Document Sparkle update contract#81
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4f85f38132
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| require_pattern "$TEMPLATE_PATH" "sparkle:releaseNotesLink sparkle:edSignature=" "signed release notes link" | ||
| require_pattern "$TEMPLATE_PATH" "<sparkle:criticalUpdate" "critical update marker" | ||
| require_pattern "$TEMPLATE_PATH" "url=\"https://github\\.com/OMT-Global/apw-cli/releases/download/v[0-9]+\\.[0-9]+\\.[0-9]+/APW\\.app\\.zip\"" "release archive URL" | ||
| require_pattern "$TEMPLATE_PATH" "sparkle:edSignature=" "signed archive enclosure" |
There was a problem hiding this comment.
The signed archive enclosure assertion only greps for sparkle:edSignature= anywhere in the template, so it still passes if the archive <enclosure> loses its signature while sparkle:releaseNotesLink keeps one. In that case, fast checks would report the appcast contract as valid even though the update archive is no longer guaranteed to be signed, which weakens the security gate this script is intended to enforce.
Useful? React with 👍 / 👎.
| require_pattern "$TEMPLATE_PATH" "<sparkle:criticalUpdate" "critical update marker" | ||
| require_pattern "$TEMPLATE_PATH" "url=\"https://github\\.com/OMT-Global/apw-cli/releases/download/v[0-9]+\\.[0-9]+\\.[0-9]+/APW\\.app\\.zip\"" "release archive URL" | ||
| require_pattern "$TEMPLATE_PATH" "sparkle:edSignature=" "signed archive enclosure" | ||
| require_pattern "$TEMPLATE_PATH" "length=\"[0-9]+\"" "archive length" |
There was a problem hiding this comment.
The archive length check matches length="[0-9]+" globally, which is satisfied by sparkle:length on sparkle:releaseNotesLink even if the archive <enclosure> no longer has a length attribute. That creates a false pass for a malformed appcast item and undermines this CI contract check for update metadata integrity.
Useful? React with 👍 / 👎.
athena-omt
added
area:infra
…-contract # Conflicts: # docs/SECURITY_POSTURE_AND_TESTING.md # scripts/ci/run-fast-checks.sh
Retry interrupted native-host socket reads so transient EINTR does not surface as a disconnected native helper while reading frame headers or payloads. Verification: - cargo fmt --manifest-path rust/Cargo.toml -- --check - cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings - cargo test --manifest-path rust/Cargo.toml daemon::tests::start_daemon_native_routes_requests_and_tracks_host_disconnect - cargo test --manifest-path rust/Cargo.toml - bash scripts/ci/run-fast-checks.sh - git diff --check
Retry interrupted UDP receives in the daemon test helper so Linux CI does not fail when recv returns EINTR while waiting for the daemon response. Verification: - cargo fmt --manifest-path rust/Cargo.toml -- --check - cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings - cargo test --manifest-path rust/Cargo.toml daemon::tests::start_daemon_native_routes_requests_and_tracks_host_disconnect - cargo test --manifest-path rust/Cargo.toml - bash scripts/ci/run-fast-checks.sh - git diff --check
Wire the documented Sparkle managed-update disable key into APW.app status and doctor payloads so the runtime can enforce enterprise update policy before enabling Sparkle checks. Also silence the AuthenticationServices error mapping warning by retaining a stable unknown fallback for newer SDK cases. Verification: - swift test --package-path native-app - bash scripts/build-native-app.sh - bash scripts/ci/validate-appcast-contract.sh - bash scripts/ci/run-fast-checks.sh - git diff --check
Add Sparkle as the native app update framework, start SPUStandardUpdaterController behind the managed update-disable policy, and package Sparkle.framework into APW.app with the correct runtime search path. Verification: - swift test --package-path native-app - bash scripts/build-native-app.sh - native-app/dist/APW.app/Contents/MacOS/APW doctor - test -d native-app/dist/APW.app/Contents/Frameworks/Sparkle.framework && otool -l native-app/dist/APW.app/Contents/MacOS/APW | rg -q '@loader_path/\.\./Frameworks' - codesign --verify --deep --strict --verbose=2 native-app/dist/APW.app - bash scripts/ci/run-fast-checks.sh - git diff --check
Parse the Sparkle template XML and verify the archive URL, EdDSA signature, and length directly on the enclosure element so unrelated attributes cannot satisfy the contract.
2 participants
Summary
scripts/ci/validate-appcast-contract.sh, then wires that validator into fast checks.<enclosure>element.scripts/prepare-sparkle-appcast.shand regression coverage for signed update enclosures, signed release-notes links, and critical-update release notes.appcast.xmland a signedAPW.appupdate archive whenSPARKLE_GENERATE_APPCASTis configured on the release runner.APW_SPARKLE_PUBLIC_ED_KEYis configured.SPUStandardUpdaterControllerbehind the managed update-disable policy, and embedsSparkle.frameworkintoAPW.app.Related issue: #57.
This now covers the documented Sparkle decision, signed appcast publication path, native bundle metadata, runtime Sparkle linkage, and managed update-disable policy. The remaining acceptance proof for #57 is a signed/notarized update-flow run against a real release appcast.
Verification
./scripts/ci/validate-appcast-contract.sh./scripts/test-prepare-sparkle-appcast.sh./scripts/test-render-native-app-info-plist.shbash -n scripts/prepare-sparkle-appcast.sh scripts/test-prepare-sparkle-appcast.sh scripts/ci/validate-appcast-contract.sh scripts/ci/run-fast-checks.shruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "release.yml parses"'bash scripts/ci/run-fast-checks.shswift test --package-path native-appbash scripts/build-native-app.shnative-app/dist/APW.app/Contents/MacOS/APW doctortest -d native-app/dist/APW.app/Contents/Frameworks/Sparkle.framework && otool -l native-app/dist/APW.app/Contents/MacOS/APW | rg -q '@loader_path/\\.\\./Frameworks'codesign --verify --deep --strict --verbose=2 native-app/dist/APW.appAPW_SPARKLE_PUBLIC_ED_KEY=test-ed25519-public-key bash scripts/build-native-app.sh && grep -q '<key>SUPublicEDKey</key>' native-app/dist/APW.app/Contents/Info.plist && grep -q 'test-ed25519-public-key' native-app/dist/APW.app/Contents/Info.plist && grep -q '<key>SURequireSignedFeed</key>' native-app/dist/APW.app/Contents/Info.plistcargo fmt --manifest-path rust/Cargo.toml -- --checkcargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warningscargo test --manifest-path rust/Cargo.toml daemon::tests::start_daemon_native_routes_requests_and_tracks_host_disconnectcargo test --manifest-path rust/Cargo.tomlgit diff --checkNotes
SUFeedURL, EdDSA signatures,SUVerifyUpdateBeforeExtraction,SURequireSignedFeed, andsparkle:criticalUpdate.SPARKLE_GENERATE_APPCASTis absent so it cannot publish unsigned placeholder metadata.