# Sparkle Release Channel

Burrow stages Sparkle files under `dist/builds/<build>/sparkle/<channel>/` and
publishes them through `.forgejo/workflows/publish-store-uploads.yml`.

The current implementation prepares the channel and public pointer layout:

- `sparkle/<channel>/appcast.xml`
- `sparkle/appcast.xml`
- `sparkle/default/`
- `sparkle/main-channel.txt`

Sparkle enclosure signatures can be produced with the non-exportable
`sparkle-ed25519` Google KMS key:

```sh
Scripts/sparkle/sign-appcast-kms.py \
  --appcast dist/builds/<build>/sparkle/<channel>/appcast.xml \
  --artifact-dir dist/builds/<build>/sparkle/<channel>
```

The public EdDSA key embedded in macOS release builds is:

```text
Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=
```

The build lane only signs appcasts when `BURROW_SPARKLE_SIGN_WITH_KMS=true`.
The live Google KMS key uses `EC_SIGN_ED25519` with software protection because
Google KMS rejects Ed25519 for HSM protection level.