If AV software doesn't mind the modification of assemblies (EXE/DLL files), then the self-update could be done by creating copies of the current, running files and writing the update bytes to the copies.
Then, the in-use executables' directory entries can be renamed to *.exe.bak which won't affect the running processes.
Finally, the copies can be renamed to the original names and the process will attempt to restart with its original command line.
This is the hard way, but the easy way means paying for 100+ USD code-signing certificates.
e.g. a DigiCert "Code Signing Certificate" is ~500 USD. However, we would need an "EV Code Signing Certificate" which DigiCert sells for ~700 USD.
Both options would need to be renewed annually.
Which means we would need to spend ~700 USD every year on a code-signing certificate for a free, non-profit software.
If AV software doesn't mind the modification of assemblies (EXE/DLL files), then the self-update could be done by creating copies of the current, running files and writing the update bytes to the copies. Then, the in-use executables' directory entries can be renamed to *.exe.bak which won't affect the running processes. Finally, the copies can be renamed to the original names and the process will attempt to restart with its original command line.
This is the hard way, but the easy way means paying for 100+ USD code-signing certificates. e.g. a DigiCert "Code Signing Certificate" is ~500 USD. However, we would need an "EV Code Signing Certificate" which DigiCert sells for ~700 USD. Both options would need to be renewed annually. Which means we would need to spend ~700 USD every year on a code-signing certificate for a free, non-profit software.