Deprecate SparkleUpdater SecurityProtocolType prop; don't use Service…

…PointManager
NetSparkleUpdater · Oct 11, 2024 · 2cc2120 · 2cc2120
1 parent 6fc1012
commit 2cc2120
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 5 deletions.
diff --git a/UPGRADING.md b/UPGRADING.md
@@ -137,6 +137,7 @@
 * Add `TrustEverySSLConnection` to .NET Core `WebFileDownloader`
 * Fix `WebFileDownloader` not setting up an `HttpClientHandler` (was always auto-redirect'ing before despite setting `RedirectHandler`; now behaves more similarly to `WebRequestAppCastDataDownloader`)
 * Fixed `Unsafe` mode in DSA/ed25519 checkers still checking signatures if a signature existed
+* Deprecated `SecurityProtocolType SecurityProtocolType` property in `SparkleUpdater` (deprecated in .NET 9 and you can easily override the pertinent `HttpClient` behavior yourself)
 
 ## Updating from 0.X or 1.X to 2.X
 

diff --git a/src/NetSparkle/Downloaders/WebRequestAppCastDataDownloader.cs b/src/NetSparkle/Downloaders/WebRequestAppCastDataDownloader.cs
@@ -79,8 +79,12 @@ public async Task<string> DownloadAndGetAppCastDataAsync(string url)
         {
             _appcastUrl = url;
             // configure ssl cert link
+            // .NET 9 -> ServicePointManager is deprecated
+            // we have the lambda below for trusting all connections anyway, so this
+            // is sort of redundant at the moment.
+#if NETSTANDARD || NET6 || NET7 || NET8 
             ServicePointManager.ServerCertificateValidationCallback += ValidateRemoteCertificate;
-
+#endif
             var handler = new HttpClientHandler();
             if (RedirectHandler != null)
             {
@@ -111,7 +115,10 @@ public async Task<string> DownloadAndGetAppCastDataAsync(string url)
                     if (response.IsSuccessStatusCode)
                     {
                         Stream responseStream = await response.Content.ReadAsStreamAsync().ConfigureAwait(false);
+                        // .NET 9 -> ServicePointManager is deprecated
+#if NETSTANDARD || NET6 || NET7 || NET8
                         ServicePointManager.ServerCertificateValidationCallback -= ValidateRemoteCertificate;
+#endif
                         using (StreamReader reader = new StreamReader(responseStream, GetAppCastEncoding()))
                         {
                             return await reader.ReadToEndAsync().ConfigureAwait(false);
@@ -143,8 +150,10 @@ public async Task<string> DownloadAndGetAppCastDataAsync(string url)
                     }
                     else
                     {
-                        Stream responseStream = await httpClient.GetStreamAsync(url).ConfigureAwait(false);
+                        Stream responseStream = await httpClient.GetStreamAsync(url).ConfigureAwait(false);// .NET 9 -> ServicePointManager is deprecated
+#if NETSTANDARD || NET6 || NET7 || NET8
                         ServicePointManager.ServerCertificateValidationCallback -= ValidateRemoteCertificate;
+#endif
                         using (StreamReader reader = new StreamReader(responseStream, GetAppCastEncoding()))
                         {
                             return await reader.ReadToEndAsync().ConfigureAwait(false);

diff --git a/src/NetSparkle/SparkleUpdater.cs b/src/NetSparkle/SparkleUpdater.cs
@@ -149,11 +149,19 @@ public SparkleUpdater(string appcastUrl, ISignatureVerifier signatureVerifier, s
 
         #region Properties
 
+#if NETSTANDARD || NET6 || NET7 || NET8
         /// <summary>
         /// The security protocol used by NetSparkle. Setting this property will also set this 
-        /// for the current AppDomain of the caller. Needs to be set to 
-        /// SecurityProtocolType.Tls12 for some cases (such as when downloading from GitHub).
-        /// </summary>
+        /// for the current AppDomain of the caller. May need to be set to 
+        /// SecurityProtocolType.Tls12 for some cases (such as when downloading from GitHub);
+        /// however, if your app is using a more recent version of .NET, you should be OK.
+        /// See also: https://stackoverflow.com/a/59398678/3938401
+        /// .NET 9 -> ServicePointManager is deprecated
+        /// </summary>
+        [Obsolete("Deprecated in .NET 9; this property may be removed at any time " + 
+            "(including minor/patch updates to this library); override pertinent " + 
+            "functions (e.g. to HttpClient) in WebRequestAppCastDataDownloader or " + 
+            "similar to make equivalent changes to your application")]
         public SecurityProtocolType SecurityProtocolType
         {
             get
@@ -165,6 +173,7 @@ public SecurityProtocolType SecurityProtocolType
                 ServicePointManager.SecurityProtocol = value;
             }
         }
+#endif
 
         /// <summary>
         /// Set the user interaction mode for Sparkle to use when there is a valid update for the software