Upgrading from DSA to EdDSA signatures

This document describes how to migrate apps that used older, now deprecated DSA signatures, to EdDSA without disruptions.

Add EdDSA signatures

1. Update WinSparkle bundled with the app to 0.9.0 or newer.
2. Replace calls to win_sparkle_set_dsa_pub_pem() or use of the DSAPub resource with win_sparkle_set_eddsa_public_key() or EdDSAPub respectively, using a new EdDSA key.
3. Remove DSA public key from the application.
4. Release the new version.
5. Going forward, add sparkle:edSignature to appcast enclosures in addition to existing sparkle:dsaSignature.

Following these steps ensures that older app versions will still be able to update to the latest version (using DSA for validation), while the newer versions of the app will use EdDSA.

Migrating away from DSA

To fully migrate away from DSA and stop signing updates with DSA, you have two options:

1. Wait sufficiently long, until ~all users upgrade (or you don't care that some are left behind); or
2. Change appcast feed URL in the new version of the app and stop publishing updates to the old URL. This will require users on old versions to update to future new versions in two steps: by first updating to the last DSA-signed version in the old feed, then updating from it to the latest version available on the new feed.

Or don't, and continue signing with DSA indefinitely... Note that WinSparkle will ignore both the DSA key and DSA signatures if it was provided with an EdDSA public key, so continuing to sign with DSA does not reduce security of new versions of your app.

Additional links

1. Mac Sparkle's docs on the subject with feed examples.
2. Discussion of DSA's worse security: e.g. here, here or here.