[revopushbot]

Fixes REV-137.

Problem

sign() deletes a previous .codepushrelease before writing a new one, but it used fs.rmdir, which only removes folders. Signing an already signed folder always failed with ENOTDIR: not a directory, rmdir '…/.codepushrelease'.

release-react and release-expo empty the output folder before signing, so this didn't affect them today. It failed whenever sign() ran on a folder that was already signed.

Fix

• sign.ts: delete the file with fs.rm(signatureFilePath, { force: true }). The "Deleting previous release signature" log line and the access-rights error stay as they were.
• New test/sign.ts, which signs with a freshly generated RSA key and checks the result with the public key:
  • First signing: writes a valid signature whose contentHash equals generatePackageHashFromDirectory for the folder.
  • Signing the same folder again: replaces the signature, and the content hash is unchanged, which also shows the old signature was removed before hashing. This test failed with ENOTDIR before the fix.
  • A missing signing key: is rejected, and no signature file is written.

Verification

• Build and lint: tsc, npm run lint and Prettier are clean.
• Tests: all 158 pass on macOS and on Linux (Docker, Node 20.19.0).

🤖 Generated with Claude Code