Merge pull request #40 from pavelhov/development

Promote macOS in-app updates to main

Author: pavelhov

THIRD_PARTY_NOTICES.md

@@ -25,3 +25,145 @@ NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPO
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
 DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
 OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## Sparkle 2.9.6
+
+Repository: <https://github.com/sparkle-project/Sparkle>
+
+Pinned revision: ac2def288cbff5cfc7df3ffef6abdf45b72bcb0a.
+The macOS bundle includes the complete framework and its helpers.
+
+Copyright (c) 2006-2013 Andy Matuschak.
+Copyright (c) 2009-2013 Elgato Systems GmbH.
+Copyright (c) 2011-2014 Kornel Lesiński.
+Copyright (c) 2015-2017 Mayur Pawashe.
+Copyright (c) 2014 C.W. Betts.
+Copyright (c) 2014 Petroules Corporation.
+Copyright (c) 2014 Big Nerd Ranch.
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+=================
+EXTERNAL LICENSES
+=================
+
+bspatch.c and bsdiff.c, from bsdiff 4.3 <http://www.daemonology.net/bsdiff/>:
+
+Copyright 2003-2005 Colin Percival
+All rights reserved
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted providing that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+--
+
+sais.c and sais.h, from sais-lite (2010/08/07) <https://sites.google.com/site/yuta256/sais>:
+
+The sais-lite copyright is as follows:
+
+Copyright (c) 2008-2010 Yuta Mori All Rights Reserved.
+
+Permission is hereby granted, free of charge, to any person
+obtaining a copy of this software and associated documentation
+files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
+OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
+HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+--
+
+Portable C implementation of Ed25519, from https://github.com/orlp/ed25519
+
+Copyright (c) 2015 Orson Peters <orsonpeters@gmail.com>
+
+This software is provided 'as-is', without any express or implied warranty. In no event will the
+authors be held liable for any damages arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose, including commercial
+applications, and to alter it and redistribute it freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not claim that you wrote the
+   original software. If you use this software in a product, an acknowledgment in the product
+   documentation would be appreciated but is not required.
+
+2. Altered source versions must be plainly marked as such, and must not be misrepresented as
+   being the original software.
+
+3. This notice may not be removed or altered from any source distribution.
+
+--
+
+SUSignatureVerifier.m:
+
+Copyright (c) 2011 Mark Hamlin.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted providing that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.

app/Info.plist

@@ -22,6 +22,20 @@
   <string>0.0.0</string>
   <key>CFBundleVersion</key>
   <string>0.0.0</string>
+  <key>CodexCommanderUpdaterEnabled</key>
+  <false/>
+  <key>SUFeedURL</key>
+  <string>https://github.com/pavelhov/CodexCommander/releases/latest/download/appcast.xml</string>
+  <key>SURequireSignedFeed</key>
+  <true/>
+  <key>SUVerifyUpdateBeforeExtraction</key>
+  <true/>
+  <key>SUSignedFeedFailureExpirationInterval</key>
+  <integer>0</integer>
+  <key>SUAllowsAutomaticUpdates</key>
+  <false/>
+  <key>SUEnableAutomaticChecks</key>
+  <true/>
   <key>LSUIElement</key>
   <true/>
   <key>LSMultipleInstancesProhibited</key>

app/Package.resolved

@@ -11,11 +11,15 @@ let package = Package(
         .executable(name: "UIProbe", targets: ["UIProbe"]),
         .executable(name: "IconProbe", targets: ["IconProbe"]),
     ],
+    dependencies: [
+        // Sparkle 2.9.6; immutable revision also pins its binary artifact checksum.
+        .package(url: "https://github.com/sparkle-project/Sparkle", revision: "ac2def288cbff5cfc7df3ffef6abdf45b72bcb0a"),
+    ],
     targets: [
         .target(name: "MenuBarCore", path: "Sources/MenuBarCore"),
         // AppKit views live in a library so both the app and the visual-QA probe can
         // build the same surface. An executable target cannot be imported.
-        .target(name: "MenuBarUI", dependencies: ["MenuBarCore"], path: "Sources/MenuBarUI"),
+        .target(name: "MenuBarUI", dependencies: ["MenuBarCore", .product(name: "Sparkle", package: "Sparkle")], path: "Sources/MenuBarUI"),
         .executableTarget(
             name: "MenuBarApp",
             dependencies: ["MenuBarCore", "MenuBarUI"],

app/Package.swift

@@ -42,6 +42,6 @@ let app = NSApplication.shared
 // packaged bundle, and this covers `swift run` during development.
 app.setActivationPolicy(.accessory)
 
-let delegate = AppDelegate()
+let delegate = MainActor.assumeIsolated { AppDelegate() }
 app.delegate = delegate
 app.run()

app/Sources/MenuBarApp/main.swift

@@ -311,7 +311,7 @@ public enum LifecycleHelperDiscovery {
     }
 }
 
-private final class BoundedOutput: @unchecked Sendable {
+final class BoundedOutput: @unchecked Sendable {
     private let lock = NSLock()
     private let limit: Int
     private var data = Data()
@@ -335,7 +335,7 @@ private final class BoundedOutput: @unchecked Sendable {
     }
 }
 
-private final class TimeoutState: @unchecked Sendable {
+final class TimeoutState: @unchecked Sendable {
     private let lock = NSLock()
     private var fired = false
 
@@ -455,7 +455,7 @@ public actor LifecycleHelper: LifecycleCommandRunning {
 
     /// Preserve CodexCommander/Codex configuration while removing runtime preloads and an
     /// attacker-controlled PATH from this privileged fixed-action bridge.
-    private nonisolated static func controlledEnvironment(for invocation: LifecycleInvocation) -> [String: String] {
+    nonisolated static func controlledEnvironment(for invocation: LifecycleInvocation) -> [String: String] {
         var environment = ProcessInfo.processInfo.environment
         environment["PATH"] = "/usr/bin:/bin:/usr/sbin:/sbin"
         if let workingDirectory = invocation.workingDirectory {

app/Sources/MenuBarCore/LifecycleHelper.swift

@@ -0,0 +1,127 @@
+import Foundation
+import Darwin
+
+public enum MacOSUpdateAction: String, Codable, Sendable {
+    case status, prepare, arm, cancel, reconcile
+    case recordOff = "record-off"
+}
+public enum MacOSUpdateStatus: String, Codable, Sendable {
+    case idle, prepared, armed, recovered, blocked
+    case confirmationRequired = "confirmation-required"
+    case finishRequired = "finish-required"
+}
+public struct MacOSUpdateCommand: Equatable, Sendable {
+    public let action: MacOSUpdateAction
+    public let transactionId: String?
+    public let targetBuild: String?
+    public let updateAnyway: Bool
+    public init(_ action: MacOSUpdateAction, transactionId: String? = nil, targetBuild: String? = nil, updateAnyway: Bool = false) {
+        self.action = action; self.transactionId = transactionId; self.targetBuild = targetBuild; self.updateAnyway = updateAnyway
+    }
+    public func arguments() throws -> [String] {
+        switch action {
+        case .status, .reconcile, .recordOff:
+            guard transactionId == nil, targetBuild == nil, !updateAnyway else { throw LifecycleHelperError.invalidResponse }
+            return [action.rawValue]
+        case .arm, .cancel:
+            guard let transactionId, UUID(uuidString: transactionId) != nil, targetBuild == nil, !updateAnyway else { throw LifecycleHelperError.invalidResponse }
+            return [action.rawValue, transactionId]
+        case .prepare:
+            guard let transactionId, UUID(uuidString: transactionId) != nil, let targetBuild, Self.validBuild(targetBuild) else { throw LifecycleHelperError.invalidResponse }
+            return [action.rawValue, transactionId, targetBuild] + (updateAnyway ? ["update-anyway"] : [])
+        }
+    }
+    static func validBuild(_ value: String) -> Bool {
+        value.range(of: "^[1-9][0-9]{0,19}$", options: .regularExpression) != nil
+    }
+}
+public struct MacOSUpdateResult: Decodable, Equatable, Sendable {
+    public let schemaVersion: Int
+    public let action: MacOSUpdateAction
+    public let status: MacOSUpdateStatus
+    public let transactionId: String?
+    public let targetBuild: String?
+    public let active: Int
+    public let errorCode: String?
+    public let message: String
+    public init(schemaVersion: Int = 1, action: MacOSUpdateAction, status: MacOSUpdateStatus, transactionId: String? = nil, targetBuild: String? = nil, active: Int = 0, errorCode: String? = nil, message: String = "Update lifecycle state verified.") {
+        self.schemaVersion = schemaVersion; self.action = action; self.status = status
+        self.transactionId = transactionId; self.targetBuild = targetBuild; self.active = active
+        self.errorCode = errorCode; self.message = message
+    }
+    public static func decode(_ data: Data, command: MacOSUpdateCommand, exitCode: Int32) throws -> MacOSUpdateResult {
+        guard data.count <= 2048,
+              let object = try JSONSerialization.jsonObject(with: data) as? [String: Any],
+              Set(object.keys) == Set(["schemaVersion", "action", "status", "transactionId", "targetBuild", "active", "errorCode", "message"])
+        else { throw LifecycleHelperError.invalidResponse }
+        let result = try JSONDecoder().decode(Self.self, from: data)
+        guard result.schemaVersion == 1, result.action == command.action,
+              result.active >= 0, result.active <= 1_000_000,
+              result.message.utf8.count <= 240,
+              result.transactionId.map({ UUID(uuidString: $0) != nil }) ?? true,
+              result.targetBuild.map({ MacOSUpdateCommand.validBuild($0) }) ?? true,
+              (result.transactionId == nil) == (result.targetBuild == nil),
+              result.errorCode == nil || result.errorCode == "UPDATE_RECOVERY_REQUIRED",
+              (result.status == .blocked ? exitCode == 1 : exitCode == 0),
+              command.transactionId == nil || result.transactionId == command.transactionId || result.status == .recovered || result.status == .blocked,
+              command.targetBuild == nil || result.targetBuild == command.targetBuild || result.status == .blocked,
+              result.status != .confirmationRequired || (command.action == .prepare && result.active > 0 && result.transactionId != nil),
+              ![MacOSUpdateStatus.prepared, .armed, .finishRequired].contains(result.status) || result.transactionId != nil
+        else { throw LifecycleHelperError.invalidResponse }
+        return result
+    }
+}
+public protocol MacOSUpdateCommandRunning: Sendable {
+    func run(_ command: MacOSUpdateCommand) async throws -> MacOSUpdateResult
+}
+/// Fixed embedded-runtime bridge; no global-install discovery fallback is accepted.
+public actor MacOSUpdateHelper: MacOSUpdateCommandRunning {
+    private let invocation: LifecycleInvocation?
+    private let timeout: TimeInterval
+    public init(invocation: LifecycleInvocation? = LifecycleHelperDiscovery.discover(), timeout: TimeInterval = LifecycleHelper.timeout) {
+        self.invocation = invocation; self.timeout = timeout
+    }
+    public func run(_ command: MacOSUpdateCommand) async throws -> MacOSUpdateResult {
+        guard let invocation, invocation.appOwnedRuntime else { throw LifecycleHelperError.unavailable }
+        let arguments = try command.arguments()
+        let timeout = self.timeout
+        return try await withCheckedThrowingContinuation { continuation in
+            DispatchQueue.global(qos: .userInitiated).async {
+                let process = Process()
+                let pipe = Pipe()
+                let output = BoundedOutput(limit: LifecycleHelper.maximumOutputBytes)
+                let timeoutState = TimeoutState()
+                process.executableURL = invocation.executable
+                process.arguments = invocation.prefixArguments + ["__macos-update"] + arguments
+                process.currentDirectoryURL = invocation.workingDirectory
+                process.environment = LifecycleHelper.controlledEnvironment(for: invocation)
+                process.standardOutput = pipe
+                process.standardError = FileHandle.nullDevice
+                pipe.fileHandleForReading.readabilityHandler = { output.append($0.availableData) }
+                let killWork = DispatchWorkItem {
+                    guard timeoutState.didFire, process.isRunning else { return }
+                    _ = Darwin.kill(process.processIdentifier, SIGKILL)
+                }
+                let timeoutWork = DispatchWorkItem {
+                    guard process.isRunning else { return }
+                    timeoutState.markFired(); process.terminate()
+                    DispatchQueue.global(qos: .utility).asyncAfter(deadline: .now() + 1, execute: killWork)
+                }
+                do { try process.run() } catch {
+                    pipe.fileHandleForReading.readabilityHandler = nil
+                    continuation.resume(throwing: LifecycleHelperError.launchFailed); return
+                }
+                DispatchQueue.global(qos: .utility).asyncAfter(deadline: .now() + timeout, execute: timeoutWork)
+                process.waitUntilExit(); timeoutWork.cancel(); killWork.cancel()
+                pipe.fileHandleForReading.readabilityHandler = nil
+                output.append(pipe.fileHandleForReading.readDataToEndOfFile())
+                let (data, overflow) = output.snapshot()
+                guard !overflow, process.terminationReason != .uncaughtSignal else {
+                    continuation.resume(throwing: timeoutState.didFire ? LifecycleHelperError.timedOut : LifecycleHelperError.invalidResponse); return
+                }
+                do { continuation.resume(returning: try MacOSUpdateResult.decode(data, command: command, exitCode: process.terminationStatus)) }
+                catch { continuation.resume(throwing: LifecycleHelperError.invalidResponse) }
+            }
+        }
+    }
+}