mobile: add OTA code-signing cert and enable signed production updates

Author: aapeliv

app/mobile/.gitignore

@@ -39,6 +39,8 @@ yarn-error.*
 # macOS
 .DS_Store
 *.pem
+# but the OTA code-signing certificate (public) is committed; the private key is not
+!certs/certificate.pem
 
 # local env files
 .env*.local

app/mobile/app.config.js

@@ -79,15 +79,22 @@ const intentFilters = variant.linkHost
 // baked in and manifests are served unsigned over HTTPS.
 //
 // Staging points at our self-hosted OTA backend (cut 1: validating the Expo
-// Updates protocol + native<->backend transport, unsigned). Production has OTA
-// disabled until the self-hosted backend is proven on staging, then it points
-// here too.
+// Updates protocol + native<->backend transport, unsigned).
+//
+// Production requires a code-signed manifest: the tools/ publish lambda signs
+// each bundle with the private key, and this cert (its public half) lets the
+// device reject anything not signed by it. keyid/alg must match the lambda's
+// OTA_SIGNING_KEY_ID and rsa-v1_5-sha256.
 const updates =
   APP_VARIANT === "devtool"
     ? { enabled: true }
     : APP_VARIANT === "staging"
       ? { url: "https://dev-api.couchershq.org/native/ota/manifest" }
-      : { enabled: false };
+      : {
+          url: "https://api.couchers.org/native/ota/manifest",
+          codeSigningCertificate: "./certs/certificate.pem",
+          codeSigningMetadata: { keyid: "main", alg: "rsa-v1_5-sha256" },
+        };
 
 export default {
   name: variant.name,

app/mobile/certs/certificate.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC3TCCAcWgAwIBAgIJXxmaYUSc1wmtMA0GCSqGSIb3DQEBCwUAMBcxFTATBgNV
+BAMTDENvdWNoZXJzLm9yZzAgFw0yNjA1MjUxNjU2MjZaGA8yMTI2MDUyNTE2NTYy
+NlowFzEVMBMGA1UEAxMMQ291Y2hlcnMub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEAue5pylwy90g9rMH2rr0ohpR686MWzvVsIcWd1aDQBw1xTm3v
+2nuADp5/djn4FP7/kdRgIdY6Z/ktHZwCUAp0txMDTZBlzrAgUu/pfI0oUAu10j3+
+2IbSCzHusDuaManwYQnILxi1ics0krSeKkg1xypbcLj50zuI7ACayN8vLLbqFwX+
+OrVuTHhiRM3kXd89IxWoigaKRmmZ/EQrEmzqInvS5XN57wum5cIPiQR4c6IjuSjf
+jz3QtT9Gmw2P5uyR2kY10fedBvN+HblfpeC0GD+/EgCI+DdnqxzM8hewfFM+D79p
+QB+5upEDGXH0Ll8O90gdQb3+dnZkHqsaMNXGEQIDAQABoyowKDAOBgNVHQ8BAf8E
+BAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwMwDQYJKoZIhvcNAQELBQADggEB
+AAuf4G7cxlkwMsr+GAdzM8tanAtkem/edVgXZ3SAeamn+hW+fp1DD7TFrghi0xTq
+KVVg0RgTTQ2Nnd7cJexGKiATZ0+810KUWnYL43ZwjOErYcWYtP8TOlk63CDlSgvj
+r8hvW+lXWXHpWQy0hJ7Azs56g+ufbxsQrJ5+qIzUSUu1S+XME5zFXeh/q8fzCmvE
+pFeyhRHioZyqHKnBd1fdoJ0MoxbsxV5F5KJT95VIFZi3NtbaQgNUHK/K2PW8frzY
+D/qvsIRBNjpcMQOOrotXpkXwPaKZgPtoCD4h5EnIflIMP5Ka1JrCgkCSuKypyBcS
+8FD9CNIt7L9rOJudDtGyQUE=
+-----END CERTIFICATE-----