They should not be bundle IDs because they may surface up in the UI.
Particularly, the Installer XPC Service may show up in the authorization prompt when authorization is required to install an update.
For development we should include task-get-allow entitlements. For distribution if people use custom workflows, they need to properly re-sign the app without preserving this entitlement
The workflow assumes changelog and version information have been updated and the tag has not been created yet before running it. When the workflow finishes, it should take you to a release page with the uploaded binaries, where you can verify the final details and publish a tag officially.
Also the following improvements were made:
* Change CURRENT_PROJECT_VERSION to represent a monotonically increasing bundle version (starting at 2000)
* Add MARKETING_VERSION to represent marketing version of Sparkle, comprised of SPARKLE_VERSION_MAJOR, SPARKLE_VERSION_MINOR, SPARKLE_VERSION_PATCH, and the new SPARKLE_VERSION_SUFFIX for pre-releases.
* Verify code signing signatures of extracted SPM zip file in make release and CI
* Generate changes to Sparkle podspec, just like the Package.swift file, based on current marketing version
* Improve format of Info.plist version strings when appending git hash info, eliminating unnecessary whitespace
* Simplify validating that XPC Service versions align with framework version
* Handle lightweight tags in addition to annotated tags in release-move-tag.sh
In some cases for shared headers in downloader XPC Service or generate_appcast / sign_update tools, I had to do a little dance for using double quote imports.
Add entitlements to InstallerConnection and InstallerStatus services and add option to specify bundle id in the now renamed codesign_xpc_service.py script.
Only check and update tag in Package.swift when not running a CI build. As long as GitHub actions are reserved for tests, this should be ok as this is a "fake" update of Package.swift anyway. If you ever use GitHub actions for releases, you'll probably have to rethink the tagging logic once again
Improves prompt asking to force move tag (default is NO, but can be triggered after `make release`). Fixes issues with single quotes in make-release-package.sh.
We now use XPC for communication between Sparkle.framework and Autoupdate.
Autoupdate is now ran as a launchd agaent/daemon. (Most of the time, it acts as an agent).
Using XPC can only be done from non-sandboxed processes, so a connection and status service had to be created.
Currently, the GUI progress tool doesn't work properly, but everything else should be behaving like before.
Zorg
Tony Arnold
Jonas Zaugg
Gwynne Raskind
Andrey Teologov
Karl Moskowski
Kornel Lesiński
Jake Petroules