bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity
hololake-system-architecture/product-source/hololake-native-desktop/src-tauri/src/release_update.rs

1215 lines
45 KiB
Rust
Raw Blame History

// SPDX-License-Identifier: AGPL-3.0-or-later
use crate::release_trust::provisioned_release_trust;
use fs2::FileExt;
use ring::digest::{digest, SHA256};
use serde::{Deserialize, Serialize};
use serde_json::Value;
use std::fs::{self, OpenOptions};
use std::io::Write;
use std::os::unix::fs::OpenOptionsExt;
use std::path::{Path, PathBuf};
use std::process::{Command, Output};
use std::time::{SystemTime, UNIX_EPOCH};
use tauri::{AppHandle, Manager};
use tauri_plugin_updater::{Update, UpdaterExt};
use uuid::Uuid;
const CANDIDATE_SCHEMA: &str = "hololake.release-candidate/v1";
const RECEIPT_SCHEMA: &str = "hololake.release-install-receipt/v1";
const RECOVERY_SCHEMA: &str = "hololake.release-recovery/v1";
const CANDIDATE_TTL_MS: u128 = 30 * 60 * 1000;
const EXPECTED_BUNDLE_IDENTIFIER: &str = "world.guanghu.hololake";
const PUBLIC_RELEASE_PACKAGE_PREFIX: &str = "/hololake/releases/";
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct ReleaseCandidateRecord {
schema: String,
state: String,
candidate_id: String,
confirmation_token_sha256: String,
release_id: String,
current_version: String,
version: String,
raw_broadcast_sha256: String,
download_url: String,
package_sha256: String,
package_size: u64,
issued_at_unix_ms: u128,
expires_at_unix_ms: u128,
}
#[derive(Clone, Debug, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct ReleaseRecoveryRecord {
schema: String,
state: String,
release_id: String,
previous_version: String,
installed_version: String,
backup_bundle_path: String,
backup_identifier: String,
backup_team_identifier: String,
backup_cdhash: String,
failed_bundle_path: Option<String>,
observed_at_unix_ms: u128,
receipt_id: String,
}
#[derive(Clone, Debug, PartialEq, Eq)]
struct CodeSignatureEvidence {
identifier: String,
team_identifier: String,
cdhash: String,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
pub struct ConfirmReleaseInstallInput {
candidate_id: String,
confirmation_token: String,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase")]
struct ReleaseEnvelope {
schema: String,
release_id: String,
version: String,
notes: String,
platforms: serde_json::Map<String, Value>,
hololake: HoloLakeMetadata,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct HoloLakeMetadata {
features: Vec<String>,
#[serde(default)]
fixes: Vec<String>,
compatibility: CompatibilityMetadata,
restart: RestartMetadata,
rollback: RollbackMetadata,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct CompatibilityMetadata {
minimum_version: String,
data_migration_required: bool,
notes: Option<String>,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct RestartMetadata {
required: bool,
automatic_allowed: bool,
message: Option<String>,
}
#[derive(Clone, Debug, Deserialize)]
#[serde(rename_all = "camelCase", deny_unknown_fields)]
struct RollbackMetadata {
supported: bool,
health_receipt_required: bool,
previous_version: Option<String>,
}
#[derive(Clone, Debug, Deserialize)]
struct PlatformRelease {
url: String,
signature: String,
size: u64,
sha256: String,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct ReleaseCandidateReceipt {
schema: &'static str,
state: &'static str,
candidate_id: String,
confirmation_token: String,
release_id: String,
current_version: String,
version: String,
notes: String,
features: Vec<String>,
fixes: Vec<String>,
minimum_version: String,
data_migration_required: bool,
compatibility_notes: Option<String>,
restart_message: Option<String>,
rollback_supported: bool,
previous_version: Option<String>,
expires_at_unix_ms: u128,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct ReleaseCheckReceipt {
schema: &'static str,
state: &'static str,
candidate: Option<ReleaseCandidateReceipt>,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct ReleaseInstallReceipt {
schema: &'static str,
state: &'static str,
release_id: String,
previous_version: String,
installed_version: String,
package_sha256: String,
package_size: u64,
automatic_restart: bool,
health_receipt_required: bool,
rollback_declared_by_broadcast: bool,
receipt_id: String,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct ReleaseRecoveryStatus {
pub schema: &'static str,
pub state: String,
pub previous_version: Option<String>,
pub installed_version: Option<String>,
pub backup_ready: bool,
pub human_action_required: bool,
}
#[derive(Clone, Debug, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct ReleaseRecoveryReceipt {
pub schema: &'static str,
pub state: String,
pub previous_version: String,
pub installed_version: String,
pub automatic_restart: bool,
pub receipt_id: String,
}
#[tauri::command]
pub async fn check_hololake_update(app: AppHandle) -> Result<ReleaseCheckReceipt, String> {
let trust = provisioned_release_trust()?
.ok_or_else(|| "HOLOLAKE_RELEASE_TRUST_UNPROVISIONED_NO_NETWORK_REQUEST".to_string())?;
let root = release_update_root(&app)?;
let _install_lease = install_lease(&root)?;
ensure_no_unresolved_recovery_at(&root)?;
let update = app
.updater_builder()
.endpoints(trust.endpoints.clone())
.map_err(|error| format!("HOLOLAKE_RELEASE_UPDATER_INVALID: {error}"))?
.build()
.map_err(|error| format!("HOLOLAKE_RELEASE_UPDATER_INVALID: {error}"))?
.check()
.await
.map_err(|error| format!("HOLOLAKE_RELEASE_CHECK_FAILED: {error}"))?;
let Some(update) = update else {
return Ok(ReleaseCheckReceipt {
schema: CANDIDATE_SCHEMA,
state: "CURRENT_VERSION_IS_LATEST",
candidate: None,
});
};
let snapshot = validate_update(&update, &trust.allowed_release_host)?;
let candidate = create_candidate_at(&root, &snapshot)?;
Ok(ReleaseCheckReceipt {
schema: CANDIDATE_SCHEMA,
state: "UPDATE_AVAILABLE_AWAITING_HUMAN_CONFIRMATION",
candidate: Some(candidate),
})
}
#[tauri::command]
pub async fn confirm_hololake_update_install(
app: AppHandle,
input: ConfirmReleaseInstallInput,
) -> Result<ReleaseInstallReceipt, String> {
let trust = provisioned_release_trust()?
.ok_or_else(|| "HOLOLAKE_RELEASE_TRUST_UNPROVISIONED_NO_NETWORK_REQUEST".to_string())?;
let root = release_update_root(&app)?;
let _install_lease = install_lease(&root)?;
ensure_no_unresolved_recovery_at(&root)?;
let record = authorize_candidate_at(&root, &input)?;
let update = app
.updater_builder()
.endpoints(trust.endpoints.clone())
.map_err(|error| format!("HOLOLAKE_RELEASE_UPDATER_INVALID: {error}"))?
.build()
.map_err(|error| format!("HOLOLAKE_RELEASE_UPDATER_INVALID: {error}"))?
.check()
.await
.map_err(|error| format!("HOLOLAKE_RELEASE_RECHECK_FAILED: {error}"))?
.ok_or_else(|| "HOLOLAKE_RELEASE_CANDIDATE_NO_LONGER_AVAILABLE".to_string())?;
let snapshot = validate_update(&update, &trust.allowed_release_host)?;
require_same_candidate(&record, &snapshot)?;
let bytes = update
.download(|_, _| {}, || {})
.await
.map_err(|error| format!("HOLOLAKE_RELEASE_DOWNLOAD_OR_SIGNATURE_FAILED: {error}"))?;
if bytes.len() as u64 != snapshot.package_size || sha256_hex(&bytes) != snapshot.package_sha256
{
return Err("HOLOLAKE_RELEASE_PACKAGE_DIGEST_OR_SIZE_MISMATCH".into());
}
let current_bundle = current_app_bundle_path()?;
let backup = prepare_last_known_good_at(&root, &current_bundle)?;
let mut recovery = ReleaseRecoveryRecord {
schema: RECOVERY_SCHEMA.into(),
state: "LAST_KNOWN_GOOD_VERIFIED_INSTALLING".into(),
release_id: snapshot.envelope.release_id.clone(),
previous_version: snapshot.current_version.clone(),
installed_version: snapshot.envelope.version.clone(),
backup_bundle_path: backup.0.to_string_lossy().into_owned(),
backup_identifier: backup.1.identifier,
backup_team_identifier: backup.1.team_identifier,
backup_cdhash: backup.1.cdhash,
failed_bundle_path: None,
observed_at_unix_ms: now_unix_ms()?,
receipt_id: sha256_hex(
format!(
"{}\n{}\n{}\n{}",
snapshot.envelope.release_id,
snapshot.current_version,
snapshot.envelope.version,
snapshot.package_sha256
)
.as_bytes(),
),
};
write_json_atomic(&recovery_path(&root), &recovery, "RECOVERY")?;
let receipt = ReleaseInstallReceipt {
schema: RECEIPT_SCHEMA,
state: "SIGNED_PACKAGE_VERIFIED_INSTALL_STARTED_RESTART_REQUIRED",
release_id: snapshot.envelope.release_id.clone(),
previous_version: snapshot.current_version.clone(),
installed_version: snapshot.envelope.version.clone(),
package_sha256: snapshot.package_sha256.clone(),
package_size: snapshot.package_size,
automatic_restart: false,
health_receipt_required: snapshot.envelope.hololake.rollback.health_receipt_required,
rollback_declared_by_broadcast: snapshot.envelope.hololake.rollback.supported,
receipt_id: sha256_hex(
format!(
"{}\n{}\n{}\n{}",
snapshot.envelope.release_id,
snapshot.current_version,
snapshot.envelope.version,
snapshot.package_sha256
)
.as_bytes(),
),
};
write_json_atomic(
&root.join("pending-install-receipt.json"),
&receipt,
"RECEIPT",
)?;
if let Err(error) = mark_candidate_installing_at(&root, &record.candidate_id) {
recovery.state = "INSTALL_FAILED_BACKUP_RETAINED".into();
recovery.observed_at_unix_ms = now_unix_ms()?;
write_json_atomic(&recovery_path(&root), &recovery, "RECOVERY")?;
return Err(error);
}
if let Err(error) = update.install(&bytes) {
recovery.state = "INSTALL_FAILED_BACKUP_RETAINED".into();
recovery.observed_at_unix_ms = now_unix_ms()?;
write_json_atomic(&recovery_path(&root), &recovery, "RECOVERY")?;
return Err(format!("HOLOLAKE_RELEASE_INSTALL_FAILED: {error}"));
}
recovery.state = "INSTALL_REPLACED_AWAITING_MANUAL_RESTART".into();
recovery.observed_at_unix_ms = now_unix_ms()?;
write_json_atomic(&recovery_path(&root), &recovery, "RECOVERY")?;
Ok(receipt)
}
#[tauri::command]
pub fn get_hololake_release_recovery_status(
app: AppHandle,
) -> Result<ReleaseRecoveryStatus, String> {
release_recovery_status_at(&release_update_root(&app)?)
}
#[tauri::command]
pub fn confirm_hololake_release_health(app: AppHandle) -> Result<ReleaseRecoveryReceipt, String> {
let root = release_update_root(&app)?;
let _lock = lock(&root)?;
let path = recovery_path(&root);
let mut record: ReleaseRecoveryRecord = read_json(&path)?;
if !matches!(
record.state.as_str(),
"AWAITING_HUMAN_HEALTH_CONFIRMATION"
| "ROLLED_BACK_AWAITING_HUMAN_ACKNOWLEDGEMENT"
| "INSTALL_FAILED_BACKUP_RETAINED"
| "INSTALL_INTERRUPTED_BACKUP_RETAINED"
) {
return Err("HOLOLAKE_RELEASE_HEALTH_CONFIRMATION_NOT_AVAILABLE".into());
}
let running_version = app.package_info().version.to_string();
let expected = if record.state == "AWAITING_HUMAN_HEALTH_CONFIRMATION" {
&record.installed_version
} else {
&record.previous_version
};
if &running_version != expected {
return Err("HOLOLAKE_RELEASE_RUNNING_VERSION_MISMATCH".into());
}
remove_owned_bundle_path(&root, Path::new(&record.backup_bundle_path))?;
if let Some(failed) = record.failed_bundle_path.as_deref() {
remove_owned_failed_bundle(Path::new(failed), &current_app_parent()?)?;
}
record.state = match record.state.as_str() {
"AWAITING_HUMAN_HEALTH_CONFIRMATION" => "HEALTH_CONFIRMED_BACKUP_REMOVED",
"ROLLED_BACK_AWAITING_HUMAN_ACKNOWLEDGEMENT" => "ROLLBACK_CONFIRMED_BACKUP_REMOVED",
_ => "INSTALL_FAILURE_ACKNOWLEDGED_BACKUP_REMOVED",
}
.into();
record.observed_at_unix_ms = now_unix_ms()?;
write_json_atomic(&path, &record, "RECOVERY")?;
Ok(recovery_receipt(&record))
}
#[tauri::command]
pub fn rollback_hololake_update(app: AppHandle) -> Result<ReleaseRecoveryReceipt, String> {
let root = release_update_root(&app)?;
let _lock = lock(&root)?;
let path = recovery_path(&root);
let mut record: ReleaseRecoveryRecord = read_json(&path)?;
if record.state != "AWAITING_HUMAN_HEALTH_CONFIRMATION" {
return Err("HOLOLAKE_RELEASE_ROLLBACK_NOT_AVAILABLE".into());
}
if app.package_info().version.to_string() != record.installed_version {
return Err("HOLOLAKE_RELEASE_RUNNING_VERSION_MISMATCH".into());
}
let backup = validated_backup_path(&root, &record)?;
let current = current_app_bundle_path()?;
let failed = replace_bundle_with_backup(&current, &backup, &record)?;
record.failed_bundle_path = Some(failed.to_string_lossy().into_owned());
record.state = "ROLLBACK_REPLACED_AWAITING_MANUAL_RESTART".into();
record.observed_at_unix_ms = now_unix_ms()?;
write_json_atomic(&path, &record, "RECOVERY")?;
Ok(recovery_receipt(&record))
}
pub(crate) fn observe_release_startup(app: &AppHandle) -> Result<(), String> {
let root = release_update_root(app)?;
let path = recovery_path(&root);
if !path.exists() {
return Ok(());
}
let _lock = lock(&root)?;
let mut record: ReleaseRecoveryRecord = read_json(&path)?;
let version = app.package_info().version.to_string();
let next = match record.state.as_str() {
"INSTALL_REPLACED_AWAITING_MANUAL_RESTART" if version == record.installed_version => {
Some("AWAITING_HUMAN_HEALTH_CONFIRMATION")
}
"ROLLBACK_REPLACED_AWAITING_MANUAL_RESTART" if version == record.previous_version => {
if let Some(failed) = record.failed_bundle_path.as_deref() {
remove_owned_failed_bundle(Path::new(failed), &current_app_parent()?)?;
record.failed_bundle_path = None;
}
Some("ROLLED_BACK_AWAITING_HUMAN_ACKNOWLEDGEMENT")
}
"LAST_KNOWN_GOOD_VERIFIED_INSTALLING" if version == record.previous_version => {
Some("INSTALL_INTERRUPTED_BACKUP_RETAINED")
}
"LAST_KNOWN_GOOD_VERIFIED_INSTALLING" if version == record.installed_version => {
Some("AWAITING_HUMAN_HEALTH_CONFIRMATION")
}
"AWAITING_HUMAN_HEALTH_CONFIRMATION" if version == record.previous_version => {
Some("ROLLED_BACK_AWAITING_HUMAN_ACKNOWLEDGEMENT")
}
_ => None,
};
if let Some(next) = next {
record.state = next.into();
record.observed_at_unix_ms = now_unix_ms()?;
write_json_atomic(&path, &record, "RECOVERY")?;
}
Ok(())
}
pub(crate) fn release_recovery_state(app: &AppHandle) -> Result<String, String> {
let root = release_update_root(app)?;
Ok(release_recovery_state_at(&root))
}
fn release_recovery_state_at(root: &Path) -> String {
release_recovery_status_at(root)
.map(|status| status.state)
.unwrap_or_else(|_| "RECOVERY_STATE_UNREADABLE_ACTION_REQUIRED".into())
}
struct UpdateSnapshot {
current_version: String,
envelope: ReleaseEnvelope,
raw_broadcast_sha256: String,
download_url: String,
package_sha256: String,
package_size: u64,
}
fn validate_update(update: &Update, allowed_host: &str) -> Result<UpdateSnapshot, String> {
let raw = serde_json::to_vec(&update.raw_json)
.map_err(|error| format!("HOLOLAKE_RELEASE_BROADCAST_INVALID: {error}"))?;
let envelope: ReleaseEnvelope = serde_json::from_value(update.raw_json.clone())
.map_err(|error| format!("HOLOLAKE_RELEASE_BROADCAST_INVALID: {error}"))?;
if envelope.schema != "hololake.release-broadcast/v1"
|| envelope.release_id.trim().is_empty()
|| envelope.version != update.version
|| envelope.notes.trim().is_empty()
|| envelope.hololake.features.is_empty()
|| !envelope.hololake.restart.required
|| envelope.hololake.restart.automatic_allowed
|| !envelope.hololake.rollback.supported
|| !envelope.hololake.rollback.health_receipt_required
{
return Err("HOLOLAKE_RELEASE_BROADCAST_POLICY_INVALID".into());
}
let url = &update.download_url;
if url.scheme() != "https"
|| url.host_str() != Some(allowed_host)
|| !url.path().starts_with(PUBLIC_RELEASE_PACKAGE_PREFIX)
|| url.query().is_some()
|| url.fragment().is_some()
{
return Err("HOLOLAKE_RELEASE_PACKAGE_HOST_NOT_TRUSTED".into());
}
let platform = envelope
.platforms
.values()
.filter_map(|value| serde_json::from_value::<PlatformRelease>(value.clone()).ok())
.find(|platform| platform.url == url.as_str() && platform.signature == update.signature)
.ok_or("HOLOLAKE_RELEASE_PLATFORM_EVIDENCE_MISSING")?;
validate_sha256(&platform.sha256)?;
if platform.size == 0 {
return Err("HOLOLAKE_RELEASE_PACKAGE_SIZE_INVALID".into());
}
Ok(UpdateSnapshot {
current_version: update.current_version.clone(),
envelope,
raw_broadcast_sha256: sha256_hex(&raw),
download_url: url.to_string(),
package_sha256: platform.sha256,
package_size: platform.size,
})
}
fn create_candidate_at(
root: &Path,
snapshot: &UpdateSnapshot,
) -> Result<ReleaseCandidateReceipt, String> {
let _lock = lock(root)?;
let issued_at_unix_ms = now_unix_ms()?;
let expires_at_unix_ms = issued_at_unix_ms + CANDIDATE_TTL_MS;
let candidate_id = format!("release-{}", Uuid::new_v4());
let confirmation_token = format!("install-{}-{}", Uuid::new_v4(), Uuid::new_v4());
let record = ReleaseCandidateRecord {
schema: CANDIDATE_SCHEMA.into(),
state: "PENDING_HUMAN_CONFIRMATION".into(),
candidate_id: candidate_id.clone(),
confirmation_token_sha256: sha256_hex(confirmation_token.as_bytes()),
release_id: snapshot.envelope.release_id.clone(),
current_version: snapshot.current_version.clone(),
version: snapshot.envelope.version.clone(),
raw_broadcast_sha256: snapshot.raw_broadcast_sha256.clone(),
download_url: snapshot.download_url.clone(),
package_sha256: snapshot.package_sha256.clone(),
package_size: snapshot.package_size,
issued_at_unix_ms,
expires_at_unix_ms,
};
write_json_atomic(&candidate_path(root, &candidate_id), &record, "CANDIDATE")?;
Ok(ReleaseCandidateReceipt {
schema: CANDIDATE_SCHEMA,
state: "AWAITING_HUMAN_DOWNLOAD_AND_INSTALL_CONFIRMATION",
candidate_id,
confirmation_token,
release_id: snapshot.envelope.release_id.clone(),
current_version: snapshot.current_version.clone(),
version: snapshot.envelope.version.clone(),
notes: snapshot.envelope.notes.clone(),
features: snapshot.envelope.hololake.features.clone(),
fixes: snapshot.envelope.hololake.fixes.clone(),
minimum_version: snapshot
.envelope
.hololake
.compatibility
.minimum_version
.clone(),
data_migration_required: snapshot
.envelope
.hololake
.compatibility
.data_migration_required,
compatibility_notes: snapshot.envelope.hololake.compatibility.notes.clone(),
restart_message: snapshot.envelope.hololake.restart.message.clone(),
rollback_supported: snapshot.envelope.hololake.rollback.supported,
previous_version: snapshot.envelope.hololake.rollback.previous_version.clone(),
expires_at_unix_ms,
})
}
fn authorize_candidate_at(
root: &Path,
input: &ConfirmReleaseInstallInput,
) -> Result<ReleaseCandidateRecord, String> {
validate_machine_id(&input.candidate_id)?;
if input.confirmation_token.len() < 32 || input.confirmation_token.len() > 256 {
return Err("HOLOLAKE_RELEASE_CONFIRMATION_TOKEN_INVALID".into());
}
let _lock = lock(root)?;
let record: ReleaseCandidateRecord = read_json(&candidate_path(root, &input.candidate_id))?;
if record.schema != CANDIDATE_SCHEMA || record.candidate_id != input.candidate_id {
return Err("HOLOLAKE_RELEASE_CANDIDATE_INVALID".into());
}
if record.confirmation_token_sha256 != sha256_hex(input.confirmation_token.as_bytes()) {
return Err("HOLOLAKE_RELEASE_CANDIDATE_NOT_AUTHORIZED".into());
}
if record.state != "PENDING_HUMAN_CONFIRMATION" || now_unix_ms()? > record.expires_at_unix_ms {
return Err("HOLOLAKE_RELEASE_CANDIDATE_EXPIRED_OR_CONSUMED".into());
}
Ok(record)
}
fn require_same_candidate(
record: &ReleaseCandidateRecord,
snapshot: &UpdateSnapshot,
) -> Result<(), String> {
if record.release_id != snapshot.envelope.release_id
|| record.current_version != snapshot.current_version
|| record.version != snapshot.envelope.version
|| record.raw_broadcast_sha256 != snapshot.raw_broadcast_sha256
|| record.download_url != snapshot.download_url
|| record.package_sha256 != snapshot.package_sha256
|| record.package_size != snapshot.package_size
{
return Err("HOLOLAKE_RELEASE_BROADCAST_CHANGED_RECONFIRM_REQUIRED".into());
}
Ok(())
}
fn mark_candidate_installing_at(root: &Path, candidate_id: &str) -> Result<(), String> {
let _lock = lock(root)?;
let path = candidate_path(root, candidate_id);
let mut record: ReleaseCandidateRecord = read_json(&path)?;
if record.state != "PENDING_HUMAN_CONFIRMATION" {
return Err("HOLOLAKE_RELEASE_CANDIDATE_EXPIRED_OR_CONSUMED".into());
}
record.state = "INSTALLING".into();
write_json_atomic(&path, &record, "CANDIDATE")
}
fn ensure_no_unresolved_recovery_at(root: &Path) -> Result<(), String> {
let path = recovery_path(root);
if !path.exists() {
return Ok(());
}
let record: ReleaseRecoveryRecord = read_json(&path)?;
if matches!(
record.state.as_str(),
"HEALTH_CONFIRMED_BACKUP_REMOVED"
| "ROLLBACK_CONFIRMED_BACKUP_REMOVED"
| "INSTALL_FAILURE_ACKNOWLEDGED_BACKUP_REMOVED"
) {
Ok(())
} else {
Err("HOLOLAKE_RELEASE_RECOVERY_ACTION_REQUIRED_BEFORE_NEXT_UPDATE".into())
}
}
fn release_recovery_status_at(root: &Path) -> Result<ReleaseRecoveryStatus, String> {
let path = recovery_path(root);
if !path.exists() {
return Ok(ReleaseRecoveryStatus {
schema: RECOVERY_SCHEMA,
state: "NONE".into(),
previous_version: None,
installed_version: None,
backup_ready: false,
human_action_required: false,
});
}
let record: ReleaseRecoveryRecord = read_json(&path)?;
let human_action_required = matches!(
record.state.as_str(),
"AWAITING_HUMAN_HEALTH_CONFIRMATION"
| "ROLLED_BACK_AWAITING_HUMAN_ACKNOWLEDGEMENT"
| "INSTALL_FAILED_BACKUP_RETAINED"
| "INSTALL_INTERRUPTED_BACKUP_RETAINED"
);
let backup_ready = Path::new(&record.backup_bundle_path).exists();
Ok(ReleaseRecoveryStatus {
schema: RECOVERY_SCHEMA,
state: record.state,
previous_version: Some(record.previous_version),
installed_version: Some(record.installed_version),
backup_ready,
human_action_required,
})
}
fn recovery_receipt(record: &ReleaseRecoveryRecord) -> ReleaseRecoveryReceipt {
ReleaseRecoveryReceipt {
schema: RECOVERY_SCHEMA,
state: record.state.clone(),
previous_version: record.previous_version.clone(),
installed_version: record.installed_version.clone(),
automatic_restart: false,
receipt_id: sha256_hex(
format!(
"{}\n{}\n{}\n{}",
record.receipt_id, record.state, record.previous_version, record.installed_version
)
.as_bytes(),
),
}
}
fn prepare_last_known_good_at(
root: &Path,
current_bundle: &Path,
) -> Result<(PathBuf, CodeSignatureEvidence), String> {
let current = current_bundle
.canonicalize()
.map_err(|error| format!("HOLOLAKE_RELEASE_CURRENT_BUNDLE_UNAVAILABLE: {error}"))?;
if current.extension().and_then(|value| value.to_str()) != Some("app") {
return Err("HOLOLAKE_RELEASE_CURRENT_BUNDLE_INVALID".into());
}
let current_evidence = verify_bundle_signature(&current)?;
if current_evidence.identifier != EXPECTED_BUNDLE_IDENTIFIER
|| current_evidence.team_identifier.is_empty()
{
return Err("HOLOLAKE_RELEASE_CURRENT_BUNDLE_IDENTITY_INVALID".into());
}
let next_root = root.join(format!(".last-known-good-next-{}", Uuid::new_v4()));
fs::create_dir(&next_root)
.map_err(|error| format!("HOLOLAKE_RELEASE_BACKUP_CREATE_FAILED: {error}"))?;
let next_bundle = next_root.join("HoloLake.app");
let copy = trusted_command("/usr/bin/ditto")
.arg(&current)
.arg(&next_bundle)
.output();
let copy = match copy {
Ok(output) => output,
Err(error) => {
let _ = fs::remove_dir_all(&next_root);
return Err(format!("HOLOLAKE_RELEASE_BACKUP_COPY_FAILED: {error}"));
}
};
if let Err(error) = require_command_success(copy, "HOLOLAKE_RELEASE_BACKUP_COPY") {
let _ = fs::remove_dir_all(&next_root);
return Err(error);
}
let copied_evidence = match verify_bundle_signature(&next_bundle) {
Ok(evidence) => evidence,
Err(error) => {
let _ = fs::remove_dir_all(&next_root);
return Err(error);
}
};
if copied_evidence != current_evidence {
let _ = fs::remove_dir_all(&next_root);
return Err("HOLOLAKE_RELEASE_BACKUP_SIGNATURE_DRIFT".into());
}
let final_root = root.join("last-known-good");
let previous_root = root.join(format!(".last-known-good-previous-{}", Uuid::new_v4()));
if final_root.exists() {
fs::rename(&final_root, &previous_root)
.map_err(|error| format!("HOLOLAKE_RELEASE_BACKUP_ROTATE_FAILED: {error}"))?;
}
if let Err(error) = fs::rename(&next_root, &final_root) {
if previous_root.exists() {
let _ = fs::rename(&previous_root, &final_root);
}
let _ = fs::remove_dir_all(&next_root);
return Err(format!("HOLOLAKE_RELEASE_BACKUP_ACTIVATE_FAILED: {error}"));
}
if previous_root.exists() {
fs::remove_dir_all(&previous_root)
.map_err(|error| format!("HOLOLAKE_RELEASE_BACKUP_ROTATE_FAILED: {error}"))?;
}
Ok((final_root.join("HoloLake.app"), copied_evidence))
}
fn validated_backup_path(root: &Path, record: &ReleaseRecoveryRecord) -> Result<PathBuf, String> {
let backup = PathBuf::from(&record.backup_bundle_path)
.canonicalize()
.map_err(|error| format!("HOLOLAKE_RELEASE_BACKUP_UNAVAILABLE: {error}"))?;
let owned_root = root
.join("last-known-good")
.canonicalize()
.map_err(|error| format!("HOLOLAKE_RELEASE_BACKUP_UNAVAILABLE: {error}"))?;
if backup != owned_root.join("HoloLake.app") {
return Err("HOLOLAKE_RELEASE_BACKUP_BOUNDARY_INVALID".into());
}
let evidence = verify_bundle_signature(&backup)?;
if evidence.identifier != record.backup_identifier
|| evidence.team_identifier != record.backup_team_identifier
|| evidence.cdhash != record.backup_cdhash
{
return Err("HOLOLAKE_RELEASE_BACKUP_SIGNATURE_MISMATCH".into());
}
Ok(backup)
}
fn replace_bundle_with_backup(
current: &Path,
backup: &Path,
record: &ReleaseRecoveryRecord,
) -> Result<PathBuf, String> {
let current = current
.canonicalize()
.map_err(|error| format!("HOLOLAKE_RELEASE_CURRENT_BUNDLE_UNAVAILABLE: {error}"))?;
let current_evidence = verify_bundle_signature(&current)?;
if current_evidence.identifier != EXPECTED_BUNDLE_IDENTIFIER
|| current_evidence.team_identifier != record.backup_team_identifier
{
return Err("HOLOLAKE_RELEASE_CURRENT_BUNDLE_IDENTITY_INVALID".into());
}
let parent = current
.parent()
.ok_or("HOLOLAKE_RELEASE_CURRENT_BUNDLE_PATH_INVALID")?;
let failed = parent.join(format!(".HoloLake.failed-{}.app", Uuid::new_v4()));
fs::rename(&current, &failed)
.map_err(|error| format!("HOLOLAKE_RELEASE_ROLLBACK_STAGE_FAILED: {error}"))?;
let copied = trusted_command("/usr/bin/ditto")
.arg(backup)
.arg(&current)
.output();
let copied = match copied {
Ok(output) => output,
Err(error) => {
restore_staged_current(&failed, &current)?;
return Err(format!("HOLOLAKE_RELEASE_ROLLBACK_COPY_FAILED: {error}"));
}
};
if let Err(error) = require_command_success(copied, "HOLOLAKE_RELEASE_ROLLBACK_COPY") {
restore_staged_current(&failed, &current)?;
return Err(error);
}
let restored = verify_bundle_signature(&current);
if restored.as_ref()
!= Ok(&CodeSignatureEvidence {
identifier: record.backup_identifier.clone(),
team_identifier: record.backup_team_identifier.clone(),
cdhash: record.backup_cdhash.clone(),
})
{
restore_staged_current(&failed, &current)?;
return Err("HOLOLAKE_RELEASE_ROLLBACK_SIGNATURE_MISMATCH".into());
}
Ok(failed)
}
fn restore_staged_current(staged: &Path, current: &Path) -> Result<(), String> {
if current.exists() {
fs::remove_dir_all(current)
.map_err(|error| format!("HOLOLAKE_RELEASE_ROLLBACK_RECOVERY_FAILED: {error}"))?;
}
fs::rename(staged, current)
.map_err(|error| format!("HOLOLAKE_RELEASE_ROLLBACK_RECOVERY_FAILED: {error}"))
}
fn remove_owned_bundle_path(root: &Path, bundle: &Path) -> Result<(), String> {
let expected = root.join("last-known-good").join("HoloLake.app");
if bundle != expected {
return Err("HOLOLAKE_RELEASE_BACKUP_BOUNDARY_INVALID".into());
}
let owner = root.join("last-known-good");
if owner.exists() {
fs::remove_dir_all(&owner)
.map_err(|error| format!("HOLOLAKE_RELEASE_BACKUP_REMOVE_FAILED: {error}"))?;
}
Ok(())
}
fn remove_owned_failed_bundle(bundle: &Path, expected_parent: &Path) -> Result<(), String> {
let name = bundle
.file_name()
.and_then(|value| value.to_str())
.ok_or("HOLOLAKE_RELEASE_FAILED_BUNDLE_BOUNDARY_INVALID")?;
if !name.starts_with(".HoloLake.failed-") || !name.ends_with(".app") {
return Err("HOLOLAKE_RELEASE_FAILED_BUNDLE_BOUNDARY_INVALID".into());
}
if bundle.parent() != Some(expected_parent) {
return Err("HOLOLAKE_RELEASE_FAILED_BUNDLE_BOUNDARY_INVALID".into());
}
if bundle.exists() {
fs::remove_dir_all(bundle)
.map_err(|error| format!("HOLOLAKE_RELEASE_FAILED_BUNDLE_REMOVE_FAILED: {error}"))?;
}
Ok(())
}
fn verify_bundle_signature(bundle: &Path) -> Result<CodeSignatureEvidence, String> {
let verify = trusted_command("/usr/bin/codesign")
.args(["--verify", "--deep", "--strict", "--verbose=4"])
.arg(bundle)
.output()
.map_err(|error| format!("HOLOLAKE_RELEASE_CODESIGN_VERIFY_FAILED: {error}"))?;
require_command_success(verify, "HOLOLAKE_RELEASE_CODESIGN_VERIFY")?;
let display = trusted_command("/usr/bin/codesign")
.args(["-dv", "--verbose=4"])
.arg(bundle)
.output()
.map_err(|error| format!("HOLOLAKE_RELEASE_CODESIGN_READ_FAILED: {error}"))?;
let text = String::from_utf8_lossy(&display.stderr);
let value = |name: &str| {
text.lines()
.find_map(|line| line.strip_prefix(&format!("{name}=")))
.map(str::to_owned)
.ok_or_else(|| format!("HOLOLAKE_RELEASE_CODESIGN_{name}_MISSING"))
};
Ok(CodeSignatureEvidence {
identifier: value("Identifier")?,
team_identifier: value("TeamIdentifier")?,
cdhash: value("CDHash")?,
})
}
fn current_app_bundle_path() -> Result<PathBuf, String> {
let executable = std::env::current_exe()
.map_err(|error| format!("HOLOLAKE_RELEASE_CURRENT_EXECUTABLE_UNAVAILABLE: {error}"))?
.canonicalize()
.map_err(|error| format!("HOLOLAKE_RELEASE_CURRENT_EXECUTABLE_UNAVAILABLE: {error}"))?;
let contents = executable
.parent()
.and_then(Path::parent)
.ok_or("HOLOLAKE_RELEASE_CURRENT_BUNDLE_PATH_INVALID")?;
let bundle = contents
.parent()
.ok_or("HOLOLAKE_RELEASE_CURRENT_BUNDLE_PATH_INVALID")?;
if contents.file_name().and_then(|value| value.to_str()) != Some("Contents")
|| bundle.extension().and_then(|value| value.to_str()) != Some("app")
{
return Err("HOLOLAKE_RELEASE_CURRENT_BUNDLE_PATH_INVALID".into());
}
Ok(bundle.to_path_buf())
}
fn current_app_parent() -> Result<PathBuf, String> {
let bundle = current_app_bundle_path()?;
let parent = bundle
.parent()
.ok_or("HOLOLAKE_RELEASE_CURRENT_BUNDLE_PATH_INVALID")?
.to_path_buf();
Ok(parent)
}
fn trusted_command(program: &str) -> Command {
let mut command = Command::new(program);
command
.env_clear()
.env("PATH", "/usr/bin:/bin")
.env("LANG", "C");
command
}
fn require_command_success(output: Output, label: &str) -> Result<(), String> {
if output.status.success() {
Ok(())
} else {
Err(format!(
"{label}_FAILED: {}",
String::from_utf8_lossy(&output.stderr).trim()
))
}
}
fn release_update_root(app: &AppHandle) -> Result<PathBuf, String> {
let root = app
.path()
.app_data_dir()
.map_err(|error| format!("HOLOLAKE_RELEASE_STORAGE_UNAVAILABLE: {error}"))?
.join("release-update-v1");
fs::create_dir_all(&root)
.map_err(|error| format!("HOLOLAKE_RELEASE_STORAGE_UNAVAILABLE: {error}"))?;
root.canonicalize()
.map_err(|error| format!("HOLOLAKE_RELEASE_STORAGE_UNAVAILABLE: {error}"))
}
fn candidate_path(root: &Path, candidate_id: &str) -> PathBuf {
root.join(format!("{candidate_id}.json"))
}
fn recovery_path(root: &Path) -> PathBuf {
root.join("recovery.json")
}
fn lock(root: &Path) -> Result<std::fs::File, String> {
let lock = OpenOptions::new()
.read(true)
.write(true)
.create(true)
.truncate(false)
.mode(0o600)
.open(root.join("release.lock"))
.map_err(|error| format!("HOLOLAKE_RELEASE_LOCK_FAILED: {error}"))?;
lock.lock_exclusive()
.map_err(|error| format!("HOLOLAKE_RELEASE_LOCK_FAILED: {error}"))?;
Ok(lock)
}
fn install_lease(root: &Path) -> Result<std::fs::File, String> {
let lease = OpenOptions::new()
.read(true)
.write(true)
.create(true)
.truncate(false)
.mode(0o600)
.open(root.join("install.lock"))
.map_err(|error| format!("HOLOLAKE_RELEASE_INSTALL_LEASE_FAILED: {error}"))?;
lease
.try_lock_exclusive()
.map_err(|_| "HOLOLAKE_RELEASE_INSTALL_ALREADY_IN_PROGRESS".to_string())?;
Ok(lease)
}
fn read_json<T: for<'de> Deserialize<'de>>(path: &Path) -> Result<T, String> {
let metadata = fs::symlink_metadata(path)
.map_err(|error| format!("HOLOLAKE_RELEASE_CANDIDATE_READ_FAILED: {error}"))?;
if !metadata.is_file() || metadata.file_type().is_symlink() {
return Err("HOLOLAKE_RELEASE_CANDIDATE_INVALID".into());
}
serde_json::from_slice(
&fs::read(path)
.map_err(|error| format!("HOLOLAKE_RELEASE_CANDIDATE_READ_FAILED: {error}"))?,
)
.map_err(|error| format!("HOLOLAKE_RELEASE_CANDIDATE_INVALID: {error}"))
}
fn write_json_atomic<T: Serialize>(path: &Path, value: &T, label: &str) -> Result<(), String> {
let parent = path
.parent()
.ok_or_else(|| format!("HOLOLAKE_RELEASE_{label}_PATH_INVALID"))?;
let temporary = parent.join(format!(".{label}-{}.tmp", Uuid::new_v4()));
let bytes = serde_json::to_vec_pretty(value)
.map_err(|error| format!("HOLOLAKE_RELEASE_{label}_INVALID: {error}"))?;
let mut file = OpenOptions::new()
.write(true)
.create_new(true)
.mode(0o600)
.open(&temporary)
.map_err(|error| format!("HOLOLAKE_RELEASE_{label}_WRITE_FAILED: {error}"))?;
file.write_all(&bytes)
.and_then(|_| file.sync_all())
.map_err(|error| format!("HOLOLAKE_RELEASE_{label}_WRITE_FAILED: {error}"))?;
fs::rename(&temporary, path)
.map_err(|error| format!("HOLOLAKE_RELEASE_{label}_WRITE_FAILED: {error}"))
}
fn validate_machine_id(value: &str) -> Result<(), String> {
if value.is_empty()
|| value.len() > 128
|| !value
.bytes()
.all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.'))
{
return Err("HOLOLAKE_RELEASE_CANDIDATE_ID_INVALID".into());
}
Ok(())
}
fn validate_sha256(value: &str) -> Result<(), String> {
if value.len() != 64
|| !value
.bytes()
.all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
{
return Err("HOLOLAKE_RELEASE_PACKAGE_SHA256_INVALID".into());
}
Ok(())
}
fn now_unix_ms() -> Result<u128, String> {
SystemTime::now()
.duration_since(UNIX_EPOCH)
.map(|duration| duration.as_millis())
.map_err(|error| format!("HOLOLAKE_RELEASE_CLOCK_INVALID: {error}"))
}
fn sha256_hex(bytes: &[u8]) -> String {
digest(&SHA256, bytes)
.as_ref()
.iter()
.map(|byte| format!("{byte:02x}"))
.collect()
}
#[cfg(test)]
mod tests {
use super::*;
use tempfile::TempDir;
fn snapshot() -> UpdateSnapshot {
UpdateSnapshot {
current_version: "0.1.0".into(),
envelope: ReleaseEnvelope {
schema: "hololake.release-broadcast/v1".into(),
release_id: "release-1".into(),
version: "0.2.0".into(),
notes: "First signed update".into(),
platforms: serde_json::Map::new(),
hololake: HoloLakeMetadata {
features: vec!["Personal channel".into()],
fixes: vec![],
compatibility: CompatibilityMetadata {
minimum_version: "0.1.0".into(),
data_migration_required: false,
notes: None,
},
restart: RestartMetadata {
required: true,
automatic_allowed: false,
message: Some("Restart yourself".into()),
},
rollback: RollbackMetadata {
supported: true,
health_receipt_required: true,
previous_version: Some("0.1.0".into()),
},
},
},
raw_broadcast_sha256: "1".repeat(64),
download_url: "https://release.guanghu.test/HoloLake.tar.gz".into(),
package_sha256: "2".repeat(64),
package_size: 42,
}
}
#[test]
fn installation_requires_the_exact_short_lived_human_candidate() {
let root = TempDir::new().unwrap();
let candidate = create_candidate_at(root.path(), &snapshot()).unwrap();
let wrong = authorize_candidate_at(
root.path(),
&ConfirmReleaseInstallInput {
candidate_id: candidate.candidate_id.clone(),
confirmation_token: "wrong-confirmation-token-long-enough-123".into(),
},
)
.unwrap_err();
assert_eq!(wrong, "HOLOLAKE_RELEASE_CANDIDATE_NOT_AUTHORIZED");
let authorized = authorize_candidate_at(
root.path(),
&ConfirmReleaseInstallInput {
candidate_id: candidate.candidate_id,
confirmation_token: candidate.confirmation_token,
},
)
.unwrap();
assert_eq!(authorized.version, "0.2.0");
}
#[test]
fn any_broadcast_or_package_change_requires_a_new_confirmation() {
let root = TempDir::new().unwrap();
let original = snapshot();
let candidate = create_candidate_at(root.path(), &original).unwrap();
let record = authorize_candidate_at(
root.path(),
&ConfirmReleaseInstallInput {
candidate_id: candidate.candidate_id,
confirmation_token: candidate.confirmation_token,
},
)
.unwrap();
let mut changed = snapshot();
changed.package_sha256 = "3".repeat(64);
assert_eq!(
require_same_candidate(&record, &changed).unwrap_err(),
"HOLOLAKE_RELEASE_BROADCAST_CHANGED_RECONFIRM_REQUIRED"
);
}
#[test]
fn unresolved_recovery_blocks_the_next_update_until_human_resolution() {
let root = TempDir::new().unwrap();
let backup = root.path().join("last-known-good/HoloLake.app");
fs::create_dir_all(&backup).unwrap();
let recovery = ReleaseRecoveryRecord {
schema: RECOVERY_SCHEMA.into(),
state: "AWAITING_HUMAN_HEALTH_CONFIRMATION".into(),
release_id: "release-1".into(),
previous_version: "0.1.0".into(),
installed_version: "0.2.0".into(),
backup_bundle_path: backup.to_string_lossy().into_owned(),
backup_identifier: EXPECTED_BUNDLE_IDENTIFIER.into(),
backup_team_identifier: "TEAM".into(),
backup_cdhash: "cdhash".into(),
failed_bundle_path: None,
observed_at_unix_ms: now_unix_ms().unwrap(),
receipt_id: "receipt".into(),
};
write_json_atomic(&recovery_path(root.path()), &recovery, "RECOVERY").unwrap();
assert_eq!(
ensure_no_unresolved_recovery_at(root.path()).unwrap_err(),
"HOLOLAKE_RELEASE_RECOVERY_ACTION_REQUIRED_BEFORE_NEXT_UPDATE"
);
let status = release_recovery_status_at(root.path()).unwrap();
assert_eq!(status.state, "AWAITING_HUMAN_HEALTH_CONFIRMATION");
assert!(status.backup_ready);
assert!(status.human_action_required);
}
#[test]
fn failed_bundle_cleanup_is_confined_to_the_exact_current_parent() {
let root = TempDir::new().unwrap();
let parent = root.path().join("Applications");
let elsewhere = root.path().join("elsewhere");
fs::create_dir_all(&parent).unwrap();
fs::create_dir_all(&elsewhere).unwrap();
let misleading = elsewhere.join(".HoloLake.failed-test.app");
fs::create_dir(&misleading).unwrap();
assert_eq!(
remove_owned_failed_bundle(&misleading, &parent).unwrap_err(),
"HOLOLAKE_RELEASE_FAILED_BUNDLE_BOUNDARY_INVALID"
);
assert!(misleading.exists());
}
#[test]
fn unreadable_recovery_record_keeps_the_app_available_but_locks_updates() {
let root = TempDir::new().unwrap();
fs::write(recovery_path(root.path()), b"not-json").unwrap();
assert_eq!(
release_recovery_state_at(root.path()),
"RECOVERY_STATE_UNREADABLE_ACTION_REQUIRED"
);
assert!(ensure_no_unresolved_recovery_at(root.path()).is_err());
}
#[test]
fn only_one_install_operation_can_hold_the_release_lease() {
let root = TempDir::new().unwrap();
let first = install_lease(root.path()).unwrap();
assert_eq!(
install_lease(root.path()).unwrap_err(),
"HOLOLAKE_RELEASE_INSTALL_ALREADY_IN_PROGRESS"
);
drop(first);
assert!(install_lease(root.path()).is_ok());
}
#[test]
fn partial_rollback_copy_is_removed_before_the_running_bundle_is_restored() {
let root = TempDir::new().unwrap();
let current = root.path().join("HoloLake.app");
let staged = root.path().join(".HoloLake.failed-test.app");
fs::create_dir(&current).unwrap();
fs::write(current.join("partial"), b"partial").unwrap();
fs::create_dir(&staged).unwrap();
fs::write(staged.join("original"), b"original").unwrap();
restore_staged_current(&staged, &current).unwrap();
assert!(current.join("original").exists());
assert!(!current.join("partial").exists());
assert!(!staged.exists());
}
}
Reference in a new issue View git blame Copy permalink