feat: bundle encryption

Author: triniwiz

NativeScriptWindowsDemo/NativeScriptWindowsDemo.csproj

@@ -104,7 +104,12 @@
     <Compile Include="$(NSGenDir)\NSWinRTProxies\**\*.cs" Visible="false" Condition="Exists('$(NSGenDir)\NSWinRTProxies')" />
     <Compile Remove="$(NSGenDir)\NSWinRTProxies\obj\**\*.cs" Condition="Exists('$(NSGenDir)\NSWinRTProxies\obj')" />
 
-    <Content Include="App\**\*">
+    <!-- Sealed source-protected bundle (see runtime/src/source_protect.rs), when present, takes
+         priority over the plaintext App\ tree; produced by the nsbundle_pack packer tool. -->
+    <Content Include="app.nsbundle" Condition="Exists('app.nsbundle')">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="App\**\*" Condition="!Exists('app.nsbundle')">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
     </Content>
     <Content Include="$(NSGenDir)\sbg-manifest.json" Link="sbg-manifest.json" CopyToOutputDirectory="PreserveNewest" Condition="Exists('$(NSGenDir)\sbg-manifest.json')" />

NativeScriptWindowsDemo/RuntimeHost.cs

@@ -32,6 +32,20 @@ internal sealed class RuntimeHost : IDisposable
         [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_set_local_folder))]
         private static extern void runtime_set_local_folder([MarshalAs(UnmanagedType.LPUTF8Str)] string localFolder);
 
+        // Escape hatch for apps packed with `nsbundle_pack --key-hex <hex>` (custom-key
+        // app.nsbundle containers). Must be called before runtime_init if used at all — apps
+        // packed with the default pepper (no --key-hex) never need to call this. Not wired to a
+        // default call site here; an app author supplies their own key material and calls this
+        // from Initialize() before runtime_init(...).
+        [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_set_bundle_key))]
+        private static extern int runtime_set_bundle_key([MarshalAs(UnmanagedType.LPUTF8Str)] string keyHex);
+
+        [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_read_protected_file))]
+        private static extern IntPtr runtime_read_protected_file([MarshalAs(UnmanagedType.LPUTF8Str)] string virtualPath);
+
+        [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_free_protected_string))]
+        private static extern void runtime_free_protected_string(IntPtr ptr);
+
         [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_get_last_js_error))]
         private static extern IntPtr runtime_get_last_js_error();
 
@@ -191,6 +205,27 @@ private static bool ConsumeDebugBreakMarker()
         }
 #endif
 
+        /// Reads a file that may live inside a sealed app.nsbundle instead of on disk: tries the
+        /// protected-VFS native call first (cheap no-op when no bundle is loaded), falls back to
+        /// the real filesystem. `path` is whatever candidate the caller already built for
+        /// `File.Exists`/`File.ReadAllText` — the native side strips it down to the bundle's
+        /// virtual (app/App-relative) path itself, so no extra bookkeeping is needed here.
+        private static string TryReadVirtual(string path)
+        {
+            IntPtr ptr = IntPtr.Zero;
+            try
+            {
+                ptr = runtime_read_protected_file(path);
+                return ptr == IntPtr.Zero ? null : Marshal.PtrToStringUTF8(ptr);
+            }
+            catch { return null; }
+            finally { if (ptr != IntPtr.Zero) runtime_free_protected_string(ptr); }
+        }
+
+        private static bool VExists(string path) => TryReadVirtual(path) != null || File.Exists(path);
+
+        private static string VReadAllText(string path) => TryReadVirtual(path) ?? File.ReadAllText(path);
+
         public void RunMainScript()
         {
             if (!_initialized)
@@ -208,7 +243,7 @@ public void RunMainScript()
             foreach (var chunkName in new[] { "runtime.js", "vendor.js" })
             {
                 var chunkPath = Path.Combine(dir, chunkName);
-                if (File.Exists(chunkPath) &&
+                if (VExists(chunkPath) &&
                     !string.Equals(chunkPath, Path.GetFullPath(entryPath), StringComparison.OrdinalIgnoreCase))
                 {
                     chunks.Add(chunkPath);
@@ -218,7 +253,7 @@ public void RunMainScript()
 
             foreach (var scriptPath in chunks)
             {
-                var script = File.ReadAllText(Path.GetFullPath(scriptPath));
+                var script = VReadAllText(Path.GetFullPath(scriptPath));
                 try
                 {
                     runtime_runscript(_runtime, script, Path.GetFileName(scriptPath));
@@ -260,7 +295,7 @@ private static string ResolveEntryScriptPath()
             foreach (var dir in appDirCandidates)
             {
                 var candidate = Path.Combine(dir, "package.json");
-                if (File.Exists(candidate))
+                if (VExists(candidate))
                 {
                     packageJsonPath = candidate;
                     resolvedBaseDir = dir;
@@ -269,7 +304,7 @@ private static string ResolveEntryScriptPath()
             }
 
             // Also accept package.json at the project root (parent of bin/).
-            if (packageJsonPath == null && File.Exists(Path.Combine(parentDir, "package.json")))
+            if (packageJsonPath == null && VExists(Path.Combine(parentDir, "package.json")))
             {
                 packageJsonPath = Path.Combine(parentDir, "package.json");
                 resolvedBaseDir = parentDir;
@@ -278,7 +313,7 @@ private static string ResolveEntryScriptPath()
             string Fallback() =>
                 appDirCandidates
                     .SelectMany(d => new[] { Path.Combine(d, "bundle.js"), Path.Combine(d, "bundle.mjs") })
-                    .FirstOrDefault(File.Exists);
+                    .FirstOrDefault(VExists);
 
             if (packageJsonPath == null)
                 return Fallback();
@@ -304,7 +339,7 @@ string Fallback() =>
 
         private static RuntimePackageConfig ParsePackageConfig(string packageJsonPath)
         {
-            using var doc = JsonDocument.Parse(File.ReadAllText(packageJsonPath));
+            using var doc = JsonDocument.Parse(VReadAllText(packageJsonPath));
             var config = new RuntimePackageConfig();
             if (doc.RootElement.TryGetProperty("main", out var main) && main.ValueKind == JsonValueKind.String)
                 config.Main = main.GetString();
@@ -321,11 +356,11 @@ private static string ResolveScriptPath(string baseDir, string scriptPath)
             foreach (var candidate in new[] { normalized, normalized + ".js", normalized + ".mjs" })
             {
                 var direct = Path.IsPathRooted(candidate) ? candidate : Path.Combine(baseDir, candidate);
-                if (File.Exists(direct)) return direct;
+                if (VExists(direct)) return direct;
                 var appLower = Path.Combine(baseDir, "app", candidate);
-                if (File.Exists(appLower)) return appLower;
+                if (VExists(appLower)) return appLower;
                 var appUpper = Path.Combine(baseDir, "App", candidate);
-                if (File.Exists(appUpper)) return appUpper;
+                if (VExists(appUpper)) return appUpper;
             }
             return null;
         }

TestApp/RuntimeHost.cs

@@ -32,6 +32,20 @@ internal sealed class RuntimeHost : IDisposable
         [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_set_local_folder))]
         private static extern void runtime_set_local_folder([MarshalAs(UnmanagedType.LPUTF8Str)] string localFolder);
 
+        // Escape hatch for apps packed with `nsbundle_pack --key-hex <hex>` (custom-key
+        // app.nsbundle containers). Must be called before runtime_init if used at all — apps
+        // packed with the default pepper (no --key-hex) never need to call this. Not wired to a
+        // default call site here; an app author supplies their own key material and calls this
+        // from Initialize() before runtime_init(...).
+        [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_set_bundle_key))]
+        private static extern int runtime_set_bundle_key([MarshalAs(UnmanagedType.LPUTF8Str)] string keyHex);
+
+        [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_read_protected_file))]
+        private static extern IntPtr runtime_read_protected_file([MarshalAs(UnmanagedType.LPUTF8Str)] string virtualPath);
+
+        [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_free_protected_string))]
+        private static extern void runtime_free_protected_string(IntPtr ptr);
+
         [DllImport(NativeScriptLibrary, EntryPoint = nameof(runtime_get_last_js_error))]
         private static extern IntPtr runtime_get_last_js_error();
 
@@ -191,6 +205,27 @@ private static bool ConsumeDebugBreakMarker()
         }
 #endif
 
+        /// Reads a file that may live inside a sealed app.nsbundle instead of on disk: tries the
+        /// protected-VFS native call first (cheap no-op when no bundle is loaded), falls back to
+        /// the real filesystem. `path` is whatever candidate the caller already built for
+        /// `File.Exists`/`File.ReadAllText` — the native side strips it down to the bundle's
+        /// virtual (app/App-relative) path itself, so no extra bookkeeping is needed here.
+        private static string TryReadVirtual(string path)
+        {
+            IntPtr ptr = IntPtr.Zero;
+            try
+            {
+                ptr = runtime_read_protected_file(path);
+                return ptr == IntPtr.Zero ? null : Marshal.PtrToStringUTF8(ptr);
+            }
+            catch { return null; }
+            finally { if (ptr != IntPtr.Zero) runtime_free_protected_string(ptr); }
+        }
+
+        private static bool VExists(string path) => TryReadVirtual(path) != null || File.Exists(path);
+
+        private static string VReadAllText(string path) => TryReadVirtual(path) ?? File.ReadAllText(path);
+
         public void RunMainScript()
         {
             if (!_initialized)
@@ -208,7 +243,7 @@ public void RunMainScript()
             foreach (var chunkName in new[] { "runtime.js", "vendor.js" })
             {
                 var chunkPath = Path.Combine(dir, chunkName);
-                if (File.Exists(chunkPath) &&
+                if (VExists(chunkPath) &&
                     !string.Equals(chunkPath, Path.GetFullPath(entryPath), StringComparison.OrdinalIgnoreCase))
                 {
                     chunks.Add(chunkPath);
@@ -218,7 +253,7 @@ public void RunMainScript()
 
             foreach (var scriptPath in chunks)
             {
-                var script = File.ReadAllText(Path.GetFullPath(scriptPath));
+                var script = VReadAllText(Path.GetFullPath(scriptPath));
                 try
                 {
                     runtime_runscript(_runtime, script, Path.GetFileName(scriptPath));
@@ -260,7 +295,7 @@ private static string ResolveEntryScriptPath()
             foreach (var dir in appDirCandidates)
             {
                 var candidate = Path.Combine(dir, "package.json");
-                if (File.Exists(candidate))
+                if (VExists(candidate))
                 {
                     packageJsonPath = candidate;
                     resolvedBaseDir = dir;
@@ -269,7 +304,7 @@ private static string ResolveEntryScriptPath()
             }
 
             // Also accept package.json at the project root (parent of bin/).
-            if (packageJsonPath == null && File.Exists(Path.Combine(parentDir, "package.json")))
+            if (packageJsonPath == null && VExists(Path.Combine(parentDir, "package.json")))
             {
                 packageJsonPath = Path.Combine(parentDir, "package.json");
                 resolvedBaseDir = parentDir;
@@ -278,7 +313,7 @@ private static string ResolveEntryScriptPath()
             string Fallback() =>
                 appDirCandidates
                     .SelectMany(d => new[] { Path.Combine(d, "bundle.js"), Path.Combine(d, "bundle.mjs") })
-                    .FirstOrDefault(File.Exists);
+                    .FirstOrDefault(VExists);
 
             if (packageJsonPath == null)
                 return Fallback();
@@ -304,7 +339,7 @@ string Fallback() =>
 
         private static RuntimePackageConfig ParsePackageConfig(string packageJsonPath)
         {
-            using var doc = JsonDocument.Parse(File.ReadAllText(packageJsonPath));
+            using var doc = JsonDocument.Parse(VReadAllText(packageJsonPath));
             var config = new RuntimePackageConfig();
             if (doc.RootElement.TryGetProperty("main", out var main) && main.ValueKind == JsonValueKind.String)
                 config.Main = main.GetString();
@@ -321,11 +356,11 @@ private static string ResolveScriptPath(string baseDir, string scriptPath)
             foreach (var candidate in new[] { normalized, normalized + ".js", normalized + ".mjs" })
             {
                 var direct = Path.IsPathRooted(candidate) ? candidate : Path.Combine(baseDir, candidate);
-                if (File.Exists(direct)) return direct;
+                if (VExists(direct)) return direct;
                 var appLower = Path.Combine(baseDir, "app", candidate);
-                if (File.Exists(appLower)) return appLower;
+                if (VExists(appLower)) return appLower;
                 var appUpper = Path.Combine(baseDir, "App", candidate);
-                if (File.Exists(appUpper)) return appUpper;
+                if (VExists(appUpper)) return appUpper;
             }
             return null;
         }

TestApp/TestApp.csproj

@@ -86,7 +86,12 @@
     <Compile Include="$(NSGenDir)\NSWinRTProxies\**\*.cs" Visible="false" Condition="Exists('$(NSGenDir)\NSWinRTProxies')" />
     <Compile Remove="$(NSGenDir)\NSWinRTProxies\obj\**\*.cs" Condition="Exists('$(NSGenDir)\NSWinRTProxies\obj')" />
 
-    <Content Include="App\**\*">
+    <!-- Sealed source-protected bundle (see runtime/src/source_protect.rs), when present, takes
+         priority over the plaintext App\ tree; produced by the nsbundle_pack packer tool. -->
+    <Content Include="app.nsbundle" Condition="Exists('app.nsbundle')">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+    <Content Include="App\**\*" Condition="!Exists('app.nsbundle')">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
     </Content>
     <Content Include="$(NSGenDir)\sbg-manifest.json" Link="sbg-manifest.json" CopyToOutputDirectory="PreserveNewest" Condition="Exists('$(NSGenDir)\sbg-manifest.json')" />

integration-tests/tests/protected_bundle.rs

@@ -0,0 +1,74 @@
+//! Proves the sealed `app.nsbundle` container (`runtime::source_protect`) actually serves as the
+//! JS source for a real `Runtime` run — not just round-tripping in isolation (see
+//! `source_protect`'s own unit tests for that). The plaintext staging directory is deleted right
+//! after packing, before `Runtime::new` ever runs, so there is no possible filesystem fallback:
+//! if the ESM import below resolves at all, it can only have come from the decrypted in-memory
+//! table.
+
+use runtime::source_protect;
+use runtime::Runtime;
+use std::fs;
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+static COUNTER: AtomicU64 = AtomicU64::new(0);
+
+fn scratch_dir(name: &str) -> PathBuf {
+    let n = COUNTER.fetch_add(1, Ordering::Relaxed);
+    let dir = std::env::temp_dir().join(format!(
+        "nsbundle_integration_{name}_{}_{n}",
+        std::process::id()
+    ));
+    let _ = fs::remove_dir_all(&dir);
+    fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+#[test]
+fn esm_import_resolves_from_sealed_bundle_with_no_plaintext_on_disk() {
+    // Stage the two-file ESM "app", pack it, then destroy the plaintext — everything downstream
+    // must come from the decrypted table or this test fails.
+    let staging = scratch_dir("stage");
+    fs::write(
+        staging.join("entry.mjs"),
+        b"import { value } from './dep.mjs';\n\
+          if (value !== 42) { throw new Error('wrong value: ' + value); }\n",
+    )
+    .unwrap();
+    fs::write(staging.join("dep.mjs"), b"export const value = 42;\n").unwrap();
+
+    let app_root = scratch_dir("approot");
+    let bundle_path = app_root.join("app.nsbundle");
+    source_protect::pack_directory(
+        &staging,
+        &bundle_path,
+        source_protect::KEY_MODE_DEFAULT,
+        source_protect::default_key(),
+    )
+    .unwrap();
+
+    fs::remove_dir_all(&staging).unwrap();
+    assert!(!staging.exists(), "plaintext staging dir must be gone");
+
+    // Runtime::new -> Runtime::source_protect::init_from_app_root locates app_root/app.nsbundle
+    // and decrypts it into the in-memory table before anything else runs.
+    let mut rt = Runtime::new(app_root.to_str().unwrap());
+    assert!(
+        source_protect::has_bundle(),
+        "app.nsbundle should have been found and loaded from {}",
+        app_root.display()
+    );
+
+    // Fetch the entry's own source from the protected table too (mirrors what a real host does
+    // via runtime_read_protected_file instead of File.ReadAllText).
+    let entry_source =
+        source_protect::read_text("entry.mjs").expect("entry.mjs should be served from the bundle");
+
+    rt.run_script(&entry_source, "entry.mjs");
+
+    assert_eq!(
+        runtime::get_last_js_error(),
+        None,
+        "ESM import of the bundle-only dep.mjs should have resolved cleanly"
+    );
+}

nativescript/src/lib.rs

@@ -190,6 +190,20 @@ pub extern "C" fn runtime_set_local_folder(path: *const c_char) {
     let _ = LOCAL_FOLDER.set(s);
 }
 
+/// Supply a custom key (64 hex chars = 32 bytes) for opening a `key_mode == 1` app.nsbundle
+/// container packed with `nsbundle_pack --key-hex`. Must be called before `runtime_init` — same
+/// ordering requirement as `runtime_set_local_folder`. Returns 1 on success, 0 on malformed input
+/// (wrong length or non-hex characters). Apps sealed with the default pepper (`key_mode == 0`,
+/// i.e. `nsbundle_pack` invoked without `--key-hex`) never need to call this.
+#[no_mangle]
+pub extern "C" fn runtime_set_bundle_key(key_hex: *const c_char) -> c_int {
+    if key_hex.is_null() {
+        return 0;
+    }
+    let hex = unsafe { CStr::from_ptr(key_hex) }.to_string_lossy();
+    runtime::source_protect::set_custom_key_hex(hex.as_ref()) as c_int
+}
+
 #[no_mangle]
 pub extern "C" fn runtime_init(app_root: *const c_char) -> i64 {
     install_veh();
@@ -285,6 +299,32 @@ pub extern "C" fn runtime_free_js_error(ptr: *mut c_char) {
     }
 }
 
+/// Read a JS source file out of the sealed app.nsbundle loaded for this process, if any. Returns
+/// NULL when no bundle was loaded, or the given path isn't in it — this doubles as an existence
+/// probe, so callers (`RuntimeHost.cs`'s `VExists`/`VReadAllText`) can use one call for both.
+/// Non-NULL results must be freed with `runtime_free_protected_string`.
+#[no_mangle]
+pub extern "C" fn runtime_read_protected_file(virtual_path: *const c_char) -> *mut c_char {
+    if virtual_path.is_null() {
+        return std::ptr::null_mut();
+    }
+    let path = unsafe { CStr::from_ptr(virtual_path) }.to_string_lossy();
+    match runtime::source_protect::read_text(path.as_ref()) {
+        Some(content) => CString::new(content)
+            .map(|c| c.into_raw())
+            .unwrap_or(std::ptr::null_mut()),
+        None => std::ptr::null_mut(),
+    }
+}
+
+/// Free a string previously returned by `runtime_read_protected_file`.
+#[no_mangle]
+pub extern "C" fn runtime_free_protected_string(ptr: *mut c_char) {
+    if !ptr.is_null() {
+        drop(unsafe { CString::from_raw(ptr) });
+    }
+}
+
 // ─── Devtools FFI ─────────────────────────────────────────────────────────────
 
 #[no_mangle]