№ 042 · The Appcast Almanac Vol. I

Sparkle Validator

★ A field instrument for inspecting appcast.xml feeds — errors, warnings, and the small mistakes that ship at 2 a.m.

✦ Free & Open Source MIT License No tracking · validates locally Source on GitHub
A celestial chart depicting a magnifying glass formed from constellations, framed by trumpeting cherubim and armillary spheres
Plate I Inspectio Stellaris
§I

Submit your feed

By URL, by file, or by paste. We'll inspect it in your browser — nothing is uploaded.

Enter the URL to your appcast.xml file. We'll fetch it through our proxy and validate it for you.

Optional: use 2.10.0 for a single-item feed, or 200=2.10.0 to check build 200 in a feed with older releases. Targeted Sparkle 2.10+ updates must require macOS 12 or later.
Require enclosure signatures and signature/length metadata on in-app release notes. Checks format and length only; does not verify cryptographic authenticity.

Sparkle is the standard framework for delivering software updates to macOS apps. It reads an appcast.xml feed to discover new versions. This tool catches mistakes before your users do — checking signature metadata, versions, URLs, and appcast rules drawn from the Sparkle documentation.

Updated for Sparkle 2.10: check the macOS 12 minimum for selected updates, validate signed release-note metadata, and keep older releases in your feed. Read the changelog ↗

§II

From the terminal

Install the CLI for local validation and CI/CD integration. Requires Node.js 22 or later.

  • npm $ npm install -g sparkle-validator
  • brew $ brew tap dweekly/sparkle-validator
    brew trust --formula dweekly/sparkle-validator/sparkle-validator
    brew install dweekly/sparkle-validator/sparkle-validator
  • npx $ npx sparkle-validator https://example.com/appcast.xml

Check build 200 in a feed containing historical releases (replace 200 with your update's build version): 

sparkle-validator --target-sparkle-version 200=2.10.0 appcast.xml
--require-signed-feed metadata checks --base-url relative links --check-urls verify links --strict mode JSON output stdin support
§III

In your pipeline

Validate appcasts automatically on every push.

- uses: dweekly/Sparkle-Validator@v1
  with:
    file: appcast.xml
strict mode check-urls option target-sparkle-version require-signed-feed JSON output View on Marketplace ↗
§IV

Schema validation

Validate offline against our XSD schema with xmllint.

$ curl -fSLO https://sparklevalidator.com/appcast.xsd
$ curl -fSLO https://sparklevalidator.com/sparkle-appcast.xsd
$ curl -fSLO https://sparklevalidator.com/xml.xsd
$ xmllint --nonet --schema appcast.xsd --noout your-appcast.xml

Download all three files into the same directory once, then validate offline. XSD checks structure; use the validator for version, signature-format, and Sparkle compatibility checks.

xml.xsd appcast.xsd sparkle-appcast.xsd