react-native-bspatch 1.1.2 → 1.1.3

package/src/ota/otaMetadata.ts

@@ -106,9 +106,51 @@ export const registerNewVersion = (
     };
 };
 
+/**
+ * Scans the OTA directory and removes old version directories and leftover temporary files
+ * that are no longer referenced in the active metadata.
+ */
+export const cleanupOldVersions = async (
+    metadata: OtaMetadata,
+    baseVersion: number,
+): Promise<void> => {
+    try {
+        if (!(await ReactNativeBlobUtil.fs.exists(OTA_DIR))) return;
+        const items = await ReactNativeBlobUtil.fs.ls(OTA_DIR);
+
+        // Retain current active version and rollback versions
+        const retainedVersions = new Set<number>([
+            metadata.currentVersion,
+            ...(metadata.previousVersions || []),
+        ]);
+
+        for (const item of items) {
+            // Check if directory matches "v<number>"
+            const versionMatch = item.match(/^v(\d+)$/);
+            if (versionMatch) {
+                const ver = parseInt(versionMatch[1], 10);
+                if (!retainedVersions.has(ver) && ver !== baseVersion) {
+                    const dirPath = `${OTA_DIR}/${item}`;
+                    await ReactNativeBlobUtil.fs.unlink(dirPath).catch(() => {});
+                    if (__DEV__) {
+                        console.log(`[otaMetadata] Cleaned up obsolete OTA version: ${item}`);
+                    }
+                }
+            }
+            // Clean up leftover temporary bundle files (.tmp)
+            if (item.endsWith('.tmp')) {
+                await ReactNativeBlobUtil.fs.unlink(`${OTA_DIR}/${item}`).catch(() => {});
+            }
+        }
+    } catch (e) {
+        console.warn('[otaMetadata] Cleanup old versions failed:', e);
+    }
+};
+
 /**
  * Marks the current session as healthy, indicating a successful boot.
  * This prevents the native bridge from rolling back the version on the next launch.
+ * Also cleans up obsolete version directories from disk.
  *
  * @param defaultVersion - Base version for metadata lookup fallback.
  * @returns The updated metadata.
@@ -117,16 +159,16 @@ export const markHealthy = async (
     defaultVersion: number,
 ): Promise<OtaMetadata> => {
     const metadata = await loadMetadata(defaultVersion);
-    if (metadata.lastLaunchSuccessful && metadata.rollbackCount === 0) {
-        return metadata;
-    }
-
     const updated: OtaMetadata = {
         ...metadata,
         lastLaunchSuccessful: true,
         rollbackCount: 0,
     };
     await saveMetadata(updated);
+
+    // Garbage collect older versions on disk to free storage
+    await cleanupOldVersions(updated, defaultVersion);
+
     return updated;
 };
 

package/src/ota/storage/CustomStorage.ts

@@ -7,8 +7,15 @@ interface TokenCache {
     expiresAt: number;
 }
 
+interface RegistryCache {
+    etag?: string;
+    patches: OtaPatch[];
+}
+
 /** Cache tokens per server endpoint so switching configs invalidates stale tokens. */
 const tokenCache = new Map<string, TokenCache>();
+/** Cache registry ETag and parsed patches to avoid redownloading unmodified manifests. */
+const registryCache = new Map<string, RegistryCache>();
 
 /**
  * Implementation for the custom MinIO-based storage server.
@@ -60,6 +67,8 @@ export class CustomStorageProvider implements OtaStorageProvider {
 
     const { baseUrl, channel, baseFolder = 'bspatch' } = config.customServer;
     const registryPath = `${baseFolder}/ota_registry.json`;
+    const regCacheKey = `${baseUrl}|${registryPath}|${config.appVersion}|${channel}`;
+    const cachedReg = registryCache.get(regCacheKey);
 
     try {
       const token = await this.getAccessToken(config);
@@ -74,11 +83,23 @@ export class CustomStorageProvider implements OtaStorageProvider {
       const registryUrl = linkJson.data;
       if (!registryUrl) throw new Error('Failed to generate registry download link');
 
-      const registryRes = await ReactNativeBlobUtil.fetch('GET', registryUrl);
+      const reqHeaders: Record<string, string> = {};
+      if (cachedReg?.etag) {
+        reqHeaders['If-None-Match'] = cachedReg.etag;
+      }
+
+      const registryRes = await ReactNativeBlobUtil.fetch('GET', registryUrl, reqHeaders);
+      if (registryRes.respInfo.status === 304 && cachedReg) {
+        return cachedReg.patches;
+      }
       if (registryRes.respInfo.status !== 200) {
         throw new Error(`Registry fetch failed with status ${registryRes.respInfo.status}`);
       }
 
+      const etag = registryRes.respInfo.headers?.['etag'] || registryRes.respInfo.headers?.['ETag'];
+      if (!config.appVersion) {
+        throw new Error('[CustomStorage] config.appVersion is required to query OTA registry');
+      }
       const registry = JSON.parse(registryRes.data);
       const appGroup = registry?.apps?.[config.appVersion];
       const flavorGroup = appGroup?.flavors?.[channel.toLowerCase()];
@@ -87,10 +108,12 @@ export class CustomStorageProvider implements OtaStorageProvider {
         return config.bundledPatches || [];
       }
 
-      return (flavorGroup.patches || []).filter((p: OtaPatch) => p.platform === Platform.OS);
+      const matchedPatches = (flavorGroup.patches || []).filter((p: OtaPatch) => p.platform === Platform.OS);
+      registryCache.set(regCacheKey, { etag, patches: matchedPatches });
+      return matchedPatches;
     } catch (error) {
       console.warn('[CustomStorage] Manifest fetch error:', (error as Error).message);
-      return config.bundledPatches || [];
+      return cachedReg?.patches || config.bundledPatches || [];
     }
   }
 

package/src/ota/storage/GitHubRawStorage.ts

@@ -61,6 +61,11 @@ export class GitHubRawStorageProvider implements OtaStorageProvider {
                     ? JSON.parse(res.data)
                     : res.data;
 
+            if (!config.appVersion) {
+                throw new Error(
+                    '[GitHubRawStorage] config.appVersion is required to query OTA registry',
+                );
+            }
             const appGroup = registry?.apps?.[config.appVersion];
             const flavorGroup = appGroup?.flavors?.[channelName];
 

package/src/ota/storage/GitHubReleaseStorage.ts

@@ -59,6 +59,11 @@ export class GitHubReleaseStorageProvider implements OtaStorageProvider {
             }
 
             // Structured: apps["1.0.0"].channels["production"].patches[]
+            if (!config.appVersion) {
+                throw new Error(
+                    '[GitHubReleaseStorage] config.appVersion is required to query OTA registry',
+                );
+            }
             const appGroup = registry?.apps?.[config.appVersion];
             const channelGroup = appGroup?.channels?.[config.githubRelease.repo] // use repo as channel fallback
                 ?? appGroup?.channels?.production

package/src/ota/types.ts

@@ -117,8 +117,8 @@ export type OtaNetworkStrategy = {
 };
 
 export type OtaConfig = {
-    /** Current app versionName (e.g. "1.0.0") */
-    appVersion: string;
+    /** Current app versionName (e.g. "1.0.0"). If omitted, auto-detected from native app. */
+    appVersion?: string;
     /** Initial version baked into the APK (usually 1) */
     baseAppVersion: number;
     /** Default patches if manifest fetch fails */
@@ -213,8 +213,12 @@ export type OtaState = {
     pendingCount: number;
     isChecking: boolean;
     metrics: OtaMetrics | null;
+    /** True if a background update has been downloaded and prepared silently */
+    isUpdateReady: boolean;
     applyUpdate: () => Promise<void>;
     resetToFactory: () => Promise<void>;
     markAsHealthy: () => Promise<void>;
     checkUpdate: () => Promise<void>;
+    /** Reload the React Native JS bundle immediately to apply downloaded update */
+    reloadBundle: () => void;
 };

package/tools/build_ota.sh

@@ -42,6 +42,8 @@ fi
 FLAVOR="dev"
 ACTION="ota"
 PLATFORM_ARG=""
+APP_VERSION_ARG=""
+NON_INTERACTIVE=false
 
 PUSH_REMOTE=false
 # Arg parsing
@@ -49,6 +51,8 @@ while [[ "$#" -gt 0 ]]; do
   case $1 in
     --platform) PLATFORM_ARG="$2"; shift ;;
     --flavor) FLAVOR="$2"; shift ;;
+    --app-version) APP_VERSION_ARG="$2"; shift ;;
+    -y|--yes|--non-interactive) NON_INTERACTIVE=true ;;
     --push) PUSH_REMOTE=true ;;
     reset|base) ACTION="$1" ;;
     setup) ACTION="$1" ;;
@@ -239,19 +243,111 @@ sha256() {
   shasum -a 256 "$1" | awk '{print $1}'
 }
 
-# ── Extract APP_VERSION from otaConfig.ts ─────────────────────────────────────
-APP_VERSION=$(node -e "
+# ── Auto-Detect APP_VERSION ──────────────────────────────────────────────────
+APP_VERSION_INFO=$(node -e "
   const fs = require('fs');
-  const content = fs.readFileSync('$ROOT/src/ota/otaConfig.ts', 'utf8');
-  const match = content.match(/export const APP_VERSION = ['\"](.+?)['\"]/);
-  console.log(match ? match[1] : 'unknown');
+  const path = require('path');
+  const root = '$ROOT';
+  const cliOverride = '$APP_VERSION_ARG';
+
+  if (cliOverride && cliOverride !== '') {
+    console.log(JSON.stringify({ version: cliOverride, source: 'CLI --app-version' }));
+    process.exit(0);
+  }
+
+  // 1. Try android/app/build.gradle (most reliable for Android release)
+  try {
+    const gradlePath = path.join(root, 'android/app/build.gradle');
+    if (fs.existsSync(gradlePath)) {
+      const content = fs.readFileSync(gradlePath, 'utf8');
+      const match = content.match(/versionName\\s+[\"']([^\"']+)[\"']/);
+      if (match && match[1] !== '0.0.0' && match[1] !== '0.0.1') {
+        console.log(JSON.stringify({ version: match[1], source: 'android/app/build.gradle' }));
+        process.exit(0);
+      }
+    }
+  } catch (e) {}
+
+  // 2. Try ios project.pbxproj (most reliable for iOS release)
+  try {
+    const iosDir = path.join(root, 'ios');
+    if (fs.existsSync(iosDir)) {
+      const files = fs.readdirSync(iosDir);
+      for (const f of files) {
+        if (f.endsWith('.xcodeproj')) {
+          const pbxPath = path.join(iosDir, f, 'project.pbxproj');
+          if (fs.existsSync(pbxPath)) {
+            const content = fs.readFileSync(pbxPath, 'utf8');
+            const match = content.match(/MARKETING_VERSION\\s*=\\s*([^;]+);/);
+            if (match && match[1].trim() !== '0.0.0' && match[1].trim() !== '0.0.1') {
+              console.log(JSON.stringify({ version: match[1].trim(), source: 'ios/' + f }));
+              process.exit(0);
+            }
+          }
+        }
+      }
+    }
+  } catch (e) {}
+
+  // 3. Try package.json
+  try {
+    const pkgPath = path.join(root, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      if (pkg.version && pkg.version !== '0.0.0' && pkg.version !== '0.0.1') {
+        console.log(JSON.stringify({ version: pkg.version, source: 'package.json' }));
+        process.exit(0);
+      }
+    }
+  } catch (e) {}
+
+  // 4. Fallback: src/ota/otaConfig.ts
+  try {
+    const otaConfigPath = path.join(root, 'src/ota/otaConfig.ts');
+    if (fs.existsSync(otaConfigPath)) {
+      const content = fs.readFileSync(otaConfigPath, 'utf8');
+      const match = content.match(/export const APP_VERSION = ['\"](.+?)['\"]/);
+      if (match) {
+        console.log(JSON.stringify({ version: match[1], source: 'src/ota/otaConfig.ts' }));
+        process.exit(0);
+      }
+    }
+  } catch (e) {}
+
+  console.log(JSON.stringify({ version: 'unknown', source: 'none' }));
 ")
 
-if [ "$APP_VERSION" == "unknown" ]; then
-  echo "ERROR: Could not find APP_VERSION in otaConfig.ts"
+APP_VERSION=$(node -e "try { console.log(JSON.parse('$APP_VERSION_INFO').version); } catch(e) { console.log('unknown'); }")
+APP_VERSION_SOURCE=$(node -e "try { console.log(JSON.parse('$APP_VERSION_INFO').source); } catch(e) { console.log('none'); }")
+
+# Interactive confirmation / prompt:
+# Prompt if running in an interactive terminal, not in reset mode, and no explicit flags passed
+if [ -t 0 ] && [ -z "$APP_VERSION_ARG" ] && [ "$NON_INTERACTIVE" = false ] && [ "$ACTION" != "reset" ]; then
+  echo ""
+  echo "────────────────────────────────────────────────────────"
+  if [ "$APP_VERSION" != "unknown" ]; then
+    echo "  Detected Native App Version: $APP_VERSION ($APP_VERSION_SOURCE)"
+    read -p "  Enter App Version to build [Press Enter for '$APP_VERSION']: " USER_INPUT_VER
+  else
+    read -p "  Enter Native App Version to build (e.g. 1.0.0): " USER_INPUT_VER
+  fi
+  echo "────────────────────────────────────────────────────────"
+  echo ""
+
+  if [ -n "$USER_INPUT_VER" ]; then
+    APP_VERSION=$(echo "$USER_INPUT_VER" | tr -d ' ')
+    APP_VERSION_SOURCE="User Input"
+  fi
+fi
+
+if [ "$APP_VERSION" == "unknown" ] || [ -z "$APP_VERSION" ]; then
+  echo "ERROR: Native App Version is required to build OTA updates."
+  echo "       Please enter a valid version or use: ./build_ota.sh --app-version <version>"
   exit 1
 fi
 
+echo "  ✓ Building OTA for APP_VERSION=$APP_VERSION (Source: $APP_VERSION_SOURCE)"
+
 # ── Reset ─────────────────────────────────────────────────────────────────────
 if [ "$ACTION" = "reset" ]; then
   echo "Resetting OTA registry and output for flavor '$FLAVOR_LOWER'..."

package/tools/bump_version.js

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+// ─────────────────────────────────────────────────────────────────────────────
+// bump_version.js — Synchronize App Version Across Platforms
+//
+// Updates:
+//   - package.json ("version")
+//   - android/app/build.gradle (versionName & increments versionCode)
+//   - ios/*.xcodeproj/project.pbxproj (MARKETING_VERSION & increments CURRENT_PROJECT_VERSION)
+//   - src/ota/otaConfig.ts (APP_VERSION, if it exists)
+//
+// Usage:
+//   node bump_version.js <new_version> [--root <path>]
+//   e.g. node bump_version.js 1.0.2
+// ─────────────────────────────────────────────────────────────────────────────
+
+const fs = require('fs');
+const path = require('path');
+
+const args = process.argv.slice(2);
+let newVersion = '';
+let rootDir = process.cwd();
+
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === '--root' && args[i + 1]) {
+    rootDir = path.resolve(args[i + 1]);
+    i++;
+  } else if (!args[i].startsWith('--')) {
+    newVersion = args[i].trim();
+  }
+}
+
+if (!newVersion) {
+  console.error('Usage: node bump_version.js <new_version> [--root <path>]');
+  console.error('Example: node bump_version.js 1.0.2');
+  process.exit(1);
+}
+
+// Validate semver format loosely (e.g. 1.0.2 or 1.0.2-beta)
+if (!/^\d+\.\d+\.\d+.*$/.test(newVersion)) {
+  console.error(`Invalid version format: "${newVersion}". Expected semver (e.g. 1.0.2)`);
+  process.exit(1);
+}
+
+console.log(`\n=== Bumping App Version to ${newVersion} ===\n`);
+let changedCount = 0;
+
+// 1. package.json
+const pkgPath = path.join(rootDir, 'package.json');
+if (fs.existsSync(pkgPath)) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    const oldVer = pkg.version;
+    pkg.version = newVersion;
+    fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+    console.log(`  ✓ package.json: ${oldVer} → ${newVersion}`);
+    changedCount++;
+  } catch (e) {
+    console.warn(`  ⚠ Failed to update package.json: ${e.message}`);
+  }
+}
+
+// 2. android/app/build.gradle
+const gradlePath = path.join(rootDir, 'android/app/build.gradle');
+if (fs.existsSync(gradlePath)) {
+  try {
+    let content = fs.readFileSync(gradlePath, 'utf8');
+    let oldName = '';
+    let newCode = 1;
+
+    // Bump versionName
+    content = content.replace(/versionName\s+["']([^"']+)["']/, (_, old) => {
+      oldName = old;
+      return `versionName "${newVersion}"`;
+    });
+
+    // Increment versionCode
+    content = content.replace(/versionCode\s+(\d+)/, (_, code) => {
+      newCode = parseInt(code, 10) + 1;
+      return `versionCode ${newCode}`;
+    });
+
+    fs.writeFileSync(gradlePath, content, 'utf8');
+    console.log(`  ✓ android/app/build.gradle: versionName "${oldName}" → "${newVersion}", versionCode → ${newCode}`);
+    changedCount++;
+  } catch (e) {
+    console.warn(`  ⚠ Failed to update build.gradle: ${e.message}`);
+  }
+}
+
+// 3. iOS Xcode project.pbxproj
+const iosDir = path.join(rootDir, 'ios');
+if (fs.existsSync(iosDir)) {
+  try {
+    const files = fs.readdirSync(iosDir);
+    for (const f of files) {
+      if (f.endsWith('.xcodeproj')) {
+        const pbxPath = path.join(iosDir, f, 'project.pbxproj');
+        if (fs.existsSync(pbxPath)) {
+          let content = fs.readFileSync(pbxPath, 'utf8');
+
+          // Replace MARKETING_VERSION
+          content = content.replace(/MARKETING_VERSION\s*=\s*[^;]+;/g, `MARKETING_VERSION = ${newVersion};`);
+
+          // Increment CURRENT_PROJECT_VERSION if numeric
+          content = content.replace(/CURRENT_PROJECT_VERSION\s*=\s*(\d+);/g, (_, v) => {
+            const nextV = parseInt(v, 10) + 1;
+            return `CURRENT_PROJECT_VERSION = ${nextV};`;
+          });
+
+          fs.writeFileSync(pbxPath, content, 'utf8');
+          console.log(`  ✓ ios/${f}/project.pbxproj: MARKETING_VERSION → ${newVersion}`);
+          changedCount++;
+        }
+      }
+    }
+  } catch (e) {
+    console.warn(`  ⚠ Failed to update iOS project: ${e.message}`);
+  }
+}
+
+// 4. src/ota/otaConfig.ts (if exists)
+const otaConfigPath = path.join(rootDir, 'src/ota/otaConfig.ts');
+if (fs.existsSync(otaConfigPath)) {
+  try {
+    let content = fs.readFileSync(otaConfigPath, 'utf8');
+    content = content.replace(/export const APP_VERSION = ['"][^'"]+['"];/, `export const APP_VERSION = '${newVersion}';`);
+    fs.writeFileSync(otaConfigPath, content, 'utf8');
+    console.log(`  ✓ src/ota/otaConfig.ts: APP_VERSION → '${newVersion}'`);
+    changedCount++;
+  } catch (e) {}
+}
+
+console.log(`\n✓ Done! Updated ${changedCount} file(s) to version ${newVersion}.\n`);

package/tools/generate_keys.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// ─────────────────────────────────────────────────────────────────────────────
+// generate_keys.js — Generate Asymmetric Keypair for OTA Patch Signing
+//
+// Usage:
+//   node tools/generate_keys.js [--type rsa|ec] [--out <dir>]
+//   e.g. node tools/generate_keys.js
+// ─────────────────────────────────────────────────────────────────────────────
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const args = process.argv.slice(2);
+let keyType = 'rsa';
+let outDir = process.cwd();
+
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === '--type' && args[i + 1]) {
+    keyType = args[i + 1].toLowerCase();
+    i++;
+  } else if (args[i] === '--out' && args[i + 1]) {
+    outDir = path.resolve(args[i + 1]);
+    i++;
+  }
+}
+
+console.log(`\n=== Generating ${keyType.toUpperCase()} Keypair for OTA Patch Security ===\n`);
+
+let privateKey, publicKey;
+
+if (keyType === 'ec') {
+  const keypair = crypto.generateKeyPairSync('ec', {
+    namedCurve: 'prime256v1',
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+  });
+  privateKey = keypair.privateKey;
+  publicKey = keypair.publicKey;
+} else {
+  // Default: RSA 2048
+  const keypair = crypto.generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
+  });
+  privateKey = keypair.privateKey;
+  publicKey = keypair.publicKey;
+}
+
+const privPath = path.join(outDir, 'ota_private_key.pem');
+const pubPath = path.join(outDir, 'ota_public_key.pem');
+
+fs.writeFileSync(privPath, privateKey, { mode: 0o600 });
+fs.writeFileSync(pubPath, publicKey, { mode: 0o644 });
+
+// Clean public key string for inline JS config
+const pubKeyClean = publicKey
+  .replace(/-----BEGIN PUBLIC KEY-----/, '')
+  .replace(/-----END PUBLIC KEY-----/, '')
+  .replace(/\s+/g, '');
+
+console.log(`  ✓ Private Key saved to: ${privPath}`);
+console.log(`  ✓ Public Key saved to:  ${pubPath}`);
+console.log('\n────────────────────────────────────────────────────────');
+console.log('  HOW TO USE:');
+console.log('  1. KEEP PRIVATE KEY SAFE on your build machine / CI server:');
+console.log('     Add "ota_private_key.pem" to .gitignore!');
+console.log('');
+console.log('  2. ADD PUBLIC KEY TO YOUR CLIENT APP CONFIG:');
+console.log('     const otaConfig: OtaConfig = {');
+console.log(`       publicKey: '${pubKeyClean}',`);
+console.log('       ...');
+console.log('     };');
+console.log('────────────────────────────────────────────────────────\n');

package/tools/update_registry.js

@@ -12,6 +12,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 
 const [
   projectRoot,
@@ -61,6 +62,24 @@ if (!registry.apps[appVersion].flavors[flavor]) {
 const flavorGroup = registry.apps[appVersion].flavors[flavor];
 flavorGroup.latestOtaVersion = toOtaVersion;
 
+// ── Check for private key for asymmetric signing ───────────────────────────
+let signingKey = process.env.OTA_PRIVATE_KEY || null;
+if (!signingKey) {
+  const candidateKeyPaths = [
+    path.join(process.cwd(), 'ota_private_key.pem'),
+    path.join(path.dirname(registryPath), 'ota_private_key.pem'),
+    path.join(path.dirname(registryPath), '../ota_private_key.pem'),
+  ];
+  for (const kp of candidateKeyPaths) {
+    if (fs.existsSync(kp)) {
+      try {
+        signingKey = fs.readFileSync(kp, 'utf8');
+        break;
+      } catch (e) {}
+    }
+  }
+}
+
 // ── Update patches ──────────────────────────────────────────────────────────
 if (newPatches.length > 0) {
   // We merge patches by platform to avoid overwriting between Android and iOS
@@ -71,7 +90,32 @@ if (newPatches.length > 0) {
     const fullBundleName = `bundle_${appVersion}_v${toOtaVersion}_${platform}_${flavor}.hbc`;
     const manifestName = path.basename(_assetManifestFile);
 
-    return {
+    let signature = undefined;
+    if (signingKey) {
+      try {
+        const patchFileCandidates = [
+          path.join(path.dirname(registryPath), p.file),
+          path.join(process.cwd(), p.file),
+        ];
+        let patchData = null;
+        for (const pfc of patchFileCandidates) {
+          if (fs.existsSync(pfc)) {
+            patchData = fs.readFileSync(pfc);
+            break;
+          }
+        }
+        if (patchData) {
+          const signer = crypto.createSign('SHA256');
+          signer.update(patchData);
+          signature = signer.sign(signingKey, 'base64');
+          console.log(`  ✓ Signed patch ${p.file} with asymmetric private key`);
+        }
+      } catch (signErr) {
+        console.warn(`  ⚠ Could not sign patch ${p.file}: ${signErr.message}`);
+      }
+    }
+
+    const patchObj = {
       id: `v${p.from}-to-v${p.to}-${flavor}-${platform}`,
       label: `V${p.from} → V${p.to} (${flavor} ${platform})`,
       appVersion,
@@ -85,6 +129,12 @@ if (newPatches.length > 0) {
       assetManifestUrl: manifestName,
       flavor: flavor,
     };
+
+    if (signature) {
+      patchObj.signature = signature;
+    }
+
+    return patchObj;
   });
 
   flavorGroup.patches = [...otherPlatformPatches, ...mappedNewPatches];