Bug: rando "Insecure Update error!"

[lucasgonze]

Summary

As a Mac user, I get "Insecure update error!" alerts with no context that would allow me to fix the problem. The message "you need to code sign your application or sign your updates with a DSA key", but I am not getting this message with regard to my application and I have no way to know which application is causing the problem.

There are many instances of other users reporting the same problem.

The problem occurs regularly. Dismissing the alert does not fix it. It is a perma-bug in my system.

Possible Fix

Option 1: state the relevant app in the message

Option 2: create public documentation for whatever I would need to do

Option 3: console.log diagnostics

Option 4: create a file with a well known name that flags the instance of Sparkle

Version

N/A

[zorgiepoo]

This is some old version of Sparkle and probably some app that runs in the background. I can't find these strings in the repo. You'll have to find which app it is whether it is digging through your Console logs or going in Activity Monitor or what else. It helps to attach screenshots for issues like this.

Meanwhile I should check we include the app name in situations like this going forward.

[fuzzy76]

Which exact logs should I look at, and what kind of strings should I search for? I could not find anything.
Here is a screenshot that I doubt will help anyone:

[lucasgonze]

Meanwhile I should check we include the app name in situations like this going forward.

How did that come out? Did you find that the problem will not exist going forward?

[zorgiepoo]

I put the name of the app in a different worded generic dialog in 2.8.1 I believe (there's been no message reports of versions that have EdDSA support or are >= 2.0, afaik)

[zorgiepoo]

For @fuzzy76 's screenshot I can tell that case is also from a pretty old version of Sparkle before EdDSA support was added (before Sparkle 1.21).

#2779 (reply in thread)
#2779 (reply in thread)

may be of some help finding the process. I don't know the definitive best way to pinpoint it. Ask yourself if you installed any background dock-less/menu-bar running apps/services, and if you had any app cleaning software that may have caused this, though.

[zorgiepoo]

See #1601 for the specific issue you're encountering

[zorgiepoo]

I doubt developers are holding on to old versions. Package managers are more likely culprits

Many apps hold onto old versions of Sparkle (despite security fixes and all).. Sparkle also has a lot of usage outside of package managers too (like via a submodule or just a downloaded binary framework), so developers can have a frozen version of Sparkle until the next time they remember to consider updating it. I'm not sure what the default auto-update dependency rules are for package managers like cocoa pods or catharge, but in any case developers may want to validate updates before automatically upgrading too, and upgrading Sparkle is not often on the top of their list. The problem is not so much "where old versions are being served"; once they bundle an old version, not much can be prevented from it being used as long as It Aint Broken. The other issue is in this kind of case it's possible the developer did update Sparkle, just that for whatever reason the user has an old version of their app running.

Check live processes in Activity Monitor. Have "All Processes" checked in View menu. If you have Xcode installed you may be able to use Accessibility Inspector and inspect the alert window. Check your login / startup items in System Settings. Maybe check in these directories

~/Library/LaunchAgents/
/Library/LaunchAgents/
/Library/LaunchDaemons/

If you leave Console.app running and streaming for logs you may be able to search for "Sparkle" but I'm not sure.

Ask around or an LLM how to find what app that is hiding itself from the dock and menu bar is presenting a NSAlert on the screen.

That commit is not related to the error message you raised. (Not like it matters).

[zorgiepoo]

https://github.com/sparkle-project/Sparkle/releases/tag/1.22.0rc1 was the first release with the fix to the error message you are seeing I believe.

[lucasgonze]

So, here is a note to developers stumbling on this thread when their users complain about the message:

make sure you are using at least 1.22.0rc1.

[fuzzy76]

I tried the accessibility inspector. Unfortunately, it is not able to inspect modals. It only gave me data for whatever window was behind the dialog box. :(

[zorgiepoo]

Maybe https://github.com/sjitech/mac_list_windows_pids would help, requires installing some pyobjc dependencies

[lucasgonze]

Next, let's work on a method for identifying which program is throwing the error. Here is the result of my system scan, which took about three hours.

A text version of that is at https://gist.github.com/lucasgonze/f55a1f856551b16c2b84e0f0d7d67f6e

Can we be sure the outdated Sparkle is in that list? Is there any way for it to hide from that find command?

Unfortunately, the find results above do not indicate the stale copy is part of Firefox. That hit is based on the browser's cache of this conversation:

:-)

That leaves only these candidates:

/System/Volumes/Data/Users/lucasgonze/Library/Preferences/com.apple.finder.plist
/Users/lucasgonze/Library/Preferences/com.apple.finder.plist

And, unfortunately, those are also artifacts of my attempt to find the source: they use the key SGTRecentFileSearches, which stores recent searches in Finder.

So, find and mkfind are dead ends.

If you leave Console.app running and streaming for logs you may be able to search for "Sparkle" but I'm not sure.

No luck so far

[zorgiepoo]

I think searching for Insecure update error! is not a good way to find the app (it doesn't seem to be in any string files). May be better to search for all Sparkle.framework on your system, optionally filtering the CFBundleVersion but may not be needed. Firefox has never used Sparkle.

Otherwise use the other methods I mentioned.

[lucasgonze]

No luck using any of the methods you mentioned, except that I didn't have Xcode installed (or the disk space to install it) so couldn't use Accessibility Inspector and inspect the alert window.

You're sure there are no detectable Sparkle artifacts to hunt for? No file, shared library, binary blob, or string?

The only (non-Xcode) method we haven't eliminated is uninstalling apps one by one.

[lucasgonze]

I have made the alert go away by deleting applications. The cause was one of these:

(list of 11 apps)

[fuzzy76]

I would assume that if I opened a suspected app, chose "check for updates", and it didn't fail, that would mean that app was innocent?

[zorgiepoo]

That should be correct. I also think there's a high chance it's some helper app not in /Applications as I said above.
The app icon in the screenshot you attached is also kind of telling, that the app bundle could be very malformed / stripped already.

[fuzzy76]

find ~/Library -name Sparkle.framework|while read f; do version=$(plutil -extract CFBundleVersion raw -o - "${f}/Resources/Info.plist") && echo $version – $(echo $f|cut -f 3 -d /) ; done returned nothing 🤷‍♂️ and the only app in /Applications using Sparkle < 1.22 was not running (Gas Mask).

[fuzzy76]

Found it. It was a partially uninstalled instance of Unlox(abandonded app). For anyone else coming here: the solution was what @zorgiepoo suggested two weeks ago: when the dialog comes up, leave it up and close one app at a time until it disappears. First those in the dock, then those in the menubar and lastly those left in the activity monitor that does not seem to belong to the system.

[lucasgonze]

And possibly share what app and version it was so that others can look it up.