Bundle Signing

Bundle signing uses an ECDSA P-256 keypair. The dashboard and every native app binary store the full public key; your release pipeline keeps the private key and passes it to each upload. Server-side registration alone is not enough—the device cannot verify a bundle unless the same public key is compiled into it.

Signing is mandatory for NativeScript. Its prepare hook reads the complete base64 DER SPKI key from NITROPUSH_BUNDLE_PUBLIC_KEY; the private PEM never enters the app. Follow NativeScript setup for the native hook and full-tree signing workflow. Reuse an existing registered keypair; generating another changes the trust root for future uploads.

Generate and register a key:

nitropush app signing-key generate \
  --app APP_ID \
  --out ./nitropush-signing.pem

The command prints the complete base64 DER SubjectPublicKeyInfo value. Copy it without truncation into your native configuration.

For Expo, make a missing key fail the build:

[
  "@nitropush/react-native",
  {
    "deploymentKey": "PROD-XXXXXX",
    "bundlePublicKey": "BASE64_DER_PUBLIC_KEY",
    "requireBundleSigning": true
  }
]

For bare React Native, set NITROPUSH_BUNDLE_PUBLIC_KEY in Info.plist and AndroidManifest <meta-data>. The SDK validates the key during configure() and rejects malformed keys. Once a key is configured, clients accept only schema-4 manifests whose release identity, environment, runtime, platform, OTA sequence, mandatory flag, bundle, and asset inventory share one valid signature.

Add the private key file to .gitignore, then upload signed releases:

nitropush release upload \
  --project PROJECT_ID \
  --environment prod \
  --runtime-version 1.0.0 \
  --label 1.0.1 \
  --bundle-path ./dist-ios \
  --signing-key ./nitropush-signing.pem