User Guide - OTA Server

{
  "id": "20261008-091500",
  "file": "bundles/dev_delivery/1.0.66+93/20261008-091500.bundle",
  "sha256": "8a8adac45df963d4b491a18c17590cd376a53314c79d28bd27cb4a0e98a896d9",
  "size": 19707016,
  "note": "Sửa màn giao hàng",
  "commit": "e39c6d34",
  "signature": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+Pw==",
  "mandatory": true,
  "branch": "dev/delivery",
  "createdAt": "2026-10-08T09:15:00.000Z"
}

set -euo pipefail
BASE='https://ota.example.com'
APP='unitel-man'
PLATFORM='android'
CHANNEL='dev/delivery'
BINARY='1.0.66+93'
BUNDLE='./build/app.bundle'
: "${OTA_PUSH_TOKEN:?Inject bearer từ secret store}"
: "${OTA_UPLOAD_KEY:?Inject upload key của app từ secret store}"
SIGNATURE="${OTA_PUBLIC_SIGNATURE:-}"
MANDATORY="${OTA_MANDATORY:-false}"
SHA="$(node --input-type=module -e 'import {createHash} from "node:crypto"; import {readFileSync} from "node:fs"; process.stdout.write(createHash("sha256").update(readFileSync(process.argv[1])).digest("hex"))' "$BUNDLE")"

curl --fail-with-body -X POST "$BASE/ota/$APP/$PLATFORM/releases" \
  -H "Authorization: Bearer $OTA_PUSH_TOKEN" \
  -H "X-OTA-Upload-Key: $OTA_UPLOAD_KEY" \
  -F "bundle=@$BUNDLE" \
  --form-string "channel=$CHANNEL" \
  --form-string "binary=$BINARY" \
  --form-string "sha256=$SHA" \
  --form-string "signature=$SIGNATURE" \
  --form-string "mandatory=$MANDATORY" \
  --form-string 'note=nightly' \
  --form-string "commit=$(git rev-parse --short HEAD)"

curl --fail-with-body "$BASE/ota/$APP/$PLATFORM/manifest.json"
FILE='bundles/dev_delivery/1.0.66+93/20261008-091500.bundle'
curl --fail-with-body -H 'Accept-Encoding: identity' \
  "$BASE/ota/$APP/$PLATFORM/$FILE" -o ./downloaded.bundle
curl --fail-with-body --get "$BASE/ota/$APP/$PLATFORM/releases" \
  -H "Authorization: Bearer $OTA_PUSH_TOKEN" \
  --data-urlencode "channel=$CHANNEL" --data-urlencode "binary=$BINARY"

QUERY="$(node -e 'process.stdout.write(new URLSearchParams({channel:process.argv[1],binary:process.argv[2]}).toString())' "$CHANNEL" "$BINARY")"
curl --fail-with-body -X DELETE "$BASE/ota/$APP/$PLATFORM/releases?$QUERY" \
  -H "Authorization: Bearer $OTA_PUSH_TOKEN"

{"ok":true,"data":{"app":"unitel-man","configured":false,"updatedAt":null}}

{ok:true,data:{key:<plaintext chỉ có trong response này>,record:{app:"unitel-man",configured:true,updatedAt:<ISO timestamp>}}}

const statusResponse = await fetch('/api/ota/upload-key?app=unitel-man', {
  credentials: 'same-origin'
});
const status = await statusResponse.json();
// Kiểm tra status.ok và status.data.configured trước khi quyết định rotate.
const rotationResponse = await fetch('/api/ota/upload-key-rotate', {
  method: 'POST',
  credentials: 'same-origin',
  headers: {'Content-Type': 'application/json', 'X-EmDash-Request': '1'},
  body: JSON.stringify({app: 'unitel-man'})
});
const rotation = await rotationResponse.json();
// Nếu rotation.ok, chuyển rotation.data.key vào secret store được duyệt.
// Không log/chụp màn hình/export biến này; mất key thì rotate lại, không truy hồi hash.