• For the Installer and Downloader XPC Services, if these executables are code signed with an Apple issued Team ID, then the connecting client must also be code signed with a matching Team ID.
• For the Downloader XPC Service, the request URL must be http/https
• For Autoupdate, if stage 1 of installation hasn't been completed yet and this executable is code signed with an Apple issued Team ID, then the connecting client must also be code signed with a matching Team ID. As before, multiple simultaneous connections are still disallowed.
• For Autoupdate, if it's not signed with Apple issued certificate, when installing package updates the bundle being updated must be itself and owned by root on disk (as one expects from a PKG installation)
• The authorization prompt message in the Installer Service is more computed inside the service so the client can't pass a completely arbitrary message
• Add extra nullable checking of parameters coming from XPC endpoints
• Add more thread-safe synchronization for Autoupdate installer
• Add logs for more failure points

This change is back ported to 2.7.2 over here fc4f8cb

The in depth security details of this change are discussed here.

Misc Checklist

• My change requires a documentation update on Sparkle's website repository
• My change requires changes to generate_appcast, generate_keys, or sign_update

Testing

I tested and verified my change by using one or multiple of these methods:

• Sparkle Test App
• Unit Tests
• My own app
• Other (please specify)

Tested:

• Running sparkle test app in debug
• Production app using sandboxing and no sandboxing,
• Production app with using pkg update

macOS version tested:
15.5 (24F74)
10.14.6