The update is improperly signed and could not be validated.

[JesseGuoX]

Thank you for the great open source software you create. I have some trouble to build application with it.

Description of the problem

When I integrate Sparkle2 into my application, it can detect and download updates normally, but an Update Error! will occur during the update process.

Update Error!
The update is improperly signed and could not be validated. Please try again later or contact the app developer.

Do you use Sandboxing in your app?

No

Version of Sparkle.framework in the latest version of your app

Sparkle-2.4.2

Version of Sparkle.framework in the old version of app that your users have (or N/A)

N/A

Steps to reproduce the behavior

Here is my step to use Sparkle:

1. Download Sparkle-2.4.2 copy necessary files to my project and link to it.
2. Run ./bin/generate_keys to generate keys, and set the value of SUPublicEDKey in Info.plist to the public key shown on the console.
3. Create zip archives with my app ditto -c -k --sequesterRsrc --keepParent MyApp.app MyApp.zip.
4. bin/sign_update MyApp.zip sign my archives.
5. set sparkle:edSignature="9VzxOlScAwl7Q1AlzHtK7xYtCpPppy5zhanT5D3GCQEZ5i8uRjnVO6342t+Dk3Js7Jep+RezKN1O3ShWCN0tCg==" length="81895663" to appcast file.
6. Run my app and check update.
7. Check update(success)->Downloading(success)->Extracting(success)->occur Update Error.

FYI

Currently I don't have an Apple developer account, so I can't sign the application with a developer certificate.
My application is a Qt Appliction.

Questions

Is an Apple developer certification required? Is an edDSA signature required? How to set up skipping?

[zorgiepoo]

Please check the Console app for more information on the error; look for logs under your app or Autoupdate. Sparkle's test app goes through the same process (EdDSA signing + adhoc-signed).

If you paste the contents of the appcast file I can also validate to see if it looks right. Or you can use generate_appcast which automates this instead of signing updates manually, and is less likely to get the process wrong (plus it generates deltas).

[JesseGuoX]

Sorry, my mistake. I just signed an old app for test which have no EdDSA key in the Info.plist, everything works perfect after I upload a new compiled app.

Autoupdate: [org.sparkle-project.Sparkle:Sparkle] Error: Update validation was a failure (null) (URL (null))
Autoupdate: [org.sparkle-project.Sparkle:Sparkle] Error: A public (Ed)DSA key was found in the old bundle but no public (Ed)DSA key was found in the new update. Sparkle only supports rotation, but not removal of (Ed)DSA keys. Please add an EdDSA key to the new app. (null) (URL (null))

[dqhieu]

Hi @JesseGuoX , my users have the same issue. How did you get this log?

[JesseGuoX]

sign again and recompile should solve your problem.