Require Patch Signing
When your enterprise requires patch signing, Shorebird refuses releases built without signing in any of its organizations, and releases that already don’t check signatures take no new patches. Shorebird’s servers apply the policy, so it holds whether you release and patch from the CLI, CI or a service account.
Patch Signing explains how signing works and how to sign with Shorebird’s managed key or your own.
What it refuses
Section titled “What it refuses”While patch signing is required, for every app in every organization of your enterprise:
| You try to | Refused when |
|---|---|
| Release | The release is built with --no-patch-signing, or with a Shorebird CLI older than 1.6.132, which doesn’t record how a release is signed |
| Patch a release | The release was built unsigned, or with a CLI older than 1.6.132, even one signed with your own key: Shorebird can’t confirm its devices check a patch’s signature |
| Promote a patch, roll a patch forward, or approve either request | The patch isn’t signed: its release doesn’t check signatures (as in the row above), or it’s an older patch uploaded without a signature |
Each platform of a release is checked on its own. A release signed on Android but not on iOS still takes Android patches, and refuses iOS ones. Promoting, rolling forward or approving checks the patch as a whole: if any platform of the patch isn’t signed, it’s refused on every platform.
Rolling a patch back is never refused. On a release that doesn’t check signatures, though, a patch you roll back can’t be rolled forward again.
Refusals from Shorebird’s servers name your enterprise and why. For example, they refuse a patch to an unsigned release with:
To patch an app with an unsigned release in the field, update the Shorebird CLI, make a new release with managed signing (the default) or your own key, and patch that release. Devices still on the unsigned release get no new patches until their users install the new release from the store.
Turn it on or off
Section titled “Turn it on or off”Enterprise Owners and Admins set it in the Patch signing card: in the Shorebird console, open Enterprise in the sidebar, then its Security tab.
Before you turn it on, the console counts the releases in your enterprise’s apps that have a platform that can’t verify a signature (unsigned, or built with a CLI older than 1.6.132) and had patch installs in the last 30 days, and lists them with their app, version, organization, unsigned platforms and installs. The installs count every platform of the release, signed ones too. Past 100, it lists the 100 with the most installs. Those are the releases recently patched that stop taking patches. Every other unsigned release stops too, including ones your users run that haven’t been patched yet. Nothing is deleted or changed: they keep running, and patches already live on them keep installing.
Turning it off lets unsigned releases and patches through again.
The audit log records each change as
enterprise.patch_signing_policy_update. Refused releases and patches aren’t
recorded in your organization’s or enterprise’s audit log.
Which enterprises start with it on
Section titled “Which enterprises start with it on”A new enterprise requires patch signing from the start, unless the organizations it’s set up with already ship unsigned releases that had patch installs in the last 30 days: then it starts with patch signing optional, so those apps keep patching. An enterprise that existed before this setting was added starts with patch signing optional, so nothing it already ships stops taking patches; turn it on once its apps have moved to signed releases.
An organization that joins an enterprise that already requires patch signing, or an app moved into one of its organizations, stops patching its unsigned releases at once, with no warning: the console counts releases that stop taking patches only when you turn the setting on. Afterwards, each such release is marked in the app’s release list as one that can’t be patched. Before an organization joins or an app moves in, move its apps to signed releases, or turn the setting off until it has.