Skip to content

Fix sandboxed Sparkle installer configuration #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
marcplotkin wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix sandboxed Sparkle installer configuration #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions 01_Project/syncthingStatus/Info.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,5 +20,7 @@
<string>eH6joIk0G+i5Hur25e/9B4hF3jN8q5lBqXzMxuOfcxw=</string>
<key>SUEnableAutomaticChecks</key>
<true/>
<key>SUEnableInstallerLauncherService</key>
<true/>
</dict>
</plist>
8 changes: 7 additions & 1 deletion 01_Project/syncthingStatus/syncthingStatus.entitlements
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict/>
<dict>
<key>com.apple.security.temporary-exception.mach-lookup.global-name</key>
<array>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spks</string>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)-spki</string>
</array>
</dict>
</plist>
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ Or visit the [Releases page](https://github.com/Xpycode/syncthingStatus/releases

> **Note**: The app is notarized by Apple and will run without security warnings.

> **Auto-update troubleshooting**: if the in-app update fails with _"An error occurred while launching the installer"_, the bundle on disk is at a malformed path (e.g. `/Applications/syncthingStatus.app.1` or any name without the `.app` suffix — usually a Finder rename mishap). macOS won't dispatch Sparkle's XPC services unless the parent bundle ends in `.app`. Run [`tools/repair-install.sh`](tools/repair-install.sh) for a clean re-install that preserves your settings, or just trash the malformed bundle in `/Applications/` and drag-install fresh from the DMG.
> **Auto-update troubleshooting**: if the in-app update fails with _"An error occurred while launching the installer"_, the bundle on disk may be at a malformed path (e.g. `/Applications/syncthingStatus.app.1` or any name without the `.app` suffix — usually a Finder rename mishap). macOS won't dispatch Sparkle's XPC services unless the parent bundle ends in `.app`. Sandboxed builds also need Sparkle's installer launcher service and Mach lookup entitlements; release notarization now asserts both so future packages fail fast instead of shipping a broken updater. Run [`tools/repair-install.sh`](tools/repair-install.sh) for a clean re-install that preserves your settings, or just trash the malformed bundle in `/Applications/` and drag-install fresh from the DMG.

### Build from Source
1. Clone this repository:
Expand Down
14 changes: 14 additions & 0 deletions tools/notarize.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,20 @@ for key in com.apple.security.app-sandbox com.apple.security.network.client; do
done
echo " ✓ sandbox + network.client entitlements intact"

# Sandboxed Sparkle apps must opt into the installer launcher service and allow
# Sparkle to communicate with its installer/status helpers via temporary Mach lookup.
bundle_id="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$APP/Contents/Info.plist")"
installer_launcher="$(/usr/libexec/PlistBuddy -c 'Print :SUEnableInstallerLauncherService' "$APP/Contents/Info.plist" 2>/dev/null || true)"
if [ "$installer_launcher" != "true" ]; then
echo "error: SUEnableInstallerLauncherService is not true; sandboxed Sparkle installs will fail" >&2
exit 1
fi
for service in "${bundle_id}-spks" "${bundle_id}-spki"; do
printf '%s' "$ent" | grep -Fq "$service" \
|| { echo "error: exported app lost Sparkle Mach lookup entitlement $service" >&2; exit 1; }
done
echo " ✓ Sparkle sandbox installer configuration intact"

# --- 3. submit to the notary service ---------------------------------------
mkdir -p "$OUT_DIR"
rm -f "$ZIP"
Expand Down