fix(release): correct the v0.8.0 appcast signature to match the shipped DMG

[alecf]

Every user on 0.8.0 or earlier currently gets "The update is improperly signed and could not be validated" when Sparkle tries to update. This restores the feed.

What broke

The appcast entry for 0.8.0 advertises a signature over bytes that are not the bytes GitHub serves:

	signature	length
appcast.xml on main	xeGbajj6…kKuYBA==	1893410
DMG actually attached to the v0.8.0 release	6lGIp4X3…Se2EAw==	1892425

Verified against the pinned SUPublicEDKey from Distribution/Info.plist: the live entry fails Ed25519 verification over the released DMG, the replacement passes. Sparkle checks the signature before it will install, so it refuses the update — correctly. The artifact is genuine; the feed was describing a different build.

How it happened

release.yml was dispatched a second time for 0.8.0 at 2026-08-08T05:58Z, after PR #63 had already merged and published the release. git-cliff still calculated 0.8.0 (no releasable commits had landed since), so the run:

1. hit the gh release delete "$TAG" --yes --cleanup-tag branch and removed the published release and its tag,
2. rebuilt the DMG — different bytes, DMG creation isn't reproducible — and signed those,
3. uploaded them as a fresh draft, and
4. force-pushed the new appcast entry to release/v0.8.0, whose PR had already merged and closed.

Step 4 is where the signature was lost: there was no open PR left to carry it to main. The draft was then published, leaving the new DMG live under the old entry.

The tag itself is fine — v0.8.0 points at b7d1e94, same as main.

The fix

Update the 0.8.0 enclosure to the signature and length of the DMG that is actually served. No re-release needed: the shipped artifact is a legitimate signed build, only the feed was stale.

Checked the whole feed rather than just the broken entry — all 11 versions now verify against their live release assets:

0.8.0 sig VALID  len ok      0.4.1 sig VALID  len ok
0.7.0 sig VALID  len ok      0.4.0 sig VALID  len ok
0.6.0 sig VALID  len ok      0.3.0 sig VALID  len ok
0.5.1 sig VALID  len ok      0.2.1 sig VALID  len ok
0.5.0 sig VALID  len ok      0.2.0 sig VALID  len ok
0.4.2 sig VALID  len ok

Merging publishes the corrected feed via deploy-site.yml. Users recover on their next update check with no action on their part.

Follow-up, not in this PR

Nothing stops this from recurring: re-dispatching release.yml for an already-published version will delete it and swap the artifact again. release.yml should refuse to delete a release that is not a draft. Left out here deliberately — #64 rewrites that file, so the guard belongs there rather than in a conflicting hotfix.

🤖 Generated with Claude Code

Screenshot

_{Auto-captured on macos-26 at d124d72 (workflow run). Updated on every push to this PR.}

[github-actions]

Test Coverage

Coverage after merging fix/appcast-08-signature into main will be

90.64%	▾ -0.52%

Coverage Report for Changed Files

File	Stmts	Branches	Funcs	Lines	Uncovered Lines