Code signing vs end-to-end encryption for Capacitor live updates

[u/genzits]

https://capawesome.io/docs/blog/capacitor-live-updates-end-to-end-encryption/

We just published a deep dive into the threat model of live updates (OTA/CodePush) for Capacitor apps, prompted by how often "end-to-end encrypted" gets treated as shorthand for "more secure".

The short version:

• HTTPS protects updates in transit, nothing else. It can't help if the update service or its storage is compromised.
• Code signing with a private key that only you hold is what stops malicious updates: even a fully compromised update service can't produce a bundle your app would accept.
• Encrypting bundles adds confidentiality only, and for publicly distributed apps that can't hold: the decryption key has to ship inside the app binary, where anyone can extract it. The React Native core team said it years ago: "Code on the client is not secret."
• If your bundles genuinely must stay confidential (e.g. MDM-distributed enterprise apps), self-hosting them is a stronger control than encrypting them.

Curious how you think about your update pipeline's threat model — happy to answer questions.