Implement code signing for client android SDK

[ruslan-bikkinin]

Basic support for bundle's signature verification for android applications has been implemented.

By default, feature is disabled, so no need for clients not interested in code signing to worry about changing code-push sdk initialization code after update.

To use this feature, developers need to use brand new CodePushBuilder or advanced constructor with parameter publicKeyResourceDescriptor specified. Public key must be assisted in string.xml, so it can be available via R.string reference.

Initialization examples:

• via CodePushBuilder

    @Override
    protected List<ReactPackage> getPackages() {
      return Arrays.<ReactPackage>asList(
              new MainReactPackage(),
              new CodePushBuilder("deployment-key-here",getApplicationContext())
                      .setPublicKeyResourceDescriptor(R.string.publicKey /* string item in strings.xml */)
                      .build()
      );
    }

• via constructor

    @Override
    protected List<ReactPackage> getPackages() {
      return Arrays.<ReactPackage>asList(
              new MainReactPackage(),
              new CodePush(
                      "deployment-key-here",
                      getApplicationContext(),
                      BuildConfig.DEBUG,
                      "https://codepush.azurewebsites.net/"
                      R.string.publicKey /* string item in strings.xml */)
      );
    }

[msftclas]

@ruslan-bikkinin,
Thanks for having already signed the Contribution License Agreement. Your agreement was validated by Microsoft. We will now review your pull request.
Thanks,
Microsoft Pull Request Bot

[ruslan-bikkinin]

Description updated with more detailed information about feature usage.

[geof90]

Awesome to finally see progress in this!

[max-mironov]

In general looks good to me, I believe we can postpone merging this (although it shouldn't break the existing code-base) unless the relevant code-push-service and code-push-cli changes would be published.

Also we should think about how we can improve code-push initialization with new code-signing feature via react-native link command (and this probably should be merged together with current PR).

[max-mironov]

Does it make sense to mark this var as Static also in accordance with how you e.g. add this to mServerUrl?

[ruslan-bikkinin]

@max-mironov it is not so critical, but, yeah, i can do it

[max-mironov]

I see that we have several places where we throw an UnknownException but why don't we add a more meaningful name to the exception class e.g. something like CodePushInvalidPublicKeyException?
The key point here from my side here - is this a really Unknown exception or do we know what kind of exception it is?

[ruslan-bikkinin]

@max-mironov good idea, thanks, i'll try to do it

[max-mironov]

Don't think if we ever need this if block here due to we can move this log statement (and this is the only thing that this block is doing now) to Line 255 right after new if (isDiffUpdate) block begins.

[ruslan-bikkinin]

@max-mironov no, we can't, because logging should be executed anyway regardless signature verification enabled or not.

[max-mironov]

Gotcha! May be we can also state what kind of update is applying currently with
isDiffUpdate ? CodePushUtils.log("Applying diff update.") : CodePushUtils.log("Applying full update.") but that is completely up to you.

[ruslan-bikkinin]

@max-mironov, good proposition, i think i'll do it your way ☝️

[ruslan-bikkinin]

@max-mironov changes added, thx!