sparkle-project / Sparkle

A software update framework for macOS
https://sparkle-project.org
Other
7.37k stars 1.05k forks source link

The update is improperly signed and could not be validated. #2400

Closed JesseGuoX closed 1 year ago

JesseGuoX commented 1 year ago

Thank you for the great open source software you create. I have some trouble to build application with it.

Description of the problem

When I integrate Sparkle2 into my application, it can detect and download updates normally, but an Update Error! will occur during the update process.

Update Error!
The update is improperly signed and could not be validated. Please try again later or contact the app developer.

Do you use Sandboxing in your app?

No

Version of Sparkle.framework in the latest version of your app

Sparkle-2.4.2

Version of Sparkle.framework in the old version of app that your users have (or N/A)

N/A

Steps to reproduce the behavior

Here is my step to use Sparkle:

  1. Download Sparkle-2.4.2 copy necessary files to my project and link to it.
  2. Run ./bin/generate_keys to generate keys, and set the value of SUPublicEDKey in Info.plist to the public key shown on the console.
  3. Create zip archives with my app ditto -c -k --sequesterRsrc --keepParent MyApp.app MyApp.zip.
  4. bin/sign_update MyApp.zip sign my archives.
  5. set sparkle:edSignature="9VzxOlScAwl7Q1AlzHtK7xYtCpPppy5zhanT5D3GCQEZ5i8uRjnVO6342t+Dk3Js7Jep+RezKN1O3ShWCN0tCg==" length="81895663" to appcast file.
  6. Run my app and check update.
  7. Check update(success)->Downloading(success)->Extracting(success)->occur Update Error.

FYI

Currently I don't have an Apple developer account, so I can't sign the application with a developer certificate. My application is a Qt Appliction.

Questions

Is an Apple developer certification required? Is an edDSA signature required? How to set up skipping?