guise-ui 1.5.0

//! macOS: mount the release `.dmg` and rsync the new bundle's contents onto the
//! installed `.app` — never replace the bundle directory itself.
//!
//! The "in place" is the point: the installed bundle keeps its path *and* its
//! directory inode, so LaunchServices' registration stays valid and the running
//! executable is only ever replaced-by-rename (its open inode lives on, which
//! macOS is fine with — it is in-place *modification* of a running binary that
//! gets a process killed). Swapping the whole bundle out from under
//! LaunchServices is what makes a relaunch fall back to running the bare Mach-O
//! inside Terminal.app: `open` on a path whose registration is stale resolves to
//! the inner executable, unbundled and broken.

use super::UpdateConfig;

#[cfg(target_os = "macos")]
pub(crate) fn install(
    config: &UpdateConfig,
    release: &crate::update::Release,
    app: &std::path::Path,
    on_stage: &dyn Fn(crate::update::UpdateStage),
) -> Result<crate::update::Relaunch, String> {
    use crate::update::{InstallKind, Relaunch, UpdateStage};
    use std::process::Command;

    /// Detach the mount on every exit path, success or error.
    struct Unmount(std::path::PathBuf);
    impl Drop for Unmount {
        fn drop(&mut self) {
            let _ = Command::new("hdiutil")
                .args(["detach", "-quiet"])
                .arg(&self.0)
                .status();
        }
    }

    // An unverifiable payload is not installable. See
    // `UpdateConfig::codesign_requirement`: without a requirement to pin the
    // signing identity to, `--verify` would only prove the bundle matches its own
    // seal, so *any* validly signed app would pass — which is not the question
    // being asked of something about to be executed as the user.
    let requirement = config
        .requirement
        .as_deref()
        .ok_or("no codesign requirement is configured, so this update can't be verified")?;

    let asset = release
        .asset_for(&InstallKind::MacApp(app.to_path_buf()))
        .ok_or("this release hasn't published a macOS build yet")?;
    let dir = std::env::temp_dir().join(format!("{}-update-{}", config.slug, release.version));
    std::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
    let dmg = dir.join("update.dmg");
    let total = asset.size;
    on_stage(UpdateStage::Downloading { done: 0, total });
    super::fetch::file(&asset.url, &dmg, total, &config.user_agent, &|done| {
        on_stage(UpdateStage::Downloading { done, total })
    })?;

    // Belt and braces alongside the codesign check below: a digest catches a
    // swapped asset before the image is even mounted, and `hdiutil` parsing an
    // attacker-chosen file is a larger surface than a hash of it.
    on_stage(UpdateStage::Verifying);
    config.verify_checksum(release, asset, &dmg)?;

    on_stage(UpdateStage::Preparing);
    let mount = dir.join("mnt");
    std::fs::create_dir_all(&mount).map_err(|e| e.to_string())?;
    let attach = Command::new("hdiutil")
        .args(["attach", "-nobrowse", "-quiet", "-mountpoint"])
        .arg(&mount)
        .arg(&dmg)
        .status()
        .map_err(|e| format!("hdiutil attach: {e}"))?;
    if !attach.success() {
        return Err("could not mount the update image".to_string());
    }
    let unmount = Unmount(mount.clone());

    // Verify the payload on the *mounted image*, before a byte of it reaches the
    // installed bundle. Verifying only afterwards means a bad update is already
    // committed by the time you find out — there is no rollback, and the next
    // launch runs it.
    on_stage(UpdateStage::Verifying);
    let src = app_in(&mount)?;
    let trusted = Command::new("codesign")
        .args(["--verify", "--deep"])
        .arg(format!("-R={requirement}"))
        .arg(&src)
        .status()
        .map_err(|e| format!("codesign: {e}"))?;
    if !trusted.success() {
        return Err(format!(
            "the update isn't signed by {} — refusing to install it",
            config.slug
        ));
    }

    // rsync the mounted bundle's *contents* (trailing slash) onto the installed
    // bundle; --delete drops files the new version no longer ships.
    // --delay-updates stages every changed file inside the bundle (per-directory
    // `.~tmp~` folders) and promotes it by rename only at the end, so a sync that
    // dies partway leaves the old files intact instead of a mixed bundle with a
    // broken signature. `Icon?` is the dmg's custom-icon file (`Icon\r`), not
    // part of the app.
    on_stage(UpdateStage::Installing);
    let mut contents = std::ffi::OsString::from(src);
    contents.push("/");
    let synced = Command::new("rsync")
        .args(["-a", "--delete", "--delay-updates", "--exclude", "Icon?"])
        .arg(&contents)
        .arg(app)
        .status()
        .map_err(|e| format!("rsync: {e}"))?;
    if !synced.success() {
        scrub_staging(app);
        return Err("could not copy the update into place".to_string());
    }

    // Re-verify what actually landed. The pre-flight check above established the
    // payload was genuine; this catches the sync itself having mangled it, which
    // Gatekeeper would otherwise turn into a dead next launch.
    let verified = Command::new("codesign")
        .args(["--verify", "--deep"])
        .arg(format!("-R={requirement}"))
        .arg(app)
        .status()
        .map_err(|e| format!("codesign: {e}"))?;
    if !verified.success() {
        return Err("the updated app failed signature verification".to_string());
    }

    drop(unmount);
    let _ = std::fs::remove_dir_all(&dir);
    Ok(Relaunch::Current)
}

/// Remove the `.~tmp~` staging folders `rsync --delay-updates` leaves under
/// `dir` when a sync fails partway.
#[cfg(target_os = "macos")]
fn scrub_staging(dir: &std::path::Path) {
    let Ok(entries) = std::fs::read_dir(dir) else {
        return;
    };
    for entry in entries.flatten() {
        let path = entry.path();
        if !path.is_dir() {
            continue;
        }
        if path.file_name().is_some_and(|n| n == ".~tmp~") {
            let _ = std::fs::remove_dir_all(&path);
        } else {
            scrub_staging(&path);
        }
    }
}

/// The first `.app` bundle inside `dir` (the mounted update image).
#[cfg(any(target_os = "macos", test))]
fn app_in(dir: &std::path::Path) -> Result<std::path::PathBuf, String> {
    std::fs::read_dir(dir)
        .ok()
        .and_then(|mut entries| {
            entries.find_map(|entry| {
                entry
                    .ok()
                    .map(|e| e.path())
                    .filter(|p| p.extension().is_some_and(|x| x == "app"))
            })
        })
        .ok_or_else(|| "no .app in the update image".to_string())
}

#[cfg(not(target_os = "macos"))]
pub(crate) fn install(
    _config: &UpdateConfig,
    _release: &crate::update::Release,
    _app: &std::path::Path,
    _on_stage: &dyn Fn(crate::update::UpdateStage),
) -> Result<crate::update::Relaunch, String> {
    Err("not macOS".to_string())
}

#[cfg(test)]
mod tests {
    use super::*;

    /// A scratch dir that cleans up after itself.
    fn scratch(name: &str) -> std::path::PathBuf {
        let dir =
            std::env::temp_dir().join(format!("guise-update-mac-{name}-{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();
        dir
    }

    #[test]
    fn finds_the_app_in_a_mounted_image() {
        let dir = scratch("appin");
        std::fs::create_dir_all(dir.join("Acme.app/Contents")).unwrap();
        std::fs::write(dir.join(".background"), b"").unwrap();
        assert_eq!(app_in(&dir).unwrap(), dir.join("Acme.app"));
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[test]
    fn empty_image_is_an_error() {
        let dir = scratch("empty");
        assert!(app_in(&dir).is_err());
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[cfg(target_os = "macos")]
    #[test]
    fn scrub_removes_only_rsync_staging_dirs() {
        let dir = scratch("scrub");
        std::fs::create_dir_all(dir.join("Contents/MacOS/.~tmp~")).unwrap();
        std::fs::write(dir.join("Contents/MacOS/.~tmp~/acme"), b"half").unwrap();
        std::fs::create_dir_all(dir.join("Contents/.~tmp~")).unwrap();
        std::fs::write(dir.join("Contents/Info.plist"), b"keep").unwrap();

        scrub_staging(&dir);

        assert!(!dir.join("Contents/MacOS/.~tmp~").exists());
        assert!(!dir.join("Contents/.~tmp~").exists());
        assert_eq!(
            std::fs::read(dir.join("Contents/Info.plist")).unwrap(),
            b"keep"
        );
        let _ = std::fs::remove_dir_all(&dir);
    }

    /// Without a configured requirement there is nothing to verify the payload
    /// against, so the install must refuse rather than trust whatever mounts.
    #[cfg(target_os = "macos")]
    #[test]
    fn an_unconfigured_requirement_refuses_to_install() {
        let release = crate::update::Release {
            version: "9.9.9".to_string(),
            url: String::new(),
            assets: vec![crate::update::ReleaseAsset {
                name: "Acme.dmg".to_string(),
                url: "https://d/x".to_string(),
                size: 0,
            }],
        };
        let config = UpdateConfig::new("Acme", "1.0.0", crate::update::UpdateSource::github("a/b"));
        let err = install(
            &config,
            &release,
            std::path::Path::new("/Applications/Acme.app"),
            &|_| {},
        )
        .unwrap_err();
        assert!(err.contains("codesign requirement"), "{err}");
    }
}