@bravemobile/react-native-code-push 12.3.2 → 12.4.0

package/CodePush.podspec

@@ -22,6 +22,4 @@ Pod::Spec.new do |s|
   # linked properly at a parent workspace level.
   s.dependency 'React-Core'
   s.dependency 'SSZipArchive', '~> 2.5.5'
-  s.dependency 'JWT', '~> 3.0.0-beta.12'
-  s.dependency 'Base64', '~> 1.1'
 end

package/README.md

@@ -8,7 +8,7 @@
 
 ### 🚀 New Architecture support
 
-Supports React Native 0.74 ~ 0.84.
+Supports React Native 0.77 ~ 0.84.
 
 > [!NOTE]
 > If you are using React Native 0.76 or lower, please use version `12.0.2` of this library.
@@ -17,7 +17,7 @@ Supports React Native 0.74 ~ 0.84.
 
 ### ✅ Requirements
 
-- **React Native**: 0.74 or higher
+- **React Native**: 0.77 or higher
 - **iOS**: 15.5 or higher
 - **Android**: API level 16 or higher
 
@@ -397,6 +397,8 @@ module.exports = Config;
 
 > [!TIP]
 > You can use `--help` command to see the available commands and options.
+>
+> For detailed documentation, see the [CLI README](cli/README.md) ([한국어](cli/README.ko.md)).
 
 (interactive mode not supported yet)
 

package/android/app/build.gradle

@@ -29,5 +29,4 @@ android {
 
 dependencies {
     implementation "com.facebook.react:react-native:+"
-    implementation 'com.nimbusds:nimbus-jose-jwt:9.37.3'
 }

package/android/app/src/main/java/com/microsoft/codepush/react/CodePush.java

@@ -3,10 +3,8 @@ package com.microsoft.codepush.react;
 import android.content.Context;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
-import android.content.res.Resources;
 
 import com.facebook.react.ReactPackage;
-import com.facebook.react.bridge.JavaScriptModule;
 import com.facebook.react.bridge.NativeModule;
 import com.facebook.react.bridge.ReactApplicationContext;
 import com.facebook.react.uimanager.ViewManager;
@@ -40,8 +38,6 @@ public class CodePush implements ReactPackage {
     private Context mContext;
     private final boolean mIsDebugMode;
 
-    private static String mPublicKey;
-
     private static CodePush mCurrentInstance;
 
     public static String getServiceUrl() {
@@ -75,33 +71,12 @@ public class CodePush implements ReactPackage {
 
         mCurrentInstance = this;
 
-        String publicKeyFromStrings = getCustomPropertyFromStringsIfExist("PublicKey");
-        if (publicKeyFromStrings != null) mPublicKey = publicKeyFromStrings;
-
         String serverUrlFromStrings = getCustomPropertyFromStringsIfExist("ServerUrl");
         if (serverUrlFromStrings != null) mServerUrl = serverUrlFromStrings;
 
         initializeUpdateAfterRestart();
     }
 
-    private String getPublicKeyByResourceDescriptor(int publicKeyResourceDescriptor){
-        String publicKey;
-        try {
-            publicKey = mContext.getString(publicKeyResourceDescriptor);
-        } catch (Resources.NotFoundException e) {
-            throw new CodePushInvalidPublicKeyException(
-                    "Unable to get public key, related resource descriptor " +
-                            publicKeyResourceDescriptor +
-                            " can not be found", e
-            );
-        }
-
-        if (publicKey.isEmpty()) {
-            throw new CodePushInvalidPublicKeyException("Specified public key is empty");
-        }
-        return publicKey;
-    }
-
     private String getCustomPropertyFromStringsIfExist(String propertyName) {
         String property;
 
@@ -133,10 +108,6 @@ public class CodePush implements ReactPackage {
         return mAssetsBundleFileName;
     }
 
-    public String getPublicKey() {
-        return mPublicKey;
-    }
-
     public String getPackageFolder() {
         JSONObject codePushLocalPackage = mUpdateManager.getCurrentPackage();
         if (codePushLocalPackage == null) {
@@ -338,12 +309,6 @@ public class CodePush implements ReactPackage {
         nativeModules.add(dialogModule);
         return nativeModules;
     }
-
-    // Deprecated in RN v0.47.
-    public List<Class<? extends JavaScriptModule>> createJSModules() {
-        return new ArrayList<>();
-    }
-
     @Override
     public List<ViewManager> createViewManagers(ReactApplicationContext reactApplicationContext) {
         return new ArrayList<>();

package/android/app/src/main/java/com/microsoft/codepush/react/CodePushConstants.java

@@ -24,7 +24,6 @@ public class CodePushConstants {
     public static final String RELATIVE_BUNDLE_PATH_KEY = "bundlePath";
     public static final String STATUS_FILE = "codepush.json";
     public static final String UNZIPPED_FOLDER_NAME = "unzipped";
-    public static final String BUNDLE_JWT_FILE = ".codepushrelease";
     public static final String LATEST_ROLLBACK_INFO_KEY = "LATEST_ROLLBACK_INFO";
     public static final String LATEST_ROLLBACK_PACKAGE_HASH_KEY = "packageHash";
     public static final String LATEST_ROLLBACK_TIME_KEY = "time";

package/android/app/src/main/java/com/microsoft/codepush/react/CodePushNativeModule.java

@@ -384,7 +384,7 @@ public class CodePushNativeModule extends ReactContextBaseJavaModule {
                                     .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter.class)
                                     .emit(CodePushConstants.DOWNLOAD_PROGRESS_EVENT_NAME, latestDownloadProgress.createWritableMap());
                         }
-                    }, mCodePush.getPublicKey());
+                    });
 
                     JSONObject newPackage = mUpdateManager.getPackage(CodePushUtils.tryGetString(updatePackage, CodePushConstants.PACKAGE_HASH_KEY));
                     promise.resolve(CodePushUtils.convertJsonObjectToWritable(newPackage));

package/android/app/src/main/java/com/microsoft/codepush/react/CodePushUpdateManager.java

@@ -144,8 +144,7 @@ public class CodePushUpdateManager {
     }
 
     public void downloadPackage(JSONObject updatePackage, String expectedBundleFileName,
-                                DownloadProgressCallback progressCallback,
-                                String stringPublicKey) throws IOException {
+                                DownloadProgressCallback progressCallback) throws IOException {
         String newUpdateHash = updatePackage.optString(CodePushConstants.PACKAGE_HASH_KEY, null);
         String newUpdateFolderPath = getPackageFolderPath(newUpdateHash);
         String newUpdateMetadataPath = CodePushUtils.appendPathComponent(newUpdateFolderPath, CodePushConstants.PACKAGE_FILE_NAME);
@@ -266,32 +265,6 @@ public class CodePushUpdateManager {
                 }
 
                 CodePushUpdateUtils.verifyFolderHash(newUpdateFolderPath, newUpdateHash);
-
-                boolean isSignatureVerificationEnabled = (stringPublicKey != null);
-
-                String signaturePath = CodePushUpdateUtils.getSignatureFilePath(newUpdateFolderPath);
-                boolean isSignatureAppearedInBundle = FileUtils.fileAtPathExists(signaturePath);
-
-                if (isSignatureVerificationEnabled) {
-                    if (isSignatureAppearedInBundle) {
-                        CodePushUpdateUtils.verifyUpdateSignature(newUpdateFolderPath, newUpdateHash, stringPublicKey);
-                    } else {
-                        throw new CodePushInvalidUpdateException(
-                                "Error! Public key was provided but there is no JWT signature within app bundle to verify. " +
-                                "Possible reasons, why that might happen: \n" +
-                                "1. You've been released CodePush bundle update using version of CodePush CLI that is not support code signing.\n" +
-                                "2. You've been released CodePush bundle update without providing --privateKeyPath option."
-                        );
-                    }
-                } else {
-                    if (isSignatureAppearedInBundle) {
-                        CodePushUtils.log(
-                                "Warning! JWT signature exists in codepush update but code integrity check couldn't be performed because there is no public key configured. " +
-                                "Please ensure that public key is properly configured within your application."
-                        );
-                    }
-                }
-
                 CodePushUtils.setJSONValueForKey(updatePackage, CodePushConstants.RELATIVE_BUNDLE_PATH_KEY, relativeBundlePath);
             }
         } else {

package/android/app/src/main/java/com/microsoft/codepush/react/CodePushUpdateUtils.java

@@ -1,13 +1,6 @@
 package com.microsoft.codepush.react;
 
 import android.content.Context;
-import android.util.Base64;
-
-import com.nimbusds.jose.JWSVerifier;
-import com.nimbusds.jose.crypto.RSASSAVerifier;
-import com.nimbusds.jwt.SignedJWT;
-
-import java.security.interfaces.*;
 
 import org.json.JSONArray;
 import org.json.JSONException;
@@ -20,14 +13,10 @@ import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.InputStream;
 import java.security.DigestInputStream;
-import java.security.KeyFactory;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.security.PublicKey;
-import java.security.spec.X509EncodedKeySpec;
 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.Map;
 
 public class CodePushUpdateUtils {
 
@@ -38,13 +27,10 @@ public class CodePushUpdateUtils {
     public static boolean isHashIgnored(String relativeFilePath) {
         final String __MACOSX = "__MACOSX/";
         final String DS_STORE = ".DS_Store";
-        final String CODEPUSH_METADATA = ".codepushrelease";
 
         return relativeFilePath.startsWith(__MACOSX)
                 || relativeFilePath.equals(DS_STORE)
-                || relativeFilePath.endsWith("/" + DS_STORE)
-                || relativeFilePath.equals(CODEPUSH_METADATA)
-                || relativeFilePath.endsWith("/" + CODEPUSH_METADATA);
+                || relativeFilePath.endsWith("/" + DS_STORE);
     }
 
     private static void addContentsOfFolderToManifest(String folderPath, String pathPrefix, ArrayList<String> manifest) {
@@ -183,88 +169,4 @@ public class CodePushUpdateUtils {
         CodePushUtils.log("The update contents succeeded the data integrity check.");
     }
 
-    public static Map<String, Object> verifyAndDecodeJWT(String jwt, PublicKey publicKey) {
-        try {
-            SignedJWT signedJWT = SignedJWT.parse(jwt);
-            JWSVerifier verifier = new RSASSAVerifier((RSAPublicKey) publicKey);
-            if (signedJWT.verify(verifier)) {
-                Map<String, Object> claims = signedJWT.getJWTClaimsSet().getClaims();
-                CodePushUtils.log("JWT verification succeeded, payload content: " + claims.toString());
-                return claims;
-            }
-            return null;
-        } catch (Exception ex) {
-            CodePushUtils.log(ex.getMessage());
-            CodePushUtils.log(ex.getStackTrace().toString());
-            return null;
-        }
-    }
-
-    public static PublicKey parsePublicKey(String stringPublicKey) {
-        try {
-            //remove unnecessary "begin/end public key" entries from string
-            stringPublicKey = stringPublicKey
-                    .replace("-----BEGIN PUBLIC KEY-----", "")
-                    .replace("-----END PUBLIC KEY-----", "")
-                    .replace(NEW_LINE, "");
-            byte[] byteKey = Base64.decode(stringPublicKey.getBytes(), Base64.DEFAULT);
-            X509EncodedKeySpec X509Key = new X509EncodedKeySpec(byteKey);
-            KeyFactory kf = KeyFactory.getInstance("RSA");
-
-            return kf.generatePublic(X509Key);
-        } catch (Exception e) {
-            CodePushUtils.log(e.getMessage());
-            CodePushUtils.log(e.getStackTrace().toString());
-            return null;
-        }
-    }
-
-    public static String getSignatureFilePath(String updateFolderPath) {
-        return CodePushUtils.appendPathComponent(
-                CodePushUtils.appendPathComponent(updateFolderPath, CodePushConstants.CODE_PUSH_FOLDER_PREFIX),
-                CodePushConstants.BUNDLE_JWT_FILE
-        );
-    }
-
-    public static String getSignature(String folderPath) {
-        final String signatureFilePath = getSignatureFilePath(folderPath);
-
-        try {
-            return FileUtils.readFileToString(signatureFilePath);
-        } catch (IOException e) {
-            CodePushUtils.log(e.getMessage());
-            CodePushUtils.log(e.getStackTrace().toString());
-            return null;
-        }
-    }
-
-    public static void verifyUpdateSignature(String folderPath, String packageHash, String stringPublicKey) throws CodePushInvalidUpdateException {
-        CodePushUtils.log("Verifying signature for folder path: " + folderPath);
-
-        final PublicKey publicKey = parsePublicKey(stringPublicKey);
-        if (publicKey == null) {
-            throw new CodePushInvalidUpdateException("The update could not be verified because no public key was found.");
-        }
-
-        final String signature = getSignature(folderPath);
-        if (signature == null) {
-            throw new CodePushInvalidUpdateException("The update could not be verified because no signature was found.");
-        }
-
-        final Map<String, Object> claims = verifyAndDecodeJWT(signature, publicKey);
-        if (claims == null) {
-            throw new CodePushInvalidUpdateException("The update could not be verified because it was not signed by a trusted party.");
-        }
-
-        final String contentHash = (String) claims.get("contentHash");
-        if (contentHash == null) {
-            throw new CodePushInvalidUpdateException("The update could not be verified because the signature did not specify a content hash.");
-        }
-
-        if (!contentHash.equals(packageHash)) {
-            throw new CodePushInvalidUpdateException("The update contents failed the code signing check.");
-        }
-
-        CodePushUtils.log("The update contents succeeded the code signing check.");
-    }
 }

package/cli/commands/bundleCommand/bundleCodePush.ts

@@ -1,4 +1,5 @@
 import fs from "fs";
+import path from "path";
 import { prepareToBundleJS } from "../../functions/prepareToBundleJS.js";
 import { runReactNativeBundleCommand } from "../../functions/runReactNativeBundleCommand.js";
 import { runExpoBundleCommand } from "../../functions/runExpoBundleCommand.js";
@@ -17,6 +18,7 @@ export async function bundleCodePush(
   entryFile: string = ENTRY_FILE,
   jsBundleName: string, // JS bundle file name (not CodePush bundle file)
   bundleDirectory: string, // CodePush bundle output directory
+  outputMetroDir?: string,
 ): Promise<string> {
     if (fs.existsSync(outputRootPath)) {
         fs.rmSync(outputRootPath, { recursive: true });
@@ -49,6 +51,8 @@ export async function bundleCodePush(
 
     console.log('log: JS bundling complete');
 
+    copyMetroOutputsIfNeeded(outputRootPath, outputMetroDir, OUTPUT_CONTENT_PATH, _jsBundleName, SOURCEMAP_OUTPUT);
+
     await runHermesEmitBinaryCommand(
       _jsBundleName,
       OUTPUT_CONTENT_PATH,
@@ -61,3 +65,28 @@ export async function bundleCodePush(
 
     return codePushBundleFileName;
 }
+
+function copyMetroOutputsIfNeeded(
+  outputRootPath: string,
+  outputMetroDir: string | undefined,
+  outputContentPath: string,
+  jsBundleName: string,
+  sourceMapOutputPath: string,
+) {
+    if (!outputMetroDir) {
+        return;
+    }
+
+    const resolvedOutputMetroDir = path.join(outputRootPath, outputMetroDir);
+
+    fs.mkdirSync(resolvedOutputMetroDir, { recursive: true });
+    fs.copyFileSync(
+        path.join(outputContentPath, jsBundleName),
+        path.join(resolvedOutputMetroDir, jsBundleName),
+    );
+    fs.copyFileSync(
+        sourceMapOutputPath,
+        path.join(resolvedOutputMetroDir, path.basename(sourceMapOutputPath)),
+    );
+    console.log(`log: Metro outputs copied to: ${resolvedOutputMetroDir}`);
+}

package/cli/commands/bundleCommand/index.ts

@@ -9,6 +9,7 @@ type Options = {
     entryFile: string;
     bundleName: string;
     outputBundleDir: string;
+    outputMetroDir?: string;
 }
 
 program.command('bundle')
@@ -18,6 +19,7 @@ program.command('bundle')
     .option('-o, --output-path <string>', 'path to output root directory', ROOT_OUTPUT_DIR)
     .option('-e, --entry-file <string>', 'path to JS/TS entry file', ENTRY_FILE)
     .option('-b, --bundle-name <string>', 'bundle file name (default-ios: "main.jsbundle" / default-android: "index.android.bundle")')
+    .option('--output-metro-dir <string>', 'name of directory to copy the Metro JS bundle and sourcemap before Hermes compilation')
     .option('--output-bundle-dir <string>', 'name of directory containing the bundle file created by the "bundle" command', OUTPUT_BUNDLE_DIR)
     .action((options: Options) => {
         bundleCodePush(
@@ -27,5 +29,6 @@ program.command('bundle')
             options.entryFile,
             options.bundleName,
             `${options.outputPath}/${options.outputBundleDir}`,
+            options.outputMetroDir,
         )
     });

package/cli/commands/releaseCommand/index.ts

@@ -19,6 +19,7 @@ type Options = {
     skipBundle: boolean;
     skipCleanup: boolean;
     outputBundleDir: string;
+    outputMetroDir?: string;
     hashCalc?: boolean;
 }
 
@@ -39,6 +40,7 @@ program.command('release')
     .option('--skip-bundle <bool>', 'skip bundle process', parseBoolean, false)
     .option('--hash-calc <bool>', 'calculates the bundle file hash used for packageHash in the release history (Requires setting --skip-bundle to true)', parseBoolean)
     .option('--skip-cleanup <bool>', 'skip cleanup process', parseBoolean, false)
+    .option('--output-metro-dir <string>', 'name of directory to copy the Metro JS bundle and sourcemap before Hermes compilation')
     .option('--output-bundle-dir <string>', 'name of directory containing the bundle file created by the "bundle" command', OUTPUT_BUNDLE_DIR)
     .action(async (options: Options) => {
         const config = findAndReadConfigFile(process.cwd(), options.config);
@@ -71,6 +73,7 @@ program.command('release')
             options.skipBundle,
             options.skipCleanup,
             `${options.outputPath}/${options.outputBundleDir}`,
+            options.outputMetroDir,
             options.hashCalc,
         )
 

package/cli/commands/releaseCommand/release.ts

@@ -24,11 +24,12 @@ export async function release(
     skipBundle: boolean,
     skipCleanup: boolean,
     bundleDirectory: string,
+    outputMetroDir?: string,
     hashCalc?: boolean,
 ): Promise<void> {
     const bundleFileName = skipBundle
         ? readBundleFileNameFrom(bundleDirectory)
-        : await bundleCodePush(framework, platform, outputPath, entryFile, jsBundleName, bundleDirectory);
+        : await bundleCodePush(framework, platform, outputPath, entryFile, jsBundleName, bundleDirectory, outputMetroDir);
     const bundleFilePath = `${bundleDirectory}/${bundleFileName}`;
 
     const packageHash = await (() => {

package/cli/dist/commands/bundleCommand/bundleCodePush.js

@@ -1,4 +1,5 @@
 import fs from "fs";
+import path from "path";
 import { prepareToBundleJS } from "../../functions/prepareToBundleJS.js";
 import { runReactNativeBundleCommand } from "../../functions/runReactNativeBundleCommand.js";
 import { runExpoBundleCommand } from "../../functions/runExpoBundleCommand.js";
@@ -10,7 +11,8 @@ import { ROOT_OUTPUT_DIR, ENTRY_FILE } from "../../constant.js";
  * @return {Promise<string>} CodePush bundle file name (equals to packageHash)
  */
 export async function bundleCodePush(framework, platform = 'ios', outputRootPath = ROOT_OUTPUT_DIR, entryFile = ENTRY_FILE, jsBundleName, // JS bundle file name (not CodePush bundle file)
-bundleDirectory) {
+bundleDirectory, // CodePush bundle output directory
+outputMetroDir) {
     if (fs.existsSync(outputRootPath)) {
         fs.rmSync(outputRootPath, { recursive: true });
     }
@@ -26,9 +28,20 @@ bundleDirectory) {
         runReactNativeBundleCommand(_jsBundleName, OUTPUT_CONTENT_PATH, platform, SOURCEMAP_OUTPUT, entryFile);
     }
     console.log('log: JS bundling complete');
+    copyMetroOutputsIfNeeded(outputRootPath, outputMetroDir, OUTPUT_CONTENT_PATH, _jsBundleName, SOURCEMAP_OUTPUT);
     await runHermesEmitBinaryCommand(_jsBundleName, OUTPUT_CONTENT_PATH, SOURCEMAP_OUTPUT);
     console.log('log: Hermes compilation complete');
     const { bundleFileName: codePushBundleFileName } = await makeCodePushBundle(OUTPUT_CONTENT_PATH, bundleDirectory);
     console.log(`log: CodePush bundle created (file path: ./${bundleDirectory}/${codePushBundleFileName})`);
     return codePushBundleFileName;
 }
+function copyMetroOutputsIfNeeded(outputRootPath, outputMetroDir, outputContentPath, jsBundleName, sourceMapOutputPath) {
+    if (!outputMetroDir) {
+        return;
+    }
+    const resolvedOutputMetroDir = path.join(outputRootPath, outputMetroDir);
+    fs.mkdirSync(resolvedOutputMetroDir, { recursive: true });
+    fs.copyFileSync(path.join(outputContentPath, jsBundleName), path.join(resolvedOutputMetroDir, jsBundleName));
+    fs.copyFileSync(sourceMapOutputPath, path.join(resolvedOutputMetroDir, path.basename(sourceMapOutputPath)));
+    console.log(`log: Metro outputs copied to: ${resolvedOutputMetroDir}`);
+}

package/cli/dist/commands/bundleCommand/index.js

@@ -8,7 +8,8 @@ program.command('bundle')
     .option('-o, --output-path <string>', 'path to output root directory', ROOT_OUTPUT_DIR)
     .option('-e, --entry-file <string>', 'path to JS/TS entry file', ENTRY_FILE)
     .option('-b, --bundle-name <string>', 'bundle file name (default-ios: "main.jsbundle" / default-android: "index.android.bundle")')
+    .option('--output-metro-dir <string>', 'name of directory to copy the Metro JS bundle and sourcemap before Hermes compilation')
     .option('--output-bundle-dir <string>', 'name of directory containing the bundle file created by the "bundle" command', OUTPUT_BUNDLE_DIR)
     .action((options) => {
-    bundleCodePush(options.framework, options.platform, options.outputPath, options.entryFile, options.bundleName, `${options.outputPath}/${options.outputBundleDir}`);
+    bundleCodePush(options.framework, options.platform, options.outputPath, options.entryFile, options.bundleName, `${options.outputPath}/${options.outputBundleDir}`, options.outputMetroDir);
 });

package/cli/dist/commands/releaseCommand/index.js

@@ -19,6 +19,7 @@ program.command('release')
     .option('--skip-bundle <bool>', 'skip bundle process', parseBoolean, false)
     .option('--hash-calc <bool>', 'calculates the bundle file hash used for packageHash in the release history (Requires setting --skip-bundle to true)', parseBoolean)
     .option('--skip-cleanup <bool>', 'skip cleanup process', parseBoolean, false)
+    .option('--output-metro-dir <string>', 'name of directory to copy the Metro JS bundle and sourcemap before Hermes compilation')
     .option('--output-bundle-dir <string>', 'name of directory containing the bundle file created by the "bundle" command', OUTPUT_BUNDLE_DIR)
     .action(async (options) => {
     const config = findAndReadConfigFile(process.cwd(), options.config);
@@ -30,7 +31,7 @@ program.command('release')
         console.error('--hash-calc option can be used only when --skip-bundle is set to true.');
         process.exit(1);
     }
-    await release(config.bundleUploader, config.getReleaseHistory, config.setReleaseHistory, options.binaryVersion, options.appVersion, options.framework, options.platform, options.identifier, options.outputPath, options.entryFile, options.bundleName, options.mandatory, options.enable, options.rollout, options.skipBundle, options.skipCleanup, `${options.outputPath}/${options.outputBundleDir}`, options.hashCalc);
+    await release(config.bundleUploader, config.getReleaseHistory, config.setReleaseHistory, options.binaryVersion, options.appVersion, options.framework, options.platform, options.identifier, options.outputPath, options.entryFile, options.bundleName, options.mandatory, options.enable, options.rollout, options.skipBundle, options.skipCleanup, `${options.outputPath}/${options.outputBundleDir}`, options.outputMetroDir, options.hashCalc);
     console.log('🚀 Release completed.');
 });
 function parseBoolean(value) {

package/cli/dist/commands/releaseCommand/release.js

@@ -4,10 +4,10 @@ import { bundleCodePush } from "../bundleCommand/bundleCodePush.js";
 import { addToReleaseHistory } from "./addToReleaseHistory.js";
 import { generatePackageHashFromDirectory } from "../../utils/hash-utils.js";
 import { unzip } from "../../utils/unzip.js";
-export async function release(bundleUploader, getReleaseHistory, setReleaseHistory, binaryVersion, appVersion, framework, platform, identifier, outputPath, entryFile, jsBundleName, mandatory, enable, rollout, skipBundle, skipCleanup, bundleDirectory, hashCalc) {
+export async function release(bundleUploader, getReleaseHistory, setReleaseHistory, binaryVersion, appVersion, framework, platform, identifier, outputPath, entryFile, jsBundleName, mandatory, enable, rollout, skipBundle, skipCleanup, bundleDirectory, outputMetroDir, hashCalc) {
     const bundleFileName = skipBundle
         ? readBundleFileNameFrom(bundleDirectory)
-        : await bundleCodePush(framework, platform, outputPath, entryFile, jsBundleName, bundleDirectory);
+        : await bundleCodePush(framework, platform, outputPath, entryFile, jsBundleName, bundleDirectory, outputMetroDir);
     const bundleFilePath = `${bundleDirectory}/${bundleFileName}`;
     const packageHash = await (() => {
         if (skipBundle && hashCalc) {

package/cli/dist/utils/hash-utils.js

@@ -48,12 +48,9 @@ class PackageManifest {
     static isIgnored(relativeFilePath) {
         const __MACOSX = '__MACOSX/';
         const DS_STORE = '.DS_Store';
-        const CODEPUSH_METADATA = '.codepushrelease';
         return (relativeFilePath.startsWith(__MACOSX) ||
             relativeFilePath === DS_STORE ||
-            relativeFilePath.endsWith('/' + DS_STORE) ||
-            relativeFilePath === CODEPUSH_METADATA ||
-            relativeFilePath.endsWith('/' + CODEPUSH_METADATA));
+            relativeFilePath.endsWith('/' + DS_STORE));
     }
 }
 export async function generatePackageHashFromDirectory(directoryPath, basePath) {

package/cli/utils/hash-utils.ts

@@ -61,13 +61,10 @@ class PackageManifest {
     static isIgnored(relativeFilePath: string): boolean {
         const __MACOSX = '__MACOSX/';
         const DS_STORE = '.DS_Store';
-        const CODEPUSH_METADATA = '.codepushrelease';
         return (
             relativeFilePath.startsWith(__MACOSX) ||
             relativeFilePath === DS_STORE ||
-            relativeFilePath.endsWith('/' + DS_STORE) ||
-            relativeFilePath === CODEPUSH_METADATA ||
-            relativeFilePath.endsWith('/' + CODEPUSH_METADATA)
+            relativeFilePath.endsWith('/' + DS_STORE)
         );
     }
 }

package/ios/CodePush/CodePush.h

@@ -102,7 +102,6 @@
 @property (readonly) NSDictionary *configuration;
 @property (copy) NSString *deploymentKey;
 @property (copy) NSString *serverURL;
-@property (copy) NSString *publicKey;
 
 + (instancetype)current;
 
@@ -140,7 +139,6 @@ failCallback:(void (^)(NSError *err))failCallback;
 
 + (void)downloadPackage:(NSDictionary *)updatePackage
  expectedBundleFileName:(NSString *)expectedBundleFileName
-              publicKey:(NSString *)publicKey
          operationQueue:(dispatch_queue_t)operationQueue
        progressCallback:(void (^)(long long, long long))progressCallback
            doneCallback:(void (^)())doneCallback
@@ -203,20 +201,6 @@ failCallback:(void (^)(NSError *err))failCallback;
                    expectedHash:(NSString *)expectedHash
                           error:(NSError **)error;
 
-// remove BEGIN / END tags and line breaks from public key string
-+ (NSString *)getKeyValueFromPublicKeyString:(NSString *)publicKeyString;
-
-+ (NSString *)getSignatureFilePath:(NSString *)updateFolderPath;
-
-+ (NSDictionary *) verifyAndDecodeJWT:(NSString *) jwt
-               withPublicKey:(NSString *)publicKey
-                       error:(NSError **)error;
-
-+ (BOOL)verifyUpdateSignatureFor:(NSString *)updateFolderPath
-                    expectedHash:(NSString *)newUpdateHash
-                   withPublicKey:(NSString *)publicKeyString
-                           error:(NSError **)error;
-
 @end
 
 void CPLog(NSString *formatString, ...);

package/ios/CodePush/CodePush.m

@@ -1,4 +1,3 @@
-#if __has_include(<React/RCTAssert.h>)
 #import <React/RCTAssert.h>
 #import <React/RCTBridgeModule.h>
 #import <React/RCTConvert.h>
@@ -6,14 +5,6 @@
 #import <React/RCTRootView.h>
 #import <React/RCTUtils.h>
 #import <React/RCTReloadCommand.h>
-#else // back compatibility for RN version < 0.40
-#import "RCTAssert.h"
-#import "RCTBridgeModule.h"
-#import "RCTConvert.h"
-#import "RCTEventDispatcher.h"
-#import "RCTRootView.h"
-#import "RCTUtils.h"
-#endif
 
 #import "CodePush.h"
 
@@ -740,12 +731,9 @@ RCT_EXPORT_METHOD(downloadUpdate:(NSDictionary*)updatePackage
         _lastProgressEventTime = 0;
     }
 
-    NSString * publicKey = [[CodePushConfig current] publicKey];
-
     [CodePushPackage
         downloadPackage:mutableUpdatePackage
         expectedBundleFileName:[bundleResourceName stringByAppendingPathExtension:bundleResourceExtension]
-        publicKey:publicKey
         operationQueue:_methodQueue
         // The download is progressing forward
         progressCallback:^(long long expectedContentLength, long long receivedContentLength) {

package/ios/CodePush/CodePushConfig.m

@@ -12,7 +12,6 @@ static NSString * const BuildVersionConfigKey = @"buildVersion";
 static NSString * const ClientUniqueIDConfigKey = @"clientUniqueId";
 static NSString * const DeploymentKeyConfigKey = @"deploymentKey";
 static NSString * const ServerURLConfigKey = @"serverUrl";
-static NSString * const PublicKeyKey = @"publicKey";
 
 + (instancetype)current
 {
@@ -35,7 +34,6 @@ static NSString * const PublicKeyKey = @"publicKey";
     NSString *buildVersion = [infoDictionary objectForKey:(NSString *)kCFBundleVersionKey];
     NSString *deploymentKey = [infoDictionary objectForKey:@"CodePushDeploymentKey"];
     NSString *serverURL = [infoDictionary objectForKey:@"CodePushServerURL"];
-    NSString *publicKey = [infoDictionary objectForKey:@"CodePushPublicKey"];
 
     NSUserDefaults *userDefaults = [NSUserDefaults standardUserDefaults];
     NSString *clientUniqueId = [userDefaults stringForKey:ClientUniqueIDConfigKey];
@@ -56,7 +54,6 @@ static NSString * const PublicKeyKey = @"publicKey";
     if (serverURL) [_configDictionary setObject:serverURL forKey:ServerURLConfigKey];
     if (clientUniqueId) [_configDictionary setObject:clientUniqueId forKey:ClientUniqueIDConfigKey];
     if (deploymentKey) [_configDictionary setObject:deploymentKey forKey:DeploymentKeyConfigKey];
-    if (publicKey) [_configDictionary setObject:publicKey forKey:PublicKeyKey];
 
     return self;
 }
@@ -91,11 +88,6 @@ static NSString * const PublicKeyKey = @"publicKey";
     return [_configDictionary objectForKey:ClientUniqueIDConfigKey];
 }
 
-- (NSString *)publicKey
-{
-    return [_configDictionary objectForKey:PublicKeyKey];
-}
-
 - (void)setAppVersion:(NSString *)appVersion
 {
     [_configDictionary setValue:appVersion forKey:AppVersionConfigKey];
@@ -111,6 +103,4 @@ static NSString * const PublicKeyKey = @"publicKey";
     [_configDictionary setValue:serverURL forKey:ServerURLConfigKey];
 }
 
-//no setter for PublicKey, because it's need to be hard coded within Info.plist for safety
-
 @end