Repository navigation
feat(update): install new versions in place with Sparkle - #3
Merged
Merged
Conversation
Picnest checks for a new version 1 time a day, asks before it installs, and
replaces the app in /Applications. An update skips the Open Anyway prompt that a
fresh DMG needs, because Sparkle does not quarantine its download. The sessions
in Application Support do not change.
- project.yml: add the Sparkle 2 package and the disable-library-validation
entitlement, set the SU* Info.plist keys, and regenerate Picnest.xcodeproj.
- Picnest: start the updater in AppDelegate, except in the test host, and add
Picnest > Check for Updates… to the menu.
- scripts: add make-appcast.sh. It signs each archive, makes the delta updates,
and writes docs/appcast.xml for GitHub Pages.
- Tests: the test host starts no updater. The existing quit guard already stops
an install while a sort runs.
- Docs: README, BUILD.md, and the design spec section 8 and risks 8 and 11.
thanhnh98
approved these changes
Oct 27, 2026
thanhnh98
left a comment
thanhnh98
left a comment
Collaborator
There was a problem hiding this comment.
The Sparkle integration is generally well structured, and both application tests and all 319 PicnestCore tests pass locally.
I left five follow-up comments covering production signing, MainActor isolation, dependency pinning, automatic-update semantics, and test coverage. Please address these before the production release.
GitHub CI is currently red with two core-test issues, while a clean local rerun passed all 319 tests. Please rerun or investigate the failing job before merging.
At the time of review, both the configured appcast URL and the GitHub updates release return 404, so scheduled and manual checks cannot find an update yet. Suggested release checks:
- Enable GitHub Pages for
/docs. - Generate and commit
docs/appcast.xml. - Create the
updatesrelease and upload the signed archives and delta files. - Add a smoke check that fails when the published appcast or its enclosure URLs are unavailable.
- Perform one end-to-end update from an older installed build before publishing.
- Keep library validation on in Release; only Debug disables it. - Read canCheckForUpdates from the KVO change, not off the main actor. - Put the updater behind an AppUpdater protocol and test the positive path with a fake. - Commit Package.resolved to pin Sparkle 2.10.0. - Set SUAllowsAutomaticUpdates to false so every install needs approval.
scripts/check-appcast.sh fails when the appcast or an enclosure URL returns an error. BUILD.md runs it after the feed is published and adds the end-to-end update test.
startNewSortWaitsUntilTheSortServiceIsIdle slept 50 ms and asserted a wait of at least 150 ms, which failed on a slow CI runner (52 ms). Poll until the blocking sort runs, then assert the sort is idle when startNewSort returns.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Picnest checks for a new version 1 time a day, asks before it installs, and replaces the app in /Applications. An update skips the Open Anyway prompt that a fresh DMG needs, because Sparkle does not quarantine its download. The sessions in Application Support do not change.
Changes
SU*Info.plist keys, and regeneratePicnest.xcodeproj.AppDelegate, except in the test host, and add Picnest > Check for Updates… to the menu.make-appcast.sh. It signs each archive, makes the delta updates, and writesdocs/appcast.xmlfor GitHub Pages.Test plan
AppDelegateTestspasses and the test host starts no updater.scripts/make-appcast.shagainst a signed archive and confirmdocs/appcast.xmlis written.