Wire Sparkle auto-updates end-to-end via GitHub Pages#5
Merged
Conversation
Point SUFeedURL at the capsule-native.github.io appcast and bake in the real EdDSA public key. The release workflow signs the appcast and sets the enclosure download URLs to the tag's Release assets (--download-url-prefix); the Pages repo's sync workflow republishes appcast.xml at the feed URL. Adds a tag/version guard so a vX.Y.Z tag can't ship mismatched artifacts, and repoints the moved repo/org references. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JYNmieH7AYvXys56bV8B7p
Public repo — drop the maintainer-only credential how-to (Developer ID cert export, notarytool store-credentials, the secrets table). Keep the pipeline and development guides: update flow, run/steps, environment, cutting a release, the fork-fallback, and the generate_appcast SUPublicEDKey-match gotcha. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JYNmieH7AYvXys56bV8B7p
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wires Capsule's Sparkle auto-updates end-to-end (Option B).
What changed
App/Info.plist:SUFeedURL→https://capsule-native.github.io/appcast.xml; real EdDSASUPublicEDKeybaked in (private key is theSPARKLE_ED_PRIVATE_KEYCI secret).Scripts/release/appcast.sh: honoursRELEASE_DOWNLOAD_URL_PREFIX→ passes--download-url-prefixso the appcast's enclosure URLs point at the tag's GitHub Release assets..github/workflows/release.yml: sets that prefix from the tag, and adds a tag↔version guard that fails the build ifvX.Y.Z≠CFBundleShortVersionString.Scripts/release/README.md: documents the new flow + thegenerate_appcast-only-signs-when-SUPublicEDKey-matches gotcha.Hosting (separate repo)
The appcast is published by a Sync appcast workflow in
capsule-native/capsule-native.github.io, which pullsreleases/latest/download/appcast.xmland commits it (ownGITHUB_TOKEN, no cross-repo auth — the org disables deploy keys).Verification
make checkclean; 885 unit tests pass.sparkle:edSignature.Before a real signed release
Add the Apple secrets to this repo:
APPLE_TEAM_ID,DEVELOPER_ID_CERT_P12_BASE64,DEVELOPER_ID_CERT_PASSWORD,NOTARY_APPLE_ID,NOTARY_PASSWORD. (SPARKLE_ED_PRIVATE_KEYis already set.)🤖 Generated with Claude Code