tauri-plugin-hot-update 0.1.0

Hot update / OTA live updates for Tauri v2 mobile and desktop apps — CodePush-style, self-hosted
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382

//! End-to-end pipeline tests: releases signed with the real CLI code
//! ([`crate::sign`]), served by a real local HTTP server, acquired through
//! the real pipeline into a real on-disk store. No mocks anywhere.

use std::fs;
use std::path::Path;
use std::sync::Arc;

use minisign::KeyPair;
use semver::Version;

use super::*;
use crate::runtime::{self, HotUpdate, Shared};
use crate::testutil::{Fixture, Route};

fn ver(s: &str) -> Version {
    Version::parse(s).unwrap()
}

/// One cold launch, as in the runtime tests: fresh Shared over a persistent
/// store root.
fn boot(root: &Path, embedded: &str) -> HotUpdate {
    let shared = Arc::new(Shared::default());
    runtime::initialize(&shared, root.to_path_buf(), ver(embedded));
    HotUpdate { shared }
}

fn no_progress(_: u64, _: u64) {}

// ------------------------------------------------------------ happy path

#[tokio::test]
async fn end_to_end_signed_release_is_verified_extracted_and_staged() {
    let fx = Fixture::new();
    let (manifest, _) = fx.publish("1.1.0", "1.0.0");
    let hot_update = boot(&fx.root, "1.0.0");

    // check(): offered and applicable, but nothing downloaded.
    let outcome = hot_update.check(&fx.config()).await.unwrap();
    assert_eq!(
        outcome,
        UpdateOutcome::Available {
            manifest: manifest.clone()
        }
    );
    assert_eq!(fx.server.request_count("/bundle-1.1.0.tar.gz"), 0);

    // download: staged on disk, exactly as the state machine expects.
    let outcome = hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    assert_eq!(
        outcome,
        UpdateOutcome::Staged {
            seq: 1,
            version: ver("1.1.0")
        }
    );
    let state = fx.state();
    assert_eq!(state["staged"], 1);
    assert_eq!(state["versions"]["1"]["version"], "1.1.0");
    assert_eq!(state["versions"]["1"]["archiveSha256"], manifest.archive.sha256);
    assert_eq!(
        fs::read(fx.bundle_dir(1).join("index.html")).unwrap(),
        b"<html>ota v-next</html>"
    );
    assert_eq!(
        fs::read(fx.bundle_dir(1).join("assets/app.js")).unwrap(),
        b"console.log('hot')"
    );
    assert!(fx.debris().is_empty(), "no temp files may leak: {:?}", fx.debris());

    // Next cold launch arms and serves it; the ack commits it.
    let hot_update = boot(&fx.root, "1.0.0");
    assert_eq!(
        hot_update.notify_app_ready().unwrap(),
        crate::AckOutcome::Committed(1)
    );
    let current = hot_update.current_bundle().unwrap();
    assert_eq!(current.source, crate::BundleSource::Ota);
    assert_eq!(current.version, ver("1.1.0"));
}

#[tokio::test]
async fn progress_is_reported_per_chunk_up_to_the_exact_total() {
    let fx = Fixture::new();
    let (manifest, _) = fx.publish("1.1.0", "1.0.0");
    let hot_update = boot(&fx.root, "1.0.0");

    let mut seen: Vec<(u64, u64)> = Vec::new();
    hot_update
        .check_and_download(&fx.config(), |downloaded, total| {
            seen.push((downloaded, total))
        })
        .await
        .unwrap();
    assert!(!seen.is_empty());
    assert!(seen.windows(2).all(|w| w[0].0 < w[1].0), "monotonic: {seen:?}");
    assert!(seen.iter().all(|(_, t)| *t == manifest.archive.size));
    assert_eq!(seen.last().unwrap().0, manifest.archive.size);
}

#[tokio::test]
async fn second_download_of_the_same_release_is_idempotent() {
    let fx = Fixture::new();
    fx.publish("1.1.0", "1.0.0");
    let hot_update = boot(&fx.root, "1.0.0");

    let first = hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    assert!(matches!(first, UpdateOutcome::Staged { seq: 1, .. }));
    let second = hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    assert_eq!(
        second,
        UpdateOutcome::AlreadyStaged {
            seq: 1,
            version: ver("1.1.0")
        }
    );
    assert_eq!(fx.server.request_count("/bundle-1.1.0.tar.gz"), 1);
}

// ------------------------------------------------------------------ gates

#[tokio::test]
async fn old_validly_signed_manifest_is_refused_downgrade_replay() {
    let fx = Fixture::new();
    // A perfectly valid, correctly signed release — but the shell has
    // already seen 2.0.0 (its embedded version). A MITM replaying this
    // manifest must not roll the fleet back.
    fx.publish("1.5.0", "1.0.0");
    let hot_update = boot(&fx.root, "2.0.0");

    let outcome = hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    assert_eq!(
        outcome,
        UpdateOutcome::UpToDate {
            offered: ver("1.5.0"),
            watermark: ver("2.0.0")
        }
    );
    assert_eq!(fx.server.request_count("/bundle-1.5.0.tar.gz"), 0);
    assert_eq!(fx.state()["staged"], serde_json::Value::Null);
}

#[tokio::test]
async fn committed_version_reports_up_to_date_on_the_next_check() {
    let fx = Fixture::new();
    fx.publish("1.1.0", "1.0.0");
    let hot_update = boot(&fx.root, "1.0.0");
    hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    boot(&fx.root, "1.0.0").notify_app_ready().unwrap(); // trial + ack

    let outcome = boot(&fx.root, "1.0.0").check(&fx.config()).await.unwrap();
    assert_eq!(
        outcome,
        UpdateOutcome::UpToDate {
            offered: ver("1.1.0"),
            watermark: ver("1.1.0")
        }
    );
}

#[tokio::test]
async fn blacklisted_archive_hash_is_refused_without_downloading() {
    let fx = Fixture::new();
    fx.publish("1.1.0", "1.0.0");
    let hot_update = boot(&fx.root, "1.0.0");
    hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    boot(&fx.root, "1.0.0"); // trial boot… crash: no ack
    boot(&fx.root, "1.0.0"); // rollback: hash blacklisted by the machine

    let downloads_before = fx.server.request_count("/bundle-1.1.0.tar.gz");
    let outcome = boot(&fx.root, "1.0.0")
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    assert_eq!(
        outcome,
        UpdateOutcome::Blacklisted {
            version: ver("1.1.0")
        }
    );
    assert_eq!(fx.server.request_count("/bundle-1.1.0.tar.gz"), downloads_before);
}

#[tokio::test]
async fn manifest_requiring_a_newer_shell_is_refused() {
    let fx = Fixture::new();
    fx.publish("1.1.0", "2.0.0");
    let hot_update = boot(&fx.root, "1.0.0");

    let outcome = hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    assert_eq!(
        outcome,
        UpdateOutcome::ShellTooOld {
            required: ver("2.0.0"),
            shell: ver("1.0.0")
        }
    );
    assert_eq!(fx.server.request_count("/bundle-1.1.0.tar.gz"), 0);
}

// ----------------------------------------------------------- verification

#[tokio::test]
async fn tampered_manifest_is_rejected_and_nothing_is_downloaded() {
    let fx = Fixture::new();
    fx.publish("1.1.0", "1.0.0");
    // Rewrite the served manifest (version bump) keeping the signature.
    let tampered = fs::read_to_string(
        fx.tmp.path().join("release-1.1.0/manifest.json"),
    )
    .unwrap()
    .replace("1.1.0", "9.9.9");
    fx.server.set("/manifest.json", tampered.into_bytes());

    let hot_update = boot(&fx.root, "1.0.0");
    let result = hot_update.check_and_download(&fx.config(), no_progress).await;
    assert!(matches!(result, Err(Error::ManifestSignature(_))), "{result:?}");
    assert_eq!(fx.server.request_count("/bundle-1.1.0.tar.gz"), 0);
    assert!(!fx.root.join("state.json").exists() || fx.state()["staged"].is_null());
}

#[tokio::test]
async fn manifest_signed_by_an_untrusted_key_is_rejected() {
    let fx = Fixture::new();
    fx.publish("1.1.0", "1.0.0");
    let hot_update = boot(&fx.root, "1.0.0");
    let attacker = KeyPair::generate_unencrypted_keypair().unwrap();
    let config = UpdateConfig {
        pubkeys: vec![attacker.pk.to_base64()],
        ..fx.config()
    };
    let result = hot_update.check(&config).await;
    assert!(matches!(result, Err(Error::ManifestSignature(_))), "{result:?}");
}

#[tokio::test]
async fn rotated_second_trusted_key_verifies_over_the_wire() {
    let fx = Fixture::new();
    let (manifest, _) = fx.publish("1.1.0", "1.0.0");
    let hot_update = boot(&fx.root, "1.0.0");
    let old_key = KeyPair::generate_unencrypted_keypair().unwrap();
    let config = UpdateConfig {
        pubkeys: vec![old_key.pk.to_base64(), fx.keypair.pk.to_base64()],
        ..fx.config()
    };
    assert_eq!(
        hot_update.check(&config).await.unwrap(),
        UpdateOutcome::Available { manifest }
    );
}

#[tokio::test]
async fn tampered_archive_is_rejected_by_sha256_and_leaves_no_trace() {
    let fx = Fixture::new();
    let (_, archive_path) = fx.publish("1.1.0", "1.0.0");
    let mut bytes =
        fs::read(fx.tmp.path().join("release-1.1.0/bundle-1.1.0.tar.gz")).unwrap();
    bytes[42] ^= 0xff; // same size, different content
    fx.server.set(&archive_path, bytes);

    let hot_update = boot(&fx.root, "1.0.0");
    let result = hot_update.check_and_download(&fx.config(), no_progress).await;
    assert!(matches!(result, Err(Error::ArchiveSha256 { .. })), "{result:?}");
    assert_eq!(fx.state()["staged"], serde_json::Value::Null);
    assert!(!fx.bundle_dir(1).exists());
    assert!(fx.debris().is_empty(), "partial download must be cleaned up");
}

#[tokio::test]
async fn short_download_fails_cleanly_and_a_retry_restarts_from_scratch() {
    let fx = Fixture::new();
    let (_, archive_path) = fx.publish("1.1.0", "1.0.0");
    let full = fs::read(fx.tmp.path().join("release-1.1.0/bundle-1.1.0.tar.gz")).unwrap();
    // Server declares the full length but closes halfway through.
    fx.server.set_route(
        &archive_path,
        Route {
            declared_len: Some(full.len() as u64),
            body: full[..full.len() / 2].to_vec(),
        },
    );

    let hot_update = boot(&fx.root, "1.0.0");
    let result = hot_update.check_and_download(&fx.config(), no_progress).await;
    // Premature close surfaces as a transport error or a size mismatch,
    // depending on where the stream breaks — both are hard stops.
    assert!(
        matches!(result, Err(Error::Http(_)) | Err(Error::ArchiveSize { .. })),
        "{result:?}"
    );
    assert!(fx.debris().is_empty(), "no .part file may survive the failure");

    // Restart from scratch succeeds once the server serves the full body.
    fx.server.set(&archive_path, full);
    let outcome = hot_update
        .check_and_download(&fx.config(), no_progress)
        .await
        .unwrap();
    assert!(matches!(outcome, UpdateOutcome::Staged { seq: 1, .. }), "{outcome:?}");
}

#[tokio::test]
async fn archive_stream_longer_than_the_signed_size_is_aborted() {
    let fx = Fixture::new();
    let (manifest, archive_path) = fx.publish("1.1.0", "1.0.0");
    let mut bytes =
        fs::read(fx.tmp.path().join("release-1.1.0/bundle-1.1.0.tar.gz")).unwrap();
    bytes.extend_from_slice(&[0u8; 4096]); // padded past the signed size
    fx.server.set(&archive_path, bytes);

    let hot_update = boot(&fx.root, "1.0.0");
    let result = hot_update.check_and_download(&fx.config(), no_progress).await;
    match result {
        Err(Error::ArchiveSize { declared, actual }) => {
            assert_eq!(declared, manifest.archive.size);
            assert!(actual > declared);
        }
        other => panic!("expected ArchiveSize, got {other:?}"),
    }
}

// ------------------------------------------------------------- transport

#[tokio::test]
async fn missing_manifest_is_a_typed_http_status_error() {
    let fx = Fixture::new(); // nothing published
    let hot_update = boot(&fx.root, "1.0.0");
    let result = hot_update.check(&fx.config()).await;
    assert!(
        matches!(result, Err(Error::HttpStatus { status: 404, .. })),
        "{result:?}"
    );
}

#[tokio::test]
async fn oversized_manifest_body_is_refused() {
    let fx = Fixture::new();
    fx.server.set(
        "/manifest.json",
        vec![b'x'; (crate::download::MANIFEST_MAX_BYTES + 1) as usize],
    );
    let hot_update = boot(&fx.root, "1.0.0");
    let result = hot_update.check(&fx.config()).await;
    assert!(matches!(result, Err(Error::ResponseTooLarge { .. })), "{result:?}");
}

#[tokio::test]
async fn update_api_errors_cleanly_before_initialization() {
    let hot_update = HotUpdate {
        shared: Arc::new(Shared::default()),
    };
    let fx_config = UpdateConfig {
        manifest_url: "http://127.0.0.1:1/manifest.json".into(),
        pubkeys: vec![],
    };
    assert!(matches!(hot_update.check(&fx_config).await, Err(Error::NotActive)));
    assert!(matches!(
        hot_update.check_and_download(&fx_config, no_progress).await,
        Err(Error::NotActive)
    ));
}