Sparkle

Forgot public key and now get code-signing error

Asked by drewmccormack

I was careless in updating to Sparkle 1.5b6: I added the framework, but didn't realize code signing was compulsory. I then made a release with version 1.5b6, which went fine, but now I am at the next release, and all users are getting a code signing error when they try to update. I assume that is because I didn't add a public key to the previous release.

I have now added a public key, and added the key signature to the enclosure, but I assume I cannot fix what is already done, because the problem was in the previous release. Can you confirm I am screwed?

Would it not be an idea for Sparkle to warn the developer in some way, or drop back to non-secure downloads, if no developer public key is found in the Info.plist?

Thanks in advance.

Drew

Question information

Language:
English Edit question
Status:
Solved
For:
Sparkle Edit question
Assignee:
No assignee Edit question
Solved by:
Hofman
Solved:
Last query:
Last reply:
Revision history for this message
Best Hofman (cmhofman) said : 		#1

Confirming that you're screwed, sorry.

BTW, falling back to non-secure updates would undo the whole purpose of the security, so that should never be an option. Sparkle can't warn the developer, because it's a matter of resources, not code, so there's nothing missing in the code. In other words, it's a runtime error, not a compile error. The only way to warn the developer therefore is to test run it yourself, which you should always do no matter what, especially when upgrading a component.

Revision history for this message
drewmccormack (drewmccormack) said : 		#2

Thanks for the followup. I figured that was the case.

Regarding 'falling back to insecure', I don't really see why that is not an option. I'm not proposing falling back on checksum failure, I'm proposing simply checking in the Info.plist for the dsa signature, and if the developer hasn't provided one, assuming they do not wish to use secure download. That was the situation before, so why break things on an update? You could allow people that add the key the extra security, without requiring it.

In any case, thanks for the reply.

Drew