FireOTA
Go to console

Code signing

Prove every update was built by you (optional, per app).

How it works

  • You generate an RSA key pair. The private key never leaves your machine or CI secret store.
  • The CLI signs the package's SHA-256 together with its runtime version and platform (RSA-SHA256, PKCS#1 v1.5).
  • FireOTA verifies the signature against the app's registered public key on upload; with “Require signed updates” on, unsigned uploads and publishes are refused.
  • The app embeds the same public key and verifies the signature natively before downloading — a forged update is never installed.

Create keys and publish

bash
npx fireota signing generate --out ./fireota-keys
#  fireota-keys/fireota-private.pem  -> keep secret (CI secret FIREOTA_SIGNING_KEY)
#  fireota-keys/fireota-public.pem   -> dashboard (app -> Code signing) + the app

npx fireota publish … --private-key ./fireota-keys/fireota-private.pem

Configure the app

tsx
FireOTA.configure({
  appId: "YOUR_APP_ID",
  serverUrl: "https://ota.example.com",
  runtimeVersion: "1.3.0",
  codeSigningCertificate: PUBLIC_KEY_PEM, // contents of fireota-public.pem
});

Rotating keys

Ship a store build with the new public key first, then replace the key in the dashboard. Builds with the old certificate keep accepting only updates signed with the old key, so publish to each runtime with the key its build embeds.