Force Sparkle updater to always verify update and to use signed appcast

ychin · ychin · commit 1224d0f58650 · 2026-04-06T17:01:21.000-07:00
Sparkle 2.9 introduced the ability to verify appcast feeds using a signature. Turn that on to prevent MITM attacks. This requires the appcast on the server side to be re-generated with signature at the end. This was done in macvim-dev/macvim-dev.github.io#5.
diff --git a/src/MacVim/Info.plist b/src/MacVim/Info.plist
@@ -1311,6 +1311,10 @@
 	</array>
 	<key>MMWhatsNewURL</key>
 	<string>https://macvim.org/release-notes/whatsnew.html</string>
+	<key>SUVerifyUpdateBeforeExtraction</key>
+	<string>YES</string>
+	<key>SURequireSignedFeed</key>
+	<string>YES</string>
 	<key>SUEnableJavaScript</key>
 	<string>YES</string>
 	<key>SUFeedURL</key>
