Skip to content

Fix reading release notes content length from appcast - #2921

Merged
zorgiepoo merged 1 commit into
sparkle-project:2.xfrom
Dev-next-gen:fix-release-notes-length
Sep 13, 2026
Merged

zorgiepoo merged 1 commit into
sparkle-project:2.xfrom
Dev-next-gen:fix-release-notes-length

Conversation

@Dev-next-gen

Copy link
Copy Markdown
Contributor

While reading how release notes signatures are verified, I noticed that SUAppcast stores the sparkle:length attribute of <sparkle:releaseNotesLink> in the link dictionary under the SUAppcastAttributeLength key (sparkle:length), but SUAppcastItem reads it back with @"length". That lookup always returns nil, so releaseNotesContentLength is always 0, even for feeds generated by generate_appcast or sign_update, which both emit sparkle:length on the release notes link.

The effect is limited to diagnostics: SPUReleaseNotesDriver passes that length to SPUVerifierInformation, and SUSignatureVerifier only adds its "expected content length differs from the downloaded file length" hint when the expected length is non-zero. So when release notes fail validation, that hint never shows up today. Verification itself doesn't use the length, so nothing about acceptance or rejection changes.

The fix reads the value with SUAppcastAttributeLength, the same constant the parser writes with. I added sparkle:length="1234" to the first release notes link in test-links.xml and checked releaseNotesContentLength in testLinks (1234 for that item, 0 for an item without the attribute). That needed SUAppcastItem+Private.h in the unit test bridging header.

This change was found, written and tested with an AI coding assistant (Claude Code): it traced the key mismatch between SUAppcast.m and SUAppcastItem.m, wrote the test, and ran it before and after the fix on CI. The diff is small (one line of code plus the test), and I checked it against the parser and verifier code paths described above.

Misc Checklist

  • My change requires a documentation update on Sparkle's website repository
  • My change requires changes to generate_appcast, generate_keys, or sign_update
  • My change was generated/assisted using AI and if so was reviewed by me in whole (explain in detail in the summary)

Testing

I tested and verified my change by using one or multiple of these methods:

  • Sparkle Test App
  • Unit Tests
  • My own app
  • Other (please specify)

I ran SUAppcastTest on a GitHub Actions macos-26 runner (Xcode 26.6) on my fork, with a workflow reduced to building the unit tests and running that class:

I did not run it on a local Mac.

macOS version tested: macOS 26 (GitHub Actions runner)

@zorgiepoo zorgiepoo modified the milestones: 2.11.0, 2.10.0 Sep 13, 2026
@zorgiepoo

Copy link
Copy Markdown
Member

Thank you.

@zorgiepoo
zorgiepoo merged commit 7565a07 into sparkle-project:2.x Sep 13, 2026
2 checks passed
super-original pushed a commit to SakuraCordApp/Sparkle that referenced this pull request Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants