From b4ef4df4531bf82d6edbb0f5edc9dd9d01c0af7c Mon Sep 17 00:00:00 2001 From: Zorg Date: Sat, 2 Jul 2022 17:13:35 -0700 Subject: [PATCH] Add note about keeping private keys safe (#153) --- documentation/index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/documentation/index.md b/documentation/index.md index 2b14b44..bf331a0 100644 --- a/documentation/index.md +++ b/documentation/index.md @@ -89,6 +89,8 @@ Since Sparkle is downloading executable code to your users' systems, you must be * [Updates of preference panes and plugins](/documentation/bundles/) *must* be signed with EdDSA. * Updates to regular application bundles that are signed with Apple's Developer ID program are strongly recommended to be signed with EdDSA for better security and fallback. Sparkle now deprecates not using EdDSA for these updates. +Please ensure your signing keys are kept safe and cannot be stolen if your web server is compromised. One way to ensure this for example is not having your signing keys accessible from the machine that is hosting your product. + #### EdDSA (ed25519) signatures To prepare signing with EdDSA signatures: