hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Seal Burrow Sparkle release key
Some checks failed
Build Rust / Cargo Test (push) Successful in 4m2s
Details
Build Site / Next.js Build (push) Failing after 4s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 4s
Details
Lint Governance / BEP Metadata (push) Successful in 1s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 16:35:07 -07:00
parent 1d45016a63
commit 1ef6fedeaf
9 changed files with 23 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.forgejo/workflows/apple-distribute-testers.yml
View file

@ -76,7 +76,7 @@ env:
BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }}
BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }}
BURROW_SPARKLE_FEED_URL: ${{ vars.BURROW_SPARKLE_FEED_URL || 'https://releases.burrow.net/sparkle/appcast.xml' }}
BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=' }}
BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }}
BURROW_KMS_LOCATION: ${{ vars.BURROW_KMS_LOCATION || 'global' }}
BURROW_KMS_KEYRING: ${{ vars.BURROW_KMS_KEYRING || 'burrow-identity' }}
BURROW_VERSION_REQUIRE_REMOTE: "1"

2
.forgejo/workflows/build-release.yml
View file

@ -81,7 +81,7 @@ env:
BURROW_SPARKLE_KMS_KEY: ${{ vars.BURROW_SPARKLE_KMS_KEY || 'sparkle-ed25519' }}
BURROW_SPARKLE_KMS_VERSION: ${{ vars.BURROW_SPARKLE_KMS_VERSION || '1' }}
BURROW_SPARKLE_FEED_URL: ${{ vars.BURROW_SPARKLE_FEED_URL || 'https://releases.burrow.net/sparkle/appcast.xml' }}
BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=' }}
BURROW_SPARKLE_PUBLIC_ED_KEY: ${{ vars.BURROW_SPARKLE_PUBLIC_ED_KEY || 'uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=' }}
BURROW_VERSION_REQUIRE_REMOTE: "1"
jobs:

2
Apple/App/App.xcconfig
View file

@ -19,7 +19,7 @@ INFOPLIST_KEY_NSMainNibFile[sdk=macosx*] = MainMenu
INFOPLIST_KEY_NSPrincipalClass[sdk=macosx*] = NSApplication
INFOPLIST_KEY_LSApplicationCategoryType[sdk=macosx*] = public.app-category.utilities
BURROW_SPARKLE_FEED_URL = https:/$()/releases.burrow.net/sparkle/appcast.xml
BURROW_SPARKLE_PUBLIC_ED_KEY = Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=
BURROW_SPARKLE_PUBLIC_ED_KEY = uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=
INFOPLIST_KEY_SUFeedURL[sdk=macosx*] = $(BURROW_SPARKLE_FEED_URL)
INFOPLIST_KEY_SUPublicEDKey[sdk=macosx*] = $(BURROW_SPARKLE_PUBLIC_ED_KEY)

2
Scripts/ci/package-apple-artifacts.sh
View file

@ -19,7 +19,7 @@ signing_ready="${BURROW_APPLE_SIGNING_READY:-0}"
signing_mode="${BURROW_APPLE_SIGNING_MODE:-keychain}"
require_signing="${BURROW_APPLE_REQUIRE_SIGNING:-false}"
sparkle_feed_url="${BURROW_SPARKLE_FEED_URL:-https://releases.burrow.net/sparkle/appcast.xml}"
sparkle_public_ed_key="${BURROW_SPARKLE_PUBLIC_ED_KEY:-Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=}"
sparkle_public_ed_key="${BURROW_SPARKLE_PUBLIC_ED_KEY:-uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=}"
sparkle_sign_with_kms="${BURROW_SPARKLE_SIGN_WITH_KMS:-false}"
notarize_macos="${BURROW_NOTARIZE_MACOS:-false}"

2
Scripts/sparkle/sign-appcast-kms.py
View file

@ -79,6 +79,8 @@ def sign_update(args: argparse.Namespace, payload: Path) -> str:
def sparkle_signature(args: argparse.Namespace, payload: Path) -> str:
if args.ed_key_path:
return sign_update(args, payload)
if payload.stat().st_size <= args.kms_max_input_bytes:
return kms_sign(args, payload)
return sign_update(args, payload)

2
docs/DISTRIBUTION.md
View file

@ -37,7 +37,7 @@ messages. Those archives are signed with Sparkle's `sign_update` using the
decrypted release `SPARKLE_EDDSA_KEY_PATH` so Sparkle receives the standard
full-archive EdDSA signature it verifies at update time. macOS release builds
embed public EdDSA key
`Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=` and point Sparkle metadata at
`uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=` and point Sparkle metadata at
`https://releases.burrow.net/sparkle/appcast.xml`. The appcast signer runs only
when `BURROW_SPARKLE_SIGN_WITH_KMS=true` so unsigned local validation artifacts
do not require Google credentials.

2
evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
View file

@ -148,7 +148,7 @@ The same change also makes the forge itself the release authority: release tags
the tester pipeline signs full-size Sparkle archives with Sparkle's
`sign_update` and the decrypted `SPARKLE_EDDSA_KEY_PATH` release secret until
a compatible KMS-backed Sparkle signing service is introduced. macOS builds
embed public EdDSA key `Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=`.
embed public EdDSA key `uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=`.
- Use Namespace labels for platform lanes:
- `namespace-profile-linux-medium`
- `namespace-profile-macos-large`

2
infra/identity/README.md
View file

@ -92,7 +92,7 @@ appcast contains the standard full-archive EdDSA signature Sparkle verifies.
The public EdDSA key embedded in macOS release builds is:
```text
Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=
uugZuJeqvvKd91NZ6F1Fv2cQenUbIG/ZW3L9MuaEz30=
```
The appcast signer is:

14
secrets/apple/sparkle.env.age Normal file
View file

@ -0,0 +1,14 @@
age-encryption.org/v1
-> ssh-ed25519 ux4N8Q 4lsJwrd+zftsXdTsQ3gHxHBPcj0vB4DI9rtV9tnNj34
egBI8PYwaKvatPeSSz/IBBpsV/HSyYINcoVL1Z5+fMo
-> ssh-ed25519 IrZmAg UMLZxY6J5w1Nt3oCnkKCELS0fP8LhRQzBuata2m0/m0
p0Nj6XUD3/Z/VgNX99POOv9d3kvMTXlCndh40uzZwuU
-> ssh-ed25519 0kWPgQ VqbeBJ9KELadFFhEUVQuXaayCw7m1XxBNoAhcavGYAs
zrUKaHsxMNI+YfFMi6w0qJ0QsGTl6lBPkAMAT6Np4U8
-> X25519 P3EVVvgL1O/2N1tDVqdiNnwpnocO1dsT1MZEBqTk+HQ
lEdIo0nWWIwWJ0gbt1X7H6do+lCjhMEyTv2dyDtEmNs
-> ssh-ed25519 tbm5Cw YjftkJadPiA1/vTWS53xK9EkyDWXiL2+WJpAx+ZM+HQ
3b3CP3UA/TK3+2EuNDL8Vf22o+Mxgx6bsm5Ub7e7lNc
--- LKEHr9rQIZlVZQTW46XwDCDa5lsKrgIamb2ocpG5vHw
P¤ïÓ
êØNƒ¡ ³±àœù²›D…³æãà¹Å5zyL"ED×0Ü%oæ–Ô„ú| Oº³†úîc¦¾Ÿ!”´µ]#© (xÎâôD‰€TGÊX¿x’¾Ô؇…Š#+‰XA…æâNƒzÇÚÀ2bvŸìŸ]