From 1ef6fedeafe1535045de5cc64c6c96ea0039c3a6 Mon Sep 17 00:00:00 2001 From: Conrad Kramer Date: Sun, 7 Jun 2026 16:35:07 -0700 Subject: [PATCH] Seal Burrow Sparkle release key --- .forgejo/workflows/apple-distribute-testers.yml | 2 +- .forgejo/workflows/build-release.yml | 2 +- Apple/App/App.xcconfig | 2 +- Scripts/ci/package-apple-artifacts.sh | 2 +- Scripts/sparkle/sign-appcast-kms.py | 2 ++ docs/DISTRIBUTION.md | 2 +- ...ase-infrastructure-and-store-upload-pipeline.md | 2 +- infra/identity/README.md | 2 +- secrets/apple/sparkle.env.age | 14 ++++++++++++++ 9 files changed, 23 insertions(+), 7 deletions(-) create mode 100644 secrets/apple/sparkle.env.age diff --git a/.forgejo/workflows/apple-distribute-testers.yml b/.forgejo/workflows/apple-distribute-testers.yml index 2c5ec64..9ef4520 100644 --- a/.forgejo/workflows/apple-distribute-testers.yml +++ b/.forgejo/workflows/apple-distribute-testers.yml @@ -76,7 +76,7 @@ env: BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }} BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }} BURROW_SPARKLE_FEED_URL: ${{ vars.BURROW_SPARKLE_FEED_URL || 'https://releases.burrow.net/sparkle/appcast.xml' }} - BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=' }} + BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }} BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }} BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }} BURROW_VERSION_REQUIRE_REMOTE: "1" diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml index 08f5b26..dbcd08c 100644 --- a/.forgejo/workflows/build-release.yml +++ b/.forgejo/workflows/build-release.yml @@ -81,7 +81,7 @@ env: BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }} BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }} BURROW_SPARKLE_FEED_URL: ${{ vars.BURROW_SPARKLE_FEED_URL || 'https://releases.burrow.net/sparkle/appcast.xml' }} - BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=' }} + BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }} BURROW_VERSION_REQUIRE_REMOTE: "1" jobs: diff --git a/Apple/App/App.xcconfig b/Apple/App/App.xcconfig index e891c69..b2b5166 100644 --- a/Apple/App/App.xcconfig +++ b/Apple/App/App.xcconfig @@ -19,7 +19,7 @@ INFOPLIST_KEY_NSMainNibFile[sdk=macosx*] = MainMenu INFOPLIST_KEY_NSPrincipalClass[sdk=macosx*] = NSApplication INFOPLIST_KEY_LSApplicationCategoryType[sdk=macosx*] = public.app-category.utilities BURROW_SPARKLE_FEED_URL = https:/$()/releases.burrow.net/sparkle/appcast.xml -BURROW_SPARKLE_PUBLIC_ED_KEY = Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI= +BURROW_SPARKLE_PUBLIC_ED_KEY = uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30= INFOPLIST_KEY_SUFeedURL[sdk=macosx*] = $(BURROW_SPARKLE_FEED_URL) INFOPLIST_KEY_SUPublicEDKey[sdk=macosx*] = $(BURROW_SPARKLE_PUBLIC_ED_KEY) diff --git a/Scripts/ci/package-apple-artifacts.sh b/Scripts/ci/package-apple-artifacts.sh index 19fbcf0..87eed26 100755 --- a/Scripts/ci/package-apple-artifacts.sh +++ b/Scripts/ci/package-apple-artifacts.sh @@ -19,7 +19,7 @@ signing_ready="${BURROW_APPLE_SIGNING_READY:-0}" signing_mode="${BURROW_APPLE_SIGNING_MODE:-keychain}" require_signing="${BURROW_APPLE_REQUIRE_SIGNING:-false}" sparkle_feed_url="${BURROW_SPARKLE_FEED_URL:-https://releases.burrow.net/sparkle/appcast.xml}" -sparkle_public_ed_key="${BURROW_SPARKLE_PUBLIC_ED_KEY:-Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=}" +sparkle_public_ed_key="${BURROW_SPARKLE_PUBLIC_ED_KEY:-uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=}" sparkle_sign_with_kms="${BURROW_SPARKLE_SIGN_WITH_KMS:-false}" notarize_macos="${BURROW_NOTARIZE_MACOS:-false}" diff --git a/Scripts/sparkle/sign-appcast-kms.py b/Scripts/sparkle/sign-appcast-kms.py index 03d28b3..cad4048 100755 --- a/Scripts/sparkle/sign-appcast-kms.py +++ b/Scripts/sparkle/sign-appcast-kms.py @@ -79,6 +79,8 @@ def sign_update(args: argparse.Namespace, payload: Path) -> str: def sparkle_signature(args: argparse.Namespace, payload: Path) -> str: + if args.ed_key_path: + return sign_update(args, payload) if payload.stat().st_size <= args.kms_max_input_bytes: return kms_sign(args, payload) return sign_update(args, payload) diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index 9c6b7ae..ccbae19 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -37,7 +37,7 @@ messages. Those archives are signed with Sparkle's `sign_update` using the decrypted release `SPARKLE_EDDSA_KEY_PATH` so Sparkle receives the standard full-archive EdDSA signature it verifies at update time. macOS release builds embed public EdDSA key -`Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=` and point Sparkle metadata at +`uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=` and point Sparkle metadata at `https://releases.burrow.net/sparkle/appcast.xml`. The appcast signer runs only when `BURROW_SPARKLE_SIGN_WITH_KMS=true` so unsigned local validation artifacts do not require Google credentials. diff --git a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md index 3458875..f4d6229 100644 --- a/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md +++ b/evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md @@ -148,7 +148,7 @@ The same change also makes the forge itself the release authority: release tags the tester pipeline signs full-size Sparkle archives with Sparkle's `sign_update` and the decrypted `SPARKLE_EDDSA_KEY_PATH` release secret until a compatible KMS-backed Sparkle signing service is introduced. macOS builds - embed public EdDSA key `Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=`. + embed public EdDSA key `uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=`. - Use Namespace labels for platform lanes: - `namespace-profile-linux-medium` - `namespace-profile-macos-large` diff --git a/infra/identity/README.md b/infra/identity/README.md index 21b74da..a36239a 100644 --- a/infra/identity/README.md +++ b/infra/identity/README.md @@ -92,7 +92,7 @@ appcast contains the standard full-archive EdDSA signature Sparkle verifies. The public EdDSA key embedded in macOS release builds is: ```text -Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI= +uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30= ``` The appcast signer is: diff --git a/secrets/apple/sparkle.env.age b/secrets/apple/sparkle.env.age new file mode 100644 index 0000000..7a73864 --- /dev/null +++ b/secrets/apple/sparkle.env.age @@ -0,0 +1,14 @@ +age-encryption.org/v1 +-> ssh-ed25519 ux4N8Q 4lsJwrd+zftsXdTsQ3gHxHBPcj0vB4DI9rtV9tnNj34 +egBI8PYwaKvatPeSSz/IBBpsV/HSyYINcoVL1Z5+fMo +-> ssh-ed25519 IrZmAg UMLZxY6J5w1Nt3oCnkKCELS0fP8LhRQzBuata2m0/m0 +p0Nj6XUD3/Z/VgNX99POOv9d3kvMTXlCndh40uzZwuU +-> ssh-ed25519 0kWPgQ VqbeBJ9KELadFFhEUVQuXaayCw7m1XxBNoAhcavGYAs +zrUKaHsxMNI+YfFMi6w0qJ0QsGTl6lBPkAMAT6Np4U8 +-> X25519 P3EVVvgL1O/2N1tDVqdiNnwpnocO1dsT1MZEBqTk+HQ +lEdIo0nWWIwWJ0gbt1X7H6do+lCjhMEyTv2dyDtEmNs +-> ssh-ed25519 tbm5Cw YjftkJadPiA1/vTWS53xK9EkyDWXiL2+WJpAx+ZM+HQ +3b3CP3UA/TK3+2EuNDL8Vf22o+Mxgx6bsm5Ub7e7lNc +--- LKEHr9rQIZlVZQTW46XwDCDa5lsKrgIamb2ocpG5vHw +P¤ïÓ +êØNƒ¡ ³±àœù²›D…³æãà¹Å5zyL"ED×0Ü%oæ–Ô„ú| Oº³†úîc¦¾Ÿ!”´µ]¶#© (xÎâôD‰€TGÊX¿x’¾Ô؇…Š#+‰XA…æâNƒzÇÚÀ2bvŸìŸ] \ No newline at end of file