feat: code signing support (#43)

### Summary

- Added code-signing support for all of the mini-apps.
- Added public keys for validating the bundles to the host app
- Changed location of news bundle in catalog-server

Co-authored-by: andrewworld <andandalex@gmail.com>

Author: jbroma

.gitignore

@@ -10,4 +10,8 @@ node_modules
 
 /*.tgz
 
-build/
+build/
+
+# Code Signing
+code-signing.pem
+code-signing.pem.pub

packages/auth/webpack.config.mjs

@@ -270,6 +270,10 @@ export default env => {
           },
         },
       }),
+      new Repack.plugins.CodeSigningPlugin({
+        privateKeyPath: path.join('..', '..', './code-signing.pem'),
+        outputPath: path.join('build', 'outputs', platform, 'remotes'),
+      }),
     ],
   };
 };

packages/booking/webpack.config.mjs

@@ -1,7 +1,7 @@
 import * as Repack from '@callstack/repack';
 import path from 'path';
 import TerserPlugin from 'terser-webpack-plugin';
-import { deps } from '../../shared/dependencies.mjs';
+import {deps} from '../../shared/dependencies.mjs';
 
 /**
  * More documentation, installation, usage, motivation and differences with Metro is available at:
@@ -253,6 +253,10 @@ export default env => {
          */
         shared: deps,
       }),
+      new Repack.plugins.CodeSigningPlugin({
+        privateKeyPath: path.join('..', '..', './code-signing.pem'),
+        outputPath: path.join('build', 'outputs', platform, 'remotes'),
+      }),
     ],
   };
 };

packages/catalog-server/data/host.json

@@ -1,20 +1,20 @@
 {
-    "ios": {
-        "0.0.1": {
-            "booking": "http://localhost:9000/[name][ext]",
-            "shopping": "http://localhost:9001/[name][ext]",
-            "news": "https://raw.githubusercontent.com/callstack/news-mini-app-showcase/main/build/generated/ios/[name][ext]",
-            "dashboard": "http://localhost:9002/[name][ext]",
-            "auth": "http://localhost:9003/[name][ext]"
-        }
-    },
-    "android": {
-        "0.0.1": {
-            "booking": "http://localhost:9000/[name][ext]",
-            "shopping": "http://localhost:9001/[name][ext]",
-            "news": "https://raw.githubusercontent.com/callstack/news-mini-app-showcase/main/build/generated/android/[name][ext]",
-            "dashboard": "http://localhost:9002/[name][ext]",
-            "auth": "http://localhost:9003/[name][ext]"
-        }
+  "ios": {
+    "0.0.1": {
+      "booking": "http://localhost:9000/[name][ext]",
+      "shopping": "http://localhost:9001/[name][ext]",
+      "news": "https://raw.githubusercontent.com/callstack/news-mini-app-showcase/main/build/outputs/ios/remotes/[name][ext]",
+      "dashboard": "http://localhost:9002/[name][ext]",
+      "auth": "http://localhost:9003/[name][ext]"
     }
-}
+  },
+  "android": {
+    "0.0.1": {
+      "booking": "http://localhost:9000/[name][ext]",
+      "shopping": "http://localhost:9001/[name][ext]",
+      "news": "https://raw.githubusercontent.com/callstack/news-mini-app-showcase/main/build/outputs/android/remotes/[name][ext]",
+      "dashboard": "http://localhost:9002/[name][ext]",
+      "auth": "http://localhost:9003/[name][ext]"
+    }
+  }
+}

packages/dashboard/webpack.config.mjs

@@ -258,6 +258,10 @@ export default env => {
          */
         shared: deps,
       }),
+      new Repack.plugins.CodeSigningPlugin({
+        privateKeyPath: path.join('..', '..', './code-signing.pem'),
+        outputPath: path.join('build', 'outputs', platform, 'remotes'),
+      }),
     ],
   };
 };

packages/host/android/app/src/main/res/values/strings.xml

@@ -1,3 +1,19 @@
 <resources>
     <string name="app_name">host</string>
+    <string name="RepackPublicKey">
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvR2JseYMjDTie9MYo/Tw
+4xGQKSBKJ15GcrwcP+eX96WWCkbTH+Oa7oUwuM2l6KyTBZsuWiTbajldnUslyfLu
+uLmAfOjmgVMgWqihRIkvBIzxG2G/wrUGMLOrXWn01enqHORami0N9O7/WayC3UO1
+KwN7c+Rmhkk7pwxQUDcsLofkPAjCAbo5SRDv04y0jjvjyXnufepVamSBcVdclEui
+d6nrDR9vWMhvNrSW6op4/NaJM0tMqvyzwNM5p081GkqSrkS59vPkkwaFOEf2/Awg
+yNsK+Efo4WDPEcZjay6S/wwhD1vw/29w/Or5KXfusIHsJu1iMC7xi5sYb9Z+pUZH
+zLqv9xPF0Q040NBOSgY1dpuPm1WE3/Yd1zG1vfWFCQJ606+DVFjVODj/uTlKldxY
++vTvrfL5mZohGiYMvO4h4DLXKDlsuI0MAbCYEO9wvm/vGEP3HTpb/O85VarT4CU/
+wsPsZn01/gGJmqS+2v/0428SHra0r1JOXhgOrJDn/SpWkfhcYPti61gq9qKmjylq
+549qj7P7TNS0hdk8gaItciTkN6oNdvLUi3xHWjFauq2nvGq7DrNGis9agb91h6qp
+cY5Xs2ruzayYogugDiaALCPvJpQFCj83AIbWft26fl7VCphxPKaFpeDHseVi6tMi
+1+opwSqunAaqo5rsLlHIw0MCAwEAAQ==
+-----END PUBLIC KEY-----
+    </string>
 </resources>

packages/host/index.js

@@ -15,9 +15,10 @@ ScriptManager.shared.addResolver(async (scriptId, caller) => {
     platform: Platform.OS,
     appName,
   });
-  const response = await fetch(containersURL);
 
-  const containers = await response.json();
+  const containersResponse = await fetch(containersURL);
+
+  const containers = await containersResponse.json();
 
   const resolveURL = Federated.createURLResolver({
     containers,
@@ -37,9 +38,8 @@ ScriptManager.shared.addResolver(async (scriptId, caller) => {
   return {
     url,
     cache: false, // For development
-    query: {
-      platform: Platform.OS,
-    },
+    query: {platform: Platform.OS},
+    verifyScriptSignature: 'strict',
   };
 });
 

packages/host/ios/host/Info.plist

@@ -70,5 +70,22 @@
 	</array>
 	<key>UIViewControllerBasedStatusBarAppearance</key>
 	<false/>
+	<key>RepackPublicKey</key>
+	<string>
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvR2JseYMjDTie9MYo/Tw
+4xGQKSBKJ15GcrwcP+eX96WWCkbTH+Oa7oUwuM2l6KyTBZsuWiTbajldnUslyfLu
+uLmAfOjmgVMgWqihRIkvBIzxG2G/wrUGMLOrXWn01enqHORami0N9O7/WayC3UO1
+KwN7c+Rmhkk7pwxQUDcsLofkPAjCAbo5SRDv04y0jjvjyXnufepVamSBcVdclEui
+d6nrDR9vWMhvNrSW6op4/NaJM0tMqvyzwNM5p081GkqSrkS59vPkkwaFOEf2/Awg
+yNsK+Efo4WDPEcZjay6S/wwhD1vw/29w/Or5KXfusIHsJu1iMC7xi5sYb9Z+pUZH
+zLqv9xPF0Q040NBOSgY1dpuPm1WE3/Yd1zG1vfWFCQJ606+DVFjVODj/uTlKldxY
++vTvrfL5mZohGiYMvO4h4DLXKDlsuI0MAbCYEO9wvm/vGEP3HTpb/O85VarT4CU/
+wsPsZn01/gGJmqS+2v/0428SHra0r1JOXhgOrJDn/SpWkfhcYPti61gq9qKmjylq
+549qj7P7TNS0hdk8gaItciTkN6oNdvLUi3xHWjFauq2nvGq7DrNGis9agb91h6qp
+cY5Xs2ruzayYogugDiaALCPvJpQFCj83AIbWft26fl7VCphxPKaFpeDHseVi6tMi
+1+opwSqunAaqo5rsLlHIw0MCAwEAAQ==
+-----END PUBLIC KEY-----
+	</string>
 </dict>
 </plist>

packages/shopping/webpack.config.mjs

@@ -238,6 +238,10 @@ export default env => {
         },
         shared: deps,
       }),
+      new Repack.plugins.CodeSigningPlugin({
+        privateKeyPath: path.join('..', '..', './code-signing.pem'),
+        outputPath: path.join('build', 'outputs', platform, 'remotes'),
+      }),
     ],
   };
 };