Documentation

Everything to ship over-the-air updates with Pulsar — from install to multi-deployment testing.

Code signing

Signing lets your app refuse any update that wasn’t signed with your key. The CLI signs each release’s package hash into the bundle, and the SDK checks it against the public key built into your app before applying the update. A tampered or unsigned update is rejected on the device.

Create a key pair

bash

pulsar keygen

This writes pulsar-private.pem (readable only by you) and pulsar-public.pem in the current folder. Keep the private key secret and back it up.

Put the public key in your app

Paste the contents of pulsar-public.pem into your native config.

xml

<!-- iOS Info.plist -->
<key>CodePushPublicKey</key>
<string>-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----</string>

<!-- Android res/values/strings.xml -->
<string moduleConfig="true" name="CodePushPublicKey">-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----</string>

Once a store build carries the public key, every update it receives must be signed with the matching private key or the device rejects it. Start signing your releases before that build reaches users.

Sign locally

Pass the key file to pulsar release, or set PULSAR_SIGNING_KEY to the key itself, which suits CI. The private key never leaves your machine or your CI runner.

bash

pulsar release MyApp Production --platform ios --target 1.0.0 --private-key pulsar-private.pem

export PULSAR_SIGNING_KEY="$(cat pulsar-private.pem)"
pulsar release MyApp Production --platform ios --target 1.0.0

Server-side signing

Without a local key, the CLI asks Pulsar to sign the package hash with the app’s signing key, which Pulsar stores encrypted. If Pulsar holds no key for the app, the release goes out unsigned and the CLI says so.

Unsigned uploads

When an app has a public key registered with Pulsar, an upload without a valid signature stays off until an organization owner approves it, so a missing key in CI can’t quietly ship an update your devices would reject.

Signing and private bundles

Private bundles require local signing: the app needs a registered public key, and Pulsar must hold no copy of the private key. Otherwise Pulsar could sign and encrypt a release of its own. The Private bundles panel can register your public key and delete Pulsar’s copy in one step.