ubriot-updates-rn 0.2.0 → 2.0.0

package/android/src/main/java/dev/ubriot/updates/UbriotUpdatesModule.kt

@@ -1,6 +1,7 @@
 package dev.ubriot.updates
 
 import android.content.Context
+import android.content.pm.PackageManager
 import android.util.Base64
 import com.facebook.react.ReactApplication
 import com.facebook.react.bridge.Arguments
@@ -19,12 +20,22 @@ import java.net.HttpURLConnection
 import java.net.URL
 import java.security.MessageDigest
 import java.util.UUID
+import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.Executors
 
 data class UbriotUpdateEntry(val id: String, val bundlePath: String)
 
 data class UbriotDownloadAsset(val key: String, val url: String, val hash: String?, val fileExtension: String)
 
+data class UbriotVerifiedManifest(
+  val id: String,
+  val runtimeVersion: String,
+  val createdAt: String?,
+  val launchUrl: String,
+  val launchHash: String?,
+  val assets: List<UbriotDownloadAsset>,
+)
+
 class UbriotUpdateState(
   var runningId: String? = null,
   var active: UbriotUpdateEntry? = null,
@@ -34,6 +45,8 @@ class UbriotUpdateState(
   var launchCount: Int = 0,
   var revertedFromId: String? = null,
   var failedUpdateIds: MutableList<String> = mutableListOf(),
+  var newestAcceptedCreatedAt: MutableMap<String, String> = mutableMapOf(),
+  var acceptedUpdateIds: MutableList<String> = mutableListOf(),
 )
 
 class UbriotUpdatesModule(
@@ -48,6 +61,7 @@ class UbriotUpdatesModule(
     val constants = HashMap<String, Any?>()
     constants["embeddedBundleUrl"] = null
     constants["supportsAssets"] = true
+    constants["codeSigningEnabled"] = signingConfig() != null
     constants["runningUpdate"] = try {
       val entry = runningEntry
       if (entry == null) null else hashMapOf<String, Any?>("id" to entry.id, "assets" to assetFileUrls(entry.bundlePath, filesDir()))
@@ -66,8 +80,157 @@ class UbriotUpdatesModule(
     }
   }
 
+  private fun signingConfig(): UbriotCodeSigning.Config? = codeSigningConfig(reactContext.applicationContext)
+
+  @ReactMethod
+  fun fetchManifest(request: ReadableMap, promise: Promise) {
+    val url = optString(request, "url")
+    val runtimeVersion = optString(request, "runtimeVersion")
+    val appSlug = optString(request, "appSlug")
+    if (url == null || runtimeVersion == null || appSlug == null) {
+      promise.reject("ubriot_updates_bad_args", "url, runtimeVersion and appSlug are required")
+      return
+    }
+    val headers = HashMap<String, String>()
+    if (request.hasKey("headers") && request.getType("headers") == ReadableType.Map) {
+      val map = request.getMap("headers")
+      val iterator = map?.keySetIterator()
+      while (map != null && iterator != null && iterator.hasNextKey()) {
+        val key = iterator.nextKey()
+        optString(map, key)?.let { headers[key] = it }
+      }
+    }
+    downloadExecutor.execute {
+      try {
+        promise.resolve(resolveManifest(url, headers, runtimeVersion, appSlug))
+      } catch (error: Throwable) {
+        promise.reject("ubriot_updates_fetch_failed", error)
+      }
+    }
+  }
+
+  private fun rejected(reason: String): WritableMap {
+    val map = Arguments.createMap()
+    map.putString("status", "rejected")
+    map.putString("reason", reason)
+    return map
+  }
+
+  private fun readLimited(connection: HttpURLConnection): ByteArray? {
+    connection.inputStream.use { input ->
+      val buffer = java.io.ByteArrayOutputStream()
+      val chunk = ByteArray(16 * 1024)
+      while (true) {
+        val read = input.read(chunk)
+        if (read < 0) break
+        buffer.write(chunk, 0, read)
+        if (buffer.size() > MAX_MANIFEST_BYTES) return null
+      }
+      return buffer.toByteArray()
+    }
+  }
+
+  private fun resolveManifest(url: String, headers: Map<String, String>, runtimeVersion: String, appSlug: String): WritableMap {
+    val config = signingConfig()
+    val connection = (URL(url).openConnection() as HttpURLConnection).apply {
+      instanceFollowRedirects = true
+      connectTimeout = 30000
+      readTimeout = 60000
+      requestMethod = "GET"
+      useCaches = false
+    }
+    try {
+      headers.forEach { (key, value) -> connection.setRequestProperty(key, value) }
+      connection.setRequestProperty("accept", "multipart/mixed,application/expo+json,application/json")
+      val primary = config?.trusted?.firstOrNull()
+      if (primary != null) {
+        connection.setRequestProperty("expo-expect-signature", UbriotCodeSigning.expectSignatureHeader(primary.keyid))
+      }
+      val status = connection.responseCode
+      if (status == 204 || status < 200 || status >= 300) {
+        val none = Arguments.createMap()
+        none.putString("status", "none")
+        return none
+      }
+      val body = readLimited(connection) ?: return rejected("parse-error")
+      val manifestBytes = if (config != null) {
+        val parsed = try {
+          UbriotCodeSigning.parseResponse(connection.contentType, connection.getHeaderField("expo-signature"), body)
+        } catch (error: UbriotCodeSigning.RejectedException) {
+          return rejected(error.reason)
+        }
+        when (val outcome = UbriotCodeSigning.verify(config, parsed)) {
+          is UbriotCodeSigning.Outcome.Rejected -> return rejected(outcome.reason)
+          is UbriotCodeSigning.Outcome.Verified -> outcome.body
+        }
+      } else {
+        body
+      }
+      val json = try {
+        JSONObject(String(manifestBytes, Charsets.UTF_8))
+      } catch (error: Throwable) {
+        return rejected("parse-error")
+      }
+      val manifest = parseVerifiedManifest(json, requireHashes = config != null) ?: return rejected("parse-error")
+      if (config != null) {
+        val state = readState(filesDir())
+        val extra = json.optJSONObject("extra")?.optJSONObject("ubriot")
+        val slugs = extra?.optJSONArray("appSlugs")?.let { array -> (0 until array.length()).map { array.optString(it, "") }.filter { it.isNotEmpty() } }
+          ?: extra?.optString("appSlug", "")?.takeIf { it.isNotEmpty() }?.let { listOf(it) }
+        val boundAppId = if (extra != null && extra.has("appId") && !extra.isNull("appId")) extra.get("appId").toString() else null
+        val allowed = setOfNotNull(state.runningId, state.active?.id, state.lastKnownGood?.id) + state.acceptedUpdateIds
+        val mismatch = UbriotCodeSigning.checkBindings(
+          runtimeVersion,
+          appSlug,
+          manifest.runtimeVersion,
+          boundAppId,
+          slugs,
+          manifest.id,
+          manifest.createdAt,
+          state.newestAcceptedCreatedAt[runtimeVersion],
+          allowed,
+          "android",
+          extra?.optString("platform", "")?.takeIf { it.isNotEmpty() },
+        )
+        if (mismatch != null) return rejected("binding-mismatch")
+      }
+      val token = UUID.randomUUID().toString()
+      verifiedManifests.clear()
+      verifiedManifests[token] = manifest
+      val result = Arguments.createMap()
+      result.putString("status", "available")
+      result.putString("token", token)
+      result.putString("manifestId", manifest.id)
+      result.putString("verification", if (config != null) "verified" else "unsigned-allowed")
+      return result
+    } finally {
+      connection.disconnect()
+    }
+  }
+
   @ReactMethod
   fun downloadUpdate(request: ReadableMap, promise: Promise) {
+    val token = optString(request, "token")
+    if (token != null) {
+      val manifest = verifiedManifests.remove(token)
+      if (manifest == null) {
+        promise.reject("ubriot_updates_unknown_token", "Unknown or expired update token. Check for updates again.")
+        return
+      }
+      stageAndPersist(manifest.id, manifest.launchUrl, manifest.launchHash, manifest.assets, promise) { state ->
+        UbriotCodeSigning.laterInstant(state.newestAcceptedCreatedAt[manifest.runtimeVersion], manifest.createdAt)?.let {
+          state.newestAcceptedCreatedAt[manifest.runtimeVersion] = it
+        }
+        state.acceptedUpdateIds.remove(manifest.id)
+        state.acceptedUpdateIds.add(manifest.id)
+        while (state.acceptedUpdateIds.size > MAX_ACCEPTED_IDS) state.acceptedUpdateIds.removeAt(0)
+      }
+      return
+    }
+    if (signingConfig() != null) {
+      promise.reject("ubriot_updates_signing_required", "Code signing is enabled: download updates through fetchManifest")
+      return
+    }
     val manifestId = if (request.hasKey("id") && request.getType("id") == ReadableType.String) request.getString("id") else null
     if (manifestId.isNullOrEmpty()) {
       promise.reject("ubriot_updates_bad_args", "id is required")
@@ -97,14 +260,27 @@ class UbriotUpdatesModule(
       }
     }
 
+    stageAndPersist(manifestId, launchUrl, launchHash, assets, promise) {}
+  }
+
+  private fun stageAndPersist(
+    manifestId: String,
+    launchUrl: String,
+    launchHash: String?,
+    assets: List<UbriotDownloadAsset>,
+    promise: Promise,
+    onPersisted: (UbriotUpdateState) -> Unit,
+  ) {
     downloadExecutor.execute {
       var staging: File? = null
       try {
         val root = updatesDir(filesDir())
         if (!root.exists()) root.mkdirs()
         val safeId = sanitize(manifestId)
-        staging = File(root, ".staging-$safeId-${UUID.randomUUID()}")
-        val failure = stageUpdate(staging, launchUrl, launchHash, assets)
+        removeAbandonedStagingDirectories(root)
+        staging = File(root, "$STAGING_PREFIX$safeId-${UUID.randomUUID()}")
+        val cacheUsed = HashSet<String>()
+        val failure = stageUpdate(staging, File(root, CACHE_DIR_NAME), launchUrl, launchHash, assets, cacheUsed)
         if (failure != null) {
           staging.deleteRecursively()
           promise.reject("ubriot_updates_download_failed", failure)
@@ -117,9 +293,11 @@ class UbriotUpdatesModule(
           promise.reject("ubriot_updates_write_failed", "Could not persist update")
           return@execute
         }
+        pruneCache(File(root, CACHE_DIR_NAME), cacheUsed)
         val bundle = File(finalDirectory, BUNDLE_FILE)
         val state = readState(filesDir())
         state.pending = UbriotUpdateEntry(manifestId, bundle.absolutePath)
+        onPersisted(state)
         writeState(filesDir(), state)
 
         val result = Arguments.createMap()
@@ -135,6 +313,10 @@ class UbriotUpdatesModule(
 
   @ReactMethod
   fun downloadBundle(url: String, manifestId: String, promise: Promise) {
+    if (signingConfig() != null) {
+      promise.reject("ubriot_updates_signing_required", "Code signing is enabled: download updates through fetchManifest")
+      return
+    }
     Thread {
       var connection: HttpURLConnection? = null
       try {
@@ -279,7 +461,79 @@ class UbriotUpdatesModule(
     private const val STATE_FILE = "state.json"
     private const val BUNDLE_FILE = "index.jsbundle"
     private const val ASSET_INDEX_FILE = "assets.json"
+    private const val CACHE_DIR_NAME = "cache"
+    private const val STAGING_PREFIX = ".staging-"
     private const val MAX_FAILED_IDS = 20
+    private const val MAX_MANIFEST_BYTES = 5 * 1024 * 1024
+    private const val MAX_ACCEPTED_IDS = 50
+    private const val META_CERTIFICATE = "dev.ubriot.updates.CODE_SIGNING_CERTIFICATE"
+    private const val META_METADATA = "dev.ubriot.updates.CODE_SIGNING_METADATA"
+    private const val META_INCLUDE_CHAIN = "dev.ubriot.updates.CODE_SIGNING_INCLUDE_CHAIN"
+    private const val META_ADDITIONAL = "dev.ubriot.updates.ADDITIONAL_CERTIFICATES"
+
+    private val verifiedManifests = ConcurrentHashMap<String, UbriotVerifiedManifest>()
+
+    @Volatile
+    private var signingConfigLoaded = false
+
+    @Volatile
+    private var cachedSigningConfig: UbriotCodeSigning.Config? = null
+
+    fun codeSigningConfig(context: Context): UbriotCodeSigning.Config? {
+      if (signingConfigLoaded) return cachedSigningConfig
+      val config = try {
+        val metaData = context.packageManager.getApplicationInfo(context.packageName, PackageManager.GET_META_DATA).metaData
+        val certificate = metaData?.getString(META_CERTIFICATE)
+        if (metaData == null || certificate.isNullOrBlank()) {
+          null
+        } else {
+          val metadata = metaData.getString(META_METADATA)?.let { JSONObject(it) }
+          val keyid = metadata?.optString("keyid", "")?.ifEmpty { null } ?: UbriotCodeSigning.DEFAULT_KEYID
+          val trusted = mutableListOf(UbriotCodeSigning.TrustedCertificate(certificate, keyid))
+          metaData.getString(META_ADDITIONAL)?.let { raw ->
+            val array = JSONArray(raw)
+            for (index in 0 until array.length()) {
+              val entry = array.optJSONObject(index) ?: continue
+              val pem = entry.optString("certificate", "")
+              val entryKeyid = entry.optString("keyid", "")
+              if (pem.isNotEmpty() && entryKeyid.isNotEmpty()) trusted.add(UbriotCodeSigning.TrustedCertificate(pem, entryKeyid))
+            }
+          }
+          UbriotCodeSigning.Config(trusted, metaData.getBoolean(META_INCLUDE_CHAIN, false))
+        }
+      } catch (error: Throwable) {
+        UbriotCodeSigning.Config(emptyList(), false)
+      }
+      cachedSigningConfig = config
+      signingConfigLoaded = true
+      return config
+    }
+
+    private fun parseVerifiedManifest(json: JSONObject, requireHashes: Boolean): UbriotVerifiedManifest? {
+      val id = json.optString("id", "")
+      val runtimeVersion = json.optString("runtimeVersion", "")
+      val launch = json.optJSONObject("launchAsset") ?: return null
+      val launchUrl = launch.optString("url", "")
+      val launchHash = launch.optString("hash", "").ifEmpty { null }
+      if (id.isEmpty() || launchUrl.isEmpty()) return null
+      if (requireHashes && launchHash == null) return null
+      val assets = mutableListOf<UbriotDownloadAsset>()
+      val array = json.optJSONArray("assets")
+      if (array != null) {
+        for (index in 0 until array.length()) {
+          val item = array.optJSONObject(index) ?: return null
+          val key = item.optString("key", "")
+          val url = item.optString("url", "")
+          val hash = item.optString("hash", "").ifEmpty { null }
+          if (key.isEmpty() || url.isEmpty()) return null
+          if (requireHashes && hash == null) return null
+          val extension = item.optString("fileExtension", "")
+          assets.add(UbriotDownloadAsset(key, url, hash, if (extension.isEmpty() || extension.startsWith(".")) extension else ".$extension"))
+        }
+      }
+      val createdAt = json.optString("createdAt", "").ifEmpty { null }
+      return UbriotVerifiedManifest(id, runtimeVersion, createdAt, launchUrl, launchHash, assets)
+    }
 
     private val downloadExecutor = Executors.newSingleThreadExecutor()
 
@@ -365,16 +619,63 @@ class UbriotUpdatesModule(
       }
     }
 
-    private fun stageUpdate(staging: File, launchUrl: String, launchHash: String?, assets: List<UbriotDownloadAsset>): String? {
+    private fun cacheNameForHash(hash: String?): String? {
+      if (hash.isNullOrEmpty()) return null
+      return sanitize(hash.replace('+', '-').replace('/', '_').trimEnd('='))
+    }
+
+    private fun fetchFile(url: String, destination: File, expectedHash: String?, cacheDir: File, cacheUsed: MutableSet<String>): String? {
+      val cacheName = cacheNameForHash(expectedHash) ?: return downloadFile(url, destination, expectedHash)
+      cacheUsed.add(cacheName)
+      val cached = File(cacheDir, cacheName)
+      if (cached.isFile) {
+        val reused = try {
+          matchesHash(cached, expectedHash) && run {
+            destination.parentFile?.mkdirs()
+            cached.copyTo(destination, overwrite = true)
+            true
+          }
+        } catch (_: Throwable) {
+          false
+        }
+        if (reused) return null
+        cached.delete()
+      }
+      downloadFile(url, destination, expectedHash)?.let { return it }
+      try {
+        cacheDir.mkdirs()
+        destination.copyTo(cached, overwrite = true)
+      } catch (_: Throwable) {
+        cached.delete()
+      }
+      return null
+    }
+
+    private fun pruneCache(cacheDir: File, keep: Set<String>) {
+      cacheDir.listFiles()?.forEach { file -> if (file.name !in keep) file.deleteRecursively() }
+    }
+
+    private fun removeAbandonedStagingDirectories(root: File) {
+      root.listFiles()?.forEach { file -> if (file.name.startsWith(STAGING_PREFIX)) file.deleteRecursively() }
+    }
+
+    private fun stageUpdate(
+      staging: File,
+      cacheDir: File,
+      launchUrl: String,
+      launchHash: String?,
+      assets: List<UbriotDownloadAsset>,
+      cacheUsed: MutableSet<String>,
+    ): String? {
       val assetsDirectory = File(staging, "assets")
       if (!assetsDirectory.mkdirs() && !assetsDirectory.isDirectory) return "Could not create update directory"
-      downloadFile(launchUrl, File(staging, BUNDLE_FILE), launchHash)?.let { return it }
+      fetchFile(launchUrl, File(staging, BUNDLE_FILE), launchHash, cacheDir, cacheUsed)?.let { return it }
       val index = JSONObject()
       for (asset in assets) {
         if (index.has(asset.key)) continue
         val extension = if (asset.fileExtension.isEmpty()) "" else sanitize(asset.fileExtension)
         val relative = "assets/${sanitize(asset.key)}$extension"
-        downloadFile(asset.url, File(staging, relative), asset.hash)?.let { return it }
+        fetchFile(asset.url, File(staging, relative), asset.hash, cacheDir, cacheUsed)?.let { return it }
         index.put(asset.key, relative)
       }
       return try {
@@ -426,6 +727,18 @@ class UbriotUpdatesModule(
       return ids
     }
 
+    private fun newestFromJson(obj: JSONObject?): MutableMap<String, String> {
+      val out = mutableMapOf<String, String>()
+      if (obj == null) return out
+      val keys = obj.keys()
+      while (keys.hasNext()) {
+        val key = keys.next()
+        val value = obj.optString(key, "")
+        if (value.isNotEmpty()) out[key] = value
+      }
+      return out
+    }
+
     private fun recordFailedId(state: UbriotUpdateState, id: String) {
       state.failedUpdateIds.remove(id)
       state.failedUpdateIds.add(id)
@@ -447,6 +760,8 @@ class UbriotUpdatesModule(
           launchCount = json.optInt("launchCount", 0),
           revertedFromId = json.optString("revertedFromId", "").ifEmpty { null },
           failedUpdateIds = failedIdsFromJson(json.optJSONArray("failedUpdateIds")),
+          newestAcceptedCreatedAt = newestFromJson(json.optJSONObject("newestAcceptedCreatedAt")),
+          acceptedUpdateIds = failedIdsFromJson(json.optJSONArray("acceptedUpdateIds")),
         )
       } catch (_: Throwable) {
         UbriotUpdateState()
@@ -467,6 +782,8 @@ class UbriotUpdatesModule(
           .put("launchCount", state.launchCount)
           .put("revertedFromId", state.revertedFromId ?: JSONObject.NULL)
           .put("failedUpdateIds", JSONArray(state.failedUpdateIds))
+          .put("newestAcceptedCreatedAt", JSONObject(state.newestAcceptedCreatedAt as Map<*, *>))
+          .put("acceptedUpdateIds", JSONArray(state.acceptedUpdateIds))
         val target = stateFile(filesDir)
         val temp = File(directory, "$STATE_FILE.tmp")
         temp.writeText(json.toString())

package/code-signing.js

@@ -0,0 +1 @@
+module.exports = require("./plugin/withUbriotCodeSigning");

package/dist/client.d.ts

@@ -40,9 +40,29 @@ export type NativeDownloadRequest = {
         fileExtension: string;
     }[];
 };
+export type VerifiedManifestResult = {
+    status: "none";
+} | {
+    status: "available";
+    token: string;
+    manifestId: string;
+    verification: "verified" | "unsigned-allowed";
+} | {
+    status: "rejected";
+    reason: string;
+};
 export type NativeUbriotUpdates = {
     getState(): Promise<NativeState>;
-    downloadUpdate?(request: NativeDownloadRequest): Promise<{
+    codeSigningEnabled?: boolean;
+    fetchManifest?(request: {
+        url: string;
+        headers: Record<string, string>;
+        runtimeVersion: string;
+        appSlug: string;
+    }): Promise<VerifiedManifestResult>;
+    downloadUpdate?(request: NativeDownloadRequest | {
+        token: string;
+    }): Promise<{
         ready: boolean;
         bundlePath?: string;
     }>;
@@ -62,6 +82,7 @@ export type UpdatesClientDeps = {
     platform: "ios" | "android";
     setTimeout(callback: () => void, ms: number): TimerHandle;
     clearTimeout(handle: TimerHandle): void;
+    codeSigningEnabled?(): boolean;
 };
 export declare const DEFAULT_LAUNCH_FALLBACK_MS = 4000;
 export declare function createUpdatesClient(deps: UpdatesClientDeps): {

package/dist/client.js

@@ -10,9 +10,6 @@ const LAUNCH_PATH = "/ubriot/updates/launch";
 function normalizeBase(apiBase) {
     return apiBase.replace(/\/+$/, "");
 }
-async function verifyManifestSignature(_manifest) {
-    return true;
-}
 function toDownloadRequest(manifest) {
     return {
         id: manifest.id,
@@ -28,6 +25,7 @@ function toDownloadRequest(manifest) {
 function createUpdatesClient(deps) {
     let config = null;
     let stagedManifest = null;
+    let stagedToken = null;
     let launchMarked = false;
     let fallbackTimer = null;
     function optionalNative() {
@@ -47,19 +45,16 @@ function createUpdatesClient(deps) {
         }
         return config;
     }
-    function reportLaunch(outcome, updateId) {
+    function postLaunchReport(body) {
         try {
             if (!config)
                 return;
-            if (!updateId)
-                return;
             const cfg = config;
             const payload = JSON.stringify({
                 appId: cfg.appSlug,
                 channel: cfg.channel,
-                updateId,
                 platform: deps.platform,
-                outcome,
+                ...body,
             });
             void deps
                 .fetch(`${cfg.apiBase}${LAUNCH_PATH}`, {
@@ -71,6 +66,25 @@ function createUpdatesClient(deps) {
         }
         catch { }
     }
+    function reportLaunch(outcome, updateId) {
+        if (!updateId)
+            return;
+        postLaunchReport({ updateId, outcome });
+    }
+    function reportRejection(reason) {
+        postLaunchReport({ outcome: "rejected", reason });
+    }
+    function signingRequired(native, cfg) {
+        var _a;
+        if (cfg.requireCodeSigning === true || native.codeSigningEnabled === true)
+            return true;
+        try {
+            return ((_a = deps.codeSigningEnabled) === null || _a === void 0 ? void 0 : _a.call(deps)) === true;
+        }
+        catch {
+            return false;
+        }
+    }
     function reportRevertIfCrashed() {
         try {
             const native = optionalNative();
@@ -111,6 +125,7 @@ function createUpdatesClient(deps) {
             runtimeVersion: next.runtimeVersion,
             nativeBuildId: next.nativeBuildId,
             nativeBuildCreatedAt: next.nativeBuildCreatedAt,
+            requireCodeSigning: next.requireCodeSigning,
         };
         reportRevertIfCrashed();
     }
@@ -140,6 +155,33 @@ function createUpdatesClient(deps) {
         });
         const url = `${cfg.apiBase}${MANIFEST_PATH}?${query.toString()}`;
         const headers = (0, manifest_headers_1.buildManifestHeaders)(cfg, deps.platform, runningId);
+        stagedManifest = null;
+        stagedToken = null;
+        if (signingRequired(native, cfg)) {
+            if (typeof native.fetchManifest !== "function") {
+                reportRejection("native-unsupported");
+                return { available: false };
+            }
+            let result;
+            try {
+                result = await native.fetchManifest({ url, headers, runtimeVersion: cfg.runtimeVersion, appSlug: cfg.appSlug });
+            }
+            catch {
+                return { available: false };
+            }
+            if ((result === null || result === void 0 ? void 0 : result.status) === "rejected") {
+                reportRejection(result.reason);
+                return { available: false };
+            }
+            if ((result === null || result === void 0 ? void 0 : result.status) !== "available" || !result.token || !result.manifestId) {
+                return { available: false };
+            }
+            if (result.manifestId === runningId || result.manifestId === pendingId || failedIds.includes(result.manifestId)) {
+                return { available: false };
+            }
+            stagedToken = result.token;
+            return { available: true, manifestId: result.manifestId };
+        }
         const response = await deps.fetch(url, { method: "GET", headers });
         if (response.status === 204 || response.status === 304 || !response.ok) {
             stagedManifest = null;
@@ -155,23 +197,34 @@ function createUpdatesClient(deps) {
             stagedManifest = null;
             return { available: false };
         }
-        const trusted = await verifyManifestSignature(raw);
-        if (!trusted) {
-            stagedManifest = null;
-            return { available: false };
-        }
         stagedManifest = manifest;
         return { available: true, manifestId: manifest.id };
     }
     async function downloadUpdate() {
-        requireConfig();
+        const cfg = requireConfig();
         const native = requireNative();
-        if (!stagedManifest) {
+        if (!stagedManifest && !stagedToken) {
             const check = await checkForUpdate();
             if (!check.available) {
                 return { ready: false };
             }
         }
+        if (stagedToken) {
+            const token = stagedToken;
+            stagedToken = null;
+            if (typeof native.downloadUpdate !== "function")
+                return { ready: false };
+            try {
+                const result = await native.downloadUpdate({ token });
+                return { ready: !!(result === null || result === void 0 ? void 0 : result.ready) };
+            }
+            catch {
+                return { ready: false };
+            }
+        }
+        if (signingRequired(native, cfg)) {
+            return { ready: false };
+        }
         const manifest = stagedManifest;
         if (!manifest) {
             return { ready: false };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export type { UbriotUpdatesConfig } from "./manifest-headers";
 export { buildManifestHeaders } from "./manifest-headers";
-export type { UpdateCheckResult, DownloadResult, ApplyOptions, SyncResult, LaunchOutcome, } from "./client";
+export type { UpdateCheckResult, DownloadResult, ApplyOptions, SyncResult, LaunchOutcome, VerifiedManifestResult, } from "./client";
 export { DEFAULT_LAUNCH_FALLBACK_MS } from "./client";
 export declare const configure: (next: import("./manifest-headers").UbriotUpdatesConfig) => void;
 export declare const checkForUpdate: () => Promise<import("./client").UpdateCheckResult>;

package/dist/index.js

@@ -23,7 +23,7 @@ function nativeConstants() {
             constants = (_a = native.getConstants()) !== null && _a !== void 0 ? _a : {};
         }
         else if (native) {
-            constants = { runningUpdate: native.runningUpdate, embeddedBundleUrl: native.embeddedBundleUrl };
+            constants = { runningUpdate: native.runningUpdate, embeddedBundleUrl: native.embeddedBundleUrl, codeSigningEnabled: native.codeSigningEnabled };
         }
     }
     catch {
@@ -57,6 +57,7 @@ const client = (0, client_1.createUpdatesClient)({
     platform: react_native_1.Platform.OS === "android" ? "android" : "ios",
     setTimeout: (callback, ms) => setTimeout(callback, ms),
     clearTimeout: (handle) => clearTimeout(handle),
+    codeSigningEnabled: () => nativeConstants().codeSigningEnabled === true,
 });
 exports.configure = client.configure;
 exports.checkForUpdate = client.checkForUpdate;

package/dist/manifest-headers.d.ts

@@ -5,5 +5,6 @@ export type UbriotUpdatesConfig = {
     runtimeVersion: string;
     nativeBuildId?: string | number;
     nativeBuildCreatedAt?: string;
+    requireCodeSigning?: boolean;
 };
 export declare function buildManifestHeaders(cfg: UbriotUpdatesConfig, platform: "ios" | "android", runningId: string | null): Record<string, string>;