Using Keygen Ed25519 keys with Sparkle on macOS?

[czottmann]

Hi, I'm a bit rusty in the cryptography department 😅 so I came here to ask for an answer. Both Keygen and Sparkle ask me to generate a Ed25519 key pair. keygen upload lets me sign my artifacts, and the docs say:

When the --signing-key flag is provided, the release will be signed using Ed25519ph (with the option to sign using Ed25519 instead, for compatibility with tools like Sparkle).

Sparkle's generate_appcast also allows me to sign the items in my Appcast XML, also with an Ed25519 key.

I think both keygen upload and generate_appcast should use the same key but the length of the generated private keys is different. Am I wrong? If not, then what am I missing, and how would I proceed here?

Thanks in advance!

[ezekg]

You should be able to share your keys, yes. This would also make it easier to migrate from generate_appcast to Keygen's sparkle engine when the time comes (not currently being worked on, but it's on the roadmap).

I'm not sure what format Sparkle expects for the keys. Do you have an example of what the private and public keys look like? Keygen formats keys in hexadecimal, which is the standard for Ed25519. Perhaps Sparkle expects a different format, e.g. PEM, DER, or even base64. If I could see an example of what the keys look like, I may be able to help more.

[czottmann]

Sure thing. Sparkle's generate_keys generated the following (for my demo purposes):

• private: A4F3iA04bYifv4sMZ8GCIz5yHAZtQMEV7k9BkBGTvy0
• public: GAbV9EnJrK2vXOkb/PVew6GtMMfP/UL6Kj97qUY4j98=

Thanks in advance!

[ezekg]

Looks like Sparkle is base64 encoding the Ed25519 keys. You can likely convert the hex keys generated via the Keygen CLI to base64 for use in Sparkle, barring any other Sparkle-specific formatting.

[czottmann]

Thanks for the pointer, I'll look into that!

[ezekg]

Let me know what you find! Would love to have that knowledge for when we write an engine for Sparkle (we have the base here in keygen-sh/keygen-api#481 but ended up shelving it for now).