Signing & verification

Shipping code over the air shouldn't mean trusting it blindly. Bundles are signed when you publish and checked on the device before they're ever applied.

Signed at publish time

When you cut a release or push a patch, Birdify signs the bundle with your project's private key and records a SHA-256 checksum. Bundles travel over TLS 1.3.

Verified on device

Before applying an update, the SDK re-computes the checksum and verifies the signature. If either check fails — a tampered or truncated bundle — it's rejected and the app keeps running the last good version. You can run the same check yourself:

bash

$ birdify verify patch#3
checksum   9f2c…a71b
signer     birdify:shop_app
signature valid ✓ · native code: none

Keys

Signatures use Ed25519 keypairs, one per project.
The public key is embedded in your app at build time; only the SDK-trusted key verifies.
Self-hosting? You hold the private key and bundles never leave your infrastructure — see Self-hosting.