From 070c8e336d7903a1b3ce32bc649a407e8f668a28 Mon Sep 17 00:00:00 2001 From: edde746 <86283021+edde746@users.noreply.github.com> Date: Tue, 24 Feb 2026 11:57:34 +0100 Subject: [PATCH] feat: switch to auto_updater fork with WinSparkle 0.9.2 EdDSA --- .github/workflows/build.yml | 56 +++++++++++++++--------- pubspec.lock | 17 +++++-- pubspec.yaml | 5 ++- windows/runner/Runner.rc | 4 +- windows/runner/resources/dsa_pub.pem | 36 --------------- windows/runner/resources/ed25519_pub.txt | 1 + 6 files changed, 56 insertions(+), 63 deletions(-) delete mode 100644 windows/runner/resources/dsa_pub.pem create mode 100644 windows/runner/resources/ed25519_pub.txt diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f8bc078f..8fd08282 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -217,11 +217,19 @@ jobs: APP_PATH="build/macos/Build/Products/Release/Plezy.app" - # Sign all frameworks and dylibs first (inside-out signing) - find "$APP_PATH/Contents/Frameworks" -name "*.framework" -o -name "*.dylib" | while read framework; do - echo "Signing: $framework" - codesign --force --sign "$IDENTITY" --timestamp --options runtime "$framework" - done + # Deep sign everything inside-out: executables, dylibs, XPC services, app bundles, frameworks + find "$APP_PATH/Contents/Frameworks" \( -name "*.xpc" -o -name "*.app" -o -name "*.framework" -o -name "*.dylib" \) -print0 \ + | sort -zr \ + | while IFS= read -r -d '' item; do + echo "Signing: $item" + codesign --force --sign "$IDENTITY" --timestamp --options runtime "$item" + done + + # Sign any remaining bare executables (e.g. Sparkle's Autoupdate) + find "$APP_PATH/Contents/Frameworks" -type f -perm +111 ! -name "*.dylib" ! -path "*/Headers/*" ! -path "*/Modules/*" -print0 \ + | while IFS= read -r -d '' exe; do + codesign --force --sign "$IDENTITY" --timestamp --options runtime "$exe" 2>/dev/null || true + done # Sign the app bundle itself echo "Signing app bundle: $APP_PATH" @@ -274,8 +282,11 @@ jobs: env: SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }} run: | - SIGN_BIN="macos/Pods/Sparkle/bin/sign_update" - SIGNATURE=$(echo "$SPARKLE_PRIVATE_KEY" | "$SIGN_BIN" plezy-macos.dmg --ed-key-file - -p) + printf -- "-----BEGIN ED25519 PRIVATE KEY-----\n%s\n-----END ED25519 PRIVATE KEY-----\n" "$SPARKLE_PRIVATE_KEY" > ed25519_key.pem + OUTPUT=$(dart run auto_updater:sign_update plezy-macos.dmg ed25519_key.pem) + rm ed25519_key.pem + # Extract edSignature value from output like: sparkle:edSignature="..." length="..." + SIGNATURE=$(echo "$OUTPUT" | grep -o 'edSignature="[^"]*"' | sed 's/edSignature="//;s/"//') echo "MACOS_ED_SIGNATURE=$SIGNATURE" >> $GITHUB_ENV echo "MACOS_DMG_SIZE=$(stat -f%z plezy-macos.dmg)" >> $GITHUB_ENV @@ -403,16 +414,21 @@ jobs: - name: Build installer and portables run: .\windows\build-installer.ps1 -X64BuildDir "build-x64" -Arm64BuildDir "build-arm64" - - name: Sign installer for WinSparkle (DSA) - if: env.WINSPARKLE_DSA_PRIVATE_KEY != '' + - name: Sign installer for WinSparkle (EdDSA) + if: env.SPARKLE_PRIVATE_KEY != '' env: - WINSPARKLE_DSA_PRIVATE_KEY: ${{ secrets.WINSPARKLE_DSA_PRIVATE_KEY }} + SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }} shell: pwsh run: | - $env:WINSPARKLE_DSA_PRIVATE_KEY | Out-File -Encoding ascii dsa_priv.pem - $output = dart run auto_updater:sign_update plezy-windows-installer.exe - Remove-Item dsa_priv.pem - $output | Out-File -Encoding ascii win-dsa-signature.txt + @" + -----BEGIN ED25519 PRIVATE KEY----- + $($env:SPARKLE_PRIVATE_KEY) + -----END ED25519 PRIVATE KEY----- + "@ | Out-File -Encoding ascii ed25519_key.pem + $output = dart run auto_updater:sign_update plezy-windows-installer.exe ed25519_key.pem + Remove-Item ed25519_key.pem + $sig = [regex]::Match($output, 'edSignature="([^"]*)"').Groups[1].Value + $sig | Out-File -Encoding ascii win-ed-signature.txt (Get-Item plezy-windows-installer.exe).Length | Out-File -Encoding ascii win-installer-size.txt - name: Attest Windows artifacts @@ -441,7 +457,7 @@ jobs: name: windows-installer path: | plezy-windows-installer.exe - win-dsa-signature.txt + win-ed-signature.txt win-installer-size.txt build-linux-x64: @@ -710,10 +726,10 @@ jobs: fi # Read Windows signature metadata (may be empty if secrets not configured) - WIN_DSA_SIG="" + WIN_ED_SIG="" WIN_INSTALLER_SIZE="0" - if [ -f artifacts/windows-installer/win-dsa-signature.txt ]; then - WIN_DSA_SIG=$(cat artifacts/windows-installer/win-dsa-signature.txt) + if [ -f artifacts/windows-installer/win-ed-signature.txt ]; then + WIN_ED_SIG=$(cat artifacts/windows-installer/win-ed-signature.txt) fi if [ -f artifacts/windows-installer/win-installer-size.txt ]; then WIN_INSTALLER_SIZE=$(cat artifacts/windows-installer/win-installer-size.txt) @@ -741,7 +757,7 @@ jobs: fi # Windows entry - if [ -n "$WIN_DSA_SIG" ]; then + if [ -n "$WIN_ED_SIG" ]; then cat >> appcast.xml << XMLEOF Version ${VERSION} @@ -749,7 +765,7 @@ jobs: windows-x64 + sparkle:edSignature="${WIN_ED_SIG}" /> XMLEOF fi diff --git a/pubspec.lock b/pubspec.lock index bccc1d78..e820bd1c 100644 --- a/pubspec.lock +++ b/pubspec.lock @@ -68,10 +68,11 @@ packages: auto_updater: dependency: "direct main" description: - name: auto_updater - sha256: "74fd008b021d15e4fc50fb5f1923870e6374ae831bb1168241c23bc35a4e898b" - url: "https://pub.dev" - source: hosted + path: "packages/auto_updater" + ref: HEAD + resolved-ref: d3dcb88a62292bbedc0a3d9101fed2991f57d40a + url: "https://github.com/edde746/auto_updater" + source: git version: "1.0.0" auto_updater_macos: dependency: transitive @@ -305,6 +306,14 @@ packages: url: "https://pub.dev" source: hosted version: "3.0.7" + cryptography: + dependency: transitive + description: + name: cryptography + sha256: "3eda3029d34ec9095a27a198ac9785630fe525c0eb6a49f3d575272f8e792ef0" + url: "https://pub.dev" + source: hosted + version: "2.9.0" csslib: dependency: transitive description: diff --git a/pubspec.yaml b/pubspec.yaml index f8c24a9a..fdbbca50 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -54,7 +54,10 @@ dependencies: mobile_scanner: ^6.0.2 android_intent_plus: ^5.0.2 background_downloader: ^9.5.2 - auto_updater: ^1.0.0 + auto_updater: + git: + url: https://github.com/edde746/auto_updater + path: packages/auto_updater dev_dependencies: flutter_test: diff --git a/windows/runner/Runner.rc b/windows/runner/Runner.rc index 7f732849..30174bbe 100644 --- a/windows/runner/Runner.rc +++ b/windows/runner/Runner.rc @@ -107,9 +107,9 @@ END ///////////////////////////////////////////////////////////////////////////// // -// WinSparkle DSA public key for update signature verification +// WinSparkle EdDSA public key for update signature verification // -DSAPub DSAPEM "resources\\dsa_pub.pem" +EdDSAPub EDDSA "resources\\ed25519_pub.txt" #endif // English (United States) resources ///////////////////////////////////////////////////////////////////////////// diff --git a/windows/runner/resources/dsa_pub.pem b/windows/runner/resources/dsa_pub.pem deleted file mode 100644 index 88668a46..00000000 --- a/windows/runner/resources/dsa_pub.pem +++ /dev/null @@ -1,36 +0,0 @@ ------BEGIN PUBLIC KEY----- -MIIGQjCCBDUGByqGSM44BAEwggQoAoICAQCIYWApPkLWfPbST2OX3aX7CrNRC1Dy -0YWG8matWNIjNoWCw4av5PS6k14/36MRuuDUzLspBM+h5r8Br/UNXuZSRtCgscmk -EXw+OYoOIhHhUrmCofxm/r7s3Av73CrNSFTiUqZFBYbKuEtiZKZFk7djOFsT7omq -yOSJz2qg5chxosfVMq3ePNzThTRL5t5y4l5kyBjhesXfOOfzegNvofAihi+SuRIB -WW4S/RGIiZWV/QO40iTVBNtHd6T97A0VjGiy9ZYRWcmTudodeZTkfNb3Dn++NyZ9 -IPG+KiSfmFGAblF6lbJRHiIiCsF0lzm+v6szV4M/l5u52cUpRw3RVL8ZLxzODF9I -cQ8ZrLlwOVlfFKgxQQvtsigBS3Z6A3bQii7+5bWLHjh8do4Vnc4Bts4s4mKXBFxN -H7HAtj+jBiBFBBWesdltNNDRgITLfbShtT3R1tGcLLMz3G1o1he80Ps1MKxE4SYI -D5Z8SV23m/uIDsTbPx/EiLpaVRko0KGvLvI7tXVZOgGuv32IjQE0Kja88MLTOHIf -yImqxz/Wva/+TThmpyKOoCQ5ZuR+3BFl8pm+EMwYDpQFyVgruMEZ5hcRvPjGXh8i -FNK9yfxPjfRHDeUL+N4u0UYH26cZCTKqocCY8tAuIwv/Z3vOagROChIImFpeeiSK -ONI21p3DN3tUyQIdAIhC40EohYm1pa7z2s92INHSzotVxQ88yEy2zWsCggIAYX1z -zRuIRbULECLxQUXIFN46K/d0kv/FsOo6x1OMr0KiS3+xTHgoVNsYBZiJPAC1wxdt -qESc0lge5WAq2rmO+g8eBeO/RnmwwYbAOPfzAgnXQObRCymjjCHFn5cmdry5AELF -TaQNe1c1DB5siCPUB9XZCDyIUxUrp7tpQDaAzHOkBTZ8QRA0+jL377I7FRCPvEto -mxpYULBdq9FJ90tRAocDKKIbW0lM6+7aMdrZ5BA8+pcouhDYwm/+ac4PLZlxj4e1 -d/we96DNOqffgIxKCn870aLKx1fb3eWyq9vJzGim1KBV4jQZgmQpuuUps2EgJJtr -u/bE9kA7I8ZXOIvedfR73behuL0stuFIPw86apy/1/AYROemGbQDuk5RVvGI2eY+ -ngFWTXObbS/kO8O3mnXMANdv0lL3Q4g681gTSzOiAmO2S8/rhnW1sRk8tJH8afm2 -fwKWuGwfgDV8oxdCro7UDNxT4rq3CIX+tEot3clxPv6urIx9L3pPBJenJb8f0K9p -vaimP9mJxcRHTHTCdq4GEVb+kVgDZ3wkJgbXdH/CdHDaH2o8+KWH5sCL+ziAZ/HM -1JhcG/RstIXtsi4zD3+GWZOJYIws+uk/5gsLAy6ZnUZRMkwm9s7Qh+DJmRVmaQ6G -GmiU+jjlBzg1xT6+9PP6uyLAFWVSE+Sus1ezdCgDggIFAAKCAgBg7zX+v0j5B2W5 -k4jnie24aC/5wbMQ56ZV4GI6UZ9eZM0dqGKCC86XfLZZi1BacY50OMShmAkOc6k3 -1/ag2ddQgUO1jAlkjzd7xnlUXpwkL3yt2orGjamBu1rzbiZjaxbYpNlZd19r2+my -UlbT+85OckJRZtq5rlFmscKQEWbPzC90zqbR/1C8NtjHK1iygdY/wlSRzp4a81gI -GgCwATDLvQzPxHMictY05sCitnH4cf/acLtLED1ClgiS0DRrZ0DGglbz9UsqP5yB -/UG7QoX8z3eT6hlicaoaLBkUIjZZcoOG1rb6ZshbtAm5fTRANiSlTek8TvYq6V85 -393lZafBCq2AvwDOtH7riSD7hJTL60XGeWVW7nhcTGNM24Y58Lkw0Op1Vi9CMPdL -6XFbfW0mEic1w3I/oiLcYcqw+ktE2n5JcPNWsesoPZnJRb0nAY6T7eMsfTfbODMG -qudB6F4lOetc/K+WAvfOVck2tAQhPRy0QvjlmaSbqIsVG1NG50pB0g8QL9VYOFsb -TyrSY84vXaZmlM/Kk6I3fq7yRM1auOMOkSj6UcU1FenBXLdr1twiYU0/dmAlkU70 -+gESZBdvWa6SywB54rHBU5YIcoiwPQb2o70suh5PWDtAk47pazPSrMfjzWSvisyi -IdoSn7v/pXbD9haYAkYFhXifYUUE/g== ------END PUBLIC KEY----- diff --git a/windows/runner/resources/ed25519_pub.txt b/windows/runner/resources/ed25519_pub.txt new file mode 100644 index 00000000..ec93ba4d --- /dev/null +++ b/windows/runner/resources/ed25519_pub.txt @@ -0,0 +1 @@ +q7t6eu1txRrqv1PeWDCRV95rFxnmD/D3GZWbUPMwUyU= \ No newline at end of file