Security & Verification

The CLI is a security-critical part of your build supply chain: it runs inside build pipelines, fetches native binaries, and handles credentials. It is built to the same standard as the rest of the Alphyn platform.

No secrets in your repository

The API key is passed by its per-platform flag (--android-api-key or --ios-api-key) or a -file path form (the CLI itself never reads it from the environment). To register builds automatically, integrate writes the key into a .alphyn/ key file and adds .alphyn/ to your .gitignore (plus an inner .alphyn/.gitignore), so the key stays on your machine and is never committed. alphyn.json itself records configuration and integrity metadata only, never a key. The build hooks are given only the file path, so the key value never reaches a build script, the Gradle configuration cache, or any command line.

Registry authentication

The SDK’s native binaries resolve from the Alphyn package registry at build time, and that resolution authenticates with your app API key as a build-time credential. alphyn-cli integrate wires the authenticated repositories into your build (the Gradle registry repository, the generated Swift package, the CocoaPods source) but deliberately never writes the key value: you supply it as ALPHYN_REGISTRY_KEY in the build environment, or through ~/.netrc for native iOS, so it lives in your environment or CI secret store and never in your source tree. The credential only grants access; every native binary is still verified against its pinned SHA-256 wherever it resolves, so access and integrity stay independent. See SDK Registry Access.

Integrity-verified downloads

Every SDK artifact is checked against the SHA-256 published in the backend’s SDK manifest before it is used. The download is streamed to a temporary file, its hash and size are verified, and only an exact match is atomically promoted into place; a checksum mismatch, a truncated stream, or an oversize response leaves nothing behind. A compromised mirror therefore cannot inject a modified SDK.

The key never leaks to a foreign host

The API key is sent only to the backend you selected. The CLI refuses to follow a redirect that leaves that origin, and refuses to download an artifact whose URL is not on the backend’s own origin, so a misconfigured or tampered manifest cannot redirect your key to another host. Plain http to a non-local host is refused outright.

Reproducible, verifiable releases

Release binaries are built with a pinned toolchain and -trimpath, and every release ships a SHA256SUMS file. You can verify a download before running it, and an auditor can rebuild a release from source and confirm it is byte-for-byte identical to the published binaries. The self-update command applies the same SHA-256 verification before it replaces the running binary, and never downgrades.

Reversible, idempotent edits

Every change integrate makes to your project is bounded by // alphyn:... markers, so re-running integrate is a no-op and remove restores the project to its exact pre-integration state.