feat: switch to auto_updater fork with WinSparkle 0.9.2 EdDSA

.github/workflows/build.yml

@@ -217,11 +217,19 @@ jobs:
 
           APP_PATH="build/macos/Build/Products/Release/Plezy.app"
 
-          # Sign all frameworks and dylibs first (inside-out signing)
+          # Deep sign everything inside-out: executables, dylibs, XPC services, app bundles, frameworks
-          find "$APP_PATH/Contents/Frameworks" -name "*.framework" -o -name "*.dylib" | while read framework; do
+          find "$APP_PATH/Contents/Frameworks" \( -name "*.xpc" -o -name "*.app" -o -name "*.framework" -o -name "*.dylib" \) -print0 \
-            echo "Signing: $framework"
+            | sort -zr \
-            codesign --force --sign "$IDENTITY" --timestamp --options runtime "$framework"
+            | while IFS= read -r -d '' item; do
-          done
+              echo "Signing: $item"
+              codesign --force --sign "$IDENTITY" --timestamp --options runtime "$item"
+            done
+
+          # Sign any remaining bare executables (e.g. Sparkle's Autoupdate)
+          find "$APP_PATH/Contents/Frameworks" -type f -perm +111 ! -name "*.dylib" ! -path "*/Headers/*" ! -path "*/Modules/*" -print0 \
+            | while IFS= read -r -d '' exe; do
+              codesign --force --sign "$IDENTITY" --timestamp --options runtime "$exe" 2>/dev/null || true
+            done
 
           # Sign the app bundle itself
           echo "Signing app bundle: $APP_PATH"
@@ -274,8 +282,11 @@ jobs:
         env:
           SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
         run: |
-          SIGN_BIN="macos/Pods/Sparkle/bin/sign_update"
+          printf -- "-----BEGIN ED25519 PRIVATE KEY-----\n%s\n-----END ED25519 PRIVATE KEY-----\n" "$SPARKLE_PRIVATE_KEY" > ed25519_key.pem
-          SIGNATURE=$(echo "$SPARKLE_PRIVATE_KEY" | "$SIGN_BIN" plezy-macos.dmg --ed-key-file - -p)
+          OUTPUT=$(dart run auto_updater:sign_update plezy-macos.dmg ed25519_key.pem)
+          rm ed25519_key.pem
+          # Extract edSignature value from output like: sparkle:edSignature="..." length="..."
+          SIGNATURE=$(echo "$OUTPUT" | grep -o 'edSignature="[^"]*"' | sed 's/edSignature="//;s/"//')
           echo "MACOS_ED_SIGNATURE=$SIGNATURE" >> $GITHUB_ENV
           echo "MACOS_DMG_SIZE=$(stat -f%z plezy-macos.dmg)" >> $GITHUB_ENV
 
@@ -403,16 +414,21 @@ jobs:
       - name: Build installer and portables
         run: .\windows\build-installer.ps1 -X64BuildDir "build-x64" -Arm64BuildDir "build-arm64"
 
-      - name: Sign installer for WinSparkle (DSA)
+      - name: Sign installer for WinSparkle (EdDSA)
-        if: env.WINSPARKLE_DSA_PRIVATE_KEY != ''
+        if: env.SPARKLE_PRIVATE_KEY != ''
         env:
-          WINSPARKLE_DSA_PRIVATE_KEY: ${{ secrets.WINSPARKLE_DSA_PRIVATE_KEY }}
+          SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
         shell: pwsh
         run: |
-          $env:WINSPARKLE_DSA_PRIVATE_KEY | Out-File -Encoding ascii dsa_priv.pem
+          @"
-          $output = dart run auto_updater:sign_update plezy-windows-installer.exe
+          -----BEGIN ED25519 PRIVATE KEY-----
-          Remove-Item dsa_priv.pem
+          $($env:SPARKLE_PRIVATE_KEY)
-          $output | Out-File -Encoding ascii win-dsa-signature.txt
+          -----END ED25519 PRIVATE KEY-----
+          "@ | Out-File -Encoding ascii ed25519_key.pem
+          $output = dart run auto_updater:sign_update plezy-windows-installer.exe ed25519_key.pem
+          Remove-Item ed25519_key.pem
+          $sig = [regex]::Match($output, 'edSignature="([^"]*)"').Groups[1].Value
+          $sig | Out-File -Encoding ascii win-ed-signature.txt
           (Get-Item plezy-windows-installer.exe).Length | Out-File -Encoding ascii win-installer-size.txt
 
       - name: Attest Windows artifacts
@@ -441,7 +457,7 @@ jobs:
           name: windows-installer
           path: |
             plezy-windows-installer.exe
-            win-dsa-signature.txt
+            win-ed-signature.txt
             win-installer-size.txt
 
   build-linux-x64:
@@ -710,10 +726,10 @@ jobs:
           fi
 
           # Read Windows signature metadata (may be empty if secrets not configured)
-          WIN_DSA_SIG=""
+          WIN_ED_SIG=""
           WIN_INSTALLER_SIZE="0"
-          if [ -f artifacts/windows-installer/win-dsa-signature.txt ]; then
+          if [ -f artifacts/windows-installer/win-ed-signature.txt ]; then
-            WIN_DSA_SIG=$(cat artifacts/windows-installer/win-dsa-signature.txt)
+            WIN_ED_SIG=$(cat artifacts/windows-installer/win-ed-signature.txt)
           fi
           if [ -f artifacts/windows-installer/win-installer-size.txt ]; then
             WIN_INSTALLER_SIZE=$(cat artifacts/windows-installer/win-installer-size.txt)
@@ -741,7 +757,7 @@ jobs:
           fi
 
           # Windows entry
-          if [ -n "$WIN_DSA_SIG" ]; then
+          if [ -n "$WIN_ED_SIG" ]; then
             cat >> appcast.xml << XMLEOF
               <item>
                 <title>Version ${VERSION}</title>
@@ -749,7 +765,7 @@ jobs:
                 <sparkle:os>windows-x64</sparkle:os>
                 <enclosure url="https://github.com/edde746/plezy/releases/download/${VERSION}/plezy-windows-installer.exe"
                            length="${WIN_INSTALLER_SIZE}" type="application/octet-stream"
-                           sparkle:dsaSignature="${WIN_DSA_SIG}" />
+                           sparkle:edSignature="${WIN_ED_SIG}" />
               </item>
           XMLEOF
           fi

pubspec.lock

@@ -68,10 +68,11 @@ packages:
   auto_updater:
     dependency: "direct main"
     description:
-      name: auto_updater
+      path: "packages/auto_updater"
-      sha256: "74fd008b021d15e4fc50fb5f1923870e6374ae831bb1168241c23bc35a4e898b"
+      ref: HEAD
-      url: "https://pub.dev"
+      resolved-ref: d3dcb88a62292bbedc0a3d9101fed2991f57d40a
-    source: hosted
+      url: "https://github.com/edde746/auto_updater"
+    source: git
     version: "1.0.0"
   auto_updater_macos:
     dependency: transitive
@@ -305,6 +306,14 @@ packages:
       url: "https://pub.dev"
     source: hosted
     version: "3.0.7"
+  cryptography:
+    dependency: transitive
+    description:
+      name: cryptography
+      sha256: "3eda3029d34ec9095a27a198ac9785630fe525c0eb6a49f3d575272f8e792ef0"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.9.0"
   csslib:
     dependency: transitive
     description:

pubspec.yaml

@@ -54,7 +54,10 @@ dependencies:
   mobile_scanner: ^6.0.2
   android_intent_plus: ^5.0.2
   background_downloader: ^9.5.2
-  auto_updater: ^1.0.0
+  auto_updater:
+    git:
+      url: https://github.com/edde746/auto_updater
+      path: packages/auto_updater
 
 dev_dependencies:
   flutter_test:

windows/runner/Runner.rc

@@ -107,9 +107,9 @@ END
 
 /////////////////////////////////////////////////////////////////////////////
 //
-// WinSparkle DSA public key for update signature verification
+// WinSparkle EdDSA public key for update signature verification
 //
-DSAPub          DSAPEM                  "resources\\dsa_pub.pem"
+EdDSAPub        EDDSA                   "resources\\ed25519_pub.txt"
 
 #endif    // English (United States) resources
 /////////////////////////////////////////////////////////////////////////////

windows/runner/resources/dsa_pub.pem

@@ -1,36 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIIGQjCCBDUGByqGSM44BAEwggQoAoICAQCIYWApPkLWfPbST2OX3aX7CrNRC1Dy
-0YWG8matWNIjNoWCw4av5PS6k14/36MRuuDUzLspBM+h5r8Br/UNXuZSRtCgscmk
-EXw+OYoOIhHhUrmCofxm/r7s3Av73CrNSFTiUqZFBYbKuEtiZKZFk7djOFsT7omq
-yOSJz2qg5chxosfVMq3ePNzThTRL5t5y4l5kyBjhesXfOOfzegNvofAihi+SuRIB
-WW4S/RGIiZWV/QO40iTVBNtHd6T97A0VjGiy9ZYRWcmTudodeZTkfNb3Dn++NyZ9
-IPG+KiSfmFGAblF6lbJRHiIiCsF0lzm+v6szV4M/l5u52cUpRw3RVL8ZLxzODF9I
-cQ8ZrLlwOVlfFKgxQQvtsigBS3Z6A3bQii7+5bWLHjh8do4Vnc4Bts4s4mKXBFxN
-H7HAtj+jBiBFBBWesdltNNDRgITLfbShtT3R1tGcLLMz3G1o1he80Ps1MKxE4SYI
-D5Z8SV23m/uIDsTbPx/EiLpaVRko0KGvLvI7tXVZOgGuv32IjQE0Kja88MLTOHIf
-yImqxz/Wva/+TThmpyKOoCQ5ZuR+3BFl8pm+EMwYDpQFyVgruMEZ5hcRvPjGXh8i
-FNK9yfxPjfRHDeUL+N4u0UYH26cZCTKqocCY8tAuIwv/Z3vOagROChIImFpeeiSK
-ONI21p3DN3tUyQIdAIhC40EohYm1pa7z2s92INHSzotVxQ88yEy2zWsCggIAYX1z
-zRuIRbULECLxQUXIFN46K/d0kv/FsOo6x1OMr0KiS3+xTHgoVNsYBZiJPAC1wxdt
-qESc0lge5WAq2rmO+g8eBeO/RnmwwYbAOPfzAgnXQObRCymjjCHFn5cmdry5AELF
-TaQNe1c1DB5siCPUB9XZCDyIUxUrp7tpQDaAzHOkBTZ8QRA0+jL377I7FRCPvEto
-mxpYULBdq9FJ90tRAocDKKIbW0lM6+7aMdrZ5BA8+pcouhDYwm/+ac4PLZlxj4e1
-d/we96DNOqffgIxKCn870aLKx1fb3eWyq9vJzGim1KBV4jQZgmQpuuUps2EgJJtr
-u/bE9kA7I8ZXOIvedfR73behuL0stuFIPw86apy/1/AYROemGbQDuk5RVvGI2eY+
-ngFWTXObbS/kO8O3mnXMANdv0lL3Q4g681gTSzOiAmO2S8/rhnW1sRk8tJH8afm2
-fwKWuGwfgDV8oxdCro7UDNxT4rq3CIX+tEot3clxPv6urIx9L3pPBJenJb8f0K9p
-vaimP9mJxcRHTHTCdq4GEVb+kVgDZ3wkJgbXdH/CdHDaH2o8+KWH5sCL+ziAZ/HM
-1JhcG/RstIXtsi4zD3+GWZOJYIws+uk/5gsLAy6ZnUZRMkwm9s7Qh+DJmRVmaQ6G
-GmiU+jjlBzg1xT6+9PP6uyLAFWVSE+Sus1ezdCgDggIFAAKCAgBg7zX+v0j5B2W5
-k4jnie24aC/5wbMQ56ZV4GI6UZ9eZM0dqGKCC86XfLZZi1BacY50OMShmAkOc6k3
-1/ag2ddQgUO1jAlkjzd7xnlUXpwkL3yt2orGjamBu1rzbiZjaxbYpNlZd19r2+my
-UlbT+85OckJRZtq5rlFmscKQEWbPzC90zqbR/1C8NtjHK1iygdY/wlSRzp4a81gI
-GgCwATDLvQzPxHMictY05sCitnH4cf/acLtLED1ClgiS0DRrZ0DGglbz9UsqP5yB
-/UG7QoX8z3eT6hlicaoaLBkUIjZZcoOG1rb6ZshbtAm5fTRANiSlTek8TvYq6V85
-393lZafBCq2AvwDOtH7riSD7hJTL60XGeWVW7nhcTGNM24Y58Lkw0Op1Vi9CMPdL
-6XFbfW0mEic1w3I/oiLcYcqw+ktE2n5JcPNWsesoPZnJRb0nAY6T7eMsfTfbODMG
-qudB6F4lOetc/K+WAvfOVck2tAQhPRy0QvjlmaSbqIsVG1NG50pB0g8QL9VYOFsb
-TyrSY84vXaZmlM/Kk6I3fq7yRM1auOMOkSj6UcU1FenBXLdr1twiYU0/dmAlkU70
-+gESZBdvWa6SywB54rHBU5YIcoiwPQb2o70suh5PWDtAk47pazPSrMfjzWSvisyi
-IdoSn7v/pXbD9haYAkYFhXifYUUE/g==
------END PUBLIC KEY-----

windows/runner/resources/ed25519_pub.txt

@@ -0,0 +1 @@
+q7t6eu1txRrqv1PeWDCRV95rFxnmD/D3GZWbUPMwUyU=