[sudoHG]

Closes #258

Summary

Adds scripts/sparkle-public-key.txt, the Ed25519 public key that Release builds embed as SUPublicEDKey (ADR 0011, decision 2). The maintainer generated the key pair in person with generate_keys from the pinned Sparkle 2.10.1 artifact. The private key is kept only in Ask Key, delivered through askkey run as SPARKLE_ED_KEY_FILE, with an offline backup. It is not in this repository, CI, logs or command arguments.

Diff stat

 scripts/sparkle-public-key.txt | 1 +
 1 file changed, 1 insertion(+)

Tests

• python3 -m unittest Tests/Automation/test_build_app_sparkle.py: 11 run, 8 passed, 0 failed, 3 skipped. The skipped tests need a local Debug bundle, which this change does not affect.

Checks

• test "$(tr -d '\n' < scripts/sparkle-public-key.txt | base64 -d | wc -c | tr -d ' ')" = 32: succeeds.
• The key matches the format scripts/build-app.sh requires (^[A-Za-z0-9+/]{43}=$, 32 bytes decoded).
• python3 scripts/check_hygiene.py: passed.
• Maintainer's in-person steps (credential stored with permission Ask, offline backup, login-keychain item removed): confirmed by the maintainer before merge.

Deviations and questions

The key was generated under the keychain account askkey instead of Sparkle's default ed25519, so it cannot be confused with another project's Sparkle key. The keychain item is deleted afterwards, and sign_update --ed-key-file reads the key from the delivered file, so the account name has no lasting effect.

[luoji-bot]

Maintainer's in-person steps for #258 are done:

• The private key is stored in Ask Key as a file credential with permission Ask, delivered as a temporary file in SPARKLE_ED_KEY_FILE.
• Its contents match the exported key byte for byte (askkey run with cmp, which prints only identical).
• The maintainer made an offline backup.
• The exported temporary file is deleted, and the login-keychain item is removed: generate_keys --account askkey -p reports no signing key.

The public key in this PR is the one generate_keys printed. Merging once both required CI jobs are green, as the maintainer approved.