Fix Sparkle

[FuJacob]

Summary

Check for updates would return error because the sparkle XML link was wrong and the sparkle public ed key wasnt inserted.

Validation

Linked issues

Risk / rollout notes

Greptile Summary

This PR fixes two misconfigurations that caused Sparkle's "Check for Updates" to fail: the feed URL in TabbyInfo.plist pointed to the wrong path on the wrong subdomain, and the Release build configuration in project.pbxproj still held a placeholder instead of the real Ed25519 public key.

• SUFeedURL corrected from https://tabbyapp.dev/tabby/appcast.xml to https://updates.tabbyapp.dev/appcast.xml, with the CI workflow's PAGES_CUSTOM_DOMAIN and documentation updated to match.
• SPARKLE_PUBLIC_ED_KEY in the Release Xcode build config replaced with the actual public key efJeZNfUISOs6npbxI2MLLe7sBB5tT/sVnTk9t/qBSY=, which already matched the SUPublicEDKey in TabbyInfo.plist and the workflow's key-verification step.

Confidence Score: 4/5

Safe to merge — the two broken Sparkle configs are correctly fixed and the key committed is a public verification key, not a secret.

The core fixes (feed URL and public key) are straightforward and consistent across TabbyInfo.plist, project.pbxproj, and the docs. The only rough edge is the release workflow still deploying a /tabby/appcast.xml copy that the updated docs say no longer exists, leaving a small discrepancy between code and documentation.

.github/workflows/release.yml lines 524–526: the stale /tabby/appcast.xml copy step should be cleaned up to match the updated docs.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Updated PAGES_CUSTOM_DOMAIN to updates.tabbyapp.dev; still deploys an unused /tabby/appcast.xml copy that docs now say is removed.
RELEASING.md	Documentation updated to reflect new feed URL (https://updates.tabbyapp.dev/appcast.xml) and adds the Sparkle public key value.
TabbyInfo.plist	SUFeedURL corrected from https://tabbyapp.dev/tabby/appcast.xml to https://updates.tabbyapp.dev/appcast.xml; SUPublicEDKey was already present.
tabby.xcodeproj/project.pbxproj	Release build configuration's SPARKLE_PUBLIC_ED_KEY placeholder replaced with the actual Ed25519 public key, matching the value in TabbyInfo.plist.

Sequence Diagram

sequenceDiagram
    participant App as Tabby.app
    participant Feed as updates.tabbyapp.dev/appcast.xml
    participant GH as GitHub Release

    App->>Feed: GET appcast.xml (SUFeedURL)
    Note over App,Feed: URL fixed: was tabbyapp.dev/tabby/appcast.xml
    Feed-->>App: appcast with edSignature + DMG URL
    App->>App: Verify edSignature with SUPublicEDKey
    Note over App: Key fixed: was placeholder in Release config
    App->>GH: Download Tabby.dmg
    GH-->>App: DMG
    App->>App: Install update

Loading

Comments Outside Diff (1)

1. .github/workflows/release.yml, line 524-526 (link)

   Stale /tabby/appcast.xml deployment still present

   The Pages artifact preparation still copies the appcast to build/pages/tabby/appcast.xml, but RELEASING.md was updated in this same PR to remove the /tabby/appcast.xml path from the documented Pages output and to state that only /appcast.xml is the current feed URL. Since the CNAME now points to updates.tabbyapp.dev, the old tabbyapp.dev/tabby/appcast.xml URL cannot be reached via this deployment anyway, making the extra copy dead output.

   

_{Reviews (1): Last reviewed commit: "Update Sparkle feed URL to updates.tabby..." | Re-trigger Greptile}