Sparkle

sign_update Does Not Code-Sign

Asked by pinkfloydgeek

Recently, I have been having trouble signing my app. I've uninstalled and reinstalled the Sparkle framework in my Xcode project (if it helps, I use Xcode 3.2.1) numerous times, destroyed and made new public and private keys, and even downgraded to an older form of Sparkle. Currently, I am using the current version of Sparkle (1.5 b6) that I just downloaded from its homepage. I've been messing around all morning trying to found the source and I think I nailed it: the code-signing Ruby tool (provided with the Sparkle package; named "sign_update.rb" as it ought to be) is not signing my final zipped app. I verified this by using the MD5 tool in Terminal.

I entered the line: ruby "./sign_update.rb" ~/Programming/Mac\ LS\ 4/build/Debug/Mac\ LS\ 5.zip ~/Keys/dsa_priv.pem
It returned: MC4CFQCYVtOwvRzlw+zlzqEjP+7GYWnOqQIVAMsIU/UnhZgjpNucfAPKetfc3R6E
I then moved the zip file to my home directory and entered the line: md5 ~/Mac\ LS\ 5.zip
MD5 returned: c5fb937e1d226de58be967a5fe0b2fcd

For clarification, "Mac LS 4" is the correct folder for my Xcode project; I just haven't changed the folder name yet. Am I forgetting a key step? I don't believe so since I've followed the documentation to the tee but I can't be sure because, well, I'm the one having the problem.

Question information

Language:
English Edit question
Status:
Solved
For:
Sparkle Edit question
Assignee:
No assignee Edit question
Solved by:
pinkfloydgeek
Solved:
Last query:
Last reply:
Revision history for this message
Andy Matuschak (andymatuschak) said : 		#1

That tool doesn't code-sign your app; it generates a DSA signature. That will be different from MD5 (it's cryptographic, for one...), so those lines shouldn't match up.

Revision history for this message
pinkfloydgeek (pinkfloydgeek) said : 		#2

Well then, if that's true, then what other choices are there?

Here are my steps for publishing each update:

1.) Run a "Release build"
2.) Compress the released app into a ZIP
3.) Run ruby "./sign_update.rb" ~/Programming/Mac\ LS\ 4/build/Debug/Mac\ LS\ 5.zip ~/Keys/dsa_priv.pem in Terminal
4.) Copy the DSA Signature outputted and paste it into my appcast at http://maclsd.110mb.com/appcast.xml (I make a very small app for a very small community called vSide).

Revision history for this message
Hofman (cmhofman) said : 		#3

You haven't mentioned anything whatsoever that fails, everything you say works exactly as it should. So what is your problem?

Revision history for this message
Hofman (cmhofman) said : 		#4

Your appcast does not include the DSA signature and the link in the appcast does not point to anything useful. If that explains your problem I don't know, because you haven't told us what your problem is.

Revision history for this message
pinkfloydgeek (pinkfloydgeek) said : 		#5

Oops... I think I removed the DSA signature for testing... as for the issue, my users cannot update their apps. It gives them the "improperly signed" warning.