Guidepoint: Enhancement - Bundle Integrity Check

[JohnathanWhite]

GP-12

[cmgustavo]

LGTM! 👍🏼

DEV is skipped (normal build)
PROD requires RN_BUNDLE_HASH

[Copilot]

Pull request overview

Adds a React Native bundle integrity check to detect tampering by hashing the shipped JS bundle at build time and verifying it at runtime on iOS and Android.

Changes:

• iOS: add a build-phase script to compute SHA-256 for main.jsbundle and inject it into the built Info.plist; verify at launch in AppDelegate.
• Android: add a verifier that hashes index.android.bundle at runtime; attempt to compute/write a build-time hash via Gradle and compare against BuildConfig.
• Add RNBundleHash to iOS Info.plist and wire early verification in Android MainActivity.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
ios/scripts/inject-bundle-hash.sh	New build-phase script to compute bundle SHA-256 and write it into the built Info.plist.
ios/Podfile	Adds an Xcode build phase via CocoaPods to run the hash injection script.
ios/BitPayApp/Info.plist	Adds RNBundleHash key intended to hold the expected hash.
ios/BitPayApp/AppDelegate.swift	Computes SHA-256 of the bundled JS and blocks launch on mismatch.
android/app/src/main/java/com/bitpay/wallet/MainActivity.kt	Runs integrity verification before continuing app initialization.
android/app/src/main/java/com/bitpay/wallet/BundleIntegrityVerifier.kt	New Android implementation of bundle hashing + comparison + blocking UI.
android/app/build.gradle	Adds RN_BUNDLE_HASH BuildConfig field and a task hook to compute/write the bundle hash post-bundle.

Comments suppressed due to low confidence (1)

ios/Podfile:38

• There appears to be an extra end at line 93. target 'BitPayApp' do should only need a single corresponding end; the additional end will break Podfile parsing or close an outer block unexpectedly. Remove the superfluous end (or adjust block structure so the number of do/end pairs matches).

target 'BitPayApp' do

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gabrielbazan7]

Tested on Android emulator and iOS simulator, tampered the bundle on both and the security warning showed up correctly