Sparkle app update not working due to EdDSA verification failing

[ArulOSlash]

I'm facing an error when trying to update my app using Sparkle. Previously I have deployed a few versions and everything worked fine for me.

This time I'm facing this error,
Console log:
Error: The update has a public (Ed)DSA key, but the public key shipped with the update doesn't match the signature. To prevent future problems, the update will be rejected. (null) (URL (null))

Error: EdDSA signature does not match. Data of the update file being checked is different than data that has been signed, or the public key and the private key are not from the same set. (null) (URL (null))

SandboxEnabled: No
Sparkle version: 2.1.0

Note: The only difference between this and the previous version might be the change in the provisioning profile. I've worked on an R&D project for my app that requires enabling a few entitlements. Later I removed all those and generated a new provisioning profile with the same entitlements.
Not sure this is related to this issue just mentioning here if it helps.

[ArulOSlash]

Attaching a screenshot of the error for reference.

[zorgiepoo]

This is likely a configuration problem.

The EdDSA signature verification failed. How are you signing the update (using generate_appcast or with sign_update manually)?

With sign_update, you can verify the signature:

./sign_update update-archive --verify ed-signature

..where update-archive is the path to your (.zip, .tar.*, or .dmg) update archive, and ed-signature is the sparkle:edSignature you supplied in your appcast item.

I'm also assuming you did not change your EdDSA keys recently.

[ArulOSlash]

I'm signing the update using generate_appcast.

when i execute this ./sign_update update-archive --verify ed-signature
I didn't get any message from the console Attaching a terminal screenshot for reference

Regarding the EdDSA key I didn't change that, just compared the SUPublicEDKey from my info.plist and ./bin/generate_keys

[zorgiepoo]

No output means it should be ok. Odd, this is the part that is failing in Sparkle but it's succeeding here. Maybe it's downloading the wrong dmg? Perhaps double check with the dmg your website is serving or the feed.

[ArulOSlash]

Found the cause of this issue, We accidentally enabled cache for the DMG file alone.
So sparkle downloading the wrong DMG as you mentioned.

Thanks for the support.

[DevLiuSir]

Why the update failed？

[zorgiepoo]

Look in the console logs for your app for the detailed error. Also please open a new discussion issue if you can’t understand the error. This is likely a configuration issue on your end.

[DevLiuSir]

There is no EdDSA signature in the update, but the app is capable of verifying them

There is no DSA signature in the update

The update has a public (Ed)DSA key, but the public key shipped with the update doesn't match the signature. To prevent future problems, the update will be rejected.

The update is improperly signed. (URL (null))

The above is the error message from my app console. How to solve it? please help me.

[zorgiepoo]

The error message Sparkle logs in this context verbatim is:

The app has an EdDSA public key, but there is no EdDSA signature in the update, so the update will be rejected.

This means there's no EdDSA signature in your update appcast (no sparkle:edSignature).

Did you follow the steps on https://sparkle-project.org/documentation/ for generating your keys with generate_keys and using generate_appcast to generate the appcast feed?

If you feel like you generated the feed correctly, paste the contents of your appcast feed here, or a link to the feed, so I can verify.

[DevLiuSir]

Thank you. I'm done here. It's just a matter of signature.