Sparkle does not accept update signing under Mavericks & Xcode 5

[sanctioned-account]

Hi,

I'm trying to integrate sparkle with my project which is developed using Xcode 5 under Mavericks. ( I don't have a Mac Developer ID and I don't use code signing )

I have read the documentation like a dozen of times and tried to release a sample update for my app, but every time I get the "The update is improperly signed" error !

Just to make sure that I'm not missing any steps or not doing anything wrong, I renamed my .app file to Sparkle Test App.app ( which is the file name used as the .app's name in Sparkle Test App_2.0.zip in the enclosure section of Sparkle test app's app cast file ) , used Sparkle Test App's app cast link in my info.plist and replaced my public key in resources with the public key (dsa_pub.pem) in the sample project. ( In order to see if my app can replace itself with an Sparkle App v2 using a safe & tested appcast.xml and code signing options so that I can figure out if I'm doing any step wrong regarding creation of a proper appcast.xml or etc )

But I got the SAME error and couldn't update the app. I have no idea what is going wrong and I really appreciate any soon suggestions.

Thank you

[vincedev]

Did you sign the app bundle or the zip file ?

[DaveMtb]

We're doing the same thing, and it works fine. The problem is that there's a LOT that can go wrong, so it pays to be meticulous.

I'm a little fuzzy on what your problem actually is, but one thing to remember is that your update is going to have to be code signed (or you have to distribute it via an SSL connection). This means you need the sparkle:dsaSignature attribute in your appcast file.

Here's a few problems we had to work through:

1. The item within the archive (whether a .pkg or a .app) has to be the same name as your app that's being updated.
2. Don't forget to copy the result of the "ruby sign_update.rb" command into your appcast file (the digital signature).
3. You can NOT rename the archive after acquiring the signature (or alter it in any way).

More than likely it's something simple. Also, note that you can look at the Console log while doing the update. Sometimes Sparkle will throw a message in there that's useful. Hope this helps...

[sanctioned-account]

Thanks for the reply guys.
I was already doing everything you mentioned but the problem was something
else. Found it and solved it.
Just in case anybody else face this problem, It was because I was using
"MacPorts Openssl". I modified sign_update.rb and generate_keys.rb and
configured them to use the other version of openssl in /usr/bin/. So now I
can use the updater without problems. (I'm trying to configure it for
silent updates though)

Again, Thanks for your time and support.

On Tue, Mar 4, 2014 at 12:14 AM, DaveMtb notifications@github.com wrote:

We're doing the same thing, and it works fine. The problem is that there's
a LOT that can go wrong, so it pays to be meticulous.

I'm a little fuzzy on what your problem actually is, but one thing to
remember is that your update is going to have to be code signed (or you
have to distribute it via an SSL connection). This means you need the
sparkle:dsaSignature attribute in your appcast file.

Here's a few problems we had to work through:

1. The item within the archive (whether a .pkg or a .app) has to be the
   same name as your app that's being updated.
2. Don't forget to copy the result of the "ruby sign_update.rb" command
   into your appcast file (the digital signature).
3. You can NOT rename the archive after acquiring the signature (or alter
   it in any way).

More than likely it's something simple. Also, note that you can look at
the Console log while doing the update. Sometimes Sparkle will throw a
message in there that's useful. Hope this helps...

Reply to this email directly or view it on GitHubhttps://github.com//issues/326#issuecomment-36557229
.