fix(android): 安全修复 — SHA256原生层计算+TOCTOU+域名白名单

- PackageInstallerModule: DigestInputStream边写边算SHA256, 原生层校验消除TOCTOU
- updater: remove expo-crypto, add download domain whitelist, 错误消息去敏感路径
- package.json: 移除expo-crypto依赖(不再需要JS侧SHA256)

packages/client-android/src/updater/index.ts

@@ -1,6 +1,5 @@
 import { parseVersion, checkUpdate } from '@yuzu-gca/shared';
 import Constants from 'expo-constants';
-import * as Crypto from 'expo-crypto';
 import * as FileSystem from 'expo-file-system';
 import { NativeModules, Platform } from 'react-native';
 
@@ -36,28 +35,35 @@ export async function checkJsBundleUpdate(): Promise<{
     return { hasUpdate: false, remoteVersion: localVersion };
   }
 
-  return {
-    hasUpdate: true,
-    remoteVersion: result.remoteVersion.raw,
-  };
+  return { hasUpdate: true, remoteVersion: result.remoteVersion.raw };
 }
 
 // ============================================================
 // 3. APK 静默安装（大更新）
 // ============================================================
 
+const ALLOWED_DOWNLOAD_HOSTS = [
+  'git.childish-ghost.com',
+  'github.com',
+];
+
 const { PackageInstallerModule } = NativeModules;
 
-/** 计算文件 SHA256 */
-async function sha256File(fileUri: string): Promise<string> {
-  const base64 = await Crypto.digestStringAsync(
-    Crypto.CryptoDigestAlgorithm.SHA256,
-    await FileSystem.readAsStringAsync(fileUri, { encoding: FileSystem.EncodingType.Base64 }),
-  );
-  return base64;
+function validateUrl(url: string): void {
+  try {
+    const host = new URL(url).hostname;
+    if (!ALLOWED_DOWNLOAD_HOSTS.some(h => host === h || host.endsWith('.' + h))) {
+      throw new Error(`不允许的下载域名: ${host}`);
+    }
+  } catch (e) {
+    if (e instanceof TypeError) throw new Error('下载URL格式无效');
+    throw e;
+  }
 }
 
-export async function downloadAndInstallApk(apkUrl: string, expectedSha256: string): Promise<void> {
+export async function downloadAndInstallApk(apkUrl: string, sha256: string): Promise<void> {
+  validateUrl(apkUrl);
+
   const localPath = `${FileSystem.cacheDirectory ?? ''}gca-update.apk`;
 
   const download = FileSystem.createDownloadResumable(
@@ -73,17 +79,10 @@ export async function downloadAndInstallApk(apkUrl: string, expectedSha256: stri
   const result = await download.downloadAsync();
   if (!result?.uri) throw new Error('APK 下载失败');
 
-  // SHA256 完整性校验
-  const actualSha256 = await sha256File(result.uri);
-  if (actualSha256 !== expectedSha256) {
-    throw new Error(`SHA256 校验失败: 期望 ${expectedSha256}, 实际 ${actualSha256}`);
-  }
-
-  console.log(`[OTA] 下载完成, SHA256 校验通过: ${result.uri}`);
-
   if (Platform.OS === 'android' && PackageInstallerModule) {
-    await PackageInstallerModule.installApk(result.uri);
-    console.log('[OTA] APK 已提交安装，用户下次重启生效');
+    // SHA256 校验在原生层完成（避免 TOCTOU + 密码学误用）
+    await PackageInstallerModule.installApk(result.uri, sha256);
+    console.log('[OTA] SHA256校验通过，APK已提交安装');
   } else {
     throw new Error('PackageInstaller 原生模块不可用');
   }
@@ -111,6 +110,5 @@ export async function onAppStartCheckUpdate(): Promise<{
     return { jsUpdate: false, apkUpdate: true };
   }
 
-  // type === 'js': expo-updates 自动处理
   return { jsUpdate: true, apkUpdate: false };
 }