perf(live-update): verify checksum only if signature is not verified

capawesome-team · Jul 14, 2024 · a1c55d8 · a1c55d8
1 parent a4b1a06
commit a1c55d8
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 22 deletions.
diff --git a/...update/android/src/main/java/io/capawesome/capacitorjs/plugins/liveupdate/LiveUpdate.java b/...update/android/src/main/java/io/capawesome/capacitorjs/plugins/liveupdate/LiveUpdate.java
@@ -387,14 +387,6 @@ public void error(Exception exception) {
                 @Override
                 public void success(@NonNull File result) {
                     try {
-                        // Verify the checksum
-                        if (expectedChecksum != null) {
-                            // Calculate the checksum
-                            String receivedChecksum = getChecksumForFileAsString(result);
-                            if (!expectedChecksum.equals(receivedChecksum)) {
-                                throw new Exception(LiveUpdatePlugin.ERROR_CHECKSUM_MISMATCH);
-                            }
-                        }
                         // Verify the signature
                         String publicKey = config.getPublicKey();
                         if (publicKey != null) {
@@ -408,6 +400,14 @@ public void success(@NonNull File result) {
                                 throw new Exception(LiveUpdatePlugin.ERROR_SIGNATURE_VERIFICATION_FAILED);
                             }
                         }
+                        // Verify the checksum
+                        else if (expectedChecksum != null) {
+                            // Calculate the checksum
+                            String receivedChecksum = getChecksumForFileAsString(result);
+                            if (!expectedChecksum.equals(receivedChecksum)) {
+                                throw new Exception(LiveUpdatePlugin.ERROR_CHECKSUM_MISMATCH);
+                            }
+                        }
 
                         // Add the bundle
                         addBundle(bundleId, result);

diff --git a/packages/live-update/ios/Plugin/LiveUpdate.swift b/packages/live-update/ios/Plugin/LiveUpdate.swift
@@ -299,20 +299,6 @@ import CommonCrypto
                 return
             }
             if let url = url {
-                // Verify the checksum
-                if let expectedChecksum = checksum {
-                    // Calculate the checksum
-                    do {
-                        let receivedChecksum = try self.getChecksumForFile(url: url)
-                        if receivedChecksum != expectedChecksum {
-                            completion(CustomError.checksumMismatch)
-                            return
-                        }
-                    } catch {
-                        completion(CustomError.checksumCalculationFailed)
-                        return
-                    }
-                }
                 // Verify the signature
                 if let publicKey = self.config.publicKey {
                     guard let signature = signature else {
@@ -331,6 +317,20 @@ import CommonCrypto
                         return
                     }
                 }
+                // Verify the checksum
+                else if let expectedChecksum = checksum {
+                    // Calculate the checksum
+                    do {
+                        let receivedChecksum = try self.getChecksumForFile(url: url)
+                        if receivedChecksum != expectedChecksum {
+                            completion(CustomError.checksumMismatch)
+                            return
+                        }
+                    } catch {
+                        completion(CustomError.checksumCalculationFailed)
+                        return
+                    }
+                }
 
                 // Add the bundle
                 self.addBundle(bundleId: bundleId, zipFile: url, completion: { error in