[ofalvai]

Part 2 of the stack that removes the JWT and Base64 pods. #94 explains the wider context.

What changes

• CodePushUpdateUtils.m verifies the update signature with CPJWTVerifier from Add CodePushCore Swift package for JWT signature verification #94.
• CodePush.podspec drops the JWT and Base64 dependencies, and adds the Swift sources.
• getKeyValueFromPublicKeyString: from the old ObjC code is gone: the Swift side now removes the PEM armor anyway, there is no need to handle this in two places.
• The E2E test app sets IPHONEOS_DEPLOYMENT_TARGET = 15.5. A pod with Swift sources needs the app's deployment target to be at least the pod's, and the generated project's default is lower.

Behavior changes to review

• A bad signature now blocks the update permanently. Before, the JWT library's error went up unchanged, outside the CodePush error domain. Now the error is wrapped in the CodePush domain, so +[CodePushErrorUtils isCodePushError:] matches it and +[CodePush saveFailedUpdate:] adds the update to the failed list. A retry cannot fix a bad signature, so I think this is correct.
• Stricter alg. The verifier rejects every alg except RS256 before it checks the signature. The old code also pinned RS256 through the library, and the CodePush CLI signs only with RS256, so the result should be the same.
• More PEM formats. The old code removed only the BEGIN/END PUBLIC KEY lines. The new code removes any PEM armor, so a PKCS#1 RSA PUBLIC KEY in Info.plist also works.

Verification

Besides the passing CI checks, manually verified:

• pod install in an RN app with static libraries: only CodePush and SSZipArchive (2.5.5) in Podfile.lock.
• npm pack --dry-run: the CodePushCore sources ship. No JWT/Base64 files and no Package.swift.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Setting s.swift_version to 5.9 selects a nonexistent Swift language mode, causing the newly included Swift sources to fail compilation; use 5.0 and specify any minimum toolchain requirement separately.

1 open issue

• Use a valid Swift language mode instead of 5.9 · New

What changed in this PR

This PR switches iOS CodePush signature verification from the JWT/Base64 pods to the CodePushCore Swift verifier.

Changes:

• Includes Swift verifier sources in the pod and routes Objective-C verification through CPJWTVerifier.
• Removes obsolete public-key preprocessing and classifies verification failures as CodePush errors.
• Updates test-app deployment settings and excludes Swift test/build files from npm publishing.

File	Description
test/​test.mts	Sets the generated iOS app’s deployment target to 15.5.
ios/​CodePushCore/​Tests/​CodePushCoreTests/​JWTVerifierTests.swift	Updates comments to remove references to deleted preprocessing.
ios/​CodePushCore/​Sources/​CodePushCore/​SignatureVerification/​RSAPublicKey.swift	Clarifies inline PEM handling in a comment.
ios/​CodePush/​CodePushUpdateUtils.m	Uses the Swift verifier and wraps verification errors.
ios/​CodePush/​CodePush.h	Removes the obsolete public-key preprocessing declaration.
CodePush.podspec	Includes Swift sources, configures Swift, and removes JWT/Base64 dependencies.
.npmignore	Excludes Swift tests, package manifest, and build metadata.

_{Review effort: Balanced}