Repository navigation
Fix reading release notes content length from appcast - #2921
Merged
zorgiepoo merged 1 commit intoSep 13, 2026
Merged
Conversation
Member
|
Thank you. |
super-original
pushed a commit
to SakuraCordApp/Sparkle
that referenced
this pull request
Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
While reading how release notes signatures are verified, I noticed that
SUAppcaststores thesparkle:lengthattribute of<sparkle:releaseNotesLink>in the link dictionary under theSUAppcastAttributeLengthkey (sparkle:length), butSUAppcastItemreads it back with@"length". That lookup always returns nil, soreleaseNotesContentLengthis always 0, even for feeds generated bygenerate_appcastorsign_update, which both emitsparkle:lengthon the release notes link.The effect is limited to diagnostics:
SPUReleaseNotesDriverpasses that length toSPUVerifierInformation, andSUSignatureVerifieronly adds its "expected content length differs from the downloaded file length" hint when the expected length is non-zero. So when release notes fail validation, that hint never shows up today. Verification itself doesn't use the length, so nothing about acceptance or rejection changes.The fix reads the value with
SUAppcastAttributeLength, the same constant the parser writes with. I addedsparkle:length="1234"to the first release notes link intest-links.xmland checkedreleaseNotesContentLengthintestLinks(1234 for that item, 0 for an item without the attribute). That neededSUAppcastItem+Private.hin the unit test bridging header.This change was found, written and tested with an AI coding assistant (Claude Code): it traced the key mismatch between
SUAppcast.mandSUAppcastItem.m, wrote the test, and ran it before and after the fix on CI. The diff is small (one line of code plus the test), and I checked it against the parser and verifier code paths described above.Misc Checklist
Testing
I tested and verified my change by using one or multiple of these methods:
I ran
SUAppcastTeston a GitHub Actions macos-26 runner (Xcode 26.6) on my fork, with a workflow reduced to building the unit tests and running that class:testLinksfails withXCTAssertEqual failed: ("1234") is not equal to ("0")(https://github.com/Dev-next-gen/Sparkle/actions/runs/34736708106)SUAppcastTesttests pass (https://github.com/Dev-next-gen/Sparkle/actions/runs/34736718659)I did not run it on a local Mac.
macOS version tested: macOS 26 (GitHub Actions runner)