generate-sparkle-appcast

Use this skill when the user wants to publish a new Mos release (stable or beta) and needs: - Sparkle generated from the notarized in - Two hosted release notes pages (Chinese + English) - Sparkle to show Chinese for all locales (Simplified/Traditional/HK/TW), and English for everything else Inputs - : the previous release commit (exclusive). Used to generate release notes from changes since that commit. - A notarized+zipped app in named: - (stable) - (beta) - Sparkle Ed25519 private key at (gitignored). - Optional env: - (default ) - / to point to pre-written HTML files (otherwise the script…

\\n \u003csparkle:channel>beta\u003c/sparkle:channel>'\n enclosure_channel_attr=

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\n sparkle:channel=\"beta\"'\nfi\n\ndescription_block=

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\n \u003cdescription>\u003c![CDATA['\"$RELEASE_NOTES_HTML\"

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

]]>\u003c/description>'\nrelease_notes_link_block=

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\\n \u003csparkle:releaseNotesLink xml:lang=\"zh\">'${RELEASE_NOTES_ZH_URL}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\u003c/sparkle:releaseNotesLink>\\n \u003csparkle:releaseNotesLink>'${RELEASE_NOTES_EN_URL}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\u003c/sparkle:releaseNotesLink>'\n\ncat >\"$APPCAST_BUILD\" \u003c\u003cEOF\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003crss version=\"2.0\"\n xmlns:sparkle=\"http://www.andymatuschak.org/xml-namespaces/sparkle\"\n xmlns:dc=\"http://purl.org/dc/elements/1.1/\">\n \u003cchannel>\n \u003ctitle>Mos\u003c/title>\n \u003clink>https://mos.caldis.me/\u003c/link>\n \u003cdescription>Mos Updates\u003c/description>\n \u003clanguage>en\u003c/language>\n\n \u003citem${item_attrs}>\n \u003ctitle>Mos ${SHORT_VERSION}\u003c/title>\n${channel_element}\n${description_block}\n \u003cpubDate>${PUB_DATE}\u003c/pubDate>\n${release_notes_link_block}\n \u003cenclosure\n url=\"${DOWNLOAD_URL}\"\n length=\"${FILE_LENGTH}\"\n type=\"application/octet-stream\"\n sparkle:shortVersionString=\"${SHORT_VERSION}\"\n sparkle:version=\"${BUNDLE_VERSION}\"\n sparkle:edSignature=\"${ED_SIGNATURE}\"${enclosure_channel_attr}\n />\n \u003c/item>\n \u003c/channel>\n\u003c/rss>\nEOF\n\ncp \"$APPCAST_BUILD\" \"$APPCAST_DOCS\"\n\ninfo \"Selected zip: $ZIP_PATH\"\ninfo \"Release tag: $TAG\"\ninfo \"Download URL: $DOWNLOAD_URL\"\ninfo \"Wrote: $APPCAST_BUILD\"\ninfo \"Copied: $APPCAST_DOCS\"\ninfo \"Done\"\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":15817,"content_sha256":"9a9b2277a7cdf660d0f203e390016663db85b0296ff149eb409f022e12dc63d8"},{"filename":"skill-report.json","content":"{\n \"schema_version\": \"2.0\",\n \"meta\": {\n \"generated_at\": \"2026-01-16T19:41:22.037Z\",\n \"slug\": \"caldis-generate-sparkle-appcast\",\n \"source_url\": \"https://github.com/Caldis/Mos/tree/master/.codex/skills/generate-sparkle-appcast\",\n \"source_ref\": \"master\",\n \"model\": \"claude\",\n \"analysis_version\": \"3.0.0\",\n \"source_type\": \"community\",\n \"content_hash\": \"d0a6358a5065ee9c78e1830c6cdae2c85aa160a82b4ff308f72a3564631ea65e\",\n \"tree_hash\": \"ae64f078708d752591340a4e7036051d9ca1592785c23e4620c50f4f7de1e62e\"\n },\n \"skill\": {\n \"name\": \"generate-sparkle-appcast\",\n \"description\": \"Generate Mos Sparkle appcast.xml from the latest build zip and recent git changes (since a given commit), then sync to docs/ for publishing.\",\n \"summary\": \"Generate Mos Sparkle appcast.xml from the latest build zip and recent git changes (since a given com...\",\n \"icon\": \"📦\",\n \"version\": \"1.0.0\",\n \"author\": \"Caldis\",\n \"license\": \"MIT\",\n \"category\": \"documentation\",\n \"tags\": [\n \"release\",\n \"sparkle\",\n \"macos\",\n \"appcast\",\n \"automation\"\n ],\n \"supported_tools\": [\n \"claude\",\n \"codex\",\n \"claude-code\"\n ],\n \"risk_factors\": [\n \"scripts\",\n \"external_commands\",\n \"filesystem\",\n \"network\",\n \"env_access\"\n ]\n },\n \"security_audit\": {\n \"risk_level\": \"low\",\n \"is_blocked\": false,\n \"safe_to_publish\": true,\n \"summary\": \"Legitimate macOS release automation tool for generating Sparkle appcast files. All static findings are false positives stemming from the scanner's inability to distinguish between legitimate release tooling and malicious patterns. The script operates only within project build/docs directories, uses standard tooling (git, python3, openssl) for release signing, and handles Ed25519 private keys appropriately for Sparkle update signing.\",\n \"risk_factor_evidence\": [\n {\n \"factor\": \"scripts\",\n \"evidence\": [\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 1,\n \"line_end\": 482\n }\n ]\n },\n {\n \"factor\": \"external_commands\",\n \"evidence\": [\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 45,\n \"line_end\": 46\n },\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 195,\n \"line_end\": 198\n },\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 213,\n \"line_end\": 213\n }\n ]\n },\n {\n \"factor\": \"filesystem\",\n \"evidence\": [\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 4,\n \"line_end\": 7\n },\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 48,\n \"line_end\": 50\n },\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 377,\n \"line_end\": 380\n }\n ]\n },\n {\n \"factor\": \"network\",\n \"evidence\": [\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 10,\n \"line_end\": 11\n },\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 165,\n \"line_end\": 165\n }\n ]\n },\n {\n \"factor\": \"env_access\",\n \"evidence\": [\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 12,\n \"line_end\": 12\n },\n {\n \"file\": \"scripts/generate_appcast.sh\",\n \"line_start\": 210,\n \"line_end\": 210\n }\n ]\n }\n ],\n \"critical_findings\": [],\n \"high_findings\": [],\n \"medium_findings\": [],\n \"low_findings\": [],\n \"dangerous_patterns\": [],\n \"files_scanned\": 3,\n \"total_lines\": 767,\n \"audit_model\": \"claude\",\n \"audited_at\": \"2026-01-16T19:41:22.037Z\"\n },\n \"content\": {\n \"user_title\": \"Generate Sparkle appcast for macOS releases\",\n \"value_statement\": \"Publishing macOS updates requires generating a Sparkle appcast.xml file with cryptographic signatures. This skill automates the entire release process from zip archive to signed appcast with bilingual release notes.\",\n \"seo_keywords\": [\n \"generate-sparkle-appcast\",\n \"sparkle appcast\",\n \"macos software update\",\n \"claude code skill\",\n \"codex skill\",\n \"claude skill\",\n \"release automation\",\n \"ed25519 signing\",\n \"bilingual release notes\",\n \"mos app\"\n ],\n \"actual_capabilities\": [\n \"Generate Sparkle appcast.xml from notarized zip archive\",\n \"Create Ed25519 cryptographic signatures for release verification\",\n \"Extract and format bilingual release notes from git history\",\n \"Parse Info.plist for version metadata (CFBundleShortVersionString, CFBundleVersion)\",\n \"Copy release artifacts to docs/ directory for web hosting\",\n \"Support stable and beta release channels with proper Sparkle filtering\"\n ],\n \"limitations\": [\n \"Requires Sparkle Ed25519 private key file (sparkle_private_key.txt) to be present\",\n \"Only works with zip files matching Mos naming convention (Mos.Versions.*.zip)\",\n \"Git history must follow conventional commit format for proper release note categorization\",\n \"Limited to Mos project directory structure (build/ and docs/ directories required)\"\n ],\n \"use_cases\": [\n {\n \"target_user\": \"macOS App Maintainers\",\n \"title\": \"Publish Mos Releases\",\n \"description\": \"Generate signed appcast and release notes when preparing new stable or beta releases for distribution.\"\n },\n {\n \"target_user\": \"DevOps Engineers\",\n \"title\": \"Automate Release Pipeline\",\n \"description\": \"Integrate into CI/CD workflows to automatically generate Sparkle update files from build artifacts.\"\n },\n {\n \"target_user\": \"Open Source Contributors\",\n \"title\": \"Create Release Candidates\",\n \"description\": \"Generate test appcast files for beta testing before official release publishing.\"\n }\n ],\n \"prompt_templates\": [\n {\n \"title\": \"Basic Release Generation\",\n \"scenario\": \"Generate appcast for stable release\",\n \"prompt\": \"Run the generate-sparkle-appcast skill with --since \u003ccommit> to create appcast.xml from the latest build zip. Use the commit hash from the previous release.\"\n },\n {\n \"title\": \"Beta Channel Release\",\n \"scenario\": \"Generate beta release appcast\",\n \"prompt\": \"Generate a beta channel appcast using generate-sparkle-appcast with --since \u003ccommit>. Ensure the beta zip file is in build/ directory.\"\n },\n {\n \"title\": \"Custom Release Notes\",\n \"scenario\": \"Use pre-written release notes\",\n \"prompt\": \"Run generate-sparkle-appcast with RELEASE_NOTES_ZH_FILE and RELEASE_NOTES_EN_FILE environment variables pointing to custom HTML files instead of auto-generating from git.\"\n },\n {\n \"title\": \"Debug Release Process\",\n \"scenario\": \"Troubleshoot release generation\",\n \"prompt\": \"Run generate-sparkle-appcast with --help to verify dependencies and check build/ directory for required zip files and Sparkle private key.\"\n }\n ],\n \"output_examples\": [\n {\n \"input\": \"Generate appcast since commit 559e727\",\n \"output\": [\n \"Selected zip: build/Mos.Versions.4.0.0-20260108.1.zip\",\n \"Release tag: 4.0.0-20260108.1\",\n \"Download URL: https://github.com/Caldis/Mos/releases/download/4.0.0-20260108.1/Mos.Versions.4.0.0-20260108.1.zip\",\n \"Wrote: build/appcast.xml\",\n \"Copied: docs/appcast.xml\"\n ]\n },\n {\n \"input\": \"Generate beta appcast since commit abc1234\",\n \"output\": [\n \"Selected zip: build/Mos.Versions.4.0.0-beta-20260108.1.zip\",\n \"Release tag: 4.0.0-beta-20260108.1\",\n \"Generated appcast with sparkle:channel set to beta\",\n \"Wrote: build/appcast.xml\",\n \"Copied: docs/appcast.xml\"\n ]\n }\n ],\n \"best_practices\": [\n \"Always verify the Ed25519 private key file is gitignored and stored securely before running releases.\",\n \"Test beta releases with a beta channel appcast before publishing stable releases to users.\",\n \"Keep release notes in a separate file for complex releases that require manual editing.\"\n ],\n \"anti_patterns\": [\n \"Running the skill without verifying the build zip matches the expected naming convention.\",\n \"Using an expired or compromised Sparkle private key for signing releases.\",\n \"Skipping the step to copy appcast.xml to docs/ before GitHub release publication.\"\n ],\n \"faq\": [\n {\n \"question\": \"What is the Sparkle private key file format?\",\n \"answer\": \"The file must contain a base64-encoded 32-byte Ed25519 seed. Keep this file gitignored and secure.\"\n },\n {\n \"question\": \"Can this skill sign releases for other macOS apps?\",\n \"answer\": \"No. The script is hardcoded for the Mos project structure and naming conventions.\"\n },\n {\n \"question\": \"What if git history does not follow conventional commits?\",\n \"answer\": \"The skill falls back to generic categorization (Fix, New, Improved) based on commit message patterns.\"\n },\n {\n \"question\": \"How are release notes separated by language?\",\n \"answer\": \"The script generates one HTML page with Chinese content followed by English, separated by an \u003chr/> tag.\"\n },\n {\n \"question\": \"Does this skill upload files to servers?\",\n \"answer\": \"No. The skill only writes to local build/ and docs/ directories. You must sync docs/ to your web host.\"\n },\n {\n \"question\": \"What dependencies are required?\",\n \"answer\": \"The skill requires git, python3, and openssl with Ed25519 support to be available in PATH.\"\n }\n ]\n },\n \"file_structure\": [\n {\n \"name\": \"scripts\",\n \"type\": \"dir\",\n \"path\": \"scripts\",\n \"children\": [\n {\n \"name\": \"generate_appcast.sh\",\n \"type\": \"file\",\n \"path\": \"scripts/generate_appcast.sh\",\n \"lines\": 482\n }\n ]\n },\n {\n \"name\": \"SKILL.md\",\n \"type\": \"file\",\n \"path\": \"SKILL.md\",\n \"lines\": 39\n }\n ]\n}\n","content_type":"application/json; charset=utf-8","language":"json","size":10508,"content_sha256":"bc7cfb65d8ba0fa08cacfce972c8b35c3f7f4b34c741196134a0615728686edf"}],"content_json":{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Use this skill when the user wants to publish a new Mos release (stable or beta) and needs:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Sparkle ","type":"text"},{"text":"appcast.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":" generated from the notarized ","type":"text"},{"text":".zip","type":"text","marks":[{"type":"code_inline"}]},{"text":" in ","type":"text"},{"text":"build/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Two hosted release notes pages (Chinese + English)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Sparkle to show Chinese for all ","type":"text"},{"text":"zh*","type":"text","marks":[{"type":"code_inline"}]},{"text":" locales (Simplified/Traditional/HK/TW), and English for everything else","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Inputs","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--since \u003ccommit>","type":"text","marks":[{"type":"code_inline"}]},{"text":": the previous release commit (exclusive). Used to generate release notes from changes since that commit.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A notarized+zipped app in ","type":"text"},{"text":"build/","type":"text","marks":[{"type":"code_inline"}]},{"text":" named:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Mos.Versions.\u003cversion>-\u003cYYYYMMDD>.\u003cnum>.zip","type":"text","marks":[{"type":"code_inline"}]},{"text":" (stable)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Mos.Versions.\u003cversion>-beta-\u003cYYYYMMDD>.\u003cnum>.zip","type":"text","marks":[{"type":"code_inline"}]},{"text":" (beta)","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Sparkle Ed25519 private key at ","type":"text"},{"text":"sparkle_private_key.txt","type":"text","marks":[{"type":"code_inline"}]},{"text":" (gitignored).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Optional env:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"RELEASE_NOTES_BASE_URL","type":"text","marks":[{"type":"code_inline"}]},{"text":" (default ","type":"text"},{"text":"https://mos.caldis.me/release-notes","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"RELEASE_NOTES_ZH_FILE","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"RELEASE_NOTES_EN_FILE","type":"text","marks":[{"type":"code_inline"}]},{"text":" to point to pre-written HTML files (otherwise the script writes to ","type":"text"},{"text":"build/release-notes/\u003ctag>.*.html","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"What to do","type":"text","marks":[{"type":"strong"}]}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Run the skill script:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"bash .codex/skills/generate-sparkle-appcast/scripts/generate_appcast.sh --since \u003ccommit>","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Confirm outputs:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"build/appcast.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":" (generated)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"docs/appcast.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":" (copied for ","type":"text"},{"text":"mos.caldis.me/appcast.xml","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"build/release-notes/\u003ctag>.zh.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"build/release-notes/\u003ctag>.en.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" (generated)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"docs/release-notes/\u003ctag>.zh.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"docs/release-notes/\u003ctag>.en.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" (copied for hosting)","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ensure the GitHub Release tag and asset name match the URL inside the generated appcast.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Notes","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The script emits two ","type":"text"},{"text":"\u003csparkle:releaseNotesLink>","type":"text","marks":[{"type":"code_inline"}]},{"text":" entries: ","type":"text"},{"text":"xml:lang=\"zh\"","type":"text","marks":[{"type":"code_inline"}]},{"text":" points to the Chinese page, and the default link points to the English page.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"You can pre-create/edit ","type":"text"},{"text":"build/release-notes/\u003ctag>.zh.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"build/release-notes/\u003ctag>.en.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" before running the script; the script will reuse them if present, otherwise it generates a default template from git history.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If the zip changes in any way (repacked/re-signed), you must re-run the script to regenerate ","type":"text"},{"text":"sparkle:edSignature","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}}]},"metadata":{"date":"2026-06-05","name":"generate-sparkle-appcast","author":"@skillopedia","source":{"stars":336,"repo_name":"marketplace","origin_url":"https://github.com/aiskillstore/marketplace/blob/HEAD/skills/caldis/generate-sparkle-appcast/SKILL.md","repo_owner":"aiskillstore","body_sha256":"0db81c1480ac9802cbbda7da549c380ac0a97d350dfd43d469bb05169c568576","cluster_key":"b8014bd0df2a31c64cc4a2b9836e4c2d92b9d9a244a92b75b1df32881ca81f14","clean_bundle":{"format":"clean-skill-bundle-v1","source":"aiskillstore/marketplace/skills/caldis/generate-sparkle-appcast/SKILL.md","attachments":[{"id":"85c893fd-6c66-5e52-9093-58e3c2995a24","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/85c893fd-6c66-5e52-9093-58e3c2995a24/attachment.sh","path":"scripts/generate_appcast.sh","size":15817,"sha256":"9a9b2277a7cdf660d0f203e390016663db85b0296ff149eb409f022e12dc63d8","contentType":"application/x-sh; charset=utf-8"},{"id":"2a0a814a-1b2c-5750-917c-567ad7223483","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/2a0a814a-1b2c-5750-917c-567ad7223483/attachment.json","path":"skill-report.json","size":10508,"sha256":"bc7cfb65d8ba0fa08cacfce972c8b35c3f7f4b34c741196134a0615728686edf","contentType":"application/json; charset=utf-8"}],"bundle_sha256":"5d589689062e4f583c25c5196c11405d54b8f10c4a6fb7d8ac528e507870874e","attachment_count":2,"text_attachments":2,"attachment_storage":"skillopedia-attachments-v1","binary_attachments":0,"excluded_attachments":[]},"cluster_size":1,"skill_md_path":"skills/caldis/generate-sparkle-appcast/SKILL.md","import_metadata":{"date":"2026-06-05","author":"@skillopedia","version":"v1","category":"testing-qa","category_label":"Testing"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"testing-qa","import_tag":"clean-skills-v1","description":"Generate Mos Sparkle appcast.xml from the latest build zip and recent git changes (since a given commit), then sync to docs/ for publishing."}},"renderedAt":1782981388653}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.