Documentation Clarification: Sparkle 1.27, no EdDSA yet, changing Apple Developer ID

[jamesatwill-okta]

Summary

I'd like a minor clarification on the https://sparkle-project.org/documentation/eddsa-migration/ page for scenarios where I'm running Sparkle 1.27, have not yet switched to EdDSA, do not have a public EdDSA key in the Info.plist, but want to change Apple Developer IDs.

Specifically:

• MyApp v1.1 -> older version of Sparkle 1.x, Signed by Developer ID A
• MyApp v1.2 -> Sparkle 1.27, Signed by Developer ID A
• MyApp v1.3 -> Sparkle 1.27, Signed by Developer ID B
• MyApp v1.4 -> Sparkle 1.27, now with EdDSA public key, and EdDSA in the xml, Signed by Developer ID B
• MyApp v1.5 -> Sparkle 2.x, only EdDSA signatures in XML, Signed By Developer ID B

It's not clear from the documentation that this upgrade plan is going to be successfully (since v1.2 -> v1.3 technically falls under both "Upgrade" sections).

[zorgiepoo]

Are the old versions of your app using DSA or were they only signed with a Developer ID? And are the older versions of Sparkle older than 1.21 if you know?

[jamesatwill-okta]

Good question; missed that detail. In the scenario above, "v1.1" is using a pre-Sparkle 1.21 version and has DSA signatures.

[zorgiepoo]

I think this should work:

MyApp (v1.1|v1.2) (DSA + Developer ID A + Sparkle 1.x) -> MyApp v1.3 (DSA + EdDSA + Developer ID B + Sparkle >= v1.27)
MyApp v1.3 (DSA + EdDSA + Developer ID B + Sparkle >= v1.27) -> MyApp v1.4 (EdDSA + Developer ID B + Sparkle >= v1.27)

Use a new appcast for MyApp >= v1.3 so it is not possible to go from MyApp (v1.1|v1.2) -> MyApp v1.4 which won't work, otherwise you will have to continue signing new updates with both DSA and EdDSA for a longer time if you use the same appcast.

Note I'm also assuming you are shipping regular app updates (not pkg ones).

To be extra sure you can test with a newer appcast in development before you push it out for production, either by changing SUFeedURL user default when using older versions of your app or using sparkle-cli with --feed-url and --check-immediately for example.

It's not clear from the documentation that this upgrade plan is going to be successfully (since v1.2 -> v1.3 technically falls under both "Upgrade" sections).

In your example v1.2 -> v1.3 should work because DSA is used in both versions. Also in your example I think going from 1.1 or 1.2 -> 1.5 will not work hence suggestion for new appcast.