Appcast Feeds

WinSparkle shares its updates checking mechanism with OS X Sparkle. It reads information about available versions from an appcast — a RSS 2.0 feed with some extensions.

The following snippet shows a sample RSS 2.0 feed with an item element representing the appcast:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
    <channel>
        <title>WinSparkle Test Appcast</title>
        <description>Most recent updates to WinSparkle Test</description>
        <language>en</language>
        <item>
            <title>Version 1.5.5880</title>
            <sparkle:releaseNotesLink>
                https://your_domain/your_path/release_notes.html
            </sparkle:releaseNotesLink>
            <pubDate>Fri, 06 Feb 2016 22:49:00 +0100</pubDate>
            <enclosure url="https://your_domain/your_path/setup.exe"
                       sparkle:dsaSignature="MEQCICh10SofkNHa5iJgVWDi2O8RBYyN+nxkFEL7u/tBuWboAiB6VOV/WQMRJE+kRoICZXAhq5b24WkgqcDs0z7gyBkGVw=="
                       sparkle:version="1.5.5880"
                       length="0"
                       type="application/octet-stream" />
        </item>
    </channel>
</rss>

Note that, in this example, the enclosure element's length is 0. While WinSparkle works without the length attribute, the RSS Best Practice Profile recommends setting length to 0 in case a publisher can't determine the enclosure's size.

See Sparkle documentation for detailed information about the feed format. Currently not all options are supported by WinSparkle. See below for additional supported extensions.

DSA signatures are now supported. Refer to official documentation for details.

Publishing the Appcast

Appcasts are accessed over HTTPS or HTTP, so it's enough to upload its XML file to your web server.

Security Considerations

It is essential that all parts of the update are served over secure connections. Always use HTTPS and never unencrypted plain HTTP! This means not only the appcast feed itself, but also resources linked from it, namely the release notes (if not embedded) and the downloads itself. Not doing so would expose your users to MITM attacks in various forms (e.g. hiding an update from them or misrepresenting its contents).

WinSparkle Extensions

Platform-specific Updates

Sparkle feeds format allows specifying update's platform with the sparkle:os attribute, which makes it possible to have e.g. files for both MacOS and Windows in a single appcast. WinSparkle adopts and respects sparkle:os. The attribute can have one of the following values:

• windows for any Windows downloads
• windows-x86 for 32-bit Windows
• windows-x64 for 64-bit Windows. Notice that this will only be used by 64-bit WinSparkle.dll, it does not check the OS bitness. In other words, 32-bit WinSparkle.dll will not use this item even if running on 64-bit Windows in WoW64 mode.
• windows-arm64 for ARM64 Windows. (Same comment as for windows-64 applies.)
• macos for any MacOS downloads (requires Sparkle >= 1.18.1)

Installer Arguments

On Windows, the enclosure is typically some kind of installer — a MSI, InnoSetup etc. It is often useful to pass additional arguments to the installer when launching it, e.g. to force non-interactive installation with reduce UI (notice that the installer shouldn’t be completely invisible, because neither WinSparkle nor the hosting application is showing any UI at the time). The sparkle:installerArguments extension attribute can be used for this purpose.

Useful values for common installers are listed below:

Installer	sparkle:installerArguments	Notes
InnoSetup	/SILENT /SP- /NOICONS	Shows only progress and errors, no startup prompt (docs, docs).
MSI	/passive	Unattended mode, shows progress bar only.
NSIS	/S	Silent mode. No standard prompts or pages are shown.