fix(store): stamp our update_url into the .crx, so installs can update (#65)

* fix(release): drop extension test files from the Windows zip too

#62 pruned them from build-release.sh, which covers linux/macos/deb/rpm/
AppImage. The Windows job stages separately with Copy-Item -Recurse and
kept shipping them: v3.8.9's tronbrowser-win-x64.zip contains
moshpit.test.js (12077B) and moshpit-drift.test.js (4106B).

Mirror the prune in the pwsh path so every platform matches.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(store): stamp our update_url into the .crx, so installs can update

Chromium polls the update_url baked into the installed manifest — it never
consults the feed the store advertises on the listing page. Most publishers
omit it (it points at us, and they write their manifest long before they
list here), so a store install pinned itself to whatever version it was
installed at and never moved again, while the store served a correct
updates.xml that nothing ever asked for.

CoinPay Wallet is the live case: the store, its gupdate feed and the packed
.crx are all at 0.9.2, but the shipped manifest has no update_url, so every
existing install sits on the version it was first given.

The .crx is packed on demand and we already know the feed URL, so set it
there, before signing (the CRX3 signature covers the zip bytes). Overwriting
a publisher's own update_url is deliberate: the id comes from the store's
signing key, and only our feed can serve an update Chromium accepts for it.

Verified against the real published 0.9.2 bundle: all 13 files stay
byte-identical, only the empty directory entries drop (Chromium recreates
those from the paths), and the resulting .crx carries the feed URL.

Note this cannot rescue already-installed copies — they have no update_url
to poll, so they need one manual reinstall to get onto the channel.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

services/api/src/store/crx.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
-import { zipSync, strToU8 } from 'fflate';
-import { crxToZip, extractListingFromCrx } from './crx.js';
+import { zipSync, unzipSync, strToU8, strFromU8 } from 'fflate';
+import { crxToZip, extractListingFromCrx, stampUpdateUrl } from './crx.js';
 
 // Build a minimal CRX3 (Cr24 + fake header + zip) for testing.
 function makeCrx(files: Record<string, Uint8Array>, headerLen = 8): Uint8Array {
@@ -50,3 +50,44 @@ describe('crx ingest', () => {
     expect(() => extractListingFromCrx(crx)).toThrow(/MV3-only/);
   });
 });
+
+describe('stampUpdateUrl', () => {
+  const FEED = 'https://tronbrowser.dev/api/store/updates.xml?id=abc';
+  const bundle = (manifest: object, extra: Record<string, Uint8Array> = {}) =>
+    zipSync({ 'manifest.json': strToU8(JSON.stringify(manifest)), ...extra });
+  const manifestOf = (zip: Uint8Array) =>
+    JSON.parse(strFromU8(unzipSync(zip)['manifest.json']));
+
+  it('adds update_url to a manifest that has none', () => {
+    // The CoinPay Wallet case: a valid MV3 bundle that never opted into the
+    // store's feed, so the install could never move off its first version.
+    const out = stampUpdateUrl(bundle({ manifest_version: 3, name: 'CoinPay Wallet', version: '0.9.2' }), FEED);
+    expect(manifestOf(out).update_url).toBe(FEED);
+  });
+
+  it('overwrites a publisher update_url that points elsewhere', () => {
+    // Only our feed can serve an update for an id derived from our signing key.
+    const out = stampUpdateUrl(bundle({ manifest_version: 3, name: 'x', version: '1', update_url: 'https://clients2.google.com/service/update2/crx' }), FEED);
+    expect(manifestOf(out).update_url).toBe(FEED);
+  });
+
+  it('keeps every other file and manifest field intact', () => {
+    const out = stampUpdateUrl(
+      bundle({ manifest_version: 3, name: 'x', version: '1', permissions: ['storage'] }, { 'sw.js': strToU8('console.log(1)') }),
+      FEED,
+    );
+    const files = unzipSync(out);
+    expect(strFromU8(files['sw.js'])).toBe('console.log(1)');
+    expect(manifestOf(out).permissions).toEqual(['storage']);
+    expect(manifestOf(out).version).toBe('1');
+  });
+
+  it('returns the original bytes when the feed is already ours', () => {
+    const zip = bundle({ manifest_version: 3, name: 'x', version: '1', update_url: FEED });
+    expect(stampUpdateUrl(zip, FEED)).toBe(zip);
+  });
+
+  it('rejects a bundle with no manifest', () => {
+    expect(() => stampUpdateUrl(zipSync({ 'sw.js': strToU8('x') }), FEED)).toThrow(/no manifest\.json/);
+  });
+});

services/api/src/store/crx.ts

@@ -3,7 +3,7 @@
 // extension's own manifest.json + icons — so publishers don't fill out forms.
 //
 // Pure parsing (fetch is separate + guarded) so it's unit-testable.
-import { unzipSync, strFromU8 } from 'fflate';
+import { unzipSync, zipSync, strFromU8, strToU8 } from 'fflate';
 
 export interface IngestedListing {
   name: string;
@@ -59,6 +59,43 @@ export function artifactToZip(buf: Uint8Array): Uint8Array {
   throw new Error('not a .crx or .zip bundle');
 }
 
+/**
+ * Stamp the store's gupdate feed into manifest.json before the zip is signed.
+ *
+ * Chromium only polls the `update_url` baked into the *installed* manifest — it
+ * never consults the feed the store advertises on the listing page. So a
+ * publisher who omits `update_url` (most of them: it points at us, and they
+ * write their manifest long before they list here) ships an extension that
+ * pins itself to whatever version was installed and never moves again. The
+ * store then serves a perfectly correct updates.xml that nothing ever asks for.
+ *
+ * We pack the .crx on the fly and already know the feed URL, so we set it here.
+ * Overwriting any existing value is deliberate: the id of this .crx comes from
+ * the store's signing key, and only the store's feed can serve an update
+ * Chromium will accept for that id — a publisher's own update_url would point
+ * at a different id and silently do nothing.
+ *
+ * Must run before packCrx: the CRX3 signature covers these exact zip bytes.
+ *
+ * Re-zipping keeps every file byte-identical but drops the archive's empty
+ * directory entries; Chromium recreates those from the file paths.
+ */
+export function stampUpdateUrl(zip: Uint8Array, updateUrl: string): Uint8Array {
+  const files = unzipSync(zip, { filter: (f) => !f.name.endsWith('/') });
+  const manifestBytes = files['manifest.json'];
+  if (!manifestBytes) throw new Error('bundle has no manifest.json');
+  let manifest: any;
+  try {
+    manifest = JSON.parse(strFromU8(manifestBytes));
+  } catch (e: any) {
+    throw new Error(`manifest.json is not valid JSON: ${e.message}`);
+  }
+  if (manifest.update_url === updateUrl) return zip; // already ours — don't re-zip
+  manifest.update_url = updateUrl;
+  files['manifest.json'] = strToU8(`${JSON.stringify(manifest, null, 2)}\n`);
+  return zipSync(files);
+}
+
 function iconToDataUri(path: string, bytes: Uint8Array): string | null {
   if (!bytes || bytes.length === 0 || bytes.length > MAX_ICON_BYTES) return null;
   const ext = path.toLowerCase().split('.').pop() || '';

services/api/src/store/routes.ts

@@ -24,7 +24,7 @@ import {
 } from './payments.js';
 import { enqueueScan } from './vu1nz.js';
 import { mirrorListing } from './mirror.js';
-import { fetchArtifact, artifactToZip, extractListingFromCrx } from './crx.js';
+import { fetchArtifact, artifactToZip, extractListingFromCrx, stampUpdateUrl } from './crx.js';
 import { scanArtifact, type ExtensionScanResult } from './scanner.js';
 import { generateSigningKey, encryptPrivateKey, decryptPrivateKey, packCrx } from './signing.js';
 import { createScan, updateScan } from './db.js';
@@ -220,7 +220,11 @@ store.get('/extensions/:slug/download.crx', async (c) => {
 
   try {
     const buf = await fetchArtifact(url);
-    const crx = packCrx(artifactToZip(buf), decryptPrivateKey(key.private_key_enc), Buffer.from(key.public_key_der, 'base64'));
+    // Stamp our gupdate feed in before signing, or the install pins itself to
+    // this version forever: Chromium polls the manifest's own update_url and
+    // most publishers never set one. See stampUpdateUrl.
+    const zip = stampUpdateUrl(artifactToZip(buf), `${APP_URL}/api/store/updates.xml?id=${ext.id}`);
+    const crx = packCrx(zip, decryptPrivateKey(key.private_key_enc), Buffer.from(key.public_key_der, 'base64'));
     c.header('content-type', 'application/x-chrome-extension');
     c.header('content-disposition', `attachment; filename="${ext.slug}-${ver!.version}.crx"`);
     // Hono wants an ArrayBuffer, not a Node Buffer view over a pooled one.