Merge pull request #71 from K9i-0/fix/sparkle-release-failure-investigation

K9i-0 · web-flow · commit 65a27afe54fc · 2025-07-06T16:13:49.000+09:00
Sparkle&#12398;&#32626;&#21517;&#29983;&#25104;&#12456;&#12521;&#12540;&#12434;&#20462;&#27491;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,12 @@ All notable changes to this project will be documented in this file.
 
 
 
+
+## [0.7.8] - 2025-07-06
+
+### Fixed
+- Sparkle&#32626;&#21517;&#29983;&#25104;&#12398;&#38750;&#25512;&#22888;&#12501;&#12521;&#12464;&#12434;&#20462;&#27491; (generate-appcast.sh, sign-update.sh)
+
 ## [0.7.7] - 2025-07-06
 
 ### Fixed
diff --git a/Info.plist b/Info.plist
@@ -17,9 +17,9 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>0.7.7</string>
+	<string>0.7.8</string>
 	<key>CFBundleVersion</key>
-	<string>0.7.7</string>
+	<string>0.7.8</string>
 	<key>CcusageVersion</key>
 	<string>15.3.0</string>
 	<key>LSMinimumSystemVersion</key>
diff --git a/scripts/generate-appcast.sh b/scripts/generate-appcast.sh
@@ -53,7 +53,7 @@ echo "Generating signature for $DMG_PATH..."
 # Write private key to temporary file with secure permissions
 PRIVATE_KEY_FILE="$TEMP_DIR/private_key.txt"
 (umask 077 && echo "$SPARKLE_PRIVATE_KEY" > "$PRIVATE_KEY_FILE")
-SIGNATURE=$("$SIGN_UPDATE" -s "$PRIVATE_KEY_FILE" "$DMG_PATH" | awk '/sparkle:edSignature=/ {print $2}' | tr -d '"')
+SIGNATURE=$("$SIGN_UPDATE" -f "$PRIVATE_KEY_FILE" -p "$DMG_PATH")
 
 # Immediately remove the private key file after use
 rm -f "$PRIVATE_KEY_FILE"
diff --git a/scripts/sign-update.sh b/scripts/sign-update.sh
@@ -46,7 +46,12 @@ fi
 
 # Generate EdDSA signature
 echo "Generating signature for $FILE_TO_SIGN..."
-SIGNATURE=$("$SIGN_UPDATE" -f "$SPARKLE_PRIVATE_KEY" "$FILE_TO_SIGN" | tail -1)
+# Write private key to temporary file with secure permissions
+PRIVATE_KEY_FILE="$TEMP_DIR/private_key.txt"
+(umask 077 && echo "$SPARKLE_PRIVATE_KEY" > "$PRIVATE_KEY_FILE")
+SIGNATURE=$("$SIGN_UPDATE" -f "$PRIVATE_KEY_FILE" -p "$FILE_TO_SIGN")
+# Immediately remove the private key file after use
+rm -f "$PRIVATE_KEY_FILE"
 
 if [ -z "$SIGNATURE" ]; then
     echo "Error: Failed to generate signature"
