Upgrading from DSA to EdDSA signatures

This document describes how to migrate apps that used older, now deprecated DSA signatures to EdDSA without disruptions.

Add EdDSA signatures

1. Update WinSparkle bundled with the app to 0.9.0 or newer.

2. Generate an EdDSA key pair using winsparkle-tool generate-key (you can also use Sparkle’s key file, as they are compatible).

3. Add the EdDSA public key to the app, using win_sparkle_set_eddsa_public_key() or EdDSAPub resource.

4. Remove calls to win_sparkle_set_dsa_pub_pem() or use of the DSAPub resource and the DSA public key from the application.

5. Release the new version.

6. Going forward, add sparkle:edSignature to appcast enclosures in addition to existing sparkle:dsaSignature.

Following these steps ensures that older app versions will still be able to update to the latest version using DSA for validation, while the newer versions of the app will use EdDSA.

Fully migrating away from DSA

To fully migrate away from DSA and stop signing updates with DSA, you have two options:

1. Wait sufficiently long, until almost all users upgrade, or you don’t care that some are left behind.
2. Change the appcast feed URL in the new version of the app and stop publishing updates to the old URL. This will require users on old versions to update to future versions in two steps: by first updating to the last DSA-signed version in the old feed, then updating from it to the latest version available on the new feed.

Or don’t, and continue signing with DSA indefinitely.

WinSparkle will ignore both the DSA key and DSA signatures if it was provided with an EdDSA public key. This means that continuing to sign with DSA does not reduce the security of new versions of your app.

Additional links

1. macOS Sparkle’s docs on the subject with feed examples.
2. Discussion of DSA’s weaker security: e.g. here, here or here.