[Android] The update contents failed the data integrity check.

[ngocan3897]

[Android] The update contents failed the data integrity check when downloading an update released with revopush release-react

Description

When the app downloads a new CodePush update on Android, codePush.sync() fails with:

The update contents failed the data integrity check.

The update is downloaded successfully (download progress reaches 100%), but the post-download hash verification rejects the package, so the update is never installed. iOS releases from the same codebase work fine.

Environment

@revopush/react-native-code-push	2.5.0
revopush CLI	0.0.13
react-native	0.83.1 (New Architecture enabled)
react	19.2.0
Hermes	enabled
Android compile/targetSdk	36, minSdk 24
R8 / ProGuard	enabled (minifyEnabled true, shrinkResources true)
CodePush server	https://api.revopush.org (Revopush cloud)
App binary version	1.0.1
Device / OS	[Android device]
Reproducibility	[every install ]

Steps to reproduce

1. Release an update to the Android app:

   revopush release-react <android-application-name> android -d Production -m -t <version>

2. In the app, check and install the update:

   const update = await codePush.checkForUpdate();
   // update.isMandatory === true → user is shown an install screen, then:
   await codePush.sync(
     {
       installMode: codePush.InstallMode.IMMEDIATE,
       mandatoryInstallMode: codePush.InstallMode.IMMEDIATE,
     },
     syncStatusChangedCallback,
     downloadProgressCallback,
     handleBinaryVersionMismatchCallback
   );

3. The package downloads fully (DOWNLOADING_PACKAGE reaches 100%), then sync rejects with the error below.

Error

{ [he.a: The update contents failed the data integrity check.]
  nativeStackAndroid:
   [ { lineNumber: 16,  file: 'SourceFile', methodName: 'd',            class: 'je.c' },
     { lineNumber: 211, file: 'SourceFile', methodName: 'k',            class: 'ge.g' },
     { lineNumber: 39,  file: 'SourceFile', methodName: 'd',            class: 'com.microsoft.codepush.react.i' },
     { lineNumber: 70,  file: 'SourceFile', methodName: 'a',            class: 'com.microsoft.codepush.react.CodePushNativeModule$b' },
     { lineNumber: 3,   file: 'SourceFile', methodName: 'doInBackground', class: 'com.microsoft.codepush.react.CodePushNativeModule$b' },
     { lineNumber: 394, file: 'AsyncTask.java',          methodName: 'call',      class: 'android.os.AsyncTask$3' },
     { lineNumber: 266, file: 'FutureTask.java',         methodName: 'run',       class: 'java.util.concurrent.FutureTask' },
     { lineNumber: 1167,file: 'ThreadPoolExecutor.java', methodName: 'runWorker', class: 'java.util.concurrent.ThreadPoolExecutor' },
     { lineNumber: 641, file: 'ThreadPoolExecutor.java', methodName: 'run',       class: 'java.util.concurrent.ThreadPoolExecutor$Worker' },
     { lineNumber: 923, file: 'Thread.java',             methodName: 'run',       class: 'java.lang.Thread' } ],
  name: 'he.a',
  userInfo: null,
  code: 'EUNSPECIFIED' }

Class names are obfuscated by R8 (the build has minifyEnabled true); the frames map to CodePushUpdateManager.downloadPackage → folder-hash verification (CodePushUpdateUtils.verifyFolderHash). I can provide the mapping.txt or a stack trace from a non-minified build if that helps.

Expected behavior

The downloaded update passes hash verification and is installed.

Actual behavior

Every download fails verification with The update contents failed the data integrity check, so users on Android can never receive OTA updates.

Additional context

• The bundle is released with the revopush CLI 0.0.13 (release-react), so the package hash is computed by the CLI at release time — this looks like a hash-computation mismatch between CLI 0.0.13 and SDK 2.5.0 on Android (possibly Hermes-related, since release-react runs the Hermes compiler for RN 0.83).
• Asset filenames are all ASCII (ruled out The update contents failed the data integrity check (UTF8 characters in filename) microsoft/react-native-code-push#1793).
• Possibly related to [Android] Integrity check fails due to path mismatch between CodePushMetadata and actual file locations #35 ([Android] Integrity check fails due to path mismatch between CodePushMetadata and actual file locations), although that one was reported for release-native — this report is for release-react.

Happy to provide the release logs, the downloaded update contents from a device, or anything else that helps debugging.