Repository navigation
Sign every update; launch-test the Windows and Linux builds - #25
Merged
Merged
Conversation
The app's updater accepted anything its appcast pointed to: the macOS build had no SUPublicEDKey and the Windows build no DSAPub, and releases carried no signatures. - macOS: Info.plist carries SUPublicEDKey, an Ed25519 key, so Sparkle installs an update only with a valid signature from it. - Windows: Runner.rc carries a DSAPub resource, since the WinSparkle 0.8 that auto_updater bundles verifies DSA (over SHA-1), not EdDSA. - release.yml signs the .dmg and the installer with the private halves (the SPARKLE_ED_PRIVATE_KEY and WINSPARKLE_DSA_PRIVATE_KEY secrets), verifies each signature against the key the app embeds, and fails if either secret is missing. tools/release_metadata.dart writes sparkle:dsaSignature as well as sparkle:edSignature; tested. - The Ed25519 signatures OpenSSL makes are byte-identical to Sparkle's own sign_update's for the same key, so Sparkle accepts them. - The Windows build is installed silently, launched, checked to still be running after 15 s, and uninstalled; the Linux tarball is unpacked and launched under Xvfb. Until now only the macOS build was ever started. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The app's updater accepted anything its appcast pointed to: no
SUPublicEDKeyon macOS, noDSAPubon Windows, and no signatures in the releases.Info.plistcarriesSUPublicEDKey(Ed25519), so Sparkle installs an update only with a valid signature.Runner.rccarries aDSAPubresource. The WinSparkle 0.8 thatauto_updaterbundles verifies DSA (over SHA-1), not EdDSA.release.ymlsigns the.dmgand the installer with the private halves (secretsSPARKLE_ED_PRIVATE_KEY,WINSPARKLE_DSA_PRIVATE_KEY, already set), verifies each signature against the key the app embeds, and fails if either secret is missing.release_metadata.dartnow writessparkle:dsaSignaturetoo, with tests.sign_update's for the same key (checked locally), so Sparkle accepts them. Locally the whole sign-and-verify step works, and a tampered file is rejected.This PR runs the release workflow as a trial (it touches
release.yml,Info.plistandRunner.rc), so all of that runs here.~/.pinbench-keyson the machine that made them. Copy them somewhere safe: an installed app accepts only updates signed with the key it shipped with.🤖 Generated with Claude Code