@onekeyfe/react-native-bundle-update 1.1.26 → 1.1.27

package/ReactNativeBundleUpdate.podspec

@@ -21,6 +21,15 @@ Pod::Spec.new do |s|
 
   s.vendored_frameworks = 'ios/Frameworks/Gopenpgp.xcframework'
 
+  # When ONEKEY_ALLOW_SKIP_GPG_VERIFICATION env var is set to a non-empty, non-'false' value,
+  # enable the ALLOW_SKIP_GPG_VERIFICATION Swift compilation condition.
+  # Without this flag, all skip-GPG code paths are compiled out (dead code elimination).
+  if ENV['ONEKEY_ALLOW_SKIP_GPG_VERIFICATION'] && ENV['ONEKEY_ALLOW_SKIP_GPG_VERIFICATION'] != '' && ENV['ONEKEY_ALLOW_SKIP_GPG_VERIFICATION'] != 'false'
+    s.pod_target_xcconfig = {
+      'SWIFT_ACTIVE_COMPILATION_CONDITIONS' => '$(inherited) ALLOW_SKIP_GPG_VERIFICATION'
+    }
+  end
+
   s.dependency 'React-jsi'
   s.dependency 'React-callinvoker'
   s.dependency 'ReactNativeNativeLogger'

package/android/build.gradle

@@ -39,6 +39,14 @@ android {
     minSdkVersion getExtOrIntegerDefault("minSdkVersion")
     targetSdkVersion getExtOrIntegerDefault("targetSdkVersion")
 
+    // When ONEKEY_ALLOW_SKIP_GPG_VERIFICATION env var is set to a non-empty, non-'false' value,
+    // enable the skip-GPG code paths. Without this flag, BuildConfig.ALLOW_SKIP_GPG_VERIFICATION
+    // is false and all skip-GPG logic is gated behind an immutable compile-time constant.
+    def allowSkipGPG = System.getenv('ONEKEY_ALLOW_SKIP_GPG_VERIFICATION') != null &&
+                       System.getenv('ONEKEY_ALLOW_SKIP_GPG_VERIFICATION') != '' &&
+                       System.getenv('ONEKEY_ALLOW_SKIP_GPG_VERIFICATION') != 'false'
+    buildConfigField("boolean", "ALLOW_SKIP_GPG_VERIFICATION", allowSkipGPG.toString())
+
     externalNativeBuild {
       cmake {
         cppFlags "-frtti -fexceptions -Wall -fstack-protector-all"

package/android/src/main/java/com/margelo/nitro/reactnativebundleupdate/ReactNativeBundleUpdate.kt

@@ -528,7 +528,7 @@ object BundleUpdateStoreAndroid {
             val signature = readSignatureFile(context, currentBundleVersion)
             OneKeyLog.debug("BundleUpdate", "getJsBundlePath: signatureLength=${signature.length}")
 
-            val devSettingsEnabled = isDevSettingsEnabled(context)
+            val devSettingsEnabled = if (BuildConfig.ALLOW_SKIP_GPG_VERIFICATION) isDevSettingsEnabled(context) else false
             if (devSettingsEnabled) {
                 OneKeyLog.warn("BundleUpdate", "Startup SHA256 validation skipped (DevSettings enabled)")
             }
@@ -591,8 +591,10 @@ object BundleUpdateStoreAndroid {
      * Returns true if the skip-GPG-verification toggle is enabled in developer settings.
      * Reads the persisted value from MMKV storage (key: onekey_bundle_skip_gpg_verification,
      * instance: onekey-app-dev-setting).
+     * Gated by BuildConfig.ALLOW_SKIP_GPG_VERIFICATION — always returns false in production builds.
      */
     fun isSkipGPGEnabled(context: Context): Boolean {
+        if (!BuildConfig.ALLOW_SKIP_GPG_VERIFICATION) return false
         return try {
             MMKV.initialize(context)
             val mmkv = MMKV.mmkvWithID("onekey-app-dev-setting") ?: return false
@@ -720,8 +722,10 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
         }
     }
 
-    /** Returns true if the skip-GPG-verification toggle is enabled via MMKV storage. */
+    /** Returns true if the skip-GPG-verification toggle is enabled via MMKV storage.
+     *  Gated by BuildConfig.ALLOW_SKIP_GPG_VERIFICATION — always returns false in production builds. */
     private fun isSkipGPGEnabled(): Boolean {
+        if (!BuildConfig.ALLOW_SKIP_GPG_VERIFICATION) return false
         return try {
             val context = NitroModules.applicationContext ?: return false
             BundleUpdateStoreAndroid.isSkipGPGEnabled(context)
@@ -891,10 +895,8 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             OneKeyLog.info("BundleUpdate", "verifyBundleASC: appVersion=$appVersion, bundleVersion=$bundleVersion, file=$filePath, signatureLength=${signature.length}")
 
             // GPG verification skipped only when both DevSettings and skip-GPG toggle are enabled
-            val devSettings = isDevSettingsEnabled()
-            val skipGPGToggle = isSkipGPGEnabled()
-            val skipGPG = devSettings && skipGPGToggle
-            OneKeyLog.info("BundleUpdate", "verifyBundleASC: GPG check: devSettings=$devSettings, skipGPGToggle=$skipGPGToggle, skipGPG=$skipGPG")
+            val skipGPG = BuildConfig.ALLOW_SKIP_GPG_VERIFICATION && isDevSettingsEnabled() && isSkipGPGEnabled()
+            OneKeyLog.info("BundleUpdate", "verifyBundleASC: GPG check: skipGPG=$skipGPG")
 
             if (!skipGPG) {
                 OneKeyLog.info("BundleUpdate", "verifyBundleASC: verifying SHA256 of downloaded file...")
@@ -987,10 +989,8 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             OneKeyLog.info("BundleUpdate", "installBundle: appVersion=$appVersion, bundleVersion=$bundleVersion, signatureLength=${signature.length}")
 
             // GPG verification skipped only when both DevSettings and skip-GPG toggle are enabled
-            val devSettings = isDevSettingsEnabled()
-            val skipGPGToggle = isSkipGPGEnabled()
-            val skipGPG = devSettings && skipGPGToggle
-            OneKeyLog.info("BundleUpdate", "installBundle: GPG check: devSettings=$devSettings, skipGPGToggle=$skipGPGToggle, skipGPG=$skipGPG")
+            val skipGPG = BuildConfig.ALLOW_SKIP_GPG_VERIFICATION && isDevSettingsEnabled() && isSkipGPGEnabled()
+            OneKeyLog.info("BundleUpdate", "installBundle: GPG check: skipGPG=$skipGPG")
 
             val folderName = "$appVersion-$bundleVersion"
             val currentFolderName = BundleUpdateStoreAndroid.getCurrentBundleVersion(context)
@@ -1116,10 +1116,9 @@ class ReactNativeBundleUpdate : HybridReactNativeBundleUpdateSpec() {
             }
 
             // Verify GPG signature is valid (skipped when both DevSettings and skip-GPG toggle are enabled)
-            val devSettings = isDevSettingsEnabled()
-            val skipGPGToggle = isSkipGPGEnabled()
-            OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: GPG check: devSettings=$devSettings, skipGPGToggle=$skipGPGToggle")
-            if (!(devSettings && skipGPGToggle)) {
+            val skipGPGSwitch = BuildConfig.ALLOW_SKIP_GPG_VERIFICATION && isDevSettingsEnabled() && isSkipGPGEnabled()
+            OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: GPG check: skipGPG=$skipGPGSwitch")
+            if (!skipGPGSwitch) {
                 if (params.signature.isEmpty() ||
                     !BundleUpdateStoreAndroid.validateMetadataFileSha256(context, bundleVersion, params.signature)) {
                     OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: GPG signature verification failed")

package/ios/ReactNativeBundleUpdate.swift

@@ -205,10 +205,15 @@ public class BundleUpdateStore: NSObject {
     /// Returns true if the skip-GPG-verification toggle is enabled in developer settings.
     /// Reads the persisted value from MMKV storage (key: onekey_bundle_skip_gpg_verification,
     /// instance: onekey-app-dev-setting).
+    /// Gated by ALLOW_SKIP_GPG_VERIFICATION compile flag — always returns false in production builds.
     public static func isSkipGPGEnabled() -> Bool {
+        #if ALLOW_SKIP_GPG_VERIFICATION
         MMKV.initialize(rootDir: nil)
         guard let mmkv = MMKV(mmapID: "onekey-app-dev-setting") else { return false }
         return mmkv.bool(forKey: "onekey_bundle_skip_gpg_verification", defaultValue: false)
+        #else
+        return false
+        #endif
     }
 
     public static func readMetadataFileSha256(_ signature: String) -> String? {
@@ -410,10 +415,14 @@ public class BundleUpdateStore: NSObject {
         let signature = readSignatureFile(currentBundleVer)
         OneKeyLog.debug("BundleUpdate", "getJsBundlePath: signatureLength=\(signature.count)")
 
+        #if ALLOW_SKIP_GPG_VERIFICATION
         let devSettingsEnabled = isDevSettingsEnabled()
         if devSettingsEnabled {
             OneKeyLog.warn("BundleUpdate", "Startup SHA256 validation skipped (DevSettings enabled)")
         }
+        #else
+        let devSettingsEnabled = false
+        #endif
         if !devSettingsEnabled && !validateMetadataFileSha256(currentBundleVer, signature: signature) {
             OneKeyLog.warn("BundleUpdate", "getJsBundlePath: validateMetadataFileSha256 failed, signatureLength=\(signature.count)")
             return nil
@@ -817,10 +826,12 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
             OneKeyLog.info("BundleUpdate", "verifyBundleASC: appVersion=\(appVersion), bundleVersion=\(bundleVersion), file=\(filePath), signatureLength=\(signature.count)")
 
             // GPG verification skipped only when both DevSettings and skip-GPG toggle are enabled
-            let devSettings = BundleUpdateStore.isDevSettingsEnabled()
-            let skipGPGToggle = BundleUpdateStore.isSkipGPGEnabled()
-            let skipGPG = devSettings && skipGPGToggle
-            OneKeyLog.info("BundleUpdate", "verifyBundleASC: GPG check: devSettings=\(devSettings), skipGPGToggle=\(skipGPGToggle), skipGPG=\(skipGPG)")
+            #if ALLOW_SKIP_GPG_VERIFICATION
+            let skipGPG = BundleUpdateStore.isDevSettingsEnabled() && BundleUpdateStore.isSkipGPGEnabled()
+            #else
+            let skipGPG = false
+            #endif
+            OneKeyLog.info("BundleUpdate", "verifyBundleASC: GPG check: skipGPG=\(skipGPG)")
 
             if !skipGPG {
                 OneKeyLog.info("BundleUpdate", "verifyBundleASC: verifying SHA256 of downloaded file...")
@@ -936,10 +947,12 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
             OneKeyLog.info("BundleUpdate", "installBundle: appVersion=\(appVersion), bundleVersion=\(bundleVersion), signatureLength=\(signature.count)")
 
             // GPG verification skipped only when both DevSettings and skip-GPG toggle are enabled
-            let devSettings = BundleUpdateStore.isDevSettingsEnabled()
-            let skipGPGToggle = BundleUpdateStore.isSkipGPGEnabled()
-            let skipGPG = devSettings && skipGPGToggle
-            OneKeyLog.info("BundleUpdate", "installBundle: GPG check: devSettings=\(devSettings), skipGPGToggle=\(skipGPGToggle), skipGPG=\(skipGPG)")
+            #if ALLOW_SKIP_GPG_VERIFICATION
+            let skipGPG = BundleUpdateStore.isDevSettingsEnabled() && BundleUpdateStore.isSkipGPGEnabled()
+            #else
+            let skipGPG = false
+            #endif
+            OneKeyLog.info("BundleUpdate", "installBundle: GPG check: skipGPG=\(skipGPG)")
 
             let folderName = "\(appVersion)-\(bundleVersion)"
             let currentFolderName = BundleUpdateStore.currentBundleVersion()
@@ -1065,10 +1078,13 @@ class ReactNativeBundleUpdate: HybridReactNativeBundleUpdateSpec {
             }
 
             // Verify GPG signature is valid (skipped when both DevSettings and skip-GPG toggle are enabled)
-            let devSettings = BundleUpdateStore.isDevSettingsEnabled()
-            let skipGPGToggle = BundleUpdateStore.isSkipGPGEnabled()
-            OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: GPG check: devSettings=\(devSettings), skipGPGToggle=\(skipGPGToggle)")
-            if !(devSettings && skipGPGToggle) {
+            #if ALLOW_SKIP_GPG_VERIFICATION
+            let skipGPGSwitch = BundleUpdateStore.isDevSettingsEnabled() && BundleUpdateStore.isSkipGPGEnabled()
+            #else
+            let skipGPGSwitch = false
+            #endif
+            OneKeyLog.info("BundleUpdate", "setCurrentUpdateBundleData: GPG check: skipGPG=\(skipGPGSwitch)")
+            if !skipGPGSwitch {
                 guard !params.signature.isEmpty,
                       BundleUpdateStore.validateMetadataFileSha256(bundleVersion, signature: params.signature) else {
                     OneKeyLog.error("BundleUpdate", "setCurrentUpdateBundleData: GPG signature verification failed")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-bundle-update",
-  "version": "1.1.26",
+  "version": "1.1.27",
   "description": "react-native-bundle-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",