system/nxpkg: address lifecycle review findings.

Fix real correctness/security gaps found during review, on top of the
network sync and CLI completion work:

- pkg_install(): commit the installed database before writing the
  current/previous pointer files, and before advancing transaction
  state past ACTIVATED. Those are recovery bookkeeping and convenience
  mirrors respectively - once the installed database itself is
  durably committed, a failure to refresh either one must not trigger
  the failure-cleanup path, which could otherwise delete a payload the
  database now legitimately points at. Also stop treating an existing
  version directory as newly created when reinstalling an
  already-installed version, so a failed reinstall can't delete a
  working install.

- pkg_uninstall()/pkg_rollback(): acquire the per-package install lock
  in addition to the installed-db lock, drop the entry from the
  authoritative database first, and only then remove payload files -
  a crash between those two steps can leave orphaned files, which are
  reclaimable, but never leaves the database pointing at a payload
  that's already gone.

- pkg_sync(): stage each sync to a PID-qualified temp filename instead
  of a single fixed name, so concurrent sync calls can no longer race
  on the same staging file. Return real negative errno codes instead
  of EXIT_SUCCESS/EXIT_FAILURE, matching the rest of this API; pkg_main.c
  maps that back to a process exit code at the CLI boundary.

- pkg_metadata_parse_installed_entry(): validate that name/current/
  previous/every entry in versions[] are safe path components, and that
  current (and previous, if set) actually appear in versions[] - a
  corrupted or tampered installed-packages database can no longer
  reference a nonexistent version or smuggle a path-traversal sequence
  through a field this code already trusted implicitly.

- pkg_store_write_all()/pkg_repo_sink(): treat a zero-byte write() as
  -EIO instead of looping on it silently.

- Removed the malloc()-falls-back-to-kmm_malloc() logic in pkg_malloc/
  pkg_zalloc/pkg_realloc/pkg_free entirely - it required tracking which
  allocator owned a given pointer via kmm_heapmember(), which is
  specific to this target's flat, single-heap memory model and not a
  sound general application API. These are now plain wrappers around
  malloc/calloc/realloc/free.

- Added pkg_metadata_load_manifest_path(), so a caller (e.g. the
  nxstore GUI frontend, launching an installed package) can load the
  manifest actually recorded for a specific installed version, instead
  of combining a rollback-selected version with whatever the current
  catalog happens to describe for that package name - those can
  disagree after a rollback if the catalog has since moved on.

- Storage root default changed from /tmp/nxpkg to /var/lib/nxpkg,
  following the conventional persistent application-data location
  instead of a path whose own name suggests non-persistent storage. A
  board without persistent storage mounted at /var, or that wants a
  different location (e.g. an SD card), still overrides this via
  CONFIG_SYSTEM_NXPKG_ROOT as before.

- Moved system/nxpkg/README.txt into the companion NuttX documentation
  PR rather than shipping user-facing documentation as an in-tree
  README.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: aviralgarg05 <gargaviral99@gmail.com>

Author: aviralgarg05

system/nxpkg/Kconfig

@@ -31,11 +31,13 @@ config SYSTEM_NXPKG_STACKSIZE
 
 config SYSTEM_NXPKG_ROOT
 	string "'nxpkg' storage root"
-	default "/tmp/nxpkg"
+	default "/var/lib/nxpkg"
 	---help---
 		Base directory used by nxpkg for its local index, installed
 		metadata, temporary downloads, and package payload storage.
-		Boards with external storage can point this to a persistent
-		location such as /mnt/sdcard/nxpkg.
+		The default follows the conventional persistent application-data
+		location.  A board must mount persistent storage at /var or set
+		this to another persistent location, such as /mnt/sdcard/nxpkg,
+		if packages need to survive a reset.
 
 endif

system/nxpkg/README.txt

@@ -35,8 +35,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include <nuttx/kmalloc.h>
-
 /****************************************************************************
  * Pre-processor Definitions
  ****************************************************************************/
@@ -58,14 +56,9 @@
 #define PKG_CATEGORY_MAX      31
 #define PKG_HASH_HEX_LEN      64
 /* Each manifest slot is ~1.7KB (dominated by PKG_LAUNCH_ARGS_MAX slots).
- * This used to be 6 to fit inside a static internal-DRAM array, but the
- * catalog outgrew that once it held every real GSoC package (calc, the
- * four games, NXDoom, and the original examples) - system/nxstore/
- * nxstore_main.c now heap-allocates its struct pkg_index_s g_index via
- * pkg_zalloc(), which draws from the PSRAM-backed user heap on this board
- * (CONFIG_ESP32S3_SPIRAM_USER_HEAP) instead of internal DRAM, so this can
- * grow without the same pressure.  Still not unbounded: keep it sized for
- * "a real catalog", not arbitrary attacker-controlled growth.
+ * Keep the catalog bounded so repository-provided metadata cannot cause
+ * unbounded memory use.  Callers should allocate struct pkg_index_s from
+ * the application heap rather than placing it on a small task stack.
  */
 
 #define PKG_INDEX_MAX         16
@@ -99,72 +92,22 @@
 
 static inline void *pkg_malloc(size_t size)
 {
-  void *ptr = malloc(size);
-
-  if (ptr == NULL)
-    {
-      ptr = kmm_malloc(size);
-    }
-
-  return ptr;
+  return malloc(size);
 }
 
 static inline void *pkg_zalloc(size_t size)
 {
-  void *ptr = calloc(1, size);
-
-  if (ptr == NULL)
-    {
-      ptr = kmm_zalloc(size);
-    }
-
-  return ptr;
+  return calloc(1, size);
 }
 
 static inline void *pkg_realloc(void *ptr, size_t size)
 {
-  if (ptr == NULL)
-    {
-      return pkg_malloc(size);
-    }
-
-  if (size == 0)
-    {
-      if (kmm_heapmember(ptr))
-        {
-          kmm_free(ptr);
-        }
-      else
-        {
-          free(ptr);
-        }
-
-      return NULL;
-    }
-
-  if (kmm_heapmember(ptr))
-    {
-      return kmm_realloc(ptr, size);
-    }
-
   return realloc(ptr, size);
 }
 
 static inline void pkg_free(void *ptr)
 {
-  if (ptr == NULL)
-    {
-      return;
-    }
-
-  if (kmm_heapmember(ptr))
-    {
-      kmm_free(ptr);
-    }
-  else
-    {
-      free(ptr);
-    }
+  free(ptr);
 }
 
 static inline FAR char *pkg_path_alloc(void)
@@ -241,6 +184,7 @@ struct pkg_installed_db_s
 
 const char *pkg_manifest_type_str(enum pkg_payload_type_e type);
 int pkg_manifest_validate(FAR const struct pkg_manifest_s *manifest);
+bool pkg_validate_path_component(FAR const char *value);
 int pkg_manifest_parse_type(FAR const char *value,
                             FAR enum pkg_payload_type_e *type);
 
@@ -291,6 +235,8 @@ int pkg_hash_file_sha256(FAR const char *path,
 int pkg_metadata_load_index_path(FAR const char *path,
                                  FAR struct pkg_index_s *index);
 int pkg_metadata_load_index(FAR struct pkg_index_s *index);
+int pkg_metadata_load_manifest_path(FAR const char *path,
+                                    FAR struct pkg_manifest_s *manifest);
 FAR const struct pkg_manifest_s *
 pkg_metadata_find_latest(FAR const struct pkg_index_s *index,
                          FAR const char *name);