codepush #

Ship Dart fixes to installed Flutter apps without an app-store review.

Your app gets one file and one dependency line. Everything else — which bucket serves your patches, which key your releases trust, what has already been released — is resolved from the app id in that file.

# codepush.yaml
app_id: cp_7f3a9c2e5b1d4860

# pubspec.yaml
dependencies:
  codepush: ^0.1.0

That is the whole integration. No main.dart changes, no Android code, no pubspec asset entry.

What a patch can change #

Dart. Not native code, not plugins, not assets, not permissions. A Dart-level bug fix or a Dart-level feature; anything else still needs a store build.

Android and iOS work differently #

Android replaces libapp.so — all of your compiled Dart. The stock Flutter engine already knows how to boot from a different one, so Android needs no forked engine. A patch is a few megabytes.

iOS cannot load native code that was not signed into the bundle, so a patch there is Dart bytecode, run by the VM's interpreter, replacing function bodies in place. That needs a Flutter engine built with --dart-dynamic-modules, and the applier lives in a separate package:

dependencies:
  codepush: ^0.1.0
  codepush_ios: ^0.1.0   # only if you patch iOS

It is separate because it calls dart:_internal.applyCodePushPatch, which only the forked engine has — and a direct call to it fails to compile against a stock SDK. Keeping it out of this package is what lets an Android-only app, and every developer's debug build, use a stock Flutter.

Every patch is signed #

The signing key is generated on your machine and never leaves it. The server holds only the public half, and your app has that half compiled in.

So a compromised server can withhold a patch or serve an old one. It cannot forge one — the signature will not verify against the key baked into the binary. The same is true of a stolen API key.

A device checks, in this order: signature, then app id, then revocation, then engine, then release, then rollout, then the artifact hash. The signature is first because every check after it reads a field out of the manifest, and those are attacker-controlled until it passes.

If a patch breaks something #

A patch is only ever attempted. It stays live only if the app reaches a first frame; a crash before that quarantines it on the next launch, with no server involved.

You can also stop one everywhere:

codepush patches revoke 7 --reason "crash loop on Android 12"

Devices running it return to the shipped build on their next cold start. This is the one command that needs no signing key — requiring one to stop a bad patch would mean being unable to stop it from a machine that lacks it.

Showing a download #

Optional, and off by default. Add the strip if you want one:

Stack(children: [child, const CodePushStatusStrip(bottomOffset: 92)])

It appears while a patch downloads and disappears when it is done. It says nothing on success, deliberately: the patch takes effect the next time the app is opened, so "update ready" would be an interruption offering no action.

Getting started #

Install the CLI and register the app:

dart pub global activate codepush_cli
codepush login --token <key from your dashboard>
codepush init
codepush keys generate      # before your first release, always
codepush release android

See codepush_cli for the full workflow.