ubriot 1.2.0 → 1.4.0

package/dist/ota-signing.js

@@ -0,0 +1,271 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYID_ENV = exports.SIGNING_CONFIG_PATH = exports.SIGNING_ALG = exports.PRIVATE_KEY_ENV = void 0;
+exports.privateKeyMatchesCertificate = privateKeyMatchesCertificate;
+exports.verifyManifestSignature = verifyManifestSignature;
+exports.signManifest = signManifest;
+exports.loadSigningMaterial = loadSigningMaterial;
+exports.readSigningConfig = readSigningConfig;
+exports.writeSigningConfig = writeSigningConfig;
+exports.upsertSigningConfigKey = upsertSigningConfigKey;
+exports.gitWorkTreeContaining = gitWorkTreeContaining;
+exports.assertKeyDirOutsideGit = assertKeyDirOutsideGit;
+exports.writePrivateKey = writePrivateKey;
+exports.writePublicFile = writePublicFile;
+exports.expiryWarnings = expiryWarnings;
+exports.generateSimpleIdentity = generateSimpleIdentity;
+exports.commonNameOf = commonNameOf;
+exports.generateChainRoot = generateChainRoot;
+exports.issueLeaf = issueLeaf;
+exports.fingerprintSha256 = fingerprintSha256;
+exports.resolveFromProject = resolveFromProject;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const code_signing_certificates_1 = require("@expo/code-signing-certificates");
+const x509_1 = require("./x509");
+const child_env_1 = require("./child-env");
+Object.defineProperty(exports, "PRIVATE_KEY_ENV", { enumerable: true, get: function () { return child_env_1.PRIVATE_KEY_ENV; } });
+exports.SIGNING_ALG = "rsa-v1_5-sha256";
+exports.SIGNING_CONFIG_PATH = (0, path_1.join)(".ubriot", "signing.json");
+exports.KEYID_ENV = "UBRIOT_OTA_KEYID";
+function publicKeyDer(key) {
+    const publicKey = key.type === "private" ? (0, crypto_1.createPublicKey)(key) : key;
+    return publicKey.export({ type: "spki", format: "der" });
+}
+function privateKeyMatchesCertificate(privateKeyPem, certificatePem) {
+    try {
+        return publicKeyDer((0, crypto_1.createPrivateKey)(privateKeyPem)).equals(publicKeyDer(new crypto_1.X509Certificate(certificatePem).publicKey));
+    }
+    catch {
+        return false;
+    }
+}
+function verifyManifestSignature(manifestJson, sig, certificatePem) {
+    try {
+        return (0, crypto_1.verify)("sha256", Buffer.from(manifestJson, "utf8"), new crypto_1.X509Certificate(certificatePem).publicKey, Buffer.from(sig, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+function signManifest(manifestJson, material) {
+    const sig = (0, crypto_1.sign)("sha256", Buffer.from(manifestJson, "utf8"), (0, crypto_1.createPrivateKey)(material.privateKeyPem)).toString("base64");
+    if (!verifyManifestSignature(manifestJson, sig, material.certificatePem)) {
+        throw new Error(`The private key for keyid "${material.keyid}" does not match its certificate. Nothing was published.`);
+    }
+    return { keyid: material.keyid, alg: exports.SIGNING_ALG, sig };
+}
+function readText(path, label) {
+    if (!(0, fs_1.existsSync)(path))
+        throw new Error(`${label} not found: ${path}`);
+    return (0, fs_1.readFileSync)(path, "utf8");
+}
+function matchRegisteredKey(privateKeyPem, registered) {
+    const usable = registered.filter((key) => key.status === "active" && key.custody === "customer");
+    return usable.find((key) => privateKeyMatchesCertificate(privateKeyPem, key.certificatePem)) ?? null;
+}
+function loadSigningMaterial(opts) {
+    const registered = opts.registeredKeys ?? [];
+    const keyidFor = (privateKeyPem, fallback) => {
+        const match = matchRegisteredKey(privateKeyPem, registered);
+        const keyid = opts.signWith?.length === 1 ? opts.signWith[0] : match?.keyid ?? fallback;
+        if (!keyid)
+            throw new Error("Could not tell which keyid this private key belongs to. Pass --sign-with <keyid>.");
+        return { keyid, match };
+    };
+    if (opts.privateKeyPath) {
+        const privateKeyPem = readText((0, path_1.resolve)(opts.projectDir, opts.privateKeyPath), "Private key");
+        const { keyid, match } = keyidFor(privateKeyPem, opts.env[exports.KEYID_ENV]);
+        const certificatePem = opts.certificatePath ? readText((0, path_1.resolve)(opts.projectDir, opts.certificatePath), "Certificate") : match?.certificatePem;
+        if (!certificatePem)
+            throw new Error("Pass --certificate-path, or register the certificate with: ubriot signing import");
+        return [{ keyid, privateKeyPem, certificatePem }];
+    }
+    const envKey = opts.env[child_env_1.PRIVATE_KEY_ENV]?.trim();
+    if (envKey) {
+        const privateKeyPem = envKey.includes("\\n") && !envKey.includes("\n") ? envKey.replace(/\\n/g, "\n") : envKey;
+        if (!opts.certificatePath && !matchRegisteredKey(privateKeyPem, registered)) {
+            throw new Error(`${child_env_1.PRIVATE_KEY_ENV} does not match any active registered certificate for this app. Pass --certificate-path or run: ubriot signing status`);
+        }
+        const { keyid, match } = keyidFor(privateKeyPem, opts.env[exports.KEYID_ENV]);
+        const certificatePem = opts.certificatePath ? readText((0, path_1.resolve)(opts.projectDir, opts.certificatePath), "Certificate") : match?.certificatePem;
+        if (!certificatePem)
+            throw new Error(`${child_env_1.PRIVATE_KEY_ENV} does not match any active registered certificate for this app. Pass --certificate-path or run: ubriot signing status`);
+        return [{ keyid, privateKeyPem, certificatePem }];
+    }
+    const config = readSigningConfig(opts.projectDir);
+    if (!config || config.keys.length === 0)
+        return [];
+    const activeKeyids = registered.length ? new Set(registered.filter((key) => key.status === "active").map((key) => key.keyid)) : null;
+    let keys = config.keys;
+    if (opts.signWith?.length) {
+        const missing = opts.signWith.filter((keyid) => !keys.some((key) => key.keyid === keyid));
+        if (missing.length)
+            throw new Error(`No local key for keyid ${missing.map((k) => `"${k}"`).join(", ")} in ${exports.SIGNING_CONFIG_PATH}`);
+        keys = keys.filter((key) => opts.signWith.includes(key.keyid));
+    }
+    else if (activeKeyids) {
+        const active = keys.filter((key) => activeKeyids.has(key.keyid));
+        if (active.length === 0) {
+            const describe = keys.map((key) => `"${key.keyid}" (${registered.find((r) => r.keyid === key.keyid)?.status ?? "not registered"})`).join(", ");
+            throw new Error(`No active signing key in ${exports.SIGNING_CONFIG_PATH}: ${describe}. Rotate with: ubriot signing rotate, or remove the stale keys from ${exports.SIGNING_CONFIG_PATH} to publish unsigned.`);
+        }
+        keys = active;
+    }
+    return keys.map((key) => ({
+        keyid: key.keyid,
+        privateKeyPem: readText((0, path_1.resolve)(opts.projectDir, key.privateKeyPath), `Private key for "${key.keyid}"`),
+        certificatePem: readText((0, path_1.resolve)(opts.projectDir, key.certificatePath), `Certificate for "${key.keyid}"`),
+    }));
+}
+function readSigningConfig(projectDir) {
+    const path = (0, path_1.join)(projectDir, exports.SIGNING_CONFIG_PATH);
+    if (!(0, fs_1.existsSync)(path))
+        return null;
+    const parsed = JSON.parse((0, fs_1.readFileSync)(path, "utf8"));
+    const keys = Array.isArray(parsed?.keys) ? parsed.keys : [];
+    return { app: typeof parsed?.app === "string" ? parsed.app : undefined, keys };
+}
+function writeSigningConfig(projectDir, config) {
+    const serialized = JSON.stringify(config, null, 2);
+    if (/PRIVATE KEY|BEGIN CERTIFICATE/.test(serialized))
+        throw new Error(`${exports.SIGNING_CONFIG_PATH} stores file paths only, never key or certificate contents`);
+    const path = (0, path_1.join)(projectDir, exports.SIGNING_CONFIG_PATH);
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(path), { recursive: true });
+    (0, fs_1.writeFileSync)(path, `${serialized}\n`, "utf8");
+}
+function upsertSigningConfigKey(projectDir, app, key) {
+    const current = readSigningConfig(projectDir) ?? { app, keys: [] };
+    const keys = current.keys.filter((existing) => existing.keyid !== key.keyid);
+    writeSigningConfig(projectDir, { app: current.app ?? app, keys: [...keys, key] });
+}
+function nearestExistingDirectory(path) {
+    let current = (0, path_1.resolve)(path);
+    while (!(0, fs_1.existsSync)(current)) {
+        const parent = (0, path_1.dirname)(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return current;
+}
+function gitWorkTreeContaining(path) {
+    const result = (0, child_process_1.spawnSync)("git", ["-C", nearestExistingDirectory(path), "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+    if (result.status !== 0)
+        return null;
+    return result.stdout.trim() || null;
+}
+function assertKeyDirOutsideGit(dir, allowInRepo) {
+    const repo = gitWorkTreeContaining(dir);
+    if (repo && !allowInRepo) {
+        throw new Error(`Refusing to write private keys inside the git working tree ${repo}. Choose --key-dir outside the repository, or pass --allow-in-repo if you understand the risk.`);
+    }
+}
+function writePrivateKey(path, pem) {
+    if ((0, fs_1.existsSync)(path))
+        throw new Error(`Refusing to overwrite an existing key file: ${path}`);
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    (0, fs_1.writeFileSync)(path, pem, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    (0, fs_1.chmodSync)(path, 0o600);
+}
+function writePublicFile(path, contents) {
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(path), { recursive: true });
+    (0, fs_1.writeFileSync)(path, contents, "utf8");
+}
+function expiryWarnings(keys, now = new Date()) {
+    const warnings = [];
+    for (const key of keys) {
+        if (key.status && key.status !== "active")
+            continue;
+        const days = Math.floor((new Date(key.notAfter).getTime() - now.getTime()) / 86400000);
+        if (days < 0)
+            warnings.push(`Certificate for keyid "${key.keyid}" has expired. Devices reject updates signed with it.`);
+        else if (days <= 14)
+            warnings.push(`Certificate for keyid "${key.keyid}" expires in ${days} days. Rotate now.`);
+        else if (days <= 60)
+            warnings.push(`Certificate for keyid "${key.keyid}" expires in ${days} days. Plan a rotation.`);
+    }
+    return warnings;
+}
+function dayBefore(date) {
+    return new Date(date.getTime() - 86400000);
+}
+function yearsFrom(date, years) {
+    const next = new Date(date.getTime());
+    next.setUTCFullYear(next.getUTCFullYear() + years);
+    return next;
+}
+function generateSimpleIdentity(opts) {
+    const now = opts.now ?? new Date();
+    const keyPair = (0, code_signing_certificates_1.generateKeyPair)();
+    const certificate = (0, code_signing_certificates_1.generateSelfSignedCodeSigningCertificate)({
+        keyPair,
+        validityNotBefore: dayBefore(now),
+        validityNotAfter: yearsFrom(now, opts.validityYears),
+        commonName: opts.commonName,
+    });
+    const pems = (0, code_signing_certificates_1.convertKeyPairToPEM)(keyPair);
+    return { privateKeyPem: pems.privateKeyPEM, publicKeyPem: pems.publicKeyPEM, certificatePem: (0, code_signing_certificates_1.convertCertificateToCertificatePEM)(certificate) };
+}
+function rsaKeyPair(modulusLength) {
+    const { privateKey, publicKey } = (0, crypto_1.generateKeyPairSync)("rsa", { modulusLength, publicExponent: 0x10001 });
+    return {
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    };
+}
+function commonNameOf(certificatePem) {
+    const subject = new crypto_1.X509Certificate(certificatePem).subject;
+    const line = subject.split("\n").find((part) => part.startsWith("CN="));
+    if (!line)
+        throw new Error("Certificate has no common name");
+    return line.slice(3);
+}
+function generateChainRoot(opts) {
+    const now = opts.now ?? new Date();
+    const keys = rsaKeyPair(4096);
+    const certificatePem = (0, x509_1.buildCertificatePem)({
+        subjectCommonName: opts.commonName,
+        issuerCommonName: opts.commonName,
+        publicKeyPem: keys.publicKeyPem,
+        issuerPublicKeyPem: keys.publicKeyPem,
+        signingPrivateKeyPem: keys.privateKeyPem,
+        notBefore: dayBefore(now),
+        notAfter: yearsFrom(now, opts.validityYears),
+        ca: true,
+        pathLength: 0,
+        codeSigning: false,
+    });
+    return { privateKeyPem: keys.privateKeyPem, certificatePem };
+}
+function issueLeaf(opts) {
+    if (!privateKeyMatchesCertificate(opts.rootPrivateKeyPem, opts.rootCertificatePem)) {
+        throw new Error("The root private key does not match the root certificate");
+    }
+    const root = new crypto_1.X509Certificate(opts.rootCertificatePem);
+    if (!root.ca)
+        throw new Error("The root certificate is not a certificate authority");
+    const now = opts.now ?? new Date();
+    const notAfter = new Date(Math.min(now.getTime() + opts.validityDays * 86400000, new Date(root.validTo).getTime()));
+    const keys = rsaKeyPair(2048);
+    const certificatePem = (0, x509_1.buildCertificatePem)({
+        subjectCommonName: opts.commonName,
+        issuerCommonName: commonNameOf(opts.rootCertificatePem),
+        publicKeyPem: keys.publicKeyPem,
+        issuerPublicKeyPem: root.publicKey.export({ type: "spki", format: "pem" }).toString(),
+        signingPrivateKeyPem: opts.rootPrivateKeyPem,
+        notBefore: dayBefore(now),
+        notAfter,
+        ca: false,
+        codeSigning: true,
+    });
+    return { privateKeyPem: keys.privateKeyPem, certificatePem };
+}
+function fingerprintSha256(certificatePem) {
+    return new crypto_1.X509Certificate(certificatePem).fingerprint256.replace(/:/g, "").toLowerCase();
+}
+function resolveFromProject(projectDir, path) {
+    return (0, path_1.isAbsolute)(path) ? path : (0, path_1.resolve)(projectDir, path);
+}

package/dist/play-options.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePlayReleaseStatus = parsePlayReleaseStatus;
+exports.parseRolloutPercentage = parseRolloutPercentage;
+function parsePlayReleaseStatus(value) {
+    if (value === undefined)
+        return undefined;
+    const status = String(value).trim().toLowerCase();
+    if (status !== "draft" && status !== "completed") {
+        throw new Error('--release-status must be "draft" (staged in the Play Console) or "completed" (live release)');
+    }
+    return status;
+}
+function parseRolloutPercentage(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0 || parsed >= 100) {
+        throw new Error("--rollout must be greater than 0 and less than 100. Drop it and use --release-status completed for a full rollout.");
+    }
+    return parsed;
+}

package/dist/publish-signing.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchSigningStatus = fetchSigningStatus;
+exports.fetchAppIdentity = fetchAppIdentity;
+exports.ubriotManifestExtra = ubriotManifestExtra;
+exports.prepareSigning = prepareSigning;
+exports.signPlatforms = signPlatforms;
+const ota_signing_1 = require("./ota-signing");
+function status(err) {
+    return err?.response?.status;
+}
+async function fetchSigningStatus(client, app) {
+    try {
+        const { data } = await client.get(`/ubriot/apps/${encodeURIComponent(app)}/ota-signing`);
+        return data;
+    }
+    catch (err) {
+        if (status(err) === 404 && !err?.response?.data?.message?.includes("App not found"))
+            return null;
+        throw err;
+    }
+}
+async function fetchAppIdentity(client, app) {
+    try {
+        const { data } = await client.get(`/ubriot/apps/${encodeURIComponent(app)}`);
+        const slugs = new Set([data.slug]);
+        try {
+            const aliases = await client.get(`/ubriot/apps/${data.id}/slug-aliases`);
+            for (const alias of aliases.data?.aliases ?? [])
+                if (typeof alias?.slug === "string")
+                    slugs.add(alias.slug);
+        }
+        catch { }
+        return { id: Number(data.id), slug: data.slug, slugs: [...slugs] };
+    }
+    catch {
+        return null;
+    }
+}
+function ubriotManifestExtra(identity, app, channel) {
+    if (!identity)
+        return { appSlug: app, appSlugs: [app], channel };
+    return { appId: identity.id, appSlug: identity.slug, appSlugs: identity.slugs, channel };
+}
+async function prepareSigning(input) {
+    const signingStatus = await fetchSigningStatus(input.client, input.app);
+    const registeredKeys = signingStatus?.keys ?? [];
+    const materials = (0, ota_signing_1.loadSigningMaterial)({
+        projectDir: input.projectDir,
+        env: input.env,
+        privateKeyPath: input.privateKeyPath,
+        certificatePath: input.certificatePath,
+        signWith: input.signWith,
+        registeredKeys,
+    });
+    if (signingStatus?.custody === "managed" && materials.length) {
+        throw new Error("This app signs with Ubriot-managed keys. Publish without local signing keys; Ubriot signs the update.");
+    }
+    if (signingStatus?.required && materials.length === 0 && signingStatus.custody !== "managed") {
+        throw new Error(`App "${input.app}" requires signed OTA updates but no signing key was found. Pass --private-key-path, set UBRIOT_OTA_PRIVATE_KEY in CI, or run: ubriot signing status --app ${input.app}`);
+    }
+    const relevant = registeredKeys.filter((key) => materials.some((material) => material.keyid === key.keyid));
+    const warnings = (0, ota_signing_1.expiryWarnings)(relevant);
+    const signs = materials.length > 0 || signingStatus?.custody === "managed";
+    if (signs && input.runtimeVersion && signingStatus?.recentUnsignedUpdates.some((u) => u.runtimeVersion === input.runtimeVersion)) {
+        warnings.push(`Unsigned updates were published recently on runtime ${input.runtimeVersion}. Give signing-enabled binaries a new runtimeVersion so they never share a runtime with unsigned updates.`);
+    }
+    return { materials, status: signingStatus, warnings };
+}
+function signPlatforms(platforms, materials) {
+    if (!materials.length)
+        return platforms;
+    return platforms.map((platform) => ({ ...platform, signatures: materials.map((material) => (0, ota_signing_1.signManifest)(platform.manifestJson, material)) }));
+}

package/dist/runtime-preflight.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preflightDecision = preflightDecision;
+exports.renderPreflight = renderPreflight;
+exports.fetchRuntimePreflight = fetchRuntimePreflight;
+function preflightDecision(result, opts) {
+    if (!result || opts.yes || !opts.interactive)
+        return "continue";
+    return result.warnings.some((w) => w.level === "warn") ? "prompt" : "continue";
+}
+function renderPreflight(result) {
+    const lines = [];
+    for (const a of result.assessments) {
+        if (a.totalDevices > 0) {
+            lines.push(`Runtime ${result.runtimeVersion} can reach ${a.reachableDevices} of ${a.totalDevices} ${a.platform} devices seen on "${result.channel}" in the last ${result.windowDays} days.`);
+        }
+    }
+    for (const w of result.warnings) {
+        lines.push(`${w.level === "warn" ? "Warning" : "Note"} (${w.platform}): ${w.message}`);
+    }
+    return lines;
+}
+async function fetchRuntimePreflight(client, input) {
+    try {
+        const params = { runtimeVersion: input.runtimeVersion, channel: input.channel };
+        if (input.platform === "ios" || input.platform === "android")
+            params.platform = input.platform;
+        const { data } = await client.get(`/ubriot/apps/${encodeURIComponent(input.app)}/updates/preflight`, { params, timeout: 20000 });
+        if (!data || !Array.isArray(data.warnings) || !Array.isArray(data.assessments))
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}