Bug: rando "Insecure Update error!"

[lucasgonze]

Summary

As a Mac user, I get "Insecure update error!" alerts with no context that would allow me to fix the problem. The message "you need to code sign your application or sign your updates with a DSA key", but I am not getting this message with regard to my application and I have no way to know which application is causing the problem.

There are many instances of other users reporting the same problem.

The problem occurs regularly. Dismissing the alert does not fix it. It is a perma-bug in my system.

Possible Fix

Option 1: state the relevant app in the message

Option 2: create public documentation for whatever I would need to do

Option 3: console.log diagnostics

Option 4: create a file with a well known name that flags the instance of Sparkle

Version

N/A

[zorgiepoo]

This is some old version of Sparkle and probably some app that runs in the background. I can't find these strings in the repo. You'll have to find which app it is whether it is digging through your Console logs or going in Activity Monitor or what else. It helps to attach screenshots for issues like this.

Meanwhile I should check we include the app name in situations like this going forward.

[zorgiepoo]

See #1601 for the specific issue you're encountering

[lucasgonze]

As much as documentation goes, that is just users using their search engine or searching in this repo and finding

Nobody has a workaround, so search engines do not yield one.

going forward on our side is 1, making sure messages like this state the relevant app

Not possible because you can't update users to the fixed version

It's not possible to block developers from holding onto old version of Sparkle

I doubt developers are holding on to old versions. Package managers are more likely culprits.

Devs rev to newer versions of libraries much faster than this. The fixed version has been out since at least 2019, right? Six years is more than enough.

Question 1: What is the last semver containing the problem?
Question 2: Which distribution points might still have the old package?

you probably have some corrupt app on your system. ... it would probably be even worse if no alert occurred

I will continue in my efforts to find and destroy whatever it is. This has been running for about 2 hours with no output yet:

"sudo find / -type f -exec grep 'Insecure Update error!' "{}" ; -print 2>/dev/null"

Is there some other flag I can use to identify the Sparkle component on my system? BTW, hunting for such a flag is a way of finding a workaround.

[lucasgonze]

OMG you fixed this in 2016! It must bug you so much to be having this conversation.

[zorgiepoo]

I doubt developers are holding on to old versions. Package managers are more likely culprits

Many apps hold onto old versions of Sparkle (despite security fixes and all).. Sparkle also has a lot of usage outside of package managers too (like via a submodule or just a downloaded binary framework), so developers can have a frozen version of Sparkle until the next time they remember to consider updating it. I'm not sure what the default auto-update dependency rules are for package managers like cocoa pods or catharge, but in any case developers may want to validate updates before automatically upgrading too, and upgrading Sparkle is not often on the top of their list. The problem is not so much "where old versions are being served"; once they bundle an old version, not much can be prevented from it being used as long as It Aint Broken. The other issue is in this kind of case it's possible the developer did update Sparkle, just that for whatever reason the user has an old version of their app running.

Check live processes in Activity Monitor. Have "All Processes" checked in View menu. If you have Xcode installed you may be able to use Accessibility Inspector and inspect the alert window. Check your login / startup items in System Settings. Maybe check in these directories

~/Library/LaunchAgents/
/Library/LaunchAgents/
/Library/LaunchDaemons/

If you leave Console.app running and streaming for logs you may be able to search for "Sparkle" but I'm not sure.

Ask around or an LLM how to find what app that is hiding itself from the dock and menu bar is presenting a NSAlert on the screen.

That commit is not related to the error message you raised. (Not like it matters).

[zorgiepoo]

https://github.com/sparkle-project/Sparkle/releases/tag/1.22.0rc1 was the first release with the fix to the error message you are seeing I believe.

[lucasgonze]

So, here is a note to developers stumbling on this thread when their users complain about the message:

make sure you are using at least 1.22.0rc1.

[lucasgonze]

Next, let's work on a method for identifying which program is throwing the error. Here is the result of my system scan, which took about three hours.

A text version of that is at https://gist.github.com/lucasgonze/f55a1f856551b16c2b84e0f0d7d67f6e

Can we be sure the outdated Sparkle is in that list? Is there any way for it to hide from that find command?

Unfortunately, the find results above do not indicate the stale copy is part of Firefox. That hit is based on the browser's cache of this conversation:

:-)

That leaves only these candidates:

/System/Volumes/Data/Users/lucasgonze/Library/Preferences/com.apple.finder.plist
/Users/lucasgonze/Library/Preferences/com.apple.finder.plist

And, unfortunately, those are also artifacts of my attempt to find the source: they use the key SGTRecentFileSearches, which stores recent searches in Finder.

So, find and mkfind are dead ends.

If you leave Console.app running and streaming for logs you may be able to search for "Sparkle" but I'm not sure.

No luck so far

[zorgiepoo]

I think searching for Insecure update error! is not a good way to find the app (it doesn't seem to be in any string files). May be better to search for all Sparkle.framework on your system, optionally filtering the CFBundleVersion but may not be needed. Firefox has never used Sparkle.

Otherwise use the other methods I mentioned.

[lucasgonze]

No luck using any of the methods you mentioned, except that I didn't have Xcode installed (or the disk space to install it) so couldn't use Accessibility Inspector and inspect the alert window.

You're sure there are no detectable Sparkle artifacts to hunt for? No file, shared library, binary blob, or string?

The only (non-Xcode) method we haven't eliminated is uninstalling apps one by one.

[lucasgonze]

I have made the alert go away by deleting applications. The cause was one of these:

(list of 11 apps)

[lucasgonze]

Still not fixed. Today I removed six more programs - we'll see if that made any difference.

Sparkle is a huge problem. It's as bad as malware, though unintentionally. I will probably have to nuke the whole OS to get rid of it.

[pajp]

Can you run the following to check Sparkle version number of all apps using Sparkle in /Applications?

find /Applications -name Sparkle.framework|while read f; do version=$(plutil -extract CFBundleVersion raw -o - "${f}/Resources/Info.plist") && echo $version – $(echo $f|cut -f 3 -d /) ; done

On my computer I find at least VLC.app shipping an old version, but not sure what those 2000+ version numbers are, maybe those developers reversion Sparkle with their own build numbers in their build system.

1.16.0 – VLC.app
2027 – CrossOver.app
1.26.0 – Loopback.app
2045 – ChatGPT.app
2019 – WhatsApp.app
218 – Micro.blog.app

[zorgiepoo]

In addition to that, I would not limit your search to only /Applications. Also it's malware or misbehaving (e.g. cleaner type) app that probably caused this, not Sparkle. Additionally I would look at the list of your Activity Monitor processes (enabling showing All Processes) while the issue occurs and pay attention to any of them that are hidden from the dock/menu bar.. For example from an older thread for one person it was an old version of Karabiner.

[zorgiepoo]

but not sure what those 2000+ version numbers are

Later versions of Sparkle transitioned to CFBundleVersion numbers like this (>= 2000 is 2.x). They are higher, so it shouldn't be an issue comparing them. And you can still look at the CFBundleShortVersionString