Merge pull request #208 from eduvpn/release/1.2b1

Release/1.2b1
eduvpn · Mar 6, 2019 · 832fa55 · 832fa55
2 parents 4d22d6b + 4754e8c
commit 832fa55
Show file tree

Hide file tree

Showing 100 changed files with 7,649 additions and 539 deletions.
diff --git a/Cartfile.resolved b/Cartfile.resolved
@@ -3,4 +3,4 @@ github "ashleymills/Reachability.swift" "v4.2.1"
 github "jedisct1/swift-sodium" "acabedbaaced5c7d3d71d627fa134fd52234849a"
 github "onevcat/Kingfisher" "4.9.0"
 github "openid/AppAuth-iOS" "1.0.0.beta1"
-github "sparkle-project/Sparkle" "1.20.0"
+github "sparkle-project/Sparkle" "1.21.2"
diff --git a/Carthage/Checkouts/Sparkle/.gitmodules b/Carthage/Checkouts/Sparkle/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "ed25519"]
+	path = ed25519
+	url = https://github.com/orlp/ed25519
diff --git a/Carthage/Checkouts/Sparkle/CHANGELOG b/Carthage/Checkouts/Sparkle/CHANGELOG
@@ -1,3 +1,25 @@
+# 1.21.2
+
+ * Allow EdDSA for delta updates, too (Kornel)
+ * Warning fixes (Brian Bergstrand)
+ * Improvements to release notes view context menu and dark mode (Bi11)
+
+# 1.21.0
+
+ * Added support EdDSA (ed25519) signatures (Kornel)
+    * DSA signatures are considered outdated, and Apple's `Security.framework` only supports weaker SHA-1-based DSA.
+    * Both old DSA and new EdDSA are still supported (and one app can use both), but new applications should use EdDSA only, and we recommend migrating away from DSA signatures.
+ * `generate_keys` is now a Swift tool that stores EdDSA private keys in the Keychain
+    * Existing apps can continue using their old DSA keys, but we've dropped support for generation of old DSA keys
+ * `sign_update` is now a Swift tool that signs using EdDSA from private keys in the Keychain
+    * The old DSA-based signing script has been moved to `bin/old_dsa_scripts`
+    * The old DSA-based signing script has been fixed to work on pre-10.13 systems (Thomas Tempelmann)
+ * `generate_appcast` has been updated to support EdDSA signatures
+    * It can sign both DSA (if `dsa_priv.pem` file is specified) and EdDSA (from Keychain)
+    * The tool now uses Caches directory and doesn't generate unnecessary delta files
+ * Fixed verification of delta updates on filesystems that change permissions of symlinks
+ * Fixed `NSURLSession` leak (Michael Ehrmann)
+
 # 1.20.0
 
  * `generate_appcast` option to read private key directly from the keychain (Tamás Lustyik)

diff --git a/Carthage/Checkouts/Sparkle/Configurations/ConfigCommon.xcconfig b/Carthage/Checkouts/Sparkle/Configurations/ConfigCommon.xcconfig
@@ -16,8 +16,8 @@ SPARKLE_AUTOMATED_DOWNGRADES = 0
 SPARKLE_NORMALIZE_INSTALLED_APPLICATION_NAME = 0
 
 SPARKLE_VERSION_MAJOR = 1
-SPARKLE_VERSION_MINOR = 20
-SPARKLE_VERSION_PATCH = 0
+SPARKLE_VERSION_MINOR = 21
+SPARKLE_VERSION_PATCH = 2
 SPARKLE_VERSION = $(SPARKLE_VERSION_MAJOR).$(SPARKLE_VERSION_MINOR).$(SPARKLE_VERSION_PATCH)
 
 CURRENT_PROJECT_VERSION = $(SPARKLE_VERSION)

diff --git a/Carthage/Checkouts/Sparkle/Configurations/ConfigGenerateKeys.xcconfig b/Carthage/Checkouts/Sparkle/Configurations/ConfigGenerateKeys.xcconfig
@@ -0,0 +1,7 @@
+// Generate Appcast only
+
+#include "ConfigSwift.xcconfig"
+
+SWIFT_OBJC_BRIDGING_HEADER = generate_keys/Bridging-Header.h
+MACOSX_DEPLOYMENT_TARGET = 10.11
+PRODUCT_NAME = generate_keys
diff --git a/Carthage/Checkouts/Sparkle/Configurations/ConfigGenerateKeysDebug.xcconfig b/Carthage/Checkouts/Sparkle/Configurations/ConfigGenerateKeysDebug.xcconfig
@@ -0,0 +1,4 @@
+// Generate Appcast Debug
+
+#include "ConfigGenerateKeys.xcconfig"
+#include "ConfigSwiftDebug.xcconfig"
diff --git a/Carthage/Checkouts/Sparkle/Configurations/ConfigGenerateKeysRelease.xcconfig b/Carthage/Checkouts/Sparkle/Configurations/ConfigGenerateKeysRelease.xcconfig
@@ -0,0 +1,4 @@
+// Generate Appcast Release
+
+#include "ConfigGenerateKeys.xcconfig"
+#include "ConfigSwiftRelease.xcconfig"
diff --git a/Carthage/Checkouts/Sparkle/Configurations/make-release-package.sh b/Carthage/Checkouts/Sparkle/Configurations/make-release-package.sh
@@ -19,6 +19,8 @@ if [ "$ACTION" = "" ] ; then
     cp -R "$SRCROOT/bin" "$CONFIGURATION_BUILD_DIR/staging"
     cp "$CONFIGURATION_BUILD_DIR/BinaryDelta" "$CONFIGURATION_BUILD_DIR/staging/bin"
     cp "$CONFIGURATION_BUILD_DIR/generate_appcast" "$CONFIGURATION_BUILD_DIR/staging/bin"
+    cp "$CONFIGURATION_BUILD_DIR/generate_keys" "$CONFIGURATION_BUILD_DIR/staging/bin"
+    cp "$CONFIGURATION_BUILD_DIR/sign_update" "$CONFIGURATION_BUILD_DIR/staging/bin"
     cp -R "$CONFIGURATION_BUILD_DIR/Sparkle Test App.app" "$CONFIGURATION_BUILD_DIR/staging"
     cp -R "$CONFIGURATION_BUILD_DIR/Sparkle.framework" "$CONFIGURATION_BUILD_DIR/staging"
 
@@ -27,6 +29,8 @@ if [ "$ACTION" = "" ] ; then
     if [ "$CONFIGURATION" = "Release" ] ; then
         cp -R "$CONFIGURATION_BUILD_DIR/BinaryDelta.dSYM" "$CONFIGURATION_BUILD_DIR/staging/bin"
         cp -R "$CONFIGURATION_BUILD_DIR/generate_appcast.dSYM" "$CONFIGURATION_BUILD_DIR/staging/bin"
+        cp -R "$CONFIGURATION_BUILD_DIR/generate_keys.dSYM" "$CONFIGURATION_BUILD_DIR/staging/bin"
+        cp -R "$CONFIGURATION_BUILD_DIR/sign_update.dSYM" "$CONFIGURATION_BUILD_DIR/staging/bin"
         cp -R "$CONFIGURATION_BUILD_DIR/Sparkle Test App.app.dSYM" "$CONFIGURATION_BUILD_DIR/staging"
         cp -R "$CONFIGURATION_BUILD_DIR/Sparkle.framework.dSYM" "$CONFIGURATION_BUILD_DIR/staging"
     fi

diff --git a/Carthage/Checkouts/Sparkle/Documentation/build-docs.sh b/Carthage/Checkouts/Sparkle/Documentation/build-docs.sh
@@ -5,7 +5,7 @@ if [ "$ACTION" = "" ] ; then
         doxygen Documentation/Doxyfile
     else
         echo "warning: Doxygen not found in PATH"
-        echo "open Terminal and type this command `brew install doxygen` then click `enter/return` key. finally build this target again"
+        echo "open Terminal and type this command 'brew install doxygen' then click 'enter/return' key. finally build this target again"
     fi
 elif [ "$ACTION" = "clean" ] ; then
     rm -rf "$SRCROOT/Documentation/html"

diff --git a/Carthage/Checkouts/Sparkle/README.markdown b/Carthage/Checkouts/Sparkle/README.markdown
@@ -7,7 +7,7 @@ Secure and reliable software update framework for Cocoa developers.
 ## Features
 
 * Seamless. There's no mention of Sparkle; your icons and app name are used.
-* Secure. Updates are verified using DSA signatures and Apple Code Signing.
+* Secure. Updates are verified using EdDSA signatures and Apple Code Signing.
 * Fast. Supports delta updates which only patch files that have changed.
 * Easy to install. Sparkle requires no code in your app, and only needs static files on a web server.
 * Supports bundles, preference panes, plugins, and other non-.app software. Can install .pkg files for more complicated products.
@@ -18,9 +18,9 @@ Secure and reliable software update framework for Cocoa developers.
 
 ## Changes since 1.5b
 
-* Compatibilty with macOS Sierra.
-* Up-to-date with 10.12 SDK and Xcode 8 (supports macOS 10.7+).
-* Important security fixes.
+* Compatibilty with macOS Sierra (and all newer versions).
+* Up-to-date with 10.14 SDK and Xcode 10 (supports macOS 10.7+).
+* Important security fixes and more secure signature algorithm.
 * Cleaned up and modernized code, using ARC and Autolayout.
 * Truly automatic background updates (no UI at all) when user agreed to "Automatically download and install updates in the future."
 * Upgraded and more reliable binary delta and code signing verification.
@@ -30,15 +30,26 @@ Secure and reliable software update framework for Cocoa developers.
 ## Requirements
 
 * Runtime: macOS 10.7 or greater
-* Build: Xcode 7 and 10.11 SDK or greater
+* Build: Xcode 8 and 10.11 SDK or greater
 * HTTPS server for serving updates (see [App Transport Security](http://sparkle-project.org/documentation/app-transport-security/))
+* No sandboxing. Sparkle 1.x can't update sandboxed apps. Sparkle 2.0 (alpha) can.
 
 ## Usage
 
 See [getting started guide](https://sparkle-project.org/documentation/). No code is necessary, but a bit of Xcode configuration is required.
 
 ## Development
 
+### Troubleshooting
+
+  * Please check **Console.app**. Sparkle prints detailed information there about all problems it encounters. It often also suggests solutions to the problems, so please read Sparkle's log messages carefully.
+
+  * Use the `generate_appcast` tool which creates appcast files, correct signatures, and delta updates automatically.
+
+  * Make sure the URL specified in [`SUFeedURL`](https://sparkle-project.org/documentation/customization/) is valid (typos/404s are a common error!), and that it uses modern TLS ([test it](https://www.ssllabs.com/ssltest/)).
+
+  * Delete your app's preferences (in `~/Library/Preferences/<your bundle id>`) if you've set another feed URL programmatically via Sparkle's Objective-C interface.
+
 ### API symbols
 
 Sparkle is built with `-fvisibility=hidden -fvisibility-inlines-hidden` which means no symbols are exported by default.

diff --git a/Carthage/Checkouts/Sparkle/Resources/SampleAppcast.xml b/Carthage/Checkouts/Sparkle/Resources/SampleAppcast.xml
@@ -10,6 +10,7 @@
                 http://you.com/app/2.0.html
             </sparkle:releaseNotesLink>
             <pubDate>Wed, 09 Jan 2006 19:20:11 +0000</pubDate>
+            <!-- Sparkle 1.21+ uses sparkle::edSignature="ed25519" instead of sparkle::dsaSignature="deprecated DSA" -->
             <enclosure url="http://you.com/app/Your%20Great%20App%202.0.zip" sparkle:version="2.0" length="1623481" type="application/octet-stream" sparkle:dsaSignature="BAFJW4B6B1K1JyW30nbkBwainOzrN6EQuAh" />
             <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion>
         </item>
@@ -20,6 +21,7 @@
                 http://you.com/app/1.5.html
             </sparkle:releaseNotesLink>
             <pubDate>Wed, 01 Jan 2006 12:20:11 +0000</pubDate>
+            <!-- Sparkle 1.21+ uses sparkle::edSignature="ed25519" instead of sparkle::dsaSignature="deprecated DSA" -->
             <enclosure url="http://you.com/app/Your%20Great%20App%201.5.zip" sparkle:version="1.5" length="1472893" type="application/octet-stream" sparkle:dsaSignature="234818feCa1JyW30nbkBwainOzrN6EQuAh" />
             <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion>
         </item>
@@ -31,6 +33,7 @@
                 http://you.com/app/1.4.html
             </sparkle:releaseNotesLink>
             <pubDate>Wed, 25 Dec 2005 12:20:11 +0000</pubDate>
+            <!-- Sparkle 1.21+ uses sparkle::edSignature="ed25519" instead of sparkle::dsaSignature="deprecated DSA" -->
             <enclosure url="http://you.com/app/Your%20Great%20App%201.4.zip" sparkle:version="241" sparkle:shortVersionString="1.4" sparkle:dsaSignature="MC0CFBfeCa1JyW30nbkBwainOzrN6EQuAh=" length="1472349" type="application/octet-stream" />
             <sparkle:minimumSystemVersion>10.7</sparkle:minimumSystemVersion>
         </item>

diff --git a/Carthage/Checkouts/Sparkle/Sparkle.podspec b/Carthage/Checkouts/Sparkle/Sparkle.podspec
@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name        = "Sparkle"
-  s.version     = "1.20.0"
+  s.version     = "1.21.2"
   s.summary     = "A software update framework for macOS"
   s.description = "Sparkle is an easy-to-use software update framework for Cocoa developers."
   s.homepage    = "http://sparkle-project.org"