Changing the developer ID *and* EdDSA key at the same time

[davidmokos]

Hello,

We've migrated our app to a new developer account so the new update is signed with a different certificate. Based on the instructions here, specificaly

We recommend rotating keys only when necessary like if you need to change your Developer ID certificate

I assumed I need to also update the EdDSA private-public key pair, which I did and added the new public key to the Info.plist.

After generating the appcast (the sign_update --verify returns success) and uploading the dmg and appcast to server the update process fails here:

The update logs say this:

Error: The update is improperly signed and could not be validated. Please try again later or contact the app developer. (null) (URL (null))
Error: Update validation was a failure (null) (URL (null))
Error: The update archive has a new (Ed)DSA key that doesn't match the previous one, and the app is signed with a new Code Signing identity that doesn't match code signing of the original app. At least one method of signature verification must be valid. The update will be rejected. (null) (URL (null))
Error: Code signature of the new version doesn't match the old version: anchor apple generic and identifier "identifier" and ... Please ensure that old and new app is signed using exactly the same certificate.

Does that mean in order to update the app successfully I need to use the old EdDSA private-public key pair? Will that even work with the new Developer ID?

[zorgiepoo]

Does that mean in order to update the app successfully I need to use the old EdDSA private-public key pair? Will that even work with the new Developer ID?

Yes you use the old key. Don't change the EdDSA key pair. You don't really have a reason to do so.

I assumed I need to also update the EdDSA private-public key pair, which I did and added the new public key to the Info.plist.

I don't know why you made this assumption. Sparkle's EdDSA key verification is independent from the Apple developer ID you use. Key rotation is such that you change either one of them, not both.

[davidmokos]

Thank you for your reply. The assumption was based on this sentence: We recommend rotating keys only when necessary like if you need to change your Developer ID certificate

Will try repeating the process with the old EdDSA key pair and will report