    std::time_t now) {
+  std::vector<std::string> doomed;
+  Status select_status =
+      SelectOldEntries(root_dir, keep_names, max_age_days, now, &doomed);
+  if (!select_status) {
+    return select_status;
+  }
+  for (const std::string& name : doomed) {
+    Status remove_status = RemovePathRecursively(JoinPath(root_dir, name));
     if (!remove_status) {
-      closedir(dir);
       return remove_status;
     }
   }
+  return Status::Ok();
+}
 
-  closedir(dir);
+Status MoveOldEntriesToTrash(
+    const std::string& root_dir,
+    const std::vector<std::string>& keep_names,
+    int max_age_days,
+    const std::string& trash_dir,
+    std::time_t now) {
+  std::vector<std::string> doomed;
+  Status select_status =
+      SelectOldEntries(root_dir, keep_names, max_age_days, now, &doomed);
+  if (!select_status || doomed.empty()) {
+    return select_status;
+  }
+  Status dir_status = EnsureDirectory(trash_dir);
+  if (!dir_status) {
+    return dir_status;
+  }
+  for (const std::string& name : doomed) {
+    std::string target = JoinPath(trash_dir, name);
+    for (int suffix = 1; PathExists(target); ++suffix) {
+      target = JoinPath(trash_dir, name + "." + IntToString(suffix));
+    }
+    const std::string source = JoinPath(root_dir, name);
+    if (rename(source.c_str(), target.c_str()) != 0) {
+      return MakeErrnoStatus("Failed to move " + source + " to trash");
+    }
+  }
   return Status::Ok();
 }
 

package/cpp/patch_core/patch_core.h

@@ -17,8 +17,12 @@ struct Status {
 
   explicit operator bool() const { return ok; }
 
-  static Status Ok();
-  static Status Error(const std::string& message);
+  // Inline so a core that only reports a Status (install_record.cpp) links
+  // without patch_core.cpp and its hpatch dependencies.
+  static Status Ok() { return Status{true, std::string()}; }
+  static Status Error(const std::string& message) {
+    return Status{false, message};
+  }
 };
 
 struct CopyOperation {
@@ -33,9 +37,16 @@ struct CopyOperation {
   uint32_t expected_crc = 0;
 };
 
+// What a patch archive's __diff.json declares (ParsePatchManifest in
+// patch_manifest.h is the one parser every platform uses).
 struct PatchManifest {
   std::vector<CopyOperation> copies;
   std::vector<std::string> deletes;
+  // __diff.json 中该 bundle patch 条目的 hbcTransform 元数据(JSON 文本)。
+  // 非空时 patch 走变换域:T(origin) → hpatch → T⁻¹。元数据不可解析或
+  // 变换规范版本不受支持时返回错误(调用方回退整包),绝不忽略元数据
+  // 直接应用——那会产出损坏的 bundle。
+  std::string bundle_hbc_transform_meta;
 };
 
 struct FileSourcePatchOptions {
@@ -47,11 +58,6 @@ struct FileSourcePatchOptions {
   std::string bundle_output_path;
   std::string merge_source_subdir;
   bool enable_merge = true;
-  // __diff.json 中该 bundle patch 条目的 hbcTransform 元数据(原始 JSON)。
-  // 非空时 patch 走变换域:T(origin) → hpatch → T⁻¹。元数据不可解析或
-  // 变换规范版本不受支持时返回错误(调用方回退整包),绝不忽略元数据
-  // 直接应用——那会产出损坏的 bundle。
-  std::string bundle_hbc_transform_meta;
 };
 
 class BundleRebuilder {
@@ -89,6 +95,20 @@ Status CleanupOldEntries(
     int max_age_days,
     std::time_t now = 0);
 
+// Same selection as CleanupOldEntries, but each doomed entry is renamed into
+// trash_dir (created if needed; must be on the same file system, e.g. a
+// dot-named child of root_dir so the selection itself skips it) instead of
+// being deleted. Renames are cheap, so a caller can hold its version-files
+// lock across this call and delete trash_dir's contents after releasing it
+// (CleanupOldEntries(trash_dir, {}, 0)). A name already present in trash_dir
+// (left over by an interrupted earlier delete) gets a numeric suffix.
+Status MoveOldEntriesToTrash(
+    const std::string& root_dir,
+    const std::vector<std::string>& keep_names,
+    int max_age_days,
+    const std::string& trash_dir,
+    std::time_t now = 0);
+
 bool IsSafeRelativePath(const std::string& path);
 
 namespace internal {

package/cpp/patch_core/patch_manifest.cpp

@@ -0,0 +1,201 @@
+#include "patch_manifest.h"
+
+#include <cmath>
+#include <cstdint>
+#include <unordered_map>
+#include <utility>
+
+// Relative like every other cross-core include (see patch_core.cpp's hpatch.h
+// include): use_frameworks! flattens the pod's headers.
+#include "../update_flow_core/flow_json.h"
+
+namespace pushy {
+namespace delta {
+namespace {
+
+constexpr const char* kErrorPrefix = "delta manifest: ";
+
+Status ManifestError(const std::string& message) {
+  return Status::Error(kErrorPrefix + message);
+}
+
+// null counts as absent everywhere (JSON writers emit it for empty maps).
+bool IsAbsent(const flowjson::Value& value) {
+  return value.IsUndefined() ||
+         value.kind() == flowjson::Value::Kind::Null;
+}
+
+// An integer in [0, 2^32): the only CRC value a client can compare.
+bool ReadCrc32(const flowjson::Value& value, uint32_t* out) {
+  if (!value.IsNumber()) {
+    return false;
+  }
+  const double number = value.AsNumber();
+  if (!std::isfinite(number) || number < 0 || number > 4294967295.0 ||
+      std::floor(number) != number) {
+    return false;
+  }
+  *out = static_cast<uint32_t>(number);
+  return true;
+}
+
+Status ParseCopies(
+    const flowjson::Value& copies,
+    const flowjson::Value& copies_crc,
+    const PatchManifestOptions& options,
+    PatchManifest* manifest) {
+  if (IsAbsent(copies)) {
+    return Status::Ok();
+  }
+  if (!copies.IsObject()) {
+    return ManifestError("copies is not an object");
+  }
+  if (!IsAbsent(copies_crc) && !copies_crc.IsObject()) {
+    return ManifestError("copiesCrc is not an object");
+  }
+  // Target -> declared CRC value; one pass, not a member scan per copy.
+  std::unordered_map<std::string, const flowjson::Value*> crc_by_target;
+  if (copies_crc.IsObject()) {
+    crc_by_target.reserve(copies_crc.members().size());
+    for (const auto& member : copies_crc.members()) {
+      crc_by_target.emplace(member.first, &member.second);
+    }
+  }
+  const std::string& prefix = options.copy_source_prefix;
+  // Source -> the CRC some copy of it declared, to catch contradictions.
+  std::unordered_map<std::string, uint32_t> crc_by_source;
+  manifest->copies.reserve(copies.members().size());
+  for (const auto& member : copies.members()) {
+    const std::string& to = member.first;
+    const flowjson::Value& from_value = member.second;
+    std::string from;
+    if (from_value.IsString()) {
+      from = from_value.AsString();
+    } else if (!IsAbsent(from_value)) {
+      return ManifestError("copies entry is not a string: " + to);
+    }
+    if (!prefix.empty() && from.compare(0, prefix.size(), prefix) == 0) {
+      from.erase(0, prefix.size());
+    }
+    if (from.empty()) {
+      from = to;
+    }
+
+    CopyOperation copy;
+    copy.from = std::move(from);
+    copy.to = to;
+    const auto declared = crc_by_target.find(to);
+    if (declared != crc_by_target.end()) {
+      const flowjson::Value& crc = *declared->second;
+      if (!IsAbsent(crc)) {
+        if (!ReadCrc32(crc, &copy.expected_crc)) {
+          return ManifestError("copiesCrc entry is not a CRC32: " + to);
+        }
+        copy.has_expected_crc = true;
+        const auto inserted =
+            crc_by_source.emplace(copy.from, copy.expected_crc);
+        if (!inserted.second &&
+            inserted.first->second != copy.expected_crc) {
+          return ManifestError("conflicting copiesCrc for source " + copy.from);
+        }
+      }
+    }
+    manifest->copies.push_back(std::move(copy));
+  }
+  return Status::Ok();
+}
+
+Status ParseDeletes(const flowjson::Value& deletes, PatchManifest* manifest) {
+  if (IsAbsent(deletes)) {
+    return Status::Ok();
+  }
+  if (deletes.IsObject()) {
+    manifest->deletes.reserve(deletes.members().size());
+    for (const auto& member : deletes.members()) {
+      manifest->deletes.push_back(member.first);
+    }
+    return Status::Ok();
+  }
+  if (deletes.IsArray()) {
+    manifest->deletes.reserve(deletes.Size());
+    for (const flowjson::Value& path : deletes.elements()) {
+      if (!path.IsString()) {
+        return ManifestError("deletes entry is not a string");
+      }
+      manifest->deletes.push_back(path.AsString());
+    }
+    return Status::Ok();
+  }
+  return ManifestError("deletes is not an object or array");
+}
+
+Status ParseHbcTransform(
+    const flowjson::Value& hbc_transform,
+    const PatchManifestOptions& options,
+    PatchManifest* manifest) {
+  if (IsAbsent(hbc_transform)) {
+    return Status::Ok();
+  }
+  if (!hbc_transform.IsObject()) {
+    return ManifestError("hbcTransform is not an object");
+  }
+  const flowjson::Value& meta =
+      hbc_transform.Get(options.bundle_patch_entry_name);
+  if (IsAbsent(meta)) {
+    return Status::Ok();
+  }
+  if (!meta.IsObject()) {
+    return ManifestError(
+        "hbcTransform entry is not an object: " +
+        options.bundle_patch_entry_name);
+  }
+  manifest->bundle_hbc_transform_meta = flowjson::Stringify(meta);
+  return Status::Ok();
+}
+
+}  // namespace
+
+Status ParsePatchManifest(
+    const std::string& json_text,
+    const PatchManifestOptions& options,
+    PatchManifest* out) {
+  if (out == nullptr) {
+    return Status::Error("Manifest output is required");
+  }
+  flowjson::ParseLimits limits;
+  limits.max_input_bytes =
+      static_cast<size_t>(archive_limits::kMaxManifestBytes);
+  limits.max_nodes = kMaxManifestNodes;
+  bool ok = false;
+  const flowjson::Value root = flowjson::Parse(json_text, limits, &ok);
+  if (!ok) {
+    return ManifestError("invalid JSON or over the size limits");
+  }
+  if (!root.IsObject()) {
+    return ManifestError("not a JSON object");
+  }
+
+  PatchManifest manifest;
+  Status status =
+      ParseCopies(root.Get("copies"), root.Get("copiesCrc"), options, &manifest);
+  if (!status) {
+    return status;
+  }
+  status = ParseDeletes(root.Get("deletes"), &manifest);
+  if (!status) {
+    return status;
+  }
+  status = ParseHbcTransform(root.Get("hbcTransform"), options, &manifest);
+  if (!status) {
+    return status;
+  }
+  status = ValidateManifest(manifest);
+  if (!status) {
+    return status;
+  }
+  *out = std::move(manifest);
+  return Status::Ok();
+}
+
+}  // namespace delta
+}  // namespace pushy

package/cpp/patch_core/patch_manifest.h

@@ -0,0 +1,74 @@
+#pragma once
+
+#include <cstddef>
+#include <string>
+
+#include "archive_limits.h"
+#include "patch_core.h"
+
+// Keep the core internal to whichever binary links it (see podspec Core).
+#pragma GCC visibility push(hidden)
+
+namespace pushy {
+namespace delta {
+
+// __diff.json, the manifest inside every patch archive, as the generators
+// emit it (pushy-go internal/taskexecutor/bundle_diff.go and
+// react-native-update-cli src/diff.ts):
+//
+//   {"copies":       {"<to>": "<from>" | "", ...},
+//    "copiesCrc":    {"<to>": <crc32>, ...},          package diffs only
+//    "deletes":      {"<path>": 1, ...},              ppk diffs only
+//    "hbcTransform": {"<bundle patch entry>": {...}}} hdiffv2 track only
+//
+// The one parser of that file on Android, iOS and HarmonyOS. The rules are
+// the most permissive form that is still safe; anything else fails the
+// patch, and the JS strategy chain falls back to the full package:
+//  - the text is a JSON object (at most archive_limits::kMaxManifestBytes,
+//    at most kMaxManifestNodes values); unknown members are ignored, and a
+//    member that is null counts as absent;
+//  - copies: an object of target -> source strings. An empty (or null)
+//    source means "same path as the target". Order follows the document;
+//  - copiesCrc: an object keyed by copy *target* (not source). Each value is
+//    an integer in [0, 2^32) or null; any other value is an error (a CRC the
+//    client cannot honour must not silently skip the content check). Keys
+//    naming no copy are ignored. Two copies of one source that declare
+//    different CRCs are a self-contradictory manifest and an error;
+//  - deletes: an object (its keys) or an array of strings;
+//  - hbcTransform: an object; its member named after the bundle patch entry,
+//    when present, must be an object and is handed on re-serialized
+//    (PatchManifest::bundle_hbc_transform_meta). Non-object metadata is an
+//    error, never ignored: applying a transform-domain patch without the
+//    transform produces a corrupt bundle;
+//  - every path passes ValidateManifest.
+// Values of the wrong type (a numeric source, a non-string delete, copies as
+// an array, ...) are errors on every platform.
+struct PatchManifestOptions {
+  // The archive entry whose hbcTransform metadata is extracted
+  // (archive_patch::DefaultBundleDeltaEntryName() unless the platform names
+  // its bundle differently, e.g. HarmonyOS).
+  std::string bundle_patch_entry_name;
+  // Stripped once from the start of every copy source that begins with it,
+  // before the empty-source rule applies. HarmonyOS package diffs name the
+  // origin entries by their HAP path ("resources/rawfile/assets/a.png"),
+  // which the resource manager reads back as "assets/a.png".
+  std::string copy_source_prefix;
+};
+
+// A package holds at most archive_limits::kMaxEntries entries, and the
+// generators emit at most one copy source, one CRC and one delete per entry
+// (plus a few hundred values of hbcTransform metadata). The cap bounds the
+// parsed tree of a hostile 16 MB manifest to about ten MB of heap.
+constexpr size_t kMaxManifestNodes =
+    4 * static_cast<size_t>(archive_limits::kMaxEntries);
+
+// Fails without touching *out.
+Status ParsePatchManifest(
+    const std::string& json_text,
+    const PatchManifestOptions& options,
+    PatchManifest* out);
+
+}  // namespace delta
+}  // namespace pushy
+
+#pragma GCC visibility pop