NSIS Auto-Update

[ghost]

Creating this issue just to keep track of status, or when it is planned.

[black-snow]

@develar @kunkinkan How's this gonna work? Will it be analogue to Squirrel?

[develar]

@black-snow yes, only feed url will be changed in the user code. Auto-update API impl will be bundled.

[black-snow]

Great. How are things going? Any help needed?

[atypicalprogrammer]

Will this be better than Squirrel auto-update? I don't like with them that I cannot control the process; I should be able to allow the user to choose whether or not to update to the newest version, instead of forcing it. (And also; better security. Allow me access to the downloaded auto-update so I can for example compare md5 hashes, etc). So a method after downloading the update to verify it.

[black-snow]

@atypicalprogrammer afaik Squirrel does verify checksums.

[atypicalprogrammer]

@black-snow how do you figure? I'm talking about me providing a txt file with a checksum to compare with a downloaded file. It's a custom function that should be possible to provide better security. Something that is ran before the update itself is installed, simply a function that can cancel the further progression of install. The checksum validation I can add myself.

[develar]

Started to work on this.

First version will support only Bintray:

• no rate limits (opposite to GitHub) to access latest version and version files. Rate limit free, no need to parse html or http headers, just use Rest API (opposite to GitHub — token requirement is not user-friendly).
• better security — Bintray reports file sha256/sha1 on version files request. We use it to verify downloaded file (because windows just sucks opposite to macOS — we cannot rely on code sign completely).
• nsis-auto-updater will be published to NPM, but only to provide flexibility — will be just prebundled on pack.
• no RELEASES file. Yep!

[zh99998]

any good news now?

[mkazlauskas]

It seems like work is being done. Please write a small readme and I'll be glad to do some testing.

[develar]

@mkazlauskas Yes. It is nearly finished, but depends on a lot of small, but important things. I hope it will be ready to test this week if no other critical NSIS issues (like #735) will be discovered.

[virror]

Are there any docs for this yet so i can start developing or are they coming when all is done?

[develar]

are they coming when all is done?

Yes.

[develar]

Progress — nsis-updater module is finished, but not tested. I am going to modify electron.asar and replace squirrel implementation to nsis. I don't want to publish module to NPM to not complicate (i.e. you can use electron update API). You will be able to use rich promise-based and robust API instead of electron update API, but only as an alternative option.

[virror]

Any timeframe for this? Would love to do the switch from Squirrel.windows to NSIS.

[develar]

As I am macOS user and Windows is the worst OS in the world, testing is not easy.

If you brave enough and cannot wait, you can help me. Not expected to work.

1) Install electron-auto-updater as app dependency. Please see https://github.com/develar/onshape-desktop-shell/commit/501683723b1069aa799563336853fbfd7b71ec7b

2) Set win.publish to ["bintray", "github"] (order is very important — bintray must be first). If you don't need to publish to GitHub, you can set publish only to bintray.

3) Use import {autoUpdater} from "electron-auto-updater" instead of autoUpdater from electron. electron-auto-updater works in the same way as electron bundled, it allows you to avoid conditional statements. Except that on Windows NSIS updater will be used.

4) Do not call setFeedURL on Windows. electron-builder automatically creates .app-update.json file for you on build in the resources. But if need, you can — set to BintrayOptions object.

 {
  provider: "bintray",
  owner: "actperepo",
  package: "no-versions",
}

Again — you don't need to call setFeedURL.

Not expected to work. But if you cannot wait, your early feedback is welcome.

JFYI: Do not try to use yarn — it is much better than npm, but optional dependencies is broken in the released version.

[rsaccon]

@develar, does or will NSIS auto-updater allow to be used with a custom built server ? I just built one (very simple, just a few lines of code, running on AWS lambda and using AWS S3 for downloads) for the mac squirrel auto-updater. Current NSIS auto-updater at current state seems to need either Bintray or Github as "Provider". Or is the idea to let users implement their custom "Provider" ?

[develar]

@rsaccon As first step, only Bintray supported (it is free, no need to implement own server). Later any http server will be supported.

[dharders]

it is free, no need to implement own server

@develar I think it's only free for open-source apps.

I guess that's why @rsaccon asked, AFAICT the cheapest plan on bintray for closed source apps is $150/mth, which is quite expensive for a small independent dev.

Please correct me if I am wrong, cause I would love to be wrong on this.

P.s. Thanks for all your hard work to get to this milestone!

[develar]

@dharders Oh, Bintray pricing page is so bloody and confusing now. https://bintray.com/docs/usermanual/premium/premium_bintraypremium.html Hmm... it seems you are right. No one will restrict you to distribute commercial software, but it is not legal, as far as I see. I will contact Bintray to make it clear.

[rsaccon]

@develar, @dharders yes, that is exactly the reason I was asking, their prices seem to be a bit high, compared with what I will pay to amazon for a custom built server

[develar]

@rsaccon No doubt. $150/mth is unacceptable and if Bintray will confirm that you cannot distribute commercial software using non-Premium account, Bintray will be not recommended and default provider.

[rsaccon]

@develar thanks for the info. Btw, bintray monthly pricing seems to be without actual charges for bandwidth and storage. And the second-most scary thing to me is the lock-in into a company I never heard of (before reading the source of NSIS updater) for a crucial part of existence for a small independant software developer

[virror]

Ohh crap, so i can not use my own server to store updates? Then i cant use this since we are developing a commercial application and need to store all the stuff on out own servers. Any plan for implementing custom http servers and do you have any timeframe? But great that its finally out, would love to help with testing, but cant do that because of the server thing sadly.

[develar]

i can not use my own server to store updates?

Of course you can. I just want magic by default to ensure that you can get auto-updates without any headache — setup own server. I have limited free time and need to prioritise.

Any plan for implementing custom http servers and do you have any timeframe

Any static plain HTTP-server will be supported. It will be implemented as soon as bintray approach will be proven. Or... maybe even earlier if Bintray support will have issues and will be confirmed that Bintray is not free for any public artifacts.

timeframe

As far I see, it should be not postponed and implemented as part of this feature ;)

[virror]

You are doing wonderful work, dont take my comment as criticism : ) This package has helped us loads, was just curious about the plans.

[jessb321]

I'm definitely willing to help test auto-update for NSIS. I've been chomping at the bit to get rid of Squirrel for my app. Do let us know if you need any help testing it!
Edit: apparently I can't scroll. I'm attempting to get it working right now.

[jessb321]

Ok, I seem to have it 'working', however, it doesn't seem to execute the autoUpdater.quitAndInstall() method. It'll download the updaate, just not go any further. It could also be that the update-downloaded event is not emitted?

[develar]

@willyb321 Thanks, yes, working on it (you can try version 0.0.2, but I hope to manually test today).

[develar]

electron-auto-updater will be distributed as npm module and installed in a standard way. Maybe later it will be bundled somehow. Now we can use yarn instead of slow, unreliable and buggy npm (yarn will be recommend as soon as yarn 0.15.2+ will be released). So, it is ok.

[jessb321]

@develar yeah, v0.0.2 emits the update-downloaded event and even installs it. However, it doesn't re-open the app? I may have missed a config option though.

[jessb321]

Also, it doesn't seem to remove the actual folder when it updates, it'll remove the contents, but not the folder itself. (see here)
Only 1.6.0 has content.

[jessb321]

@develar It would seem that one of those two commits, 89966d6f83e3173dd173b5d9f23c60d6b5f013f6 or b1ae7d5b3c00de2305d6f8b2cb1981ceb574b4d0 managed to break my GH_TOKEN env on appveyor - See here, and it was working perfectly fine previously. Its not too big a deal as bintray still seems to work but I just thought i'd let you know!

[develar]

However, it doesn't re-open the app

No. As on macOS. Or Skype/Chrome — update installed on quit silently.

it doesn't seem to remove the actual folder when it updates, it'll remove the contents, but not the folder itself

Will check.

Progress: Updater is still not polished and not considered as "working". Thanks to @willyb321 for test, but I was busy to fix various publish issues.

[jessb321]

No. As on macOS. Or Skype/Chrome — update installed on quit silently

Ok, I can agree with that.

Will check.

Thanks!
Also, its no problem for me to test, and its been 'working' remarkably well in my testing!

[pwdl]

I just wanted to check the status of this upgrade solution. Is any support required for testing or anything else?

[develar]

@pwdl As @willyb321 confirmed, Bintray works correctly. You can start to use it in your project and report here if something doesn't work. I still cannot state that Bintray auto-update works because I haven't tested it using real-world app :)

This issue remains opened because Bintray pricing policy is not acceptable for commercial apps (150$/m — Bintray, are you insane?). So, it will be closed only when any http-server will be supported.

[pwdl]

Thanks @develar. Completely understood. The $150/month price point for Bintray would certainly make it an unviable option for me. What would be required to develop the auto-update via any http-server via API (or similar) solution? Is it understood, but just needing prioritised and developed or are there unknowns/hurdles to overcome?

[develar]

just needing prioritised and developed

Yes. No unknowns/hurdles to overcome. I really hope it will be fixed this month.

[jessb321]

@pwdl just to back @develar up, I'm still using NSIS and its working flawlessly from what I've seen! - Smaller sizes, no delta, RELEASES, nice and simple since its using same api as normal electron auto-updater. Another plus (for me at least), is the fact that I don't have to host my own updates, which is a problem for me (200kB/s upload!). Sure, bintray could use some work on its pricing, but since my stuff is basically 99% open source/not commercial its not a problem for me at least!
When I was using squirrel, I had to use external module for downloading the updates from github - which seems to be quite slow here at least. (For releases anyway)

[FelikZ]

Hosting yourself is not that difficult, cloud instances now very very cheap, and it is possible to find one for 5$ or even cheaper with 1Tb+ traffic included.

Awaiting hard self hosted auto-updates!

[mkazlauskas]

@FelikZ That is true, especially with Docker

[jessb321]

@develar with commit f69d2025fe56c3825f681819fabf7cf78772d01d , my app throws an error each time it loads, because it can't find app-update.yml - the old .app-update.json is still there however.

[develar]

@willyb321 Please update electron-auto-updater according to electron-builder releases. Currently, please use 0.0.4 version (0.1.0+ requires new version of electron-builder, not yet published).

[jessb321]

@develar Ah, I see. Wil do!

[develar]

It seems currently on Windows you must explicitly call quitAndInstall. On macOs you don't need — update correctly installed on quit. It is not good — it will be fixed in the electron-auto-updater.

[develar]

electron-auto-updater 0.3.0 is published — now update automatically installed on quit (in the same way as on macOS). Please note – electron-builder 7.15.0+ is required.

[develar]

it doesn't seem to remove the actual folder when it updates, it'll remove the contents, but not the folder itself

Yes, directory of version that is removed by new version — will be empty, but not removed. I have tried to fix it, but no luck because it is *\ Windows. Since it is very minor issue, it will be not fixed for now. If you can help — you are welcome.

[artpol]

Please tell me, what is the best way to publish updates for commercial software with electron-builder today? if only gitHub, is there manual for what file structure i should commit for electron-auto-updater? (bintray - I do not consider, very expensive for me)

[elronalds]

Yes, I would like to know the same @artpol. As Squirrel.Windows is going to be depreciated and no longer enhanced what are the options besides bintray. I'd like a self-hosted option. Would it be possible to use something like https://github.com/ArekSredzki/electron-release-server ?

[virror]

If you guys read here before, you can see that he is working on a solution to be able to host at whatever website you want, just need to wait a bit longer. I think its pretty high on the todo list by now.