Trust and updates

Every Sparky release is signed.

Sparky 3 updates itself over the air, like your phone and your computer do. Before it installs anything, it checks that the update really came from Sparky's maker and that not a single byte was changed on the way.

How an update reaches you

1. Mohith publishes a new version. A small list of what's in it (the manifest) is signed with Sparky's private release key, which never leaves his computer.
2. Sparky checks for updates quietly: when it opens, then every six hours. It downloads the manifest from sparky-code.web.app/updates/.
3. Sparky checks the manifest's Ed25519 signature against the public key built into the app. A wrong signature means nothing gets installed.
4. It downloads the update and checks its SHA-256 against the signed manifest. One wrong byte, and the file is thrown away.
5. When it's ready you'll see Restart to update. Most updates are small "code packs" of a few hundred kilobytes, because Python and Qt don't need to download again.
6. If a new version ever fails to start, Sparky goes back to the last version that worked by itself and tells you.

Sparky's public key

Check a download yourself

Each release comes with SHA256SUMS.txt and its signature SHA256SUMS.txt.sig. With OpenSSL 3 (built into most Macs and Linux computers):

openssl pkeyutl -verify -pubin -inkey release-key.pem -rawin \
    -in SHA256SUMS.txt -sigfile SHA256SUMS.txt.sig
shasum -a 256 -c SHA256SUMS.txt --ignore-missing

The first command should say Signature Verified Successfully, and the second should print OK next to the file you downloaded.

What isn't signed by Apple or Microsoft

Apple notarization and Windows code-signing certificates cost money every year, so the very first install still shows a warning: on a Mac, open System Settings → Privacy & Security and press Open Anyway; on Windows, press More info → Run anyway. After that first install, every update is checked by Sparky's own signature as described above.