Update and verify SDK
Managing Aera Wallets SDK versions
The Aera Wallets SDK releases are added to Sharepoint.
When using the SDK, we advise you to
- Ensure the SDK is updated as new versions are released by Aera
- Monitor Aera’s changelog for breaking changes or migration steps
Updating SDK Versions
- Download the newest Wallets SDK and SID SDK versions from Sharepoint
- Verify the integrity of the downloaded files. See section below. If anything looks suspicious, contact Aera immediately.
- Replace the old .aar/.xcframework Secure ID- and Wallets SDK files in your projects lib/frameworks folder with the new files (the Secure ID SDK MUST match the one distributed together with the Wallets SDK)
- Android: Gradle sync & rebuild project
- iOS: Embed and sign the frameworks & rebuild project
- When relevant, update your code based on the updated Change logs and SDK version log
For iOS, only one version of the same xcframework can be present at the same time. Remember to update to the correct (staging or production) versions under Frameworks!
Verify Integrity of SDK releases
Android
The Secure ID- and Wallets SDK are provided as signed .aar files, and the integrity can be verified by using the jarsigner tool.
Public Keystores found in Sharepoint include the certificates.
Example Wallets SDK
Staging
$ jarsigner -keystore <path_to_public_keystore>/android-wallets-sdk-keystore-debug-public.p12 -verify aeraWalletsSDK-androidx-release-TEST-signed.aar WalletsSDKDebug -storepass AeraWalletsSDKPublic1!👇Production
$ jarsigner -keystore <path_to_public_keystore>/android-wallets-sdk-keystore-release-public.p12 -verify aeraWalletsSDK-androidx-release-signed.aar aera-wallets-sdk-release-public -storepass AeraWalletsSDKPublic2!Example Secure ID SDK
Staging
$ jarsigner -keystore <path_to_public_keystore>/aarsign-public-test.keystore -verify AeraSdk-androidx-release-TEST-signed.aar aarsign -storepass qwer1234 👇Production
$ jarsigner -keystore <path_to_public_keystore>/aarsign-public-prod.keystore -verify AeraSdk-androidx-release-signed.aar aarsign -storepass AeraPublic1!🆕 iOS
The Secure ID- and Wallets SDK are provided as signed .xcframework files, and the integrity can be verified by using codesign and openssl.
Example Wallets SDK
Verify the signature and integrity of the xcframework with
$ codesign --verify --strict --verbose=2 aerawalletssdk.test.xcframework
$ codesign --verify --strict --verbose=2 aerawalletssdk.xcframeworkConfirm authenticity with
$ codesign -dvvv aerawalletssdk.test.xcframework
$ codesign -dvvv aerawalletssdk.xcframeworkExample Secure ID SDK
Check against the release.signature provided in each production SDK release
$ openssl dgst -sha256 -verify <path_to_public_keystore>/public_key.pem -signature release.signature Aera\ SecureID.zipUpdated about 1 month ago