LiveUpdate downloadBundle new options (checksum and signature)

[allenjaydeclines]

Hi,

I'm currently playing around the new feature of the live update which we can check the integrity and authenticity of the bundle before applying to our application.

I noticed that when I put an invalid signature in the download options it throws an error which is good, but when I tried it for the invalid checksum it still downloading and I didn't encounter any error. Shouldn't it throw an error if the checksum is invalid or I'm not using it correctly?

Thanks!

[robingenz]

If you pass a valid signature, the checksum does not need to be checked. However, if you do not pass a signature and an incorrect checksum, then an error should be thrown.

[allenjaydeclines]

I just tried it, I did not pass any signature and I just passed a checksum and it throw an error "Bundle does not contain a signature."
await LiveUpdate.downloadBundle({ url, bundleId, checksum })
Seems different to what you said 🤔
Regardless if I did pass an invalid or valid checksum it's still asking for a signature.

[robingenz]

You also have to remove the public key to test this.

[allenjaydeclines]

Oh I see, I totally missed that.

Is there a reason why the checksum does not needed to be check anymore if the signature is already provided? Is the signature already enough?

[robingenz]

Yes, checking the signature does everything the checksum does, and more.