Make AppCastGenerator multi-platform + add ed25519 support

[mphill]

I have NetSparkle working with MacOS now but I am having a rough time trying to to include a reference to Xamarin.Mac in the NetSparkle project.

For some reason VS does not want to let me correctly add a reference to Xamarin.mac.

I had to make WebRequestAppCastDataDownloader public in order to expose TrustEverySSLConnection

return sslPolicyErrors == SslPolicyErrors.None && certificate is X509Certificate2 cert2 && cert2.Verify();
Specifically cert2.Verify() crashes on MacOS/Mono - so I am bypassing it for now. Since the class was private I could not set the variable outside of the class, and there was no way to do it from code.

In the mean time, I made a large refactor to the AppCastGenerator to make it work with windows, mac and linux, and work with any extension (zip, dmg, exe, tar.gz) and some enhancements to help it integrate with github releases, like https://github.com/NetSparkleUpdater/NetSparkle/releases

I tried to see how far I could get with https://github.com/NetSparkleUpdater/NetSparkle/releases.atom but the atom feed is little light on detail.

See

sparkle-project/Sparkle#648

It's a BIG refactor. All of the parameters have changed, there are many more options too.

Update:

AppCastGenerator now used ed25519 and supports generating and verifying signatures

[Deadpikle]

Oh wow, thanks so much for your work. It will take me a few days to look at this probably, but thank you for contributing!

I'll try to look at the Xamarin.Mac thing too. I do have a Mac on hand and can take a look, I think. Perhaps if the project were created on macOS then referenced from the SLN manually? I'm not opposed to having a separate SLN if we have to. I did a quick test, and a Xamarin library project can reference the latest previews of NetSparkle on macOS, so it should be possible...

[Deadpikle]

Hi!

After some research, I would rather not use NSec.Cryptography here. Notably, it isn't very compatible with .NET Framework and forces users to use x86 or x64 instead of AnyCPU.

I also second-guessed using Chaos.NaCl due to the low level of testing it has had. It has some unit tests, but there are other more well-used/supported frameworks.

So, I did some legwork, and now there is an Ed25519Checker in the main repo that uses BouncyCastle instead. I added a unit test to do a quick verification that it works. The Ed25519Checker does expect the public key to be in base 64, which I believe is similar to Sparkle. I did run tests on macOS, and things check out there. Not all of BouncyCastle works on macOS/Linux, but I believe (??) the ed25519 stuff does.

Please use BouncyCastle instead. Here is some sample code:

Create public/private key pair:

private static readonly SecureRandom Random = new SecureRandom();

Ed25519KeyPairGenerator kpg = new Ed25519KeyPairGenerator();
kpg.Init(new Ed25519KeyGenerationParameters(Random));

AsymmetricCipherKeyPair kp = kpg.GenerateKeyPair();
Ed25519PrivateKeyParameters privateKey = (Ed25519PrivateKeyParameters)kp.Private;
Ed25519PublicKeyParameters publicKey = (Ed25519PublicKeyParameters)kp.Public;
var privKeyBase64 = Convert.ToBase64String(privateKey.GetEncoded());
var pubKeyBase64 = Convert.ToBase64String(publicKey.GetEncoded());
// write keys to file as needed

Import key:

var publicKey = "base 64 encoded public key";
var signer = new Ed25519Signer();
byte[] pubKeyBytes = Convert.FromBase64String(publicKey);
var cipherParams = new Ed25519PublicKeyParameters(pubKeyBytes, 0);
signer.Init(false, cipherParams);

Sign:

// create signature for item
byte[] msg = new byte[Random.NextInt() & 255]; // byte array of data to sign
Random.NextBytes(msg); // just creating byte array
var signer = new Ed25519Signer();
signer.Init(true, privateKey);
signer.BlockUpdate(msg, 0, msg.Length);
byte[] signature = signer.GenerateSignature();
var signatureForAppCast = Convert.ToBase64String(signature); // output for app cast in base 64

[Deadpikle]

Thanks for all this work, here! This is really great and will make this project a whole lot better.

Once you've made the requested changes, I'll run some more tests on my end before merging.

[mphill]

It's going to take me some time to figure out bouncycastle and get that integrated. That's too bad about NSec, it's a solid project.

[Deadpikle]

If you want, I can do that and send a PR to your repo? Mostly it's just some changes to the sample code I posted above. There's already an ed25519 checker that uses BouncyCastle in this repo.

[mphill]

The problem is I keep getting Unable to create package spec for project. '/Projects/NetSparkle/src/NetSparkle.UI.WPF/NetSparkle.UI.WPF.csproj' on MacOS so I have to unload all the Windows projects, that is definitely why the guids are all messed up

With BouncyCastle: Package 'BouncyCastle 1.8.6.1' was restored using '.NETFramework,Version=v4.6.1, .NETFramework,Version=v4.6.2, .NETFramework,Version=v4.7, .NETFramework,Version=v4.7.1, .NETFramework,Version=v4.7.2, .NETFramework,Version=v4.8' instead of the project target framework '.NETCoreApp,Version=v3.0'. This package may not be fully compatible with your project.

I have to use the portable version.

I will try to integrate it quickly.

[Deadpikle]

Yeah, Portable.BouncyCastle is what I am using in the main repo right now, so that's the one to use.

[mphill]

I removed my verifier from the main project, it will need to be redone with bouncy, however the rest of the comments should be resolved in the last commit.

[mphill]

Looks like you did that work already!! So glad I didn't!!! Haha. I resolved the merge conflicts.

[Deadpikle]

Things are looking fairly good. I am working on writing some tests and some small tweaks but it will be merged soon. :) Thank you!

[mphill]

Where do people normally host appcasts? Would it be worth file to include AWS/Azure uploading?

i.e. appcast_generator --publish --target aws

[Deadpikle]

@mphill Thank you so much for all your contributions. I have merged in your code along with a few extra features/tests. I also updated the README for some extra clarification.

As far as where people host app casts, I have never asked. I can see the use for such a feature, but I definitely am not going to worry about that for 2.0.0 and won't merge any PR for that right now. If you'd like to file an issue for discussion on that idea, please do.