The update is improperly signed and could not be validated

[jontelang]

Hello. I am getting this error

The update is improperly signed and could not be validated

And I am not sure how to proceed.

I am using Sparkle through SPM, and I generate the appcast with ./generate_appcast seemingly without issues. If I run sign_update it seems to verify properly too.

./sign_update /path/to/zip.0.6.zip --verify qUy.XXXXX...XXXA==

I am archiving the app through Xcode, then I just export it and place the .app file in a .zip file and run the ./generate_appcast. After this I upload the files to my web server. Then I try to update from a lower version and I get that error.

The last lines in console is

2023-03-15 22:58:43.402147 +0700	Updater	found no value for key NSWindowShouldCacheStandardWindowButton in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.402406 +0700	Updater	found no value for key NSUpdateTrackingAreasWhileLiveResizing in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.402442 +0700	Updater	found no value for key NSUpdateTrackingAreasWhileScrolling in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.402590 +0700	Updater	found no value for key NSScreenDaisyLayout in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.402765 +0700	Updater	found no value for key NSCGSShouldDisableUpdates in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.403367 +0700	Updater	_CSCheckFix(11325124,org.sparkle-project.Sparkle.Updater/2021.2)=NOT-APPLIED
2023-03-15 22:58:43.403867 +0700	Updater	found no value for key NSCGSSyncCACGS in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.406119 +0700	Updater	CFDictionaryRef copyApplicationInformationDictionaryGivenASNUsingLocalCache(LSSharedMemoryPageConstRef, LSASNRef)(), information in shared memory with seed 522 was still valid, so using cached info { "CFBundleExecutablePathDeviceID"=16777222, "BundleIdentifierLowerCase"="org.sparkle-project.sparkle.updater", "DTXcodeBuild"="13F100", "CFBundleDevelopmentRegion"="en", "pid"=66936, "CFBundleExecutablePathINode"=141651535, "CFBundleSignature"="????", "CFBundleExecutable"="Updater", "Flavor"=3, "LSCheckInTime*"=now-ish 2023/03/15 22:58:43, "LSApplicationHasSignalledItIsReady"=true, "LSLaunchedHidden"=false, "LSASN"=ASN:0x0-0x5d05d0:, "LSExecutableFilenameLowerCaseKey"="updater", "DTSDKBuild"="21E226", "LSBundlePathINode"=141651530, "LSDYLDPlatformKey"=1, "LSPersistenceSuppressRelaunchAtLogin"=true, "ApplicationType"="UIElement", "LSDisplayName"="Updater", "LSApplicationCategoryType"="public.app-category.utilities", "NSPrincipalClass"="NSApplication", "LSBundlePathDeviceID"=16777222, "LSArchitecture"="x86_64", "LSAuditToken"=$F5010000F501000014000000F50100001400000078050100A78<…>
2023-03-15 22:58:43.406450 +0700	Updater	found no value for key NSViewBridgeBoolShouldLogOnBehalfOfCoreAnimation in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.410835 +0700	Updater	looked up value (
    "en-US",
    "sv-US",
    "th-US"
) for key AppleLanguages in CFPrefsPlistSource<0x6000014d5900> (Domain: kCFPreferencesAnyApplication, User: kCFPreferencesCurrentUser, ByHost: No, Container: (null), Contents Need Refresh: No) via CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.410917 +0700	Updater	looked up value (
    "en-US",
    "sv-US",
    "th-US"
) for key AppleLanguages in CFPrefsPlistSource<0x6000014d5900> (Domain: kCFPreferencesAnyApplication, User: kCFPreferencesCurrentUser, ByHost: No, Container: (null), Contents Need Refresh: No) via CFPrefsSearchListSource<0x6000014d8c00> (Domain: kCFPreferencesAnyApplication, Container: (null))
2023-03-15 22:58:43.411003 +0700	Updater	looked up value en_US for key AppleLocale in CFPrefsPlistSource<0x6000014d5900> (Domain: kCFPreferencesAnyApplication, User: kCFPreferencesCurrentUser, ByHost: No, Container: (null), Contents Need Refresh: No) via CFPrefsSearchListSource<0x6000014d8c00> (Domain: kCFPreferencesAnyApplication, Container: (null))
2023-03-15 22:58:43.411056 +0700	Updater	looked up value 0 for key AppleTextDirection in CFPrefsPlistSource<0x6000014d5b00> (Domain: kCFPreferencesAnyApplication, User: kCFPreferencesAnyUser, ByHost: Yes, Container: (null), Contents Need Refresh: No) via CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.411128 +0700	Updater	found no value for key NSForceLeftToRightWritingDirection in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.411190 +0700	Updater	found no value for key NSForceRightToLeftWritingDirection in CFPrefsSearchListSource<0x6000014d0b80> (Domain: org.sparkle-project.Sparkle.Updater, Container: (null))
2023-03-15 22:58:43.412134 +0700	Updater	Agent failed..
2023-03-15 22:58:43.412214 +0700	Updater	Error: Error: Agent Invalidating without having the chance to reply to installer (null) (URL (null))
2023-03-15 22:58:43.421890 +0700	Updater	Entering exit handler.
2023-03-15 22:58:43.421942 +0700	Updater	Exiting exit handler.

Similar threads #2252 and #2174. Neither seems to work for me, although I am not sure how to verify the cache thing he mentions.

[zorgiepoo]

There aren't any useful error logs pasted here. There should be more descriptive logs under your app's process name, or under Autoupdate process. You can grab the last five minutes of the logs via log show --last 5m > ~/Desktop/logs.txt if you want after reproducing the issue.

It could also potentially be an apple code signing issue. If it's an EdDSA signing issue then maybe the archive Sparkle is downloading isn't the same (eg a server caching issue). But this is pretty speculative until seeing useful error information.

[jontelang]

Thank you! I was able to find more details there that solved the issue.

The error I had was

Error: The update is improperly signed and could not be validated. Please try again later or contact the app developer. (null) (URL (null))
Error: Update validation was a failure (null) (URL (null))
Error: The update archive isn't signed with an EdDSA key, and the app is signed with a new Code Signing identity that doesn't match code signing of the original app. At least one method of signature verification must be valid. The update will be rejected. (null) (URL (null))
Error: Code signature of the new version doesn't match the old version: identifier "com.my.bundle.id" and anchor apple generic and certificate leaf[subject.CN] = "Apple Development: XXXXXXX XXXXXXXXXX (XXXXXXXXXX)" and certificate 1[field.1.2.840.113635.100.6.2.1] /* exists */. Please ensure that old and new app is signed using exactly the same certificate. old info: {
    build = "0.5";
    format = "app bundle with Mach-O thin (x86_64)";
    identifier = "com.my.bundle.id";
    requirements = "designated => identifier \"com.my.bundle.id\" and anchor apple generic and certificate leaf[subject.CN] = \"Apple Development: XXXXXXX XXXXXXXXXX (XXXXXXXXXX)\" and certificate 1[field.1.2.840.113635.100.6.2.1] /* exists */\n";
    "signing-time" = "2023-03-15 14:52:58 +0000";
    teamid = XXXXXXXXX;
    version = "0.5";
}. new info: {
    build = "0.8";
    format = "app bundle with Mach-O universal (x86_64 arm64)";
    identifier = "com.my.bundle.id";
    requirement<…>

The older 0.5 version was not sent through the notarization step, while the newer versions were, so I guess that was one difference. I also played around a lot with eg. tar vs zip, and so on. So that might have been another issue.

Solution

So I made two new updates in exactly the same way (archive -> notarize -> tar -> generate appcast) and then the update succeeded.

Much appreciated!