Bundle Signing & OTA Update Security

Introduction

Over-the-air updates are powerful, but they also introduce security considerations. How do you ensure the update your app downloads is legitimate and hasn't been tampered with?

The answer: cryptographic bundle signing.

The Security Challenge

When you ship an OTA update, your app downloads JavaScript code from a server and executes it. This creates a potential attack vector:

Without signing:

1. Attacker intercepts network request
2. Replaces legitimate bundle with malicious code
3. App downloads and executes malicious bundle
4. User data compromised

With signing:

1. Attacker intercepts network request
2. Replaces legitimate bundle with malicious code
3. App verifies signature → FAILS
4. App rejects update, continues with previous version
5. User protected

How Bundle Signing Works

SwiftPatch uses public-key cryptography (Ed25519) to sign all bundles:

1. Key Generation

When you set up SwiftPatch, you generate a key pair:

swiftpatch generate-keys

# Output:
# Private key: ~/.swiftpatch/private.key (KEEP SECRET!)
# Public key: ~/.swiftpatch/public.key (embed in app)

2. Signing at Build Time

When you deploy an update, SwiftPatch signs the bundle:

swiftpatch release --platform ios --sign

# SwiftPatch:
# 1. Hashes the bundle content
# 2. Signs hash with private key
# 3. Uploads bundle + signature

3. Verification at Runtime

When your app downloads an update:

// SwiftPatch SDK automatically:
// 1. Downloads bundle + signature
// 2. Hashes downloaded bundle
// 3. Verifies signature with embedded public key
// 4. Only applies if verification passes

Implementation Guide

Step 1: Generate Keys

swiftpatch generate-keys --algorithm ed25519

• private.key: Keep in your CI/CD secrets (never commit!)
• public.key: Embed in your React Native app

Step 2: Embed Public Key

// swiftpatch.config.ts
import { SwiftPatch } from 'swiftpatch';

SwiftPatch.init({
  deploymentKey: 'YOUR_DEPLOYMENT_KEY',
  publicKey: 'YOUR_PUBLIC_KEY_HERE',
  requireSignature: true, // Reject unsigned updates
});

Step 3: Sign Releases

# In CI/CD (GitHub Actions example)
swiftpatch release \
  --platform ios \
  --sign \
  --private-key ${{ secrets.SWIFTPATCH_PRIVATE_KEY }}

Best Practices

1. Protect Your Private Key

• Store in CI/CD secrets (GitHub Secrets, AWS Secrets Manager)
• Never commit to git
• Rotate keys annually
• Use separate keys for staging/production

2. Enable Signature Requirement

SwiftPatch.init({
  requireSignature: true, // App rejects unsigned updates
});

3. Use HTTPS Everywhere

Always use HTTPS for update downloads. SwiftPatch enforces this by default.

4. Implement Certificate Pinning

For maximum security, pin your CDN certificates:

SwiftPatch.init({
  certificatePins: [
    'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
  ],
});

Security Audit Compliance

SwiftPatch's signing implementation helps with:

• SOC 2: Integrity controls requirement
• HIPAA: Data integrity safeguards
• PCI DSS: Code signing requirements
• ISO 27001: Asset integrity controls

Conclusion

Bundle signing is essential for production React Native apps. SwiftPatch makes it easy:

1. Generate keys with one command
2. Embed public key in your app
3. Sign releases in CI/CD
4. App automatically verifies

Your users deserve secure updates. Get started with SwiftPatch →