Skip to content

fix(CodeSigningPlugin): sign assets at processAssets ANALYSE stage before REPORT#1379

Merged
dannyhw merged 6 commits intocallstack:mainfrom
JhohellsDL:fix/code-signing-plugin-zephyr-timing
Apr 23, 2026
Merged

fix(CodeSigningPlugin): sign assets at processAssets ANALYSE stage before REPORT#1379
dannyhw merged 6 commits intocallstack:mainfrom
JhohellsDL:fix/code-signing-plugin-zephyr-timing

Conversation

@JhohellsDL
Copy link
Copy Markdown
Contributor

@JhohellsDL JhohellsDL commented Apr 11, 2026

Summary

Fixes #1377

CodeSigningPlugin was signing bundles in compiler.hooks.assetEmitted,
which fires after processAssets completes. When using withZephyr(),
Zephyr captures and uploads assets at PROCESS_ASSETS_STAGE_REPORT (5000)
— before assetEmitted fires — resulting in unsigned bundles being uploaded
to the CDN, making verifyScriptSignature: 'strict' ineffective.

Changes

  • Moved signing logic from assetEmitted to processAssets at
    PROCESS_ASSETS_STAGE_ANALYSE (2000), before Zephyr's REPORT stage (5000)
  • Assets are now signed in memory via compilation.updateAsset()
    instead of reading/writing from disk
  • Removed chunkFilenames Set and emit hook — no longer needed since
    signing iterates compilation.chunks directly inside processAssets
  • Added test verifying assets are signed before REPORT stage
  • Updated documentation with ## Behavior section explaining the signing stage

Testing

  • All existing tests pass
  • Added new test simulating a plugin at REPORT stage confirming
    assets are already signed when captured
  • Verified end-to-end in production with withZephyr() — bundles
    uploaded to CDN now contain the signature and verifyScriptSignature: 'strict'
    works correctly

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 11, 2026 •
edited
Loading

🦋 Changeset detected

Latest commit: b7f7682

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages
Name Type
@callstack/repack Patch
@callstack/repack-plugin-expo-modules Patch
@callstack/repack-plugin-nativewind Patch
@callstack/repack-plugin-reanimated Patch
@callstack/repack-dev-server Patch
@callstack/repack-init Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 11, 2026

@JhohellsDL is attempting to deploy a commit to the Callstack Team on Vercel.

A member of the Team first needs to authorize it.

@JhohellsDL JhohellsDL mentioned this pull request Apr 11, 2026
Closed
@dannyhw
Copy link
Copy Markdown
Collaborator

dannyhw commented Apr 13, 2026

Is there some simple way to test this locally? What would you recommend? @JhohellsDL

MikitasK
MikitasK reviewed Apr 14, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@MikitasK MikitasK left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the PR is pretty solid 👍

I tested it locally with apps/tester-app using temporary processAssets REPORT-stage capture plugin & the results satisfied my expectations:

  1. capture report showed all remote chunks signed at REPORT stage (they're showed unsigned on main branch tho)
  2. remote chunk loads successfully when verifyScriptSignature: 'strict' & public key embedded in the app
Screen.Recording.2026-04-14.at.17.17.40.mp4

can you just consider a few suggestions before merge:

Comment thread packages/repack/src/plugins/CodeSigningPlugin/CodeSigningPlugin.ts Outdated
Comment thread packages/repack/src/plugins/__tests__/CodeSigningPlugin.test.ts
Comment thread packages/repack/src/plugins/CodeSigningPlugin/CodeSigningPlugin.ts Outdated
Comment thread packages/repack/src/plugins/CodeSigningPlugin/CodeSigningPlugin.ts Outdated
MikitasK
MikitasK approved these changes Apr 15, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@MikitasK MikitasK left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🙌

@dannyhw
Copy link
Copy Markdown
Collaborator

dannyhw commented Apr 21, 2026

@JhohellsDL could you please take a look and resolve the linting errors

@JhohellsDL
Copy link
Copy Markdown
Contributor Author

JhohellsDL commented Apr 21, 2026

@dannyhw, thanks for the feedback! I’ve addressed the linting issues and pushed an update. Please take another look.

jbroma
jbroma approved these changes Apr 21, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@jbroma jbroma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

few nits, LGTM overall 👍

Comment thread website/src/v4/docs/plugins/code-signing.md
Comment thread website/src/latest/api/plugins/code-signing.md
Comment thread packages/repack/src/plugins/CodeSigningPlugin/CodeSigningPlugin.ts
@dannyhw
Copy link
Copy Markdown
Collaborator

dannyhw commented Apr 22, 2026

@JhohellsDL if you can address those last comments I think we can move forward and merge this 👍

@JhohellsDL
Copy link
Copy Markdown
Contributor Author

JhohellsDL commented Apr 22, 2026

@dannyhw, Ready, I’ve addressed the comments. I’ll keep an eye out for any further feedback 👍

@dannyhw
Copy link
Copy Markdown
Collaborator

dannyhw commented Apr 22, 2026

Thanks @JhohellsDL, appreciate your responsiveness and all your hard work 🙇‍♂️

dannyhw
dannyhw approved these changes Apr 23, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@dannyhw dannyhw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for your contribution 🙇‍♂️

@dannyhw dannyhw merged commit 8ab3105 into callstack:main Apr 23, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dannyhw dannyhw dannyhw approved these changes

+2 more reviewers

@jbroma jbroma jbroma approved these changes

@MikitasK MikitasK MikitasK approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CodeSigningPlugin signs too late (assetEmitted) – incompatible with in-memory asset consumers (e.g. Zephyr)

4 participants

@JhohellsDL @dannyhw @jbroma @MikitasK