{"action":"created","issue":{"url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/896","repository_url":"https://api.github.com/repos/sparkle-project/Sparkle","labels_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/896/labels{/name}","comments_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/896/comments","events_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/896/events","html_url":"https://github.com/sparkle-project/Sparkle/issues/896","id":181739352,"number":896,"title":"Add script to verify signature","user":{"login":"mz2","id":71363,"avatar_url":"https://avatars.githubusercontent.com/u/71363?v=3","gravatar_id":"","url":"https://api.github.com/users/mz2","html_url":"https://github.com/mz2","followers_url":"https://api.github.com/users/mz2/followers","following_url":"https://api.github.com/users/mz2/following{/other_user}","gists_url":"https://api.github.com/users/mz2/gists{/gist_id}","starred_url":"https://api.github.com/users/mz2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mz2/subscriptions","organizations_url":"https://api.github.com/users/mz2/orgs","repos_url":"https://api.github.com/users/mz2/repos","events_url":"https://api.github.com/users/mz2/events{/privacy}","received_events_url":"https://api.github.com/users/mz2/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2016-10-07T18:38:58Z","updated_at":"2016-10-10T00:40:52Z","closed_at":null,"body":"Maybe I am missing something but I cannot find documentation anywhere for how I would verify a signature, given a) a zip / dmg of the update, b) the signature in the form available in an appcast, and the private key that was used to (supposedly) create the signature. \r\n\r\nI have a case where I would like to run such a verification on my appcast to find some bad entries where I need to recreate the signature (my app includes an appcast with deltas, and the signatures from the deltas appear to be valid but I appear to have corrupted a few of the signatures for the full-sized updates)."},"comment":{"url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/comments/252524156","html_url":"https://github.com/sparkle-project/Sparkle/issues/896#issuecomment-252524156","issue_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/896","id":252524156,"user":{"login":"zorgiepoo","id":857267,"avatar_url":"https://avatars.githubusercontent.com/u/857267?v=3","gravatar_id":"","url":"https://api.github.com/users/zorgiepoo","html_url":"https://github.com/zorgiepoo","followers_url":"https://api.github.com/users/zorgiepoo/followers","following_url":"https://api.github.com/users/zorgiepoo/following{/other_user}","gists_url":"https://api.github.com/users/zorgiepoo/gists{/gist_id}","starred_url":"https://api.github.com/users/zorgiepoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zorgiepoo/subscriptions","organizations_url":"https://api.github.com/users/zorgiepoo/orgs","repos_url":"https://api.github.com/users/zorgiepoo/repos","events_url":"https://api.github.com/users/zorgiepoo/events{/privacy}","received_events_url":"https://api.github.com/users/zorgiepoo/received_events","type":"User","site_admin":false},"created_at":"2016-10-10T00:40:52Z","updated_at":"2016-10-10T00:40:52Z","body":"My point that it is not very much code also simulated by a built-in tool is why I got the feeling that it may have not been worthwhile enough to create a whole target for. I realize that figuring out how to do it with the command line tool may have been challenging, which is partly why I pasted commands showing how to achieve it. That alone does not mean a new target is the way to go.\r\n\r\nThe other day someone here was running `sign_update` on a linux system, which was why I felt the need to bring up system requirements, but I do wonder if that's worthwhile caring about.\r\n\r\nI think (note: as a final product) that a script could currently be the simplest change to accept into the overall project. However I do realize the same verification code is not being exercised, and maybe using openssl isn't ideal, but it's kind of unfortunate to have our tools result to different methods."}}
{"actor":{"display_login":"zorgiepoo"}}