Tracking upgrades using upgrades.syncthing.net instead of github.io pages

[xor-gate]

So we should probably move the current Sparkle Update feed to the auto-generated appcast.xml. And create some graph of the HTTP GET requests. The go script currently build during CI build should be easy to add (https://github.com/syncthing/syncthing-macos/blob/develop/script/ghreleases2appcast.go)

Info.plist:

	<key>SUFeedURL</key>
	<string>https://xor-gate.github.io/syncthing-macosx/appcast.xml</string>

To:

	<key>SUFeedURL</key>
	<string>https://upgrades.syncthing.net/syncthing-macos/appcast.xml</string>

Also tracking the download counter of the latest release (e.g with telegraf) is nice to see the amount of downloads.

 > curl -s https://api.github.com/repos/syncthing/syncthing-macos/releases/latest | grep download_count
      "download_count": 4066,

telegraf.conf

[[inputs.tail]]
   files = ["/Users/jerry/src/github.com/xor-gate/syncthing-macosx/script/log/upgrades.xor-gate.org.access.log"]
   pipe = false
   watch_method = "inotify"
   data_format = "grok"
   from_beginning = false
   grok_patterns = ["%{COMMON_LOG_FORMAT}"]

[[inputs.http]]
  username = "xor-gate"
  password = "---OBVUSCATED---"
  urls = ["https://api.github.com/repos/syncthing/syncthing-macos/releases/latest"]
  data_format = "json"

[xor-gate]

[calmh]

So I'm not super keen on the tracking aspect - we don't really do much of that on the Syncthing side except for the explicitly opt-in, and except for counting requests to upgrades.s.n (https://monitor.syncthing.net/dashboard/db/web-sites), which this would become a part of.

That said, it's now live on https://upgrades.syncthing.net/syncthing-macos/appcast.xml, with some tweaks to the script (there is a branch).

The release note formatting thing fails a bit, producing some ugly code, not sure how much it matters.

From a "is it looking professional looking" standpoint I'm not super impressed by having the bundle signed by someone going by the signifier "virusman" - no offence intended, @virusman...

[virusman]

I think the signature itself doesn't contain my nickname, but I'm ok if someone else wants to build and sign instead.

[xor-gate]

@calmh I agree with

From a "is it looking professional looking" standpoint I'm not super impressed by having the bundle signed by someone going by the signifier "virusman" - no offence intended, @virusman...

But this is currently the only one who stands up to sign the dmg or else macOS chokes and doesn't want to start the app. If we sign it with a new/different key and distribute it people need to install it again by hand because it is not allowed for security reasons to change signing keys between upgrades.

[virusman]

Yeah, the certificate and signature only show my real name. Or is the presence of my handle in general on Github and elsewhere an issue?

[virusman]

I've built a new .dmg, let me know what you decide on. If I create a new release from a tag, I think it will show me as an author of that release on Github.

[xor-gate]

Thats no problem for me. You are also priviledged to do so. Just create the tag (as prerelease) and I will create the changelog in the release page.

[virusman]

Hmm looks like I can't push a new tag, Github returned 403.

[xor-gate]

I have unprotected the master and develop branch (for now). Could you check again. Possibly this should not be necessary for pushing tags.

[virusman]

Still the same error: remote: Permission to syncthing/syncthing-macos.git denied to virusman.

[xor-gate]

Thats just weird, you have been added as collaborator. Have you accepted it? No clue why it doesn't work >_<

[virusman]

Looks like a release can be created without an existing tag anyway, so I created a draft and uploaded the .dmg there: https://github.com/syncthing/syncthing-macos/releases/tag/untagged-3b342874e15f3f29dc7d

[xor-gate]

Yeah that seems legit.

[xor-gate]

Everything is in place, @calmh deployed it in production. On next release it loads the appcast from the upgrades.syncthing.net. I will close this issue as there is no more work to be done. Feel free to comment if there is anything to share.

[xor-gate]

I'm not sure but we can break the release once again because we now can take the signed build from https://build.syncthing.net ? I just need to upload the artifact to github and add a notice.