Learn how code signing and key rotation work in EAS Update.
EAS Update Code Signing is only available to accounts subscribed to the EAS Enterprise plan. Sign up.
The expo-updates
library supports end-to-end code signing. Code signing allows developers to cryptographically sign their updates with their own keys. The signatures are then verified on the client before the update is applied, which ensures ISPs, CDNs, cloud providers, and even EAS itself cannot tamper with updates run by apps.
1
Generate a private key and corresponding code signing certificate for your app:
npx expo-updates codesigning:generate \
--key-output-directory keys \
--certificate-output-directory certs \
--certificate-validity-duration-years 10 \
--certificate-common-name "My App"
2
Configure your app's builds to use code signing:
npx expo-updates codesigning:configure \
--certificate-input-directory certs \
--key-input-directory keys
After this step, create a new build with a new runtime version. The code signing certificate will be embedded in this new build.
3
Publish a signed update for your app:
eas update --private-key-path keys/private-key.pem
During eas update
, the EAS CLI automatically detects that code signing is configured for your app. It then verifies the integrity of the update and creates a digital signature using your private key. This process is performed locally so that your private key never leaves your machine. The generated signature is automatically sent to EAS to store alongside the update.
4
Download the update on the client (this step is done automatically by the library). The build from step (2) that is configured for code signing checks if there is a new update available. The server responds with the update published in step (3) and its generated signature. After being downloaded but before being applied, the update is verified against the embedded certificate and included signature. The update is applied if the certificate and signature are valid, and rejected otherwise.
Key rotation is the process by which the key pair used for signing updates is changed. This is most commonly done in a few cases:
certificate-validity-duration-years
to 10 years (though it can be configured to any value). This means that after 10 years, updates signed with the private key corresponding to the certificate will no longer be applied after being downloaded by the app. Updates downloaded before the expiration of their signing certificate will continue to function normally. Rotating keys well before the certificate expires helps to preempt any potential key expiration issues and helps to guarantee all users are using the new certificate before the old certificate expires.In any of these cases, the procedure is similar:
keyid
of the new key by modifying the updates.codeSigningMetadata.keyid
field in your app config (app.json).The process of removing code signing from an app is similar to key rotation and can be thought of as a key rotation to a null
key.
updates.codeSigningMetadata
field from your app config (app.json).