{"action":"created","issue":{"url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/667","repository_url":"https://api.github.com/repos/sparkle-project/Sparkle","labels_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/667/labels{/name}","comments_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/667/comments","events_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/667/events","html_url":"https://github.com/sparkle-project/Sparkle/issues/667","id":113421334,"number":667,"title":"How to correctly sign Sparkle.framework and Autoupdate.app with Xcode 7 on 10.11 El Capitan","user":{"login":"frankrei","id":158543,"avatar_url":"https://avatars.githubusercontent.com/u/158543?v=3","gravatar_id":"","url":"https://api.github.com/users/frankrei","html_url":"https://github.com/frankrei","followers_url":"https://api.github.com/users/frankrei/followers","following_url":"https://api.github.com/users/frankrei/following{/other_user}","gists_url":"https://api.github.com/users/frankrei/gists{/gist_id}","starred_url":"https://api.github.com/users/frankrei/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frankrei/subscriptions","organizations_url":"https://api.github.com/users/frankrei/orgs","repos_url":"https://api.github.com/users/frankrei/repos","events_url":"https://api.github.com/users/frankrei/events{/privacy}","received_events_url":"https://api.github.com/users/frankrei/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-10-26T18:30:59Z","updated_at":"2016-06-10T18:44:21Z","closed_at":null,"body":"Hi,\r\n\r\nIt looks like a lot of things affecting how the framework should be signed in both Xcode 7 and Mac OS X 10.11 has changed recently, but the documentation has not been updated.\r\n\r\nThe new gatekeeper code checks signatures of resources bundles, symlinks, etc. much more rigorously and Xcode 7 has the \"sign when copying\" checkbox that does a lot of the framework signing itself. On top of that non-HTTPS delivery of the appcast and the updated archive are both subject to the new `NSAppTransportSecurity` info.plist key.\r\n\r\nI'm using RBAppCheck, spctl and codesign to verify my app bundles but after a lot of mucking about, I'm still not 100% certain that I'm doing things right.\r\n\r\nCould somebody who knows please update the documentation and describe the authoritative way of signing the framework as *everybody* using it will have to make these changes.\r\n\r\nThanks for your time."},"comment":{"url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/comments/225263847","html_url":"https://github.com/sparkle-project/Sparkle/issues/667#issuecomment-225263847","issue_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/667","id":225263847,"user":{"login":"zorgiepoo","id":857267,"avatar_url":"https://avatars.githubusercontent.com/u/857267?v=3","gravatar_id":"","url":"https://api.github.com/users/zorgiepoo","html_url":"https://github.com/zorgiepoo","followers_url":"https://api.github.com/users/zorgiepoo/followers","following_url":"https://api.github.com/users/zorgiepoo/following{/other_user}","gists_url":"https://api.github.com/users/zorgiepoo/gists{/gist_id}","starred_url":"https://api.github.com/users/zorgiepoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zorgiepoo/subscriptions","organizations_url":"https://api.github.com/users/zorgiepoo/orgs","repos_url":"https://api.github.com/users/zorgiepoo/repos","events_url":"https://api.github.com/users/zorgiepoo/events{/privacy}","received_events_url":"https://api.github.com/users/zorgiepoo/received_events","type":"User","site_admin":false},"created_at":"2016-06-10T18:44:21Z","updated_at":"2016-06-10T18:44:21Z","body":"I don't think `spctl -a` is supposed to be used on frameworks."}}
{"actor":{"display_login":"zorgiepoo"}}