@novacraft-engineering/pulsar-cli 1.2.2 → 1.2.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novacraft-engineering/pulsar-cli",
-  "version": "1.2.2",
-  "description": "Pulsar OTA release CLI \u2014 bundle, hash, and ship React Native updates over-the-air.",
+  "version": "1.2.3",
+  "description": "Pulsar OTA release CLI — bundle, hash, and ship React Native updates over-the-air.",
   "type": "module",
   "bin": {
     "pulsar": "./pulsar.js"
@@ -26,7 +26,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/hash.test.js && node test/security.test.js"
+    "test": "node test/hash.test.js && node test/security.test.js && node test/signing.test.js"
   },
   "keywords": [
     "cli",

package/pulsar.js

@@ -9,7 +9,10 @@ import crypto from 'node:crypto';
 import {computePackageHash, fileHashes} from './hash.js';
 
 // Code signing: sign the package hash into an RS256 JWT the client verifies against its
-// CodePushPublicKey (Info.plist). Written to `.codepushrelease` inside the bundle.
+// CodePushPublicKey (Info.plist). Both native SDKs read it from <update>/CodePush/.codepushrelease
+// and nowhere else; a signature anywhere else counts as no signature.
+const SIGNATURE_PATH = 'CodePush/.codepushrelease';
+
 function signCodePushJWT(privateKeyPem, contentHash) {
   const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
   const signingInput = `${encode({alg: 'RS256', typ: 'JWT'})}.${encode({contentHash})}`;
@@ -246,8 +249,11 @@ async function buildDiffPackage(baseZip, newDir) {
   fs.writeFileSync(path.join(diffDir, 'hotcodepush.json'), JSON.stringify({deletedFiles}));
   // The signature isn't part of the content hash, so it's excluded above — but the patched bundle
   // still needs it to verify, so carry it into the diff when the release is signed.
-  const signature = path.join(newDir, '.codepushrelease');
-  if (fs.existsSync(signature)) fs.copyFileSync(signature, path.join(diffDir, '.codepushrelease'));
+  const signature = path.join(newDir, SIGNATURE_PATH);
+  if (fs.existsSync(signature)) {
+    fs.mkdirSync(path.dirname(path.join(diffDir, SIGNATURE_PATH)), {recursive: true});
+    fs.copyFileSync(signature, path.join(diffDir, SIGNATURE_PATH));
+  }
   return diffDir;
 }
 
@@ -417,9 +423,20 @@ function buildOnce(args) {
   const contentsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pulsar-build-'));
   bundle(platform, contentsDir);
   const packageHash = computePackageHash(contentsDir);
+  // CI secrets arrive as environment variables holding the key itself, not as files, so the key can
+  // come from PULSAR_SIGNING_KEY as well as --private-key <file>. An unset or empty secret means
+  // "don't sign", exactly as before.
   const privateKeyPath = getFlag(args, 'private-key');
-  if (privateKeyPath) {
-    fs.writeFileSync(path.join(contentsDir, '.codepushrelease'), signCodePushJWT(fs.readFileSync(privateKeyPath, 'utf8'), packageHash));
+  const signingKey = privateKeyPath ? fs.readFileSync(privateKeyPath, 'utf8') : (process.env.PULSAR_SIGNING_KEY || '').trim();
+  if (signingKey) {
+    let signature;
+    try {
+      signature = signCodePushJWT(signingKey, packageHash);
+    } catch (error) {
+      die(`could not sign with the provided key (${error.message}) — nothing was uploaded`);
+    }
+    fs.mkdirSync(path.join(contentsDir, 'CodePush'), {recursive: true});
+    fs.writeFileSync(path.join(contentsDir, SIGNATURE_PATH), signature);
     console.log('• signed release — devices with CodePushPublicKey set will verify it');
   }
   const zip = fs.readFileSync(zipContents(contentsDir));
@@ -594,7 +611,7 @@ async function cmdKeys(args) {
   console.log(`✓ wrote ${Object.keys(vars).length} key(s) to ${target} (${written.size} updated, ${missing.length} added)`);
 }
 
-export {saveConfig, browserLogin};
+export {saveConfig, browserLogin, signCodePushJWT, SIGNATURE_PATH};
 
 // Only dispatch when run as the CLI — importing the module (e.g. from tests) must not execute a command.
 if (import.meta.url === `file://${process.argv[1]}`) {