@fireota/react-native 0.1.1 → 0.2.0

package/README.md

@@ -200,7 +200,7 @@ By default updates download silently and apply on the next cold start; mandatory
 ```js
 const result = await FireOTA.checkForUpdate();
 if (result.updateAvailable) {
-  // show your UI with result.release.version / result.release.notes, then:
+  // show your UI with result.release.message (what changed) and result.release.id, then:
   await FireOTA.downloadUpdate(result.release);
   await FireOTA.installUpdate(result.release, "immediate");
 }
@@ -220,14 +220,33 @@ if (result.updateAvailable) {
 | `getCurrentRelease()` | `{ releaseId, pendingReleaseId, installationId }` |
 | `getUpdateStatus()` | Current status string. |
 
-Options: `appId`, `serverUrl`, `runtimeVersion` (required), `channel`, `checkOnAppStart`, `installMode`, `mandatoryInstallMode`, `onStatusChange(status, detail)`.
+Options: `appId`, `serverUrl`, `runtimeVersion` (required), `channel`, `checkOnAppStart`, `installMode`, `mandatoryInstallMode`, `codeSigningCertificate`, `onStatusChange(status, detail)`.
+
+## Versioning
+
+Like Expo, an update is identified by its **ID**, not a version number, and belongs to exactly one **runtime version**. The runtime version describes the native code of a store build (Play Store / App Store): the app only receives updates published for the runtime it was built with, so an update can never reach a binary it is incompatible with. Bump `runtimeVersion` (and publish a new store build) whenever native code changes. Publishers may add an optional human label (`--version 1.3.1-hotfix`).
+
+## Code signing (optional)
+
+Prove every update was built by you. Generate a key pair with `npx fireota signing generate`, register the public key in the dashboard (app → Code signing) and embed it in the app:
+
+```js
+FireOTA.configure({
+  // …
+  codeSigningCertificate: `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqh…
+-----END PUBLIC KEY-----`,
+});
+```
+
+With a certificate set, the SDK verifies the RSA-SHA256 signature natively (Android `java.security`, iOS Security framework) **before** downloading, and rejects unsigned or wrongly signed updates — even if the server or your Firebase bucket were compromised. The signature covers the package's SHA-256, the runtime version and the platform, and the download is then checked against that SHA-256.
 
 ## Publishing updates
 
 Use [`@fireota/cli`](https://www.npmjs.com/package/@fireota/cli):
 
 ```sh
-npx fireota publish --app YOUR_APP_ID --platform android --version 1.3.1 --runtime 1.3.0 --channel production --rollout 10
+npx fireota publish --app YOUR_APP_ID --platform all --runtime 1.3.0 --channel production --rollout 10 --message "Fix checkout crash"
 ```
 
 ## License

package/android/src/main/java/dev/fireota/reactnative/FireOTAModule.kt

@@ -2,11 +2,15 @@ package dev.fireota.reactnative
 
 import android.content.Intent
 import android.os.Process
+import android.util.Base64
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.Promise
 import com.facebook.react.bridge.ReactApplicationContext
 import com.facebook.react.bridge.ReactContextBaseJavaModule
 import com.facebook.react.bridge.ReactMethod
+import java.security.KeyFactory
+import java.security.Signature
+import java.security.spec.X509EncodedKeySpec
 import java.util.concurrent.Executors
 
 class FireOTAModule(private val reactContext: ReactApplicationContext) : ReactContextBaseJavaModule(reactContext) {
@@ -47,6 +51,23 @@ class FireOTAModule(private val reactContext: ReactApplicationContext) : ReactCo
     }
   }
 
+  /**
+   * Verifies an RSA-SHA256 (PKCS#1 v1.5) update signature against the app's embedded public key
+   * (base64 X.509 SubjectPublicKeyInfo). Any parsing problem counts as an invalid signature.
+   */
+  @ReactMethod
+  fun verifySignature(message: String, signatureBase64: String, publicKeyBase64: String, promise: Promise) {
+    try {
+      val key = KeyFactory.getInstance("RSA").generatePublic(X509EncodedKeySpec(Base64.decode(publicKeyBase64, Base64.DEFAULT)))
+      val verifier = Signature.getInstance("SHA256withRSA")
+      verifier.initVerify(key)
+      verifier.update(message.toByteArray(Charsets.UTF_8))
+      promise.resolve(verifier.verify(Base64.decode(signatureBase64, Base64.DEFAULT)))
+    } catch (e: Throwable) {
+      promise.resolve(false)
+    }
+  }
+
   @ReactMethod
   fun installUpdate(releaseId: String, promise: Promise) {
     try {

package/fireota-react-native.podspec

@@ -16,4 +16,5 @@ Pod::Spec.new do |s|
   s.source_files = "ios/**/*.{h,m}"
   s.libraries    = "z"
   s.dependency "React-Core"
+  s.frameworks = "Security"
 end

package/ios/FireOTA.m

@@ -1,6 +1,7 @@
 #import "FireOTA.h"
 
 #import <CommonCrypto/CommonDigest.h>
+#import <Security/Security.h>
 #import <React/RCTReloadCommand.h>
 #import <zlib.h>
 
@@ -251,6 +252,39 @@ RCT_EXPORT_METHOD(clearFailed:(RCTPromiseResolveBlock)resolve reject:(RCTPromise
   resolve(nil);
 }
 
+/// Verifies an RSA-SHA256 (PKCS#1 v1.5) update signature against the app's embedded public key.
+/// publicKey is base64 PKCS#1 (the JS layer unwraps the PEM's SubjectPublicKeyInfo).
+RCT_EXPORT_METHOD(verifySignature:(NSString *)message
+                  signature:(NSString *)signatureBase64
+                  publicKey:(NSString *)publicKeyBase64
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+{
+  NSData *keyData = [[NSData alloc] initWithBase64EncodedString:publicKeyBase64 options:0];
+  NSData *signature = [[NSData alloc] initWithBase64EncodedString:signatureBase64 options:0];
+  NSData *payload = [message dataUsingEncoding:NSUTF8StringEncoding];
+  if (!keyData || !signature || !payload) {
+    resolve(@NO);
+    return;
+  }
+  NSDictionary *attributes = @{
+    (__bridge id)kSecAttrKeyType : (__bridge id)kSecAttrKeyTypeRSA,
+    (__bridge id)kSecAttrKeyClass : (__bridge id)kSecAttrKeyClassPublic,
+  };
+  CFErrorRef error = NULL;
+  SecKeyRef key = SecKeyCreateWithData((__bridge CFDataRef)keyData, (__bridge CFDictionaryRef)attributes, &error);
+  if (!key) {
+    if (error) CFRelease(error);
+    resolve(@NO);
+    return;
+  }
+  Boolean valid = SecKeyVerifySignature(key, kSecKeyAlgorithmRSASignatureMessagePKCS1v15SHA256,
+                                        (__bridge CFDataRef)payload, (__bridge CFDataRef)signature, &error);
+  if (error) CFRelease(error);
+  CFRelease(key);
+  resolve(@(valid));
+}
+
 /// Reloads JavaScript; React Native asks AppDelegate.bundleURL again, which applies the pending release.
 RCT_EXPORT_METHOD(restartApp:(RCTPromiseResolveBlock)resolve reject:(RCTPromiseRejectBlock)reject)
 {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fireota/react-native",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Over-the-air JavaScript updates for React Native apps, served from your own Firebase project by FireOTA.",
   "license": "MIT",
   "author": "FireOTA",
@@ -22,9 +22,6 @@
   "peerDependencies": {
     "react-native": ">=0.73.0"
   },
-  "dependencies": {
-    "@fireota/react-native": "file:fireota-react-native-0.1.0.tgz"
-  },
   "keywords": [
     "react-native",
     "ota",

package/src/index.ts

@@ -1,9 +1,12 @@
 /**
  * FireOTA React Native SDK.
  *
- * Flow: check -> download (native, SHA-256 verified) -> install (pending) -> applied on the
- * next start (or immediately for mandatory updates) -> the new bundle confirms itself on
- * launch; a bundle that never confirms is rolled back to the previous one by the native loader.
+ * Flow: check -> (signature verified, when code signing is on) -> download (native, SHA-256
+ * verified) -> install (pending) -> applied on the next start (or immediately for mandatory
+ * updates) -> the new bundle confirms itself on launch; a bundle that never confirms is
+ * rolled back to the previous one by the native loader.
+ *
+ * Updates are identified by their ID (like Expo) and target exactly one runtime version.
  */
 import { NativeModules, Platform } from "react-native";
 
@@ -25,6 +28,11 @@ export interface FireOTAConfig {
   /** Must equal the runtime version of the release; bump it whenever native code changes. */
   runtimeVersion: string;
   channel?: string;
+  /**
+   * PEM public key (contents of fireota-public.pem). When set, every update must carry a valid
+   * signature from the matching private key or it is rejected before download.
+   */
+  codeSigningCertificate?: string;
   /** Check (and download) automatically when configure() runs. Default true. */
   checkOnAppStart?: boolean;
   /** When a normal update is applied. Default "nextRestart". */
@@ -35,12 +43,20 @@ export interface FireOTAConfig {
 }
 
 export interface AvailableUpdate {
+  /** The update's unique ID. */
   id: string;
+  /** Optional human label set by the publisher ("" when none). */
   version: string;
   runtimeVersion: string;
   mandatory: boolean;
   notes: string;
+  /** What changed, as written by the publisher (same as notes). */
+  message?: string;
+  /** Shared by the Android and iOS updates published together. */
+  groupId?: string | null;
+  createdAt?: string;
   bundle: { url: string; hash: string; size: number };
+  signature?: { value: string; keyId: string | null; algorithm: string } | null;
 }
 
 export interface CheckResult {
@@ -70,12 +86,14 @@ interface FireOTANative {
   clearPending(): Promise<void>;
   clearFailed(): Promise<void>;
   restartApp(): Promise<void>;
+  verifySignature(message: string, signatureBase64: string, publicKeyBase64: string): Promise<boolean>;
 }
 
 const native = NativeModules["FireOTA"] as FireOTANative | undefined;
 const PROTOCOL_VERSION = "1";
 
-let config: Required<Omit<FireOTAConfig, "onStatusChange">> & Pick<FireOTAConfig, "onStatusChange">;
+let config: Required<Omit<FireOTAConfig, "onStatusChange" | "codeSigningCertificate">> &
+  Pick<FireOTAConfig, "onStatusChange" | "codeSigningCertificate">;
 let status: UpdateStatus = "idle";
 let running: Promise<CheckResult> | null = null;
 
@@ -157,9 +175,87 @@ export async function checkForUpdate(): Promise<CheckResult> {
   return result;
 }
 
-/** Downloads and verifies (SHA-256) an update. The running bundle is untouched. */
+// ---------- code signing ----------
+
+const B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+function base64ToBytes(input: string): Uint8Array {
+  const clean = input.replace(/[^A-Za-z0-9+/]/g, "");
+  const out: number[] = [];
+  for (let i = 0; i < clean.length; i += 4) {
+    const n = [0, 1, 2, 3].map((k) => (i + k < clean.length ? B64.indexOf(clean[i + k]!) : 0));
+    const triple = (n[0]! << 18) | (n[1]! << 12) | (n[2]! << 6) | n[3]!;
+    out.push((triple >> 16) & 255);
+    if (i + 2 < clean.length) out.push((triple >> 8) & 255);
+    if (i + 3 < clean.length) out.push(triple & 255);
+  }
+  return new Uint8Array(out);
+}
+
+function bytesToBase64(bytes: Uint8Array): string {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const triple = (bytes[i]! << 16) | ((bytes[i + 1] ?? 0) << 8) | (bytes[i + 2] ?? 0);
+    out += B64[(triple >> 18) & 63]! + B64[(triple >> 12) & 63]!;
+    out += i + 1 < bytes.length ? B64[(triple >> 6) & 63]! : "=";
+    out += i + 2 < bytes.length ? B64[triple & 63]! : "=";
+  }
+  return out;
+}
+
+/** Reads one DER element header; returns where its content starts and how long it is. */
+function derElement(der: Uint8Array, offset: number) {
+  let length = der[offset + 1]!;
+  let start = offset + 2;
+  if (length & 0x80) {
+    const bytes = length & 0x7f;
+    length = 0;
+    for (let i = 0; i < bytes; i += 1) length = (length << 8) | der[start + i]!;
+    start += bytes;
+  }
+  return { tag: der[offset]!, start, end: start + length };
+}
+
+/**
+ * The certificate is a PEM "PUBLIC KEY" (X.509 SubjectPublicKeyInfo). Android accepts that
+ * directly; iOS's SecKeyCreateWithData wants the inner PKCS#1 RSAPublicKey.
+ */
+function publicKeyForPlatform(pem: string): string {
+  const spki = base64ToBytes(pem.replace(/-----[^-]+-----/g, ""));
+  if (Platform.OS !== "ios") return bytesToBase64(spki);
+  const outer = derElement(spki, 0); // SEQUENCE
+  const algorithm = derElement(spki, outer.start); // SEQUENCE { oid, null }
+  const bitString = derElement(spki, algorithm.end); // BIT STRING
+  if (outer.tag !== 0x30 || algorithm.tag !== 0x30 || bitString.tag !== 0x03) throw new Error("Invalid code signing certificate.");
+  return bytesToBase64(spki.slice(bitString.start + 1, bitString.end)); // skip the unused-bits byte
+}
+
+/** Same message the CLI signs and the server verifies. */
+function signatureMessage(runtimeVersion: string, platform: string, sha256: string) {
+  return `fireota-update-v1\n${runtimeVersion}\n${platform}\n${sha256.toLowerCase()}`;
+}
+
+async function assertSigned(release: AvailableUpdate) {
+  const certificate = config.codeSigningCertificate;
+  if (!certificate) return;
+  const signature = release.signature?.value;
+  const valid = signature
+    ? await requireNative().verifySignature(
+        signatureMessage(config.runtimeVersion, Platform.OS, release.bundle.hash),
+        signature,
+        publicKeyForPlatform(certificate),
+      )
+    : false;
+  if (!valid) {
+    void report("install_failed", release.id, { reason: signature ? "signature_invalid" : "unsigned" });
+    throw new Error(signature ? "The update signature is not valid for this app." : "The update is not signed; this app only accepts signed updates.");
+  }
+}
+
+/** Verifies the signature (when code signing is on), then downloads and checks SHA-256. The running bundle is untouched. */
 export async function downloadUpdate(release: AvailableUpdate) {
   if (!/^[0-9a-f]{64}$/i.test(release.bundle.hash)) throw new Error("The update has no valid checksum.");
+  await assertSigned(release);
   setStatus("downloading", { releaseId: release.id });
   void report("download_started", release.id);
   await requireNative().downloadUpdate(release.bundle.url, release.bundle.hash.toLowerCase(), release.id);