History

Conrad Kramer 002bd382e9 Some checks failed Cache: Publish Nix / Publish Nix Cache (push) Waiting to run Details Build Rust / Cargo Test (push) Successful in 4m14s Details Build Site / Next.js Build (push) Failing after 6s Details Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s Details Lint Governance / BEP Metadata (push) Successful in 0s Details Build: Android / Android Rust Core Stub (push) Failing after 23s Details Wire Forge-native release infrastructure		2026-06-07 05:51:12 -07:00
..
README.md	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00

README.md

Sparkle Release Channel

Burrow stages Sparkle files under dist/builds/<build>/sparkle/<channel>/ and publishes them through .forgejo/workflows/publish-store-uploads.yml.

The current implementation prepares the channel and public pointer layout:

sparkle/<channel>/appcast.xml
sparkle/appcast.xml
sparkle/default/
sparkle/main-channel.txt

Sparkle enclosure signatures can be produced with the non-exportable sparkle-ed25519 Google KMS key:

Scripts/sparkle/sign-appcast-kms.py \
  --appcast dist/builds/<build>/sparkle/<channel>/appcast.xml \
  --artifact-dir dist/builds/<build>/sparkle/<channel>

The public EdDSA key embedded in macOS release builds is:

Myv9ZNZT6YGKMtMezh52ra4WqaeEKc4VlvVU0evhJeI=

The build lane only signs appcasts when BURROW_SPARKLE_SIGN_WITH_KMS=true. The live Google KMS key uses EC_SIGN_ED25519 with software protection because Google KMS rejects Ed25519 for HSM protection level.