react-native-bspatch 1.1.1 → 1.1.3

package/tools/generate_keys.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// ─────────────────────────────────────────────────────────────────────────────
+// generate_keys.js — Generate Asymmetric Keypair for OTA Patch Signing
+//
+// Usage:
+//   node tools/generate_keys.js [--type rsa|ec] [--out <dir>]
+//   e.g. node tools/generate_keys.js
+// ─────────────────────────────────────────────────────────────────────────────
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const args = process.argv.slice(2);
+let keyType = 'rsa';
+let outDir = process.cwd();
+
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === '--type' && args[i + 1]) {
+    keyType = args[i + 1].toLowerCase();
+    i++;
+  } else if (args[i] === '--out' && args[i + 1]) {
+    outDir = path.resolve(args[i + 1]);
+    i++;
+  }
+}
+
+console.log(`\n=== Generating ${keyType.toUpperCase()} Keypair for OTA Patch Security ===\n`);
+
+let privateKey, publicKey;
+
+if (keyType === 'ec') {
+  const keypair = crypto.generateKeyPairSync('ec', {
+    namedCurve: 'prime256v1',
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+  });
+  privateKey = keypair.privateKey;
+  publicKey = keypair.publicKey;
+} else {
+  // Default: RSA 2048
+  const keypair = crypto.generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+  });
+  privateKey = keypair.privateKey;
+  publicKey = keypair.publicKey;
+}
+
+const privPath = path.join(outDir, 'ota_private_key.pem');
+const pubPath = path.join(outDir, 'ota_public_key.pem');
+
+fs.writeFileSync(privPath, privateKey, { mode: 0o600 });
+fs.writeFileSync(pubPath, publicKey, { mode: 0o644 });
+
+// Clean public key string for inline JS config
+const pubKeyClean = publicKey
+  .replace(/-----BEGIN PUBLIC KEY-----/, '')
+  .replace(/-----END PUBLIC KEY-----/, '')
+  .replace(/\s+/g, '');
+
+console.log(`  ✓ Private Key saved to: ${privPath}`);
+console.log(`  ✓ Public Key saved to:  ${pubPath}`);
+console.log('\n────────────────────────────────────────────────────────');
+console.log('  HOW TO USE:');
+console.log('  1. KEEP PRIVATE KEY SAFE on your build machine / CI server:');
+console.log('     Add "ota_private_key.pem" to .gitignore!');
+console.log('');
+console.log('  2. ADD PUBLIC KEY TO YOUR CLIENT APP CONFIG:');
+console.log('     const otaConfig: OtaConfig = {');
+console.log(`       publicKey: '${pubKeyClean}',`);
+console.log('       ...');
+console.log('     };');
+console.log('────────────────────────────────────────────────────────\n');

package/tools/update_registry.js

@@ -12,6 +12,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 
 const [
   projectRoot,
@@ -61,6 +62,24 @@ if (!registry.apps[appVersion].flavors[flavor]) {
 const flavorGroup = registry.apps[appVersion].flavors[flavor];
 flavorGroup.latestOtaVersion = toOtaVersion;
 
+// ── Check for private key for asymmetric signing ───────────────────────────
+let signingKey = process.env.OTA_PRIVATE_KEY || null;
+if (!signingKey) {
+  const candidateKeyPaths = [
+    path.join(process.cwd(), 'ota_private_key.pem'),
+    path.join(path.dirname(registryPath), 'ota_private_key.pem'),
+    path.join(path.dirname(registryPath), '../ota_private_key.pem'),
+  ];
+  for (const kp of candidateKeyPaths) {
+    if (fs.existsSync(kp)) {
+      try {
+        signingKey = fs.readFileSync(kp, 'utf8');
+        break;
+      } catch (e) {}
+    }
+  }
+}
+
 // ── Update patches ──────────────────────────────────────────────────────────
 if (newPatches.length > 0) {
   // We merge patches by platform to avoid overwriting between Android and iOS
@@ -71,7 +90,32 @@ if (newPatches.length > 0) {
     const fullBundleName = `bundle_${appVersion}_v${toOtaVersion}_${platform}_${flavor}.hbc`;
     const manifestName = path.basename(_assetManifestFile);
 
-    return {
+    let signature = undefined;
+    if (signingKey) {
+      try {
+        const patchFileCandidates = [
+          path.join(path.dirname(registryPath), p.file),
+          path.join(process.cwd(), p.file),
+        ];
+        let patchData = null;
+        for (const pfc of patchFileCandidates) {
+          if (fs.existsSync(pfc)) {
+            patchData = fs.readFileSync(pfc);
+            break;
+          }
+        }
+        if (patchData) {
+          const signer = crypto.createSign('SHA256');
+          signer.update(patchData);
+          signature = signer.sign(signingKey, 'base64');
+          console.log(`  ✓ Signed patch ${p.file} with asymmetric private key`);
+        }
+      } catch (signErr) {
+        console.warn(`  ⚠ Could not sign patch ${p.file}: ${signErr.message}`);
+      }
+    }
+
+    const patchObj = {
       id: `v${p.from}-to-v${p.to}-${flavor}-${platform}`,
       label: `V${p.from} → V${p.to} (${flavor} ${platform})`,
       appVersion,
@@ -85,6 +129,12 @@ if (newPatches.length > 0) {
       assetManifestUrl: manifestName,
       flavor: flavor,
     };
+
+    if (signature) {
+      patchObj.signature = signature;
+    }
+
+    return patchObj;
   });
 
   flavorGroup.patches = [...otherPlatformPatches, ...mappedNewPatches];