We encourage you to head over to Microsoft Q&A for .NET for posting new questions and get involved today.
Xamarin.Mac facing issues EdDSA signing app with Sparkle
USMember ✭✭✭
Description of the problem
Hi,
I'm trying to get Sparkle to work on my Xamarin.Mac app through bindings on https://github.com/rainycape/SparkleSharp (which might i add is quite well done) however I seem to be not understanding the updating process.
Currently what i understand to process is...
- Add appcast.xml url path in SUFeedURL in info.plist
- Generate EdDSA Key
- Put EdDSA public key in Resource and add in info.plist under SUPublicDSAKeyFile : dsa_pub.pem
- Publish the application as a .app file
- Sign the .app file. Done with
codesign -f -vvvv --strict --deep -s "Developer ID Application: ******" DemoApp.app - Put the .app file in a .dmg file
- Sign the dmg with my EdDSA private key
./sign_update ~/Desktop/DemoApp.dmg dsa_priv.pem - Convert my dmg file to a read only
hdiutil convert ~/Desktop/DemoApp.dmg -format UDRO -o ~/Desktop/demoReadonly.dmg - Upload the dmg file to my website
- Update my appcast.xml
<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
<channel>
<title>For unit test only</title>
<item>
<title>Version 2.0</title>
<description>desc</description>
<pubDate>Sat, 26 Jul 2014 15:20:11 +0000</pubDate>
<enclosure url="www.mywebsite.com/demoReadonly.dmg" sparkle:version="2.0" />
<sparkle:tags> <sparkle:criticalUpdate /> </sparkle:tags>
</item>
</channel>
</rss>
After doing all this my app is able to detect there is an update available and pulls down the update but i end up with the Console.app output below
Do you use Sandboxing in your app?
I am not using Sandboxing
Version of Sparkle.framework in the latest version of your app
From what i understand the binding pulls the latest version of Sparkle and create bindings from that.
Version of Sparkle.framework in the old version of app that your users have (or N/A)
No
Sparkle's output from Console.app
2019-02-25 14:43:27.614 Demo App[36902:2325600] Sparkle: ===== Demo App ===== 2019-02-25 14:43:27.615 Demo App[36902:2325600] Sparkle: Extracting /Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/DemoAppInstall.dmg as a DMG 2019-02-25 14:43:32.990 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/ toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/ 2019-02-25 14:43:32.992 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/.DS_Store toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/.DS_Store 2019-02-25 14:43:32.993 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/.fseventsd toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/.fseventsd 2019-02-25 14:43:33.000 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/2.app toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/2.app "disk3" ejected. 2019-02-25 14:43:42.873 Demo App[36902:2325583] Sparkle: There is no DSA signature to check 2019-02-25 14:43:42.874 Demo App[36902:2325583] Sparkle: DSA signature validation failed. The update has a public DSA key and is signed with a DSA key, but the public key doesn't match the signature. The update will be rejected. 2019-02-25 14:43:44.341 Demo App[36902:2325583] Sparkle: Error: An error occurred while extracting the archive. Please try again later. The update is improperly signed. (URL (null))
Steps to reproduce the behavior
Steps have been described above in Description of problem. If more information is required I will be able to provide more.
Best Answer
-
kenneth.lee
USMember ✭✭✭
I solved my issue as there was a few problems with my implementation...
I was using updated documentation to do my updates as i made assumptions that the binding drew from the latest version of Sparkle but i was wrong and uses the commit https://github.com/sparkle-project/Sparkle/tree/bb299d075b7be7eb7dd1cbf8a5c5a82a77b90ad6/
another mistake i did was to wrap the app file in a dmg which apparently needs to be wrapped again with a pkg from my understanding and instead i wrapped and signed the app with a zip
another oversight was that i didn't add the dsaSignature in my appcast since it was not in the documentations in the new sparkle.
I found this out by using a web archive of the sparkle documentation from
https://web.archive.org/web/20151031184354/http://sparkle-project.org/documentation/
and
https://web.archive.org/web/20151027160644/http://sparkle-project.org/documentation/publishing/#publishing-an-updateEnded up just being a huge mess up on my side and hopefully this helps anyone else in the same boat.
P.S. using old versions of sparkle has some security vulnerabilities
0
Answers
You may want to contact sparkle, as this specific issue sounds very sparkle related. I'm not sure you'll find much expertise here.
I solved my issue as there was a few problems with my implementation...
I was using updated documentation to do my updates as i made assumptions that the binding drew from the latest version of Sparkle but i was wrong and uses the commit https://github.com/sparkle-project/Sparkle/tree/bb299d075b7be7eb7dd1cbf8a5c5a82a77b90ad6/
another mistake i did was to wrap the app file in a dmg which apparently needs to be wrapped again with a pkg from my understanding and instead i wrapped and signed the app with a zip
another oversight was that i didn't add the dsaSignature in my appcast since it was not in the documentations in the new sparkle.
I found this out by using a web archive of the sparkle documentation from
https://web.archive.org/web/20151031184354/http://sparkle-project.org/documentation/
and
https://web.archive.org/web/20151027160644/http://sparkle-project.org/documentation/publishing/#publishing-an-update
Ended up just being a huge mess up on my side and hopefully this helps anyone else in the same boat.
P.S. using old versions of sparkle has some security vulnerabilities