[sproctor]

🚀 Description

Improvements to differential (blockmap) updates, as eight self-contained commits that can be reviewed one at a time:

Commit	Change
fix(updater): bound block map reads…	Block map downloads, the AppImage tail read and inflation are capped; a manifest blockMapSize over 64 MiB is refused before any request; non-positive block sizes are rejected.
fix(updater): insert .blockmap before a query string…	UpdateProvider.getBlockMapUrl()'s default puts .blockmap at the end of the path, before ?…, as electron-updater does.
perf(updater): merge ranged requests separated by small unchanged gaps	DeltaPlan.coalesce() merges two downloads separated by ≤ 256 KiB of copies into one request. compute() is unchanged and still matches electron-updater.
perf(updater): download the whole artifact when a delta would fetch 90%…	A plan fetching ≥ 90% of the artifact becomes one streamed full download.
perf(updater): download delta ranges concurrently, with retries	Up to 6 concurrent ranges written by position; redirect resolved once; retries for I/O errors, 429 and 5xx (backoff, Retry-After); an expired redirect target is re-resolved; credentials only go to the original host; 30 s response timeout; no partial file left on failure.
perf(updater): make the first Windows NSIS update differential	With nothing cached, an .exe update diffs against the installer electron-builder seeds in %LOCALAPPDATA%\<updaterCacheDirName>\installer.exe, using the installed release's published block map.
ci(macos): publish a block map for the universal macOS ZIP	build-macos-universal generates <zip>.blockmap with electron-builder's own buildBlockMap, installed from the plugin's pinned lock file.
fix(plugin): delete a DMG's block map once stapling invalidates it	The notarize task deletes the stale .blockmap after stapling.

📄 Motivation and Context

Correctness and robustness

• Unbounded reads. Block maps were read with BodyHandlers.ofByteArray() and inflated with readBytes(), so their size was decided by the server. A manifest blockMapSize just under the artifact size pulls most of an AppImage into memory, and a small gzip bomb inflates without limit. The resulting OutOfMemoryError is an Error, so it escapes the catch (Exception) that falls back to a full download.
• Query strings. "$fileUrl.blockmap" put the suffix inside the last query parameter's value for any artifact URL carrying a query (token, cache-busting version), so the block map was never found.
• Notarized DMGs. Stapling rewrites the DMG after electron-builder wrote its block map. blockMapSize was already stripped from the manifest, but the resolver keys the flavour on format, so it still fetched the stale sidecar, failed the plan-size check, fell back to a full download, and cached the stale map for the next update.

Performance

• Ranges were fetched one at a time, with a 1 s pause every 100 and a redirect round trip per range; one transient error abandoned the whole delta. An update touching many scattered blocks spent most of its time on round trips.
• Every first update of a non-AppImage install was a full download, although NSIS installs already leave the previous installer on disk.
• Universal macOS installs never got deltas: the ditto-built ZIP had no block map.

Notes for review

• Blocks now arrive out of order, so the SHA-512 is computed in one pass over the assembled file instead of while writing. Progress is still reported from the caller's coroutine, so it can emit into the Flow.
• updaterCacheDirName is derived at run time from the running .exe: electron-builder builds it from the package.json name, which the plugin derives from the executable name (windows.packageName ?: packageName for jpackage, imageName for GraalVM). If it cannot be found, or the old release's block map is no longer hosted, the update is a full download as before.
• electron-builder 26 no longer ships app-builder-bin, but builds block maps in JS (app-builder-lib/out/targets/blockmap/blockmap). The release workflow's universal job adds the lock file's directory to its sparse checkout; callers using the action by reference get the whole repository. A failure there only warns.
• For notarized DMGs I chose deleting the stale block map over regenerating it: the toolchain is removed after packaging, and macOS updates prefer the ZIP, which is never stapled and keeps its map. Regenerating would mean re-provisioning electron-builder in the notarize task or porting its Rabin chunker (plus BLAKE2b) to Kotlin; happy to do either if you prefer.

🧪 How Has This Been Tested?

./gradlew :updater-runtime:check and ./gradlew :plugin:check (in plugin-build) pass. New and extended tests:

• BlockMapCodecTest: a 160 MiB gzip bomb is rejected by the bound while inflating; non-positive block sizes; readAtMost.
• DeltaResolverTest: an implausible blockMapSize is refused with no request made; the first NSIS update diffs against a seeded installer (byte-identical result, EXPECTED_DELTA_BYTES fetched); no delta when the old release's map is gone; the seeded installer is only used for .exe targets.
• DeltaPlanTest: coalescing merges, respects the bound, sums multi-copy gaps, and a coalesced plan with scattered edits still reproduces the artifact byte for byte.
• DifferentialUpdateE2ETest: a ~96% delta becomes a full download with no ranged requests.
• DifferentialDownloaderTest (new): concurrency (max in flight > 1), progress ordering, retry of 503/429, giving up after 3 attempts with no partial file, no retry for a host ignoring Range or a 404, ranges going straight to the redirect target without the original host's credentials, and re-resolution of an expired target.
• SeededInstallerTest (new): directory naming, lookup, and previous artifact name.
• GenericProviderTest: block map URL with a query string.

RangeHttpServer gains a thread pool, per-range latency, scripted failures and redirects for these tests; existing tests are unaffected.

Every new test except the naming/URL ones was checked to fail with the corresponding change removed. The concurrency tests passed five repeated runs. The universal-ZIP step was exercised on Linux by running its function against a sample ZIP (valid version-2 map covering the file). Not tested: a real Windows NSIS update, a real macOS universal release build, and the notarize-task deletion (it needs xcrun).

📦 Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

✅ Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.

🤖 Generated with Claude Code