Harden CFW/firmware updates with size verification and error logging

hexbyt3 · claude · hexbyt3 · commit 4813395da4d4 · 2026-06-25T07:28:51.000-05:00
The CFW updater could fail with a bare "Extraction failed" and no
explanation. Root cause: a truncated/corrupt download passed downloadFile's
checks (it only inspected curl's return + HTTP status, never the size), then
minizip's unzOpen rejected the bad zip and extractZip returned a generic -1 —
aborting before any file was written and leaving the SD untouched.

Changes:
- download: add downloadFileChecked() which verifies the saved file matches
  the asset's expected size (from the GitHub release JSON) and retries up to
  DOWNLOAD_MAX_ATTEMPTS, transparently surviving flaky transfers. Capture each
  asset's "size" in cfw_mgr/firmware_mgr.
- extract: extractZip now returns distinct codes (EXTRACT_ERR_OPEN/INDEX/
  MEMORY) so callers can say *why* it failed instead of "Extraction failed".
- applog: new best-effort logger writing /config/AetherBlock/last_error.log
  (rotated past APP_LOG_MAX_SIZE) capturing the failing step, expected vs
  actual sizes, and extract codes — so a failure leaves a diagnosable trail.
- error_text now includes the specific reason for both CFW and firmware flows.

Bump APP_VERSION to 2.0.8.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
@@ -20,9 +20,13 @@ jobs:
 
       - name: Install dependencies
         run: |
-          dkp-pacman -Sy --noconfirm switch-curl switch-mbedtls switch-zlib \
-            || echo "Package sync failed — checking if already installed..." \
-            && dkp-pacman -Q switch-curl switch-mbedtls switch-zlib
+          # Refresh the package DB and pull the latest libnx + portlibs so
+          # the build always targets current firmware/Atmosphere support
+          # rather than whatever libnx the container image was baked with.
+          dkp-pacman -Sy --noconfirm
+          dkp-pacman -S --noconfirm --needed libnx switch-curl switch-mbedtls switch-zlib
+          echo "## Toolchain" >> $GITHUB_STEP_SUMMARY
+          dkp-pacman -Q libnx switch-curl switch-mbedtls switch-zlib | tee -a $GITHUB_STEP_SUMMARY
 
       - name: Build
         run: make
diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@ ROMFS		:=	romfs
 
 APP_TITLE	:=	AetherBlock
 APP_AUTHOR	:=	HeXbyt3
-APP_VERSION	:=	2.0.7
+APP_VERSION	:=	2.0.8
 
 #---------------------------------------------------------------------------------
 ARCH	:=	-march=armv8-a+crc+crypto -mtune=cortex-a57 -mtp=soft -fPIE
diff --git a/include/applog.h b/include/applog.h
@@ -0,0 +1,14 @@
+#ifndef APPLOG_H
+#define APPLOG_H
+
+/* Best-effort line logger. Appends to APP_LOG_PATH so a failed update
+   leaves behind a human-readable reason instead of only an on-screen
+   message. Any failure to write the log is silently ignored — logging
+   must never affect the operation it is recording. */
+void appLog(const char *fmt, ...) __attribute__((format(printf, 1, 2)));
+
+/* Start a new titled section. Rotates (truncates) the log first if it
+   has grown past APP_LOG_MAX_SIZE so it can't grow without bound. */
+void appLogSection(const char *title);
+
+#endif
diff --git a/include/cfw_mgr.h b/include/cfw_mgr.h
@@ -18,6 +18,7 @@ typedef struct {
     char        current_ams[32];
     char        latest_tag[32];
     char        download_url[512];
+    long long   download_size;   /* expected asset size in bytes, 0 if unknown */
     char        changelog[4096];
     bool        update_available;
     bool        is_mariko;
diff --git a/include/config.h b/include/config.h
@@ -2,7 +2,7 @@
 #define CONFIG_H
 
 #define APP_NAME            "AetherBlock"
-#define APP_VERSION         "2.0.7"
+#define APP_VERSION         "2.0.8"
 #define APP_AUTHOR          "HeXbyt3"
 
 #define HOSTS_MAX_ENTRIES   256
@@ -41,4 +41,9 @@
 #define AETHERBLOCK_CONFIG_DIR "/config/AetherBlock/"
 #define FW_CLEANUP_MARKER_PATH "/config/AetherBlock/fw_cleanup_pending"
 
+/* diagnostics + download integrity */
+#define APP_LOG_PATH           "/config/AetherBlock/last_error.log"
+#define APP_LOG_MAX_SIZE       16384   /* rotate the log past this many bytes */
+#define DOWNLOAD_MAX_ATTEMPTS  3       /* retry truncated/failed transfers */
+
 #endif
diff --git a/include/download.h b/include/download.h
@@ -12,6 +12,16 @@ void downloadGlobalCleanup(void);
 int downloadFile(const char *url, const char *output_path,
                  DownloadProgressCb cb, void *userdata);
 
+/* Like downloadFile but retries up to max_attempts and, when
+   expected_size > 0, requires the saved file to match that size exactly
+   (catching truncated/corrupt transfers that otherwise pass as success).
+   On failure a human-readable reason is copied into reason_out.
+   Returns 0 on success, -1 once all attempts are exhausted. */
+int downloadFileChecked(const char *url, const char *output_path,
+                        long long expected_size, int max_attempts,
+                        DownloadProgressCb cb, void *userdata,
+                        char *reason_out, size_t reason_out_size);
+
 int downloadToMemory(const char *url, char **out_buf, size_t *out_len);
 
 int fetchJson(const char *url, cJSON **out_json);
diff --git a/include/extract.h b/include/extract.h
@@ -3,6 +3,15 @@
 
 #include <stddef.h>
 
+/* Negative return values from extractZip — hard failures that abort the
+   whole operation before any file is written. A non-negative return is
+   the count of individual entries that failed mid-extraction. */
+enum {
+    EXTRACT_ERR_OPEN   = -1,  /* zip could not be opened (corrupt/truncated) */
+    EXTRACT_ERR_INDEX  = -2,  /* archive directory could not be read */
+    EXTRACT_ERR_MEMORY = -3,  /* out of memory for the copy buffer */
+};
+
 typedef void (*ExtractProgressCb)(int current, int total, const char *filename, void *userdata);
 
 /* If stage_locked_files is non-zero, any file that can't be written
diff --git a/include/firmware_mgr.h b/include/firmware_mgr.h
@@ -7,8 +7,9 @@
 #define FW_MAX_ENTRIES 64
 
 typedef struct {
-    char version[32];
-    char url[512];
+    char      version[32];
+    char      url[512];
+    long long size;       /* expected asset size in bytes, 0 if unknown */
 } FirmwareEntry;
 
 typedef enum {
diff --git a/source/applog.c b/source/applog.c
@@ -0,0 +1,33 @@
+#include "applog.h"
+#include "config.h"
+#include <stdio.h>
+#include <stdarg.h>
+#include <sys/stat.h>
+
+void appLog(const char *fmt, ...) {
+    mkdir(AETHERBLOCK_CONFIG_DIR, 0755);
+    FILE *fp = fopen(APP_LOG_PATH, "a");
+    if (!fp) return;
+
+    va_list ap;
+    va_start(ap, fmt);
+    vfprintf(fp, fmt, ap);
+    va_end(ap);
+    fputc('\n', fp);
+    fclose(fp);
+}
+
+void appLogSection(const char *title) {
+    mkdir(AETHERBLOCK_CONFIG_DIR, 0755);
+
+    /* rotate once the log gets large so it never grows without bound */
+    const char *mode = "a";
+    struct stat st;
+    if (stat(APP_LOG_PATH, &st) == 0 && st.st_size > APP_LOG_MAX_SIZE)
+        mode = "w";
+
+    FILE *fp = fopen(APP_LOG_PATH, mode);
+    if (!fp) return;
+    fprintf(fp, "\n===== %s =====\n", title);
+    fclose(fp);
+}
diff --git a/source/cfw_mgr.c b/source/cfw_mgr.c
@@ -4,6 +4,7 @@
 #include "pending.h"
 #include "cfw_detect.h"
 #include "config.h"
+#include "applog.h"
 #include <cJSON.h>
 #include <switch.h>
 #include <stdio.h>
@@ -60,6 +61,8 @@ static int parse_release(cJSON *json, CfwPackageManager *cm) {
         if (strstr(name->valuestring, variant) && strstr(name->valuestring, ".zip")) {
             snprintf(cm->download_url, sizeof(cm->download_url),
                      "%s", url->valuestring);
+            cJSON *size = cJSON_GetObjectItem(asset, "size");
+            cm->download_size = cJSON_IsNumber(size) ? (long long)size->valuedouble : 0;
             return 0;
         }
     }
@@ -112,9 +115,20 @@ static void *download_worker(void *arg) {
 
     mkdir(AETHERBLOCK_CONFIG_DIR, 0755);
 
-    if (downloadFile(cm->download_url, CFW_DOWNLOAD_PATH, progress_cb, cm) != 0) {
+    appLogSection("CFW UPDATE");
+    appLog("package: %s  console: %s", cm->latest_tag,
+           cm->is_mariko ? "Mariko/mod-chipped" : "Erista/unpatched");
+    appLog("url: %s", cm->download_url);
+    appLog("expected size: %lld bytes", cm->download_size);
+
+    char reason[160];
+    if (downloadFileChecked(cm->download_url, CFW_DOWNLOAD_PATH,
+                            cm->download_size, DOWNLOAD_MAX_ATTEMPTS,
+                            progress_cb, cm, reason, sizeof(reason)) != 0) {
         cm->state = CFW_STATE_ERROR;
-        snprintf(cm->error_text, sizeof(cm->error_text), "Download failed");
+        snprintf(cm->error_text, sizeof(cm->error_text), "Download failed: %s", reason);
+        appLog("ERROR: download failed after %d attempts: %s",
+               DOWNLOAD_MAX_ATTEMPTS, reason);
         cm->worker_active = false;
         return NULL;
     }
@@ -130,8 +144,20 @@ static void *download_worker(void *arg) {
                                    cm->failed_files, sizeof(cm->failed_files),
                                    1);
     if (extract_errs < 0) {
+        const char *why;
+        switch (extract_errs) {
+            case EXTRACT_ERR_OPEN:
+                why = "package corrupt - delete cfw_package.zip and retry"; break;
+            case EXTRACT_ERR_INDEX:
+                why = "archive index unreadable (corrupt download)"; break;
+            case EXTRACT_ERR_MEMORY:
+                why = "out of memory"; break;
+            default:
+                why = "unknown error"; break;
+        }
         cm->state = CFW_STATE_ERROR;
-        snprintf(cm->error_text, sizeof(cm->error_text), "Extraction failed");
+        snprintf(cm->error_text, sizeof(cm->error_text), "Extraction failed: %s", why);
+        appLog("ERROR: extraction aborted (code %d): %s", extract_errs, why);
         cm->worker_active = false;
         return NULL;
     }
@@ -140,13 +166,17 @@ static void *download_worker(void *arg) {
 
     cm->state = CFW_STATE_DONE;
     cm->progress = 1.0f;
-    if (extract_errs > 0)
+    if (extract_errs > 0) {
         snprintf(cm->status_text, sizeof(cm->status_text),
                  "CFW %s installed, %d file%s failed.",
                  cm->latest_tag, extract_errs, extract_errs == 1 ? "" : "s");
-    else
+        appLog("done with %d file error(s): %s",
+               extract_errs, cm->failed_files[0] ? cm->failed_files : "(none recorded)");
+    } else {
         snprintf(cm->status_text, sizeof(cm->status_text),
                  "CFW package %s installed!", cm->latest_tag);
+        appLog("done: CFW %s installed cleanly", cm->latest_tag);
+    }
     cm->worker_active = false;
     return NULL;
 }
diff --git a/source/download.c b/source/download.c
@@ -1,11 +1,13 @@
 #include "download.h"
 #include "config.h"
+#include "applog.h"
 #include <curl/curl.h>
 #include <cJSON.h>
 #include <switch.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdio.h>
+#include <sys/stat.h>
 
 #define USER_AGENT "AetherBlock/" APP_VERSION
 
@@ -75,16 +77,24 @@ void downloadGlobalCleanup(void) {
     curl_global_cleanup();
 }
 
-int downloadFile(const char *url, const char *output_path,
-                 DownloadProgressCb cb, void *userdata) {
+/* one download attempt; on failure writes a human-readable cause into
+   reason and removes any partial file. Returns 0 on success. */
+static int download_once(const char *url, const char *output_path,
+                         DownloadProgressCb cb, void *userdata,
+                         char *reason, size_t reason_size) {
     FILE *fp = fopen(output_path, "wb");
-    if (!fp) return -1;
+    if (!fp) {
+        if (reason) snprintf(reason, reason_size, "cannot open %s for writing", output_path);
+        return -1;
+    }
 
     FileWriteCtx ctx = { .fp = fp, .cb = cb, .userdata = userdata };
 
     CURL *curl = make_curl(url);
     if (!curl) {
         fclose(fp);
+        remove(output_path);
+        if (reason) snprintf(reason, reason_size, "curl init failed");
         return -1;
     }
 
@@ -103,13 +113,65 @@ int downloadFile(const char *url, const char *output_path,
     curl_easy_cleanup(curl);
     fclose(fp);
 
-    if (res != CURLE_OK || http_code < 200 || http_code >= 400) {
+    if (res != CURLE_OK) {
+        if (reason) snprintf(reason, reason_size, "network error: %s", curl_easy_strerror(res));
+        remove(output_path);
+        return -1;
+    }
+    if (http_code < 200 || http_code >= 400) {
+        if (reason) snprintf(reason, reason_size, "server returned HTTP %ld", http_code);
         remove(output_path);
         return -1;
     }
     return 0;
 }
 
+int downloadFile(const char *url, const char *output_path,
+                 DownloadProgressCb cb, void *userdata) {
+    char reason[160];
+    return download_once(url, output_path, cb, userdata, reason, sizeof(reason));
+}
+
+int downloadFileChecked(const char *url, const char *output_path,
+                        long long expected_size, int max_attempts,
+                        DownloadProgressCb cb, void *userdata,
+                        char *reason_out, size_t reason_out_size) {
+    char reason[160] = "no attempt made";
+    if (max_attempts < 1) max_attempts = 1;
+
+    for (int attempt = 1; attempt <= max_attempts; attempt++) {
+        if (download_once(url, output_path, cb, userdata, reason, sizeof(reason)) != 0) {
+            appLog("download attempt %d/%d failed: %s", attempt, max_attempts, reason);
+            continue;
+        }
+
+        if (expected_size > 0) {
+            struct stat st;
+            if (stat(output_path, &st) != 0) {
+                snprintf(reason, sizeof(reason), "downloaded file vanished before verification");
+                appLog("download attempt %d/%d: %s", attempt, max_attempts, reason);
+                continue;
+            }
+            if ((long long)st.st_size != expected_size) {
+                snprintf(reason, sizeof(reason), "incomplete: got %lld of %lld bytes",
+                         (long long)st.st_size, expected_size);
+                appLog("download attempt %d/%d %s", attempt, max_attempts, reason);
+                remove(output_path);
+                continue;
+            }
+        }
+
+        appLog("download ok on attempt %d/%d (%lld bytes)", attempt, max_attempts,
+               expected_size > 0 ? expected_size : (long long)0);
+        if (reason_out && reason_out_size) reason_out[0] = '\0';
+        return 0;
+    }
+
+    if (reason_out && reason_out_size)
+        snprintf(reason_out, reason_out_size, "%s", reason);
+    return -1;
+}
+
 int downloadToMemory(const char *url, char **out_buf, size_t *out_len) {
     MemBuf m = { .buf = malloc(4096), .len = 0, .cap = 4096 };
     if (!m.buf) return -1;
diff --git a/source/extract.c b/source/extract.c
@@ -111,22 +111,22 @@ int extractZip(const char *zip_path, const char *dest_path,
                char *failed_out, size_t failed_out_size,
                int stage_locked_files) {
     unzFile zf = unzOpen(zip_path);
-    if (!zf) return -1;
+    if (!zf) return EXTRACT_ERR_OPEN;
 
     if (failed_out && failed_out_size > 0)
         failed_out[0] = '\0';
 
     unz_global_info gi;
     if (unzGetGlobalInfo(zf, &gi) != UNZ_OK) {
         unzClose(zf);
-        return -1;
+        return EXTRACT_ERR_INDEX;
     }
 
     int total = (int)gi.number_entry;
     char *buf = malloc(EXTRACT_BUF_SIZE);
     if (!buf) {
         unzClose(zf);
-        return -1;
+        return EXTRACT_ERR_MEMORY;
     }
 
     ensure_dir(dest_path);
diff --git a/source/firmware_mgr.c b/source/firmware_mgr.c
