expo-updates 58.0.18 → 58.0.20

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 58.0.20
+
+### Patch Changes
+
+- Remove the BouncyCastle dependency on Android. ([#52379](https://github.com/expo/expo/pull/52379) by [@lukmccall](https://github.com/lukmccall))
+
+## 58.0.19
+
+### Patch Changes
+
+- Upgrade React Native to 0.88.1. ([#52404](https://github.com/expo/expo/pull/52404) by [@intergalacticspacehighway](https://github.com/intergalacticspacehighway))
+
 ## 58.0.18
 
 ### Patch Changes

package/android/build.gradle

@@ -42,7 +42,7 @@ expoModule {
 }
 
 group = 'host.exp.exponent'
-version = '58.0.18'
+version = '58.0.20'
 
 // Utility method to derive boolean values from the environment or from Java properties,
 // and return them as strings to be used in BuildConfig fields
@@ -103,7 +103,7 @@ android {
   namespace "expo.modules.updates"
   defaultConfig {
     versionCode 31
-    versionName '58.0.18'
+    versionName '58.0.20'
     consumerProguardFiles("proguard-rules.pro")
     testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 
@@ -176,7 +176,6 @@ dependencies {
   implementation("com.squareup.okhttp3:okhttp-urlconnection:4.9.2")
   implementation("com.squareup.zstd:zstd-kmp-okio:0.4.0")
   implementation("org.brotli:dec:0.1.2")
-  implementation("org.bouncycastle:bcutil-jdk15to18:1.81")
 
   compileOnly 'com.facebook.fbjni:fbjni:0.3.0'
 

package/android/src/main/java/expo/modules/updates/codesigning/CertificateChain.kt

@@ -1,7 +1,5 @@
 package expo.modules.updates.codesigning
 
-import org.bouncycastle.asn1.ASN1Primitive
-import org.bouncycastle.asn1.DEROctetString
 import java.security.cert.CertificateException
 import java.security.cert.CertificateFactory
 import java.security.cert.X509Certificate
@@ -13,6 +11,8 @@ private const val CODE_SIGNING_OID = "1.3.6.1.5.5.7.3.3"
 // OID of expo project info, stored as `<projectId>,<scopeKey>`
 private const val EXPO_PROJECT_INFORMATION_OID = "1.2.840.113556.1.8000.2554.43437.254.128.102.157.7894389.20439.2.1"
 
+private const val DER_OCTET_STRING_TAG = 0x04
+
 data class ExpoProjectInformation(val projectId: String, val scopeKey: String)
 
 /**
@@ -60,13 +60,7 @@ class CertificateChain(private val certificateStrings: List<String>) {
 
     fun X509Certificate.expoProjectInformation(): ExpoProjectInformation? {
       return getExtensionValue(EXPO_PROJECT_INFORMATION_OID)?.let {
-        ASN1Primitive.fromByteArray(it)
-      }?.let {
-        if (it is DEROctetString) {
-          it.octets.decodeToString()
-        } else {
-          null
-        }
+        decodeDerOctetString(it).decodeToString()
       }?.let {
         val components = it.split(',').map { component -> component.trim() }
         if (components.size != 2) {
@@ -76,6 +70,38 @@ class CertificateChain(private val certificateStrings: List<String>) {
       }
     }
 
+    /**
+     * Returns the contents of the DER-encoded OCTET STRING.
+     * Throws for any other input, so that a malformed extension never reads as a missing one.
+     */
+    private fun decodeDerOctetString(der: ByteArray): ByteArray {
+      val invalid = { throw CertificateException("Invalid Expo project information extension value") }
+
+      val input = der.inputStream()
+      if (input.read() != DER_OCTET_STRING_TAG) {
+        invalid()
+      }
+      var length = input.read()
+      // Long form: 0x81-0x83 means that the next 1-3 bytes hold the length.
+      if (length >= 0x80) {
+        val lengthByteCount = length - 0x80
+        if (lengthByteCount !in 1..3 || input.available() < lengthByteCount) {
+          invalid()
+        }
+
+        length = 0
+        repeat(lengthByteCount) {
+          length = (length shl 8) or input.read()
+        }
+      }
+
+      if (length != input.available()) {
+        invalid()
+      }
+
+      return input.readBytes()
+    }
+
     private fun X509Certificate.isCACertificate(): Boolean {
       return basicConstraints > -1 && keyUsage != null && keyUsage.isNotEmpty() && keyUsage[5]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-updates",
-  "version": "58.0.18",
+  "version": "58.0.20",
   "description": "Fetches and manages remotely-hosted assets and updates to your app's JS bundle.",
   "keywords": [
     "expo",
@@ -49,7 +49,7 @@
     "@expo/env": "^2.5.3",
     "@expo/plist": "^0.10.1",
     "@expo/spawn-async": "^1.8.0",
-    "@react-native/asset-utils": "0.88.0",
+    "@react-native/asset-utils": "0.88.1",
     "arg": "^4.1.0",
     "chalk": "^4.1.2",
     "debug": "^4.3.4",
@@ -64,8 +64,8 @@
     "resolve-from": "^5.0.0"
   },
   "devDependencies": {
-    "@expo/internal-scripts": "58.0.4",
-    "@expo/metro-config": "58.0.16",
+    "@expo/internal-scripts": "58.0.5",
+    "@expo/metro-config": "58.0.20",
     "@testing-library/react-native": "^14.0.1",
     "@types/debug": "^4.1.7",
     "@types/getenv": "^1.0.3",
@@ -75,7 +75,7 @@
     "@types/picomatch": "^4.0.0",
     "@types/react": "~19.3.0",
     "@vercel/ncc": "^0.38.4",
-    "expo-dev-client": "58.0.14",
+    "expo-dev-client": "58.0.18",
     "express": "^5.1.0",
     "form-data": "^4.0.4",
     "memfs": "^3.6.0",