Repository navigation
Turn on Sparkle updates and a release script (v0.2.0 ready, key not made yet) - #2
Open
jonnilundy wants to merge 1 commit into
Open
jonnilundy wants to merge 1 commit into
jonnilundy wants to merge 1 commit into
Conversation
Installed copies read appcast.xml from this repo (raw.githubusercontent.com, main) once a day and install a newer version when they quit, after checking its EdDSA signature against the release key. Releases stay ad hoc signed, like Main Thing. - bundle.sh writes SUFeedURL, SUPublicEDKey (scripts/sparkle-public-key.txt) and the update settings. The key is a placeholder until it is created, and the app starts no updater with it. - ForkIdentity.updatesEnabled is true; AppUpdater.isConfigured refuses the placeholder key. - release.sh: dry run by default, --publish commits, tags, creates the GitHub release and pushes main. The signing key is read from 1Password and piped, never written to disk, and must match the committed public key. Refuses a placeholder key, a non-main branch, a dirty tree, a taken tag. - test-update.sh rewritten for Flowriter with a throwaway key. Checked: a signed update installs on an ad hoc signed app, an update signed with another key is refused. - release-notes/0.2.0.md, README "Updates and releases". The real key is not made yet: it has to be created where 1Password works (the header of release.sh has the three commands), then its public half goes in sparkle-public-key.txt. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Flowriter gets an updater and a release process, copied from Main Thing.
appcast.xmlin this repo (raw GitHub URL, main branch) once a day and install a newer version when they quit. Flowriter menu, Check for Updates… does it on demand.scripts/release.sh X.Y.Zis a dry run;--publishcommits, tags, creates the GitHub release and pushes main. It reads the key from 1Password, never writes it to disk, and refuses a placeholder or mismatching key, a non-main branch, a dirty tree, or a taken tag.scripts/test-update.shrewritten (it still said Flo State). Uses a throwaway key.release-notes/0.2.0.mdis a draft built from merge titles: please read it.Tested here
--wrong-key: Sparkle refuses it.release.sh 0.2.0dry run with a throwaway key: signed zip, valid appcast item, nothing published.Not done: the real signing key
ophangs on the Mac this was built on, so the key could not be made here. It needs one step on your Mac, then a commit of the public key. Until thenrelease.shrefuses to run. Steps are in the header ofscripts/release.sh.🤖 Generated with Claude Code