Two releases with same content but diff signature and app, Will download same '.codepushrelease' final, Causing one of the signatures to fail verification.

[imfms]

Env:

• server: shmopen/code-push-server:1.1.1
• cli: 2.5.3
• native plugin: capacitor-codepush

My issue steps:

1. build project to $FOLDER
2. release $FOLDER to $ANDROID_APP with $ANDROID_PRIVATE_KEY
3. release $FOLDER to $IOS_APP with $IOS_PRIVATE_KEY
4. open Android App, hot update success
5. open iOS App, wrong signature

Have been checked:

• Not cli problem. I checked table's 'packages/blob_url' two record's local file, thire '.codepushrelease' all have right content hash (they are diff with their signature)
• So not native plugin problem
• I found server update-info returnd download file all are 'packages_diff/diff_blob' record, and I checked diff_blob's local file, thire '.codepushrelease' content are same, so one of app must be got 'wrong signature'
• So maybe the problem be 'code-push-server/diff-feature' related?

[rocwind]

Thanks for reporting the issue! I'll try to find some time to look into this, and any help/PR is always welcome of course.

[rocwind]

@imfms
I think I found some clues here:

• .codepushrelease file is ignored in calculating package hash
• while package hash is used as the key in DateCenterManager where packages get stored

However, I didn't got a proper fix yet... - I am just trying to be careful to not break things, ideally, the fix should not change the data dir structure for DataCenterManager - maybe revisit this issue later when I understand it better

[imfms]

@rocwind Thank you for your efforts. I also want to dig deeper and fix it, but my job is too busy :(