codepush_cli 0.2.10

codepush_cli: ^0.2.10 copied to clipboard

The crash check asks whether the app is still running after startup has had time to fail, instead of whether it was running at any point. A build that crashes three seconds in is alive at two, so the polling version passed it.

Fixes the crash check added in 0.2.8, which reported a healthy app as crashed.

It matched the process list on the app name, and every Flutter app's executable is called Runner — so it found somebody else's app or nothing, and then blamed another app's old crash report on this one. Liveness is now checked by the pid the launch returns, and a crash report has to carry this bundle id and be newer than the launch.

codepush verify ios checks the app is still running, and reads the crash report when it is not.

It used to report "a patch loaded and ran" for a build that applied a patch and then segfaulted two seconds later. The status file is written at boot, so it says applied quite truthfully and says nothing about whether the app survived — and on a real app, a patched build crashed on every single launch with a SIGSEGV in dart::Interpreter::Run, while this tool called it a success.

--api-base now accepts http for private addresses (10.x, 172.16-31.x, 192.168.x, 169.254.x, *.local) as well as localhost, with a warning naming what travels unencrypted.

The https rule exists because an API key in the clear can publish code to every device running the app. On a private address there is no path outside the local network for it to travel on — and loopback alone made device reporting impossible to test, because a phone's own loopback is the phone. The same address becomes the report URL compiled into each release, which is why the warning mentions devices and not just this terminal.

Matches codepush 0.2.6.

Matches codepush 0.2.5.

Matches codepush 0.2.4.

codepush verify ios says so when the update check was due but never ran, rather than leaving it to look like a check that found nothing.

codepush verify ios prints the last update check: what it decided, which patch the manifest offers, what the device has staged, and the reason when a patch was refused.

Releases were built with an empty manifest address whenever the server had no explicit public base URL configured — the normal case for Firebase Storage, whose download URLs encode the whole object path and so have no base to join a path onto. The app had nothing to fetch and reported noPatch forever against a correctly signed patch sitting in the bucket. The address now comes from the server, which is the only party that knows it, and a build refuses to start rather than baking an empty one.

The cached app record dropped engineIndexUrl, so a cached read reported that the server publishes no engines.

codepush verify ios prints which patch the device is running.

codepush login opens a browser instead of asking for a token to paste, and codepush init generates the signing key itself — skipping that step used to be unrecoverable, because the public key is compiled into every release. codepush --version exists. Engines are downloaded rather than built, so a machine that only publishes patches needs no engine checkout.

iOS releases worked only on the machine CodePush was developed on. Seven separate causes, each invisible there:

• The generated iOS entrypoint imports codepush_ios, and nothing said to add it. release ios now refuses up front, and init mentions it for a project with an ios/ directory.
• list_libraries and subtract_libraries were run as dart run <source>, which needs the Dart source tree and the dartdev snapshot. They are AOT snapshots in the engine tarball now.
• The generated patch contract was read as its own base: a crash on a project that had never released, and on one that had, a contract that only ever grew.
• gen_snapshot was shipped under that name; an iOS build asks for gen_snapshot_arm64. codepush doctor now checks the name the build resolves, not any of three.
• iOS releases were never recorded with the server, so every patch ios ended at "No ios release for this app".
• The iOS patch signer put 1.0.0+1 where the server verified 1.0.0, so every iOS patch was refused as a signature failure.

First release.