hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions
burrow/store-metadata/sparkle/README.md
Conrad Kramer 002bd382e9
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Details
Build Rust / Cargo Test (push) Successful in 4m14s
Details
Build Site / Next.js Build (push) Failing after 6s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Details
Lint Governance / BEP Metadata (push) Successful in 0s
Details
Build: Android / Android Rust Core Stub (push) Failing after 23s
Details
Wire Forge-native release infrastructure
2026-06-07 05:51:12 -07:00

962 B
Raw Blame History

Sparkle Release Channel

Burrow stages Sparkle files under dist/builds/<build>/sparkle/<channel>/ and publishes them through .forgejo/workflows/publish-store-uploads.yml.

The current implementation prepares the channel and public pointer layout:

  • sparkle/<channel>/appcast.xml
  • sparkle/appcast.xml
  • sparkle/default/
  • sparkle/main-channel.txt

Sparkle enclosure signatures can be produced with the non-exportable sparkle-ed25519 Google KMS key:

Scripts/sparkle/sign-appcast-kms.py \
  --appcast dist/builds/<build>/sparkle/<channel>/appcast.xml \
  --artifact-dir dist/builds/<build>/sparkle/<channel>

The public EdDSA key embedded in macOS release builds is:

Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=

The build lane only signs appcasts when BURROW_SPARKLE_SIGN_WITH_KMS=true. The live Google KMS key uses EC_SIGN_ED25519 with software protection because Google KMS rejects Ed25519 for HSM protection level.