@scalebun/react-native 1.13.0 → 2.0.1

package/android/src/main/java/com/scalebun/rn/ota/ScaleBunOtaModule.kt

@@ -96,6 +96,21 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
 
     private val slotManager by lazy { SlotManager(reactApplicationContext.filesDir) }
 
+    /**
+     * Trusted RSA public keys embedded in the APK (docs §9). Non-empty once the
+     * app ships a `scalebun_ota_keys.json` asset — which is what flips staging
+     * into the native-ENFORCED path (see [stageBundle]).
+     */
+    private val keyRegistry by lazy { ScaleBunOtaKeyRegistry.fromAssets(reactApplicationContext) }
+
+    /** Device-derived verification context — never taken from JS. */
+    private fun buildContext(): ExpectedContext = ExpectedContext(
+        projectId = keyRegistry.projectId,
+        applicationId = reactApplicationContext.packageName,
+        currentSequence = slotManager.highestConfirmedSequence(),
+        nowEpochSeconds = System.currentTimeMillis() / 1000,
+    )
+
     override fun getName(): String = NAME
 
     /**
@@ -139,6 +154,27 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
         return slotManager.slotState().toString()
     }
 
+    /**
+     * Device integrity signals as a JSON array of reason strings.
+     *
+     * Reported, never enforced here: the SDK does not decide to withhold an
+     * update on a rooted device, because that is a product decision a host app
+     * makes with knowledge of its own users. Empty array means nothing was
+     * detected, which is not proof the device is clean.
+     */
+    @ReactMethod(isBlockingSynchronousMethod = true)
+    override fun getDeviceIntegrity(): String {
+        return org.json.JSONArray(
+            DeviceIntegrity.rootIndicators(reactApplicationContext),
+        ).toString()
+    }
+
+    /** JSON array of the trusted key IDs embedded in this app (SDK trust coverage). */
+    @ReactMethod(isBlockingSynchronousMethod = true)
+    override fun getTrustedKeyIds(): String {
+        return org.json.JSONArray(keyRegistry.keyIds().toList()).toString()
+    }
+
     /**
      * Stage a bundle into the `next` slot.
      *
@@ -154,6 +190,19 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
      */
     @ReactMethod
     override fun stageBundle(sourcePath: String, sha256: String, promise: Promise) {
+        // Native-enforced staging (docs §17): once trusted keys are embedded, the
+        // ONLY way to stage is verifyAndStageRelease, which proves an RSA signature
+        // over the release payload first. A hostile JS bundle can therefore not
+        // drive an unauthenticated bundle onto the device by calling this path —
+        // SHA-256 integrity alone (what this method checks) is not authenticity.
+        if (!keyRegistry.isEmpty()) {
+            android.util.Log.w(
+                NAME,
+                "stageBundle refused: trusted keys are embedded — use verifyAndStageRelease (signature-enforced).",
+            )
+            promise.resolve(false)
+            return
+        }
         var downloaded: File? = null
         try {
             val isRemote = sourcePath.startsWith("http://", true) ||
@@ -163,7 +212,7 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
             if (isRemote) {
                 val temp = File(reactApplicationContext.cacheDir, "scalebun_ota_dl_${System.nanoTime()}")
                 downloaded = temp
-                if (!BundleDownloader.download(sourcePath, temp, ::emitProgress)) {
+                if (!BundleDownloader.download(reactApplicationContext, sourcePath, temp, ::emitProgress)) {
                     promise.resolve(false)
                     return
                 }
@@ -214,6 +263,16 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
         expectedSha256: String,
         promise: Promise,
     ) {
+        // Same native-enforcement as stageBundle: a bsdiff patch staged by hash
+        // alone carries no signature, so once trusted keys are embedded this path
+        // is closed. Result-anchored signed patches are a native follow-up
+        // (verifyAndStagePatch); until then the SDK falls back to the verified
+        // full download (verifyAndStageRelease). false = "patch unavailable".
+        if (!keyRegistry.isEmpty()) {
+            android.util.Log.i(NAME, "stagePatch disabled while trusted keys are embedded — full verified download")
+            promise.resolve(false)
+            return
+        }
         var downloadedPatch: File? = null
         var rebuilt: File? = null
         try {
@@ -230,7 +289,7 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
 
             val temp = File(reactApplicationContext.cacheDir, "scalebun_ota_patch_${System.nanoTime()}")
             downloadedPatch = temp
-            if (!BundleDownloader.download(patchUrl, temp, ::emitProgress)) {
+            if (!BundleDownloader.download(reactApplicationContext, patchUrl, temp, ::emitProgress)) {
                 promise.resolve(false)
                 return
             }
@@ -284,78 +343,89 @@ class ScaleBunOtaModule(reactContext: ReactApplicationContext) :
     }
 
     /**
-     * Verify a detached ed25519 signature with PLATFORM crypto.
-     *
-     * Why native: the JS verifier lives inside the very bundle it protects, so
-     * one malicious bundle can neuter it for every update after. Platform
-     * crypto sits outside the bundle's reach. It also drops the runtime need
-     * for the optional @noble peers on Android 13+.
+     * Verify a SB-OTA-RSA-SHA256-V1 release envelope with PLATFORM crypto and the
+     * EMBEDDED trusted-key registry — no download, no side effects. Resolves the
+     * verdict JSON (see [Verdict.toJson]); a failed verification is a verdict with
+     * `ok:false` and a stable `code`, never a rejected promise.
      *
-     * Contract (mirrors the JS spec doc):
-     *   - inputs are lowercase hex, pre-validated by the JS caller
-     *   - the message is the RAW 32 BYTES of the bundle SHA-256 — the CLI
-     *     signs the digest bytes, not their hex text
-     *   - resolves 'valid' / 'invalid' / 'unavailable'; never rejects for a
-     *     wrong signature, and any unexpected throw resolves 'unavailable' so
-     *     machinery failure is distinguishable from a forged bundle
+     * Native because the JS verifier lives inside the very bundle it protects, and
+     * because the trusted key must come from the APK, not from JS or the server.
+     * `SHA256withRSA` + RSA `KeyFactory` are available on every supported Android
+     * API level, so there is no API-33 floor (the reason RSA replaced ed25519).
+     */
+    @ReactMethod
+    override fun verifyRelease(envelopeJson: String, promise: Promise) {
+        try {
+            promise.resolve(ScaleBunOtaReleaseVerifier.verify(envelopeJson, buildContext(), keyRegistry).toJson())
+        } catch (e: Throwable) {
+            promise.resolve(
+                Verdict.fail(OtaFailureCode.INTERNAL_VERIFICATION_ERROR, e.message ?: "internal error").toJson(),
+            )
+        }
+    }
+
+    /**
+     * Native-ENFORCED install (docs §5, §17): verify the RSA signature over the
+     * release payload against an embedded key, THEN download to a temp file,
+     * enforce the signed size + SHA-256, and stage into the `next` slot. JS never
+     * gets to stage bytes that were not proven authentic. Does not activate —
+     * [applyUpdate] promotes per the install mode, unchanged.
      *
-     * Availability: `Signature.getInstance("Ed25519")` ships in Android's
-     * conscrypt from API 33. Below that the JCA lookup throws
-     * NoSuchAlgorithmException — reported as 'unavailable', and JS falls back
-     * to its own verifier. Checked by attempting the lookup rather than by
-     * SDK_INT, because the algorithm's presence is the fact that matters.
+     * Resolves the verdict JSON: `ok:true` once staged, else `ok:false` with the
+     * stage that failed as a stable `code`.
      */
     @ReactMethod
-    override fun verifyEd25519(
-        messageHex: String,
-        signatureHex: String,
-        publicKeyHex: String,
-        promise: Promise,
-    ) {
+    override fun verifyAndStageRelease(envelopeJson: String, promise: Promise) {
+        var downloaded: File? = null
         try {
-            val message = hexToBytes(messageHex)
-            val signature = hexToBytes(signatureHex)
-            val rawKey = hexToBytes(publicKeyHex)
-            if (message == null || signature == null || rawKey == null || rawKey.size != 32) {
-                // Malformed input from our own caller is not a forgery verdict.
-                promise.resolve("unavailable")
+            val verdict = ScaleBunOtaReleaseVerifier.verify(envelopeJson, buildContext(), keyRegistry)
+            val payload = verdict.payload
+            if (!verdict.ok || payload == null) {
+                promise.resolve(verdict.toJson())
                 return
             }
 
-            // JCA takes X.509 SubjectPublicKeyInfo, not raw key bytes: the
-            // 12-byte ed25519 SPKI prefix (OID 1.3.101.112) + the raw 32.
-            val spkiPrefix = byteArrayOf(
-                0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
-            )
-            val verifier = try {
-                java.security.Signature.getInstance("Ed25519")
-            } catch (_: java.security.NoSuchAlgorithmException) {
-                promise.resolve("unavailable") // API < 33
+            val url = JSONObject(envelopeJson).optString("downloadUrl", "")
+            if (url.isEmpty()) {
+                promise.resolve(Verdict.fail(OtaFailureCode.DOWNLOAD_FAILED, "envelope has no downloadUrl").toJson())
                 return
             }
-            val key = java.security.KeyFactory.getInstance("Ed25519")
-                .generatePublic(java.security.spec.X509EncodedKeySpec(spkiPrefix + rawKey))
-
-            verifier.initVerify(key)
-            verifier.update(message)
-            promise.resolve(if (verifier.verify(signature)) "valid" else "invalid")
-        } catch (_: Throwable) {
-            // Fail toward "cannot check", never toward "checked out fine".
-            promise.resolve("unavailable")
-        }
-    }
 
-    /** Hex → bytes; null for odd length or a non-hex character. */
-    private fun hexToBytes(hex: String): ByteArray? {
-        if (hex.isEmpty() || hex.length % 2 != 0) return null
-        val out = ByteArray(hex.length / 2)
-        for (i in out.indices) {
-            val hi = Character.digit(hex[i * 2], 16)
-            val lo = Character.digit(hex[i * 2 + 1], 16)
-            if (hi < 0 || lo < 0) return null
-            out[i] = ((hi shl 4) or lo).toByte()
+            val temp = File(reactApplicationContext.cacheDir, "scalebun_ota_dl_${System.nanoTime()}")
+            downloaded = temp
+            if (!BundleDownloader.download(reactApplicationContext, url, temp, ::emitProgress)) {
+                promise.resolve(Verdict.fail(OtaFailureCode.DOWNLOAD_FAILED, "download failed").toJson())
+                return
+            }
+            // Size first (cheap), against the SIGNED artifactSize.
+            if (temp.length() != payload.artifactSize) {
+                promise.resolve(Verdict.fail(OtaFailureCode.ARTIFACT_SIZE_MISMATCH, "downloaded size mismatch").toJson())
+                return
+            }
+
+            // SlotManager.stage streams a SHA-256 and compares against the signed
+            // artifactSha256 (== resultArtifactSha256 for a full artifact), so a
+            // wrong download cannot be staged. meta carries the sequence used by
+            // the anti-downgrade floor once the bundle is confirmed healthy.
+            val meta = JSONObject()
+                .put("sha256", payload.artifactSha256)
+                .put("releaseSequence", payload.releaseSequence)
+                .put("bundleId", payload.bundleId)
+                .put("releaseId", payload.releaseId)
+                .put("installedAt", System.currentTimeMillis())
+            val staged = slotManager.stage(temp, payload.artifactSha256, meta)
+            if (!staged) {
+                promise.resolve(Verdict.fail(OtaFailureCode.ARTIFACT_HASH_MISMATCH, "staged bytes failed hash check").toJson())
+                return
+            }
+            promise.resolve(verdict.toJson())
+        } catch (e: Throwable) {
+            promise.resolve(
+                Verdict.fail(OtaFailureCode.INTERNAL_VERIFICATION_ERROR, e.message ?: "internal error").toJson(),
+            )
+        } finally {
+            downloaded?.delete()
         }
-        return out
     }
 
     private fun sha256Hex(bytes: ByteArray): String {

package/android/src/main/java/com/scalebun/rn/ota/ScaleBunOtaReleaseVerifier.kt

@@ -0,0 +1,129 @@
+package com.scalebun.rn.ota
+
+import org.json.JSONObject
+import java.security.Signature
+
+/**
+ * SB-OTA-RSA-SHA256-V1 native release verifier (docs §5). Runs the authoritative
+ * order: strict-decode → registry-only key resolution → RSA-SHA256 verify over
+ * the EXACT signed-payload bytes → parse → cross-check the authenticated payload
+ * against the device's own identity + the anti-downgrade floor. Fails closed and
+ * maps every failure to a stable {@link OtaFailureCode}.
+ *
+ * The verify call sequence (Signature("SHA256withRSA") over payload bytes) is the
+ * same JCA surface proven in tools/rsa-ota-parity/RsaOtaParity.java against the
+ * shared fixtures, and available on every supported Android API level (no API-33
+ * floor, unlike ed25519).
+ */
+data class ExpectedContext(
+    /** The ScaleBun project this binary belongs to (from the embedded config). */
+    val projectId: String,
+    /** The native application id — the device's own package name. */
+    val applicationId: String,
+    /** Highest confirmed release sequence for anti-downgrade (0 if none yet). */
+    val currentSequence: Long,
+    /** Seconds since epoch, for the expiry check. */
+    val nowEpochSeconds: Long,
+    val platform: String = "android",
+)
+
+data class Verdict(
+    val ok: Boolean,
+    val code: OtaFailureCode?,
+    val message: String?,
+    val payload: SignedRelease?,
+    val fingerprint: String?,
+) {
+    fun toJson(): String {
+        val o = JSONObject()
+        o.put("ok", ok)
+        if (code != null) o.put("code", code.name)
+        if (message != null) o.put("message", message)
+        if (fingerprint != null) o.put("fingerprint", fingerprint)
+        payload?.let { p ->
+            o.put("keyId", p.keyId)
+            o.put("releaseId", p.releaseId)
+            o.put("bundleId", p.bundleId)
+            o.put("releaseSequence", p.releaseSequence)
+            o.put("artifactSha256", p.artifactSha256)
+            o.put("artifactSize", p.artifactSize)
+            o.put("resultArtifactSha256", p.resultArtifactSha256)
+            o.put("artifactType", p.artifactType)
+        }
+        return o.toString()
+    }
+
+    companion object {
+        fun fail(code: OtaFailureCode, message: String) = Verdict(false, code, message, null, null)
+    }
+}
+
+object ScaleBunOtaReleaseVerifier {
+
+    fun verify(envelopeJson: String, expected: ExpectedContext, registry: ScaleBunOtaKeyRegistry): Verdict {
+        return try {
+            val env = JSONObject(envelopeJson)
+            val protocol = env.optString("protocol", "")
+            if (protocol != OtaProtocol.SIGNATURE_ALGORITHM) {
+                return Verdict.fail(OtaFailureCode.UNSUPPORTED_PROTOCOL, "protocol $protocol")
+            }
+            val signedPayloadB64 = env.optString("signedPayload", "")
+            val signatureB64 = env.optString("signature", "")
+            val envKeyId = env.optString("keyId", "")
+
+            val payloadBytes = OtaProtocol.decodeBase64Strict(
+                signedPayloadB64, OtaProtocol.MAX_SIGNED_PAYLOAD_BYTES, "signedPayload",
+            )
+            val signature = OtaProtocol.decodeBase64Strict(
+                signatureB64, OtaProtocol.MAX_SIGNATURE_BYTES, "signature",
+            )
+
+            val payloadKeyId = OtaProtocol.peekKeyId(payloadBytes)
+            if (envKeyId.isNotEmpty() && envKeyId != payloadKeyId) {
+                return Verdict.fail(OtaFailureCode.INVALID_ENVELOPE, "envelope keyId disagrees with payload")
+            }
+
+            val key = registry.get(payloadKeyId)
+                ?: return Verdict.fail(OtaFailureCode.UNKNOWN_KEY_ID, "no embedded key with id $payloadKeyId")
+
+            // RSA-SHA256 over the EXACT received payload bytes, BEFORE parsing.
+            val verifier = Signature.getInstance("SHA256withRSA")
+            verifier.initVerify(key.publicKey)
+            verifier.update(payloadBytes)
+            if (!verifier.verify(signature)) {
+                return Verdict.fail(OtaFailureCode.INVALID_SIGNATURE, "signature did not verify")
+            }
+
+            val payload = OtaProtocol.parse(payloadBytes)
+
+            // The device only ever verifies a signed FULL release (patches are an
+            // out-of-band optimisation anchored to resultArtifactSha256, docs §8.1).
+            if (payload.artifactType != "full") {
+                return Verdict.fail(OtaFailureCode.INVALID_SIGNED_PAYLOAD, "signed payload is not a full release")
+            }
+            val projectExpected = if (registry.projectId.isNotEmpty()) registry.projectId else expected.projectId
+            if (projectExpected.isNotEmpty() && payload.projectId != projectExpected) {
+                return Verdict.fail(OtaFailureCode.PROJECT_MISMATCH, "projectId")
+            }
+            if (expected.applicationId.isNotEmpty() && payload.applicationId != expected.applicationId) {
+                return Verdict.fail(OtaFailureCode.APPLICATION_MISMATCH, "applicationId")
+            }
+            if (payload.platform != expected.platform) {
+                return Verdict.fail(OtaFailureCode.PLATFORM_MISMATCH, "platform")
+            }
+            if (payload.expiresAtEpochSeconds != 0L && expected.nowEpochSeconds > payload.expiresAtEpochSeconds) {
+                return Verdict.fail(OtaFailureCode.RELEASE_EXPIRED, "release expired")
+            }
+            if (payload.releaseSequence < expected.currentSequence) {
+                return Verdict.fail(OtaFailureCode.RELEASE_DOWNGRADE_REJECTED, "sequence below current")
+            }
+
+            Verdict(true, null, null, payload, key.fingerprint)
+        } catch (e: OtaVerifyException) {
+            Verdict.fail(e.code, e.message ?: "verification failed")
+        } catch (e: Throwable) {
+            // Never let an exception read as success.
+            Verdict.fail(OtaFailureCode.INTERNAL_VERIFICATION_ERROR, e.message ?: "internal error")
+        }
+    }
+}

package/android/src/main/java/com/scalebun/rn/ota/SlotManager.kt

@@ -47,6 +47,22 @@ class SlotManager(private val filesDir: File) {
     private val previousSlot: File get() = File(otaRoot, "previous")
     private val bootMarker: File get() = File(otaRoot, BOOT_MARKER_FILENAME)
     private val revertRecord: File get() = File(otaRoot, REVERT_RECORD_FILENAME)
+    private val sequenceFile: File get() = File(otaRoot, "highest_sequence")
+
+    /**
+     * Highest CONFIRMED release sequence (anti-downgrade floor, docs §15). Only
+     * updated once a bundle is marked healthy, so a failed/rolled-back higher
+     * sequence never raises the floor and never blocks a legitimate re-install.
+     */
+    fun highestConfirmedSequence(): Long =
+        try { sequenceFile.readText().trim().toLong() } catch (_: Exception) { 0L }
+
+    private fun confirmCurrentSequence() {
+        val seq = readMeta(currentSlot)?.optLong("releaseSequence", -1L) ?: -1L
+        if (seq >= 0 && seq > highestConfirmedSequence()) {
+            runCatching { otaRoot.mkdirs(); sequenceFile.writeText(seq.toString()) }
+        }
+    }
 
     /**
      * Returns the absolute path to the active JS bundle, or null if no OTA
@@ -54,7 +70,68 @@ class SlotManager(private val filesDir: File) {
      */
     fun currentBundlePath(): File? {
         val bundle = File(currentSlot, BUNDLE_FILENAME)
-        return if (bundle.exists()) bundle else null
+        if (!bundle.exists()) return null
+
+        // Integrity re-check on execution.
+        //
+        // The signature and hash are verified when a bundle is STAGED. That
+        // protects the download path, but it says nothing about the bytes still
+        // being the ones we installed: on a rooted device, anything able to write
+        // into app-private storage can replace current/bundle after the fact and
+        // the old `exists()` check would happily execute it.
+        //
+        // meta.json already records the sha256 the slot manager installed, so the
+        // comparison costs one hash of the active bundle per process — not per
+        // call, hence the cache. On mismatch we refuse the slot and return null,
+        // which makes the caller fall back to the bundle compiled into the APK.
+        // Failing closed to a known-good baseline is the only safe answer here.
+        verifiedBundlePath?.let { return if (it.exists()) it else null }
+        if (integrityFailed) return null
+
+        val expected = readMeta(currentSlot)?.optString("sha256", "").orEmpty()
+        if (expected.isEmpty()) {
+            // Pre-integrity install, or metadata lost. Nothing to compare against;
+            // do not invent a failure for a bundle that may be perfectly good.
+            Log.w(TAG, "current/ has no recorded sha256 — skipping integrity re-check")
+            verifiedBundlePath = bundle
+            return bundle
+        }
+
+        val actual = try {
+            sha256(bundle)
+        } catch (e: Exception) {
+            Log.e(TAG, "Integrity re-check could not hash current/ — refusing the slot", e)
+            integrityFailed = true
+            return null
+        }
+
+        if (!constantTimeEquals(actual, expected)) {
+            Log.e(
+                TAG,
+                "INTEGRITY FAILURE — current/ bundle does not match the sha256 recorded " +
+                    "at install (expected=${expected.take(12)}… actual=${actual.take(12)}…). " +
+                    "The bundle was modified after installation. Falling back to the " +
+                    "binary baseline and clearing the slot.",
+            )
+            integrityFailed = true
+            runCatching { currentSlot.deleteRecursively() }
+            return null
+        }
+
+        verifiedBundlePath = bundle
+        return bundle
+    }
+
+    /** Per-process memo so the active bundle is hashed once, not on every call. */
+    private var verifiedBundlePath: File? = null
+    private var integrityFailed = false
+
+    /** Length-independent comparison, so a mismatch leaks nothing through timing. */
+    private fun constantTimeEquals(a: String, b: String): Boolean {
+        if (a.length != b.length) return false
+        var diff = 0
+        for (i in a.indices) diff = diff or (a[i].code xor b[i].code)
+        return diff == 0
     }
 
     /**
@@ -163,6 +240,8 @@ class SlotManager(private val filesDir: File) {
             bootMarker.delete()
             Log.i(TAG, "Boot marker cleared — bundle marked healthy")
         }
+        // A bundle is only trusted for anti-downgrade once it has run healthily.
+        confirmCurrentSequence()
     }
 
     /**

package/android/src/main/java/com/scalebun/rn/ota/TlsPinning.kt

@@ -0,0 +1,118 @@
+package com.scalebun.rn.ota
+
+import android.content.Context
+import android.util.Base64
+import android.util.Log
+import java.security.MessageDigest
+import java.security.cert.X509Certificate
+import javax.net.ssl.HttpsURLConnection
+import org.json.JSONObject
+
+/**
+ * Optional certificate pinning for the OTA artifact download.
+ *
+ * Pins are **SPKI SHA-256 hashes**, not certificates. Pinning a certificate
+ * breaks on every renewal even when the key is unchanged, which is how pinning
+ * earns its reputation for bricking apps; pinning the public key survives
+ * renewal and only needs rotating when the key itself rotates.
+ *
+ * Configuration is a native asset, `scalebun_tls_pins.json`, alongside the
+ * trusted-key registry — JavaScript must not be able to introduce or remove a
+ * pin, for the same reason it cannot introduce a signing key:
+ *
+ *   { "pins": {
+ *       "api.scalebun.com": ["sha256/AAAA…", "sha256/BBBB…"]
+ *   }}
+ *
+ * **Absent asset = pinning disabled.** That is deliberate. A pin that ships
+ * wrong cannot be fixed over the air — it takes a store release — so this is
+ * opt-in, and refuses to arm with fewer than two pins for a host: one live, one
+ * backup. An operator who pins a single key has built a single point of failure
+ * that a routine key rotation will detonate.
+ */
+object TlsPinning {
+
+    private const val TAG = "ScaleBunOta"
+    private const val ASSET = "scalebun_tls_pins.json"
+    private const val MIN_PINS = 2
+
+    private var loaded = false
+    private var pinsByHost: Map<String, Set<String>> = emptyMap()
+
+    @Synchronized
+    private fun load(context: Context) {
+        if (loaded) return
+        loaded = true
+        try {
+            val json = context.assets.open(ASSET).use {
+                it.readBytes().toString(Charsets.UTF_8)
+            }
+            val root = JSONObject(json).optJSONObject("pins") ?: return
+            val map = mutableMapOf<String, Set<String>>()
+            for (host in root.keys()) {
+                val arr = root.optJSONArray(host) ?: continue
+                val set = (0 until arr.length()).mapNotNull { arr.optString(it, null) }.toSet()
+                if (set.size < MIN_PINS) {
+                    Log.e(
+                        TAG,
+                        "TLS pinning NOT armed for $host — ${set.size} pin(s) configured, " +
+                            "at least $MIN_PINS required (a live pin and a backup). " +
+                            "Shipping one pin means the next key rotation bricks the app.",
+                    )
+                    continue
+                }
+                map[host.lowercase()] = set
+            }
+            pinsByHost = map
+            if (map.isNotEmpty()) {
+                Log.i(TAG, "TLS pinning armed for: ${map.keys.joinToString(", ")}")
+            }
+        } catch (_: Exception) {
+            // No asset shipped: pinning is simply not in use.
+            pinsByHost = emptyMap()
+        }
+    }
+
+    /** True when this host has pins configured, so callers can log honestly. */
+    fun isPinned(context: Context, host: String): Boolean {
+        load(context)
+        return pinsByHost.containsKey(host.lowercase())
+    }
+
+    /**
+     * Verify an established HTTPS connection against the pins for its host.
+     *
+     * Returns true when the connection is acceptable — either because no pins
+     * are configured for that host, or because one of the certificates in the
+     * presented chain matches a pin. Returns false ONLY when pins exist and none
+     * matched, which is a hard failure the caller must treat as a failed
+     * download rather than retrying against the same endpoint.
+     */
+    fun verify(context: Context, connection: HttpsURLConnection, host: String): Boolean {
+        load(context)
+        val expected = pinsByHost[host.lowercase()] ?: return true
+
+        val chain = try {
+            connection.serverCertificates
+        } catch (e: Exception) {
+            Log.e(TAG, "TLS pin check could not read the certificate chain for $host", e)
+            return false
+        }
+
+        for (cert in chain) {
+            val x509 = cert as? X509Certificate ?: continue
+            val spki = x509.publicKey.encoded ?: continue
+            val digest = MessageDigest.getInstance("SHA-256").digest(spki)
+            val pin = "sha256/" + Base64.encodeToString(digest, Base64.NO_WRAP)
+            if (expected.contains(pin)) return true
+        }
+
+        Log.e(
+            TAG,
+            "TLS PIN MISMATCH for $host — the presented certificate chain matches none " +
+                "of the ${expected.size} configured pins. Refusing the download. This is " +
+                "either an interception attempt or a rotated key whose pin was never shipped.",
+        )
+        return false
+    }
+}

package/android/src/oldarch/java/com/scalebun/rn/ota/ScaleBunOtaSpec.kt

@@ -17,6 +17,9 @@ abstract class ScaleBunOtaSpec(reactContext: ReactApplicationContext) :
 
     abstract fun getActiveBundle(): String?
     abstract fun getSlotState(): String
+    abstract fun getTrustedKeyIds(): String
+
+    abstract fun getDeviceIntegrity(): String
     abstract fun stageBundle(sourcePath: String, sha256: String, promise: Promise)
     abstract fun stagePatch(
         patchUrl: String,
@@ -32,12 +35,7 @@ abstract class ScaleBunOtaSpec(reactContext: ReactApplicationContext) :
     // Hand-maintained: this file does NOT regenerate from the JS spec. A method
     // added to NativeScaleBunOta.ts that is missing here compiles green on New
     // Arch and breaks EVERY old-arch consumer's build (the ScaleBunCrashModule
-    // incident). Non-null Strings to match the codegen base's signature, so the
-    // one concrete override compiles against either architecture.
-    abstract fun verifyEd25519(
-        messageHex: String,
-        signatureHex: String,
-        publicKeyHex: String,
-        promise: Promise,
-    )
+    // incident). Keep these in lockstep with src/specs/NativeScaleBunOta.ts.
+    abstract fun verifyRelease(envelopeJson: String, promise: Promise)
+    abstract fun verifyAndStageRelease(envelopeJson: String, promise: Promise)
 }