mirror of
https://github.com/sparkle-project/Sparkle.git
synced 2025-11-01 15:34:38 +00:00
Zorg
fc4f8cb753
* For the Installer and Downloader XPC Services, if these executables are code signed with an Apple issued Team ID, then the connecting client must also be code signed with a matching Team ID. * For the Downloader XPC Service, the request URL must be http/https * For Autoupdate, if stage 1 of installation hasn't been completed yet and this executable is code signed with an Apple issued Team ID, then the connecting client must also be code signed with a matching Team ID. As before, multiple simultaneous connections are still disallowed. * For Autoupdate, if it's not signed with Apple issued certificate, when installing package updates the bundle being updated must be itself and owned by root on disk (as one expects from a PKG installation) * The authorization prompt message in the Installer Service is more computed inside the service so the client can't pass a completely arbitrary message * Add extra nullable checking of parameters coming from XPC endpoints * Add more thread-safe synchronization for Autoupdate installer * Add logs for more failure points