@dbrij/ship-react-native

Code push for React Native on Dbrij Ship: signed bundle updates, verify-before-apply, staged rollouts, and a boot canary that reverts a bundle which crashes on launch.

Install

npm i @dbrij/ship @dbrij/ship-react-native
cd ios && pod install

Wire the bundle path (once, in the store build)

iOS — AppDelegate:

override func sourceURL(for bridge: RCTBridge) -> URL? {
  #if DEBUG
    return RCTBundleURLProvider.sharedSettings().jsBundleURL(forBundleRoot: "index")
  #else
    return DbrijShip.bundleURL() ?? Bundle.main.url(forResource: "main", withExtension: "jsbundle")
  #endif
}

Android — MainApplication (inside your ReactNativeHost):

override fun getJSBundleFile(): String? =
  com.dbrij.ship.DbrijShipModule.getJSBundleFile(applicationContext)

Also register DbrijShipPackage() in getPackages() (autolinking normally handles this).

Use

import { createShip } from '@dbrij/ship';
import { notifyAppReady, syncShipUpdates } from '@dbrij/ship-react-native';
import AsyncStorage from '@react-native-async-storage/async-storage';

const ship = createShip({
  appKey: 'shp_...',
  channel: 'production',
  binaryVersion: '1.2.0',
  platform: Platform.OS,
  storage: AsyncStorage,
});

// In your root component, once the first screen mounts:
useEffect(() => {
  notifyAppReady(ship)                 // disarms the boot canary + reports 'applied'
    .then(() => syncShipUpdates(ship, { signPublicKey: 'BASE64_KEY_FROM_DASHBOARD' }))
    .catch(() => undefined);           // never let updates break the app
}, []);

A staged (non-mandatory) update applies on the next launch. Mandatory updates restart immediately. A bundle that crashes before notifyAppReady is reverted automatically on the following start, and the failure is reported so the rollout can freeze itself server-side.

Safety model

• Bundles are verified on device: sha256 must match, and the ed25519 signature (made with your app's server-held private key) must verify against the signPublicKey you pin here. Unverified bytes are never written into place.
• On Android below 13 the platform lacks Ed25519; the plugin refuses the update and the store binary keeps running (fail-closed).
• The store binary's bundled JS is always the fallback: revert never bricks.