harden runtime packaging and verification

runtime/upgrade.js

@@ -9,6 +9,8 @@ import {
   recoverRuntimeTransactionUnlocked,
   withRuntimeLifecycleLock,
 } from "./managed-home.js";
+import { errorWithCode as upgradeError } from "./errors.js";
+import { currentIsoTimestamp as isoNow } from "./time.js";
 
 export async function stageUpgrade(options) {
   const home = path.resolve(options.home);
@@ -133,6 +135,13 @@ export async function stageUpgradeUnlocked(options) {
     } catch (error) {
       rollbackErrors.push(error);
     }
+    if (staged) {
+      try {
+        await fs.rm(destination, { recursive: true, force: true });
+      } catch (error) {
+        rollbackErrors.push(error);
+      }
+    }
     const error = upgradeError(`Upgrade ${version} failed health checks and was rolled back`, "UPGRADE_ROLLED_BACK", cause);
     if (rollbackErrors.length === 1) error.rollbackError = rollbackErrors[0];
     else if (rollbackErrors.length > 1) error.rollbackError = new AggregateError(rollbackErrors, "Runtime rollback was incomplete");
@@ -335,13 +344,3 @@ async function isRealDirectory(directory) {
 function emptyPointer() {
   return { schemaVersion: 2, status: "inactive", current: null, lastKnownGood: null };
 }
-
-function isoNow(now) {
-  return (now ? now() : new Date()).toISOString();
-}
-
-function upgradeError(message, code, cause) {
-  const error = cause === undefined ? new Error(message) : new Error(message, { cause });
-  error.code = code;
-  return error;
-}