Safari Bundle - The update is improperly signed.

Asked by GRMrGecko

I am writing a Safari plugin via an Input Manager and I am wanting to add update support to it. The only problem I'm having is that I am unable to update due to singing. I used to just use beta 5 as I knew it worked without having to be signed, but I think it's about time to figure this out... I am testing this with the sparkle test app. Let me explain my steps to doing this.
1. Cd into a folder for my app signatures that I will backup once I get it working.
2. Run ruby generate_keys.rb which made the dsa_priv.pem and dsa_pub.pem successfully with the messages below.

Generating DSA parameters, 2048 bit long prime
This could take some time
.....+....................**************++++++++++++++++++++*
generate_keys.rb:8: warning: Insecure world writable dir /usr/ubin in PATH, mode 040777
Generating DSA key, 2048 bits
generate_keys.rb:9: warning: Insecure world writable dir /usr/ubin in PATH, mode 040777
read DSA key
writing DSA key
generate_keys.rb:10: warning: Insecure world writable dir /usr/ubin in PATH, mode 040777

Generated private and public keys: dsa_priv.pem and dsa_pub.pem.

BACK UP YOUR PRIVATE KEY AND KEEP IT SAFE!

If you lose it, your users will be unable to upgrade!

I am aware that ubin is writable, it's just a place for me to place little utilities that I want to quickly access.

3. (After I updated the app with the pub key and the appcast url) I place the Sparkle Test App in a folder named Sparkle Test App and zip it up (I normally will have a documentation pdf and such in that folder as well).
4. I run ruby sign_update.rb "Sparkle Test App.zip" dsa_priv.pem output is below. I am thinking it's a bit weird that it has a return on the result.
MEQCIA02KtGi7bJhxF8bLqPifw6kFBdEBh/bL15Qe1i0MYdWAiAeVAOas4U2fCje
afoPuKZuJFvttqc9mvDAiqOWvyO4Gg==

5. I add to my site that automatically creates the appcast, the result is below.
<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
   <channel>
      <title>Sparkle Test App</title>
      <language>en</language>
      <pubDate>Mon, 1 Nov 2010 20:06:04 CDT</pubDate>
      <lastBuildDate>Mon, 1 Nov 2010 20:06:04 CDT</lastBuildDate>
      <item>
         <title>Sparkle Test App 2.0</title>
         <pubDate>Mon, 1 Nov 2010 20:06:04 CDT</pubDate>
         <sparkle:releaseNotesLink>
          http://domain.com/applications/releasenotes/sparkletest
      </sparkle:releaseNotesLink>
         <enclosure sparkle:dsaSignature="MEQCIA02KtGi7bJhxF8bLqPifw6kFBdEBh/bL15Qe1i0MYdWAiAeVAOas4U2fCje
afoPuKZuJFvttqc9mvDAiqOWvyO4Gg==" sparkle:version="2.0" url="http://domain.com/applications/appcastdownload/sparkletest" length="709921" type="application/octet-stream"/>
      </item>
   </channel>
</rss>

6. I test the update, get the screen with everything that is suppose to be on it.
7. I push install update and after it downloads I get the error saying it was unable to extract and the console outputs below.
11/1/10 8:08:57 PM Sparkle Test App[54443] Sparkle Error: An error occurred while extracting the archive. Please try again later.
11/1/10 8:08:57 PM Sparkle Test App[54443] Sparkle Error (continued): The update is improperly signed.

If you ask me, I did all the steps mentioned in the documentation and it all fails. Can you see a problem here?

Question information

Language:
English Edit question
Status:
Solved
For:
Sparkle Edit question
Assignee:
No assignee Edit question
Solved by:
GRMrGecko
Solved:
Last query:
Last reply:
Revision history for this message
Andy Matuschak (andymatuschak) said :
#1

Would you run "openssl version" in the Terminal for me?

Revision history for this message
GRMrGecko (grmrgecko) said :
#2

OpenSSL 1.0.0a 1 Jun 2010
I am running Sparkle from git 7baf50506b6212cdffb0ab87337785177825bb79 Thu Oct 14 15:36:52 2010 +0800

Revision history for this message
Andy Matuschak (andymatuschak) said :
#3

Aha, yes, this is a known issue. Snow Leopard shipped with 0.9.8l, and 1.0.0a is a little different. Grab the new generate_keys.rb from GitHub, and you'll be good to go.

http://github.com/andymatuschak/Sparkle/blob/master/generate_keys.rb

Revision history for this message
GRMrGecko (grmrgecko) said :
#4

Well, it seems as if that fixed that issue, but now I am getting this error.
11/2/10 2:00:14 PM Sparkle Test App[16641] Sparkle Error: No valid unarchiver for /var/folders/rT/rT6cmBDxF-iERTnAmGCaa++++TI/-Tmp-/Sparkle Test App 1.5 Update 9/Sparkle Test App.zip!
11/2/10 2:00:16 PM Sparkle Test App[16641] Sparkle Error: An error occurred while extracting the archive. Please try again later.

The way I'm building the zip is with ditto -ck --sequesterRsrc --keepParent as I am making a script to do the distribution building.

Revision history for this message
GRMrGecko (grmrgecko) said :
#5

It does it if I use a dmg, zip, or tar.gz. I do not understand why it's doing this. I will look more into this and give an update.

Revision history for this message
GRMrGecko (grmrgecko) said :
#6

I've discovered that it only does that when you run the test app not in xcode... It works fine on my app and when I run the test app in xcode.