Xamarin.Mac facing issues EdDSA signing app with Sparkle

kenneth.lee

Description of the problem

Hi,

I'm trying to get Sparkle to work on my Xamarin.Mac app through bindings on https://github.com/rainycape/SparkleSharp (which might i add is quite well done) however I seem to be not understanding the updating process.

Currently what i understand to process is...

1. Add appcast.xml url path in SUFeedURL in info.plist
2. Generate EdDSA Key
3. Put EdDSA public key in Resource and add in info.plist under SUPublicDSAKeyFile : dsa_pub.pem
4. Publish the application as a .app file
5. Sign the .app file. Done with
   codesign -f -vvvv --strict --deep -s "Developer ID Application: ******" DemoApp.app
6. Put the .app file in a .dmg file
7. Sign the dmg with my EdDSA private key
   ./sign_update ~/Desktop/DemoApp.dmg dsa_priv.pem
8. Convert my dmg file to a read only
   hdiutil convert ~/Desktop/DemoApp.dmg -format UDRO -o ~/Desktop/demoReadonly.dmg
9. Upload the dmg file to my website
10. Update my appcast.xml

<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
  <channel>
    <title>For unit test only</title>
    <item>
        <title>Version 2.0</title>
        <description>desc</description>
        <pubDate>Sat, 26 Jul 2014 15:20:11 +0000</pubDate>
        <enclosure url="www.mywebsite.com/demoReadonly.dmg" sparkle:version="2.0" />
        <sparkle:tags> <sparkle:criticalUpdate /> </sparkle:tags> 
    </item>
  </channel>
</rss>

After doing all this my app is able to detect there is an update available and pulls down the update but i end up with the Console.app output below

Do you use Sandboxing in your app?

I am not using Sandboxing

Version of Sparkle.framework in the latest version of your app

From what i understand the binding pulls the latest version of Sparkle and create bindings from that.

Version of Sparkle.framework in the old version of app that your users have (or N/A)

No

Sparkle's output from Console.app

2019-02-25 14:43:27.614 Demo App[36902:2325600] Sparkle: ===== Demo App =====
2019-02-25 14:43:27.615 Demo App[36902:2325600] Sparkle: Extracting /Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/DemoAppInstall.dmg as a DMG
2019-02-25 14:43:32.990 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/  toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/ 
2019-02-25 14:43:32.992 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/.DS_Store toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/.DS_Store
2019-02-25 14:43:32.993 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/.fseventsd toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/.fseventsd
2019-02-25 14:43:33.000 Demo App[36902:2325600] Sparkle: copyItemAtPath:/Volumes/EB5B127E-3871-439D-A742-932733464C6C/2.app toPath:/Users/dev1/Library/Caches/com.oganisation.demoapp.macos/org.sparkle-project.Sparkle/Demo App 3.0/2.app
"disk3" ejected.
2019-02-25 14:43:42.873 Demo App[36902:2325583] Sparkle: There is no DSA signature to check
2019-02-25 14:43:42.874 Demo App[36902:2325583] Sparkle: DSA signature validation failed. The update has a public DSA key and is signed with a DSA key, but the public key doesn't match the signature. The update will be rejected.
2019-02-25 14:43:44.341 Demo App[36902:2325583] Sparkle: Error: An error occurred while extracting the archive. Please try again later. The update is improperly signed. (URL (null))

Steps to reproduce the behavior

Steps have been described above in Description of problem. If more information is required I will be able to provide more.

kenneth.lee

I solved my issue as there was a few problems with my implementation...

I was using updated documentation to do my updates as i made assumptions that the binding drew from the latest version of Sparkle but i was wrong and uses the commit https://github.com/sparkle-project/Sparkle/tree/bb299d075b7be7eb7dd1cbf8a5c5a82a77b90ad6/

another mistake i did was to wrap the app file in a dmg which apparently needs to be wrapped again with a pkg from my understanding and instead i wrapped and signed the app with a zip

another oversight was that i didn't add the dsaSignature in my appcast since it was not in the documentations in the new sparkle.

I found this out by using a web archive of the sparkle documentation from

https://web.archive.org/web/20151031184354/http://sparkle-project.org/documentation/
and
https://web.archive.org/web/20151027160644/http://sparkle-project.org/documentation/publishing/#publishing-an-update

Ended up just being a huge mess up on my side and hopefully this helps anyone else in the same boat.

P.S. using old versions of sparkle has some security vulnerabilities

ChrisHamons

You may want to contact sparkle, as this specific issue sounds very sparkle related. I'm not sure you'll find much expertise here.

kenneth.lee

I solved my issue as there was a few problems with my implementation...

I was using updated documentation to do my updates as i made assumptions that the binding drew from the latest version of Sparkle but i was wrong and uses the commit https://github.com/sparkle-project/Sparkle/tree/bb299d075b7be7eb7dd1cbf8a5c5a82a77b90ad6/

another mistake i did was to wrap the app file in a dmg which apparently needs to be wrapped again with a pkg from my understanding and instead i wrapped and signed the app with a zip

another oversight was that i didn't add the dsaSignature in my appcast since it was not in the documentations in the new sparkle.

I found this out by using a web archive of the sparkle documentation from

https://web.archive.org/web/20151031184354/http://sparkle-project.org/documentation/
and
https://web.archive.org/web/20151027160644/http://sparkle-project.org/documentation/publishing/#publishing-an-update

Ended up just being a huge mess up on my side and hopefully this helps anyone else in the same boat.

P.S. using old versions of sparkle has some security vulnerabilities