New server, Sparkle won't install new version

[JamesBucanek]

Greetings,

I hope this is the right place to ask. I have been using Sparkle since the dawn of civilization without any problems.

This last week, we migrated to a new server. The old server was running an ancient OS X Server, Apache, and Tomcat 6. The new server is Red Hat, Apache, and Tomcat 10. I know it shouldn't matter, but it's the only thing that changed!

My app is using Sparkle 2.3.1. The server has a Java Server Page that generates the RSS feed. When I run curl on the server, I get this:

<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
	<channel>
		<title>QRecall 3.0 Beta Program</title>
		<link>/QRecallWebEE/release/appcast-beta30.jsp</link>
		<description>QRecall beta releases</description>
		<language>en</language>
		<item>
			<title>Version 3.0.0(117) beta</title>
			<sparkle:releaseNotesLink>https://www.qrecall.com/release/upgradenotes.jsp?to=3.0b117&track=beta</sparkle:releaseNotesLink>
			<pubDate>Fri Apr 21 18:10:43 MST 2023</pubDate>
			<enclosure sparkle:version="3.0.0.117"
			sparkle:shortVersionString="3.0.0(117) beta"
				  sparkle:dsaSignature="MCwCFHWsHvSv8huFWLrKDfcw5EFGusDJAhRCcYzaAElLvbgLQ6id/ab7qIhjWg=="
								   url='https://www.qrecall.com/sc/qr/release/QRecall_3.0b117_update.dmg'
								length="96620544"
								  type="application/octet-stream" />
		</item>
	</channel>
</rss>

As far as I can tell, this is identical to the output of the feed page from the old server.

When I test the upgrade in my app, it finds the upgrade and displays the release notes.

But if I ask Sparkle to install the new app, I get an update error (Failed to extract update) and this error on the console:

[Sparkle] Error: No valid unarchiver for /Users/james/Library/Caches/com.qrecall.client/org.sparkle-project.Sparkle/PersistentDownloads/qYCzYcr6g/QRecall 3.0.0.117/QRecall_3.0b117_update.dmg.html!
[Sparkle] Error: Failed to extract update. (null) (URL (null))

So, has anybody seen this and might know how to fix it?

Does anyone have a threory about how .../QRecall_3.0b117_update.dmg gets changed to .../QRecall_3.0b117_update.dmg.html, or is that expected?

Any suggestions on how to debug this (i.e. how to step through the code and find the failure)?

P.S. I've also been considering changing the _update.dmg to a .zip of the application instead. If that would fix this, I can give that a try.

P.P.S. Oh, there is one (possibly big) change between the old server and the new one. The old server used mod_JK to tunnel Apache requests to the Tomcat application server, while the new server is using ProxyPass. However, the request for the disk image is a static file served directly by Apache (i.e. is not passed to Tomcat), so that shouldn't matter.

[zorgiepoo]

Sounds like a server side issue. Don’t know if it’s related to MIME type handling. Potentially zip may be handled correctly as it’s more popular.

[zorgiepoo]

Oh, also oddly, the url attribute you pasted from the feed is surrounded by single quotes instead of double quotes..

[JamesBucanek]

It turned out to be several problems. But ultimately the big problem was an obscure mod_security rule that decided to block Sparkle's access to the download URL, returning an HTML error page instead of the requested .dmg file, which is why the decode was failing.

One other problem: there was a singular & in the query portion of the release notes URL. It seemed to work OK when downloaded from the old server, but caused an XML parsing error when fetched from the new one. Replacing it with & fixed the problem.

All appears to be well now. Thanks again for a great product!