Combination of new architecture and labelling of packaged archives broke Electron auto-update

[Jaifroid]

Electron Builder's autoupdate system is very fragile. It will only auto-update an archive tagged with a precise format, and does not obey its own latest.yml release-info files that it publishes on a GitHub release. It turns out that any release subsequently published with a tag in the same format, even though the release is not labelled as latest and does not have the latest.yml release artefacts, causes it to misbehave and to crash with an unhandled Promise rejection.

The new Web-installer requires the same tag format so that it can find its supplementary files, which is why I am forced to use it for packaged archives WikiMed and Wikivoyage. However, despite not labelling these as "latest", Electron Builder reports that it cannot find the release artefacts for autoupdate of the vanilla app under the 'latest' release. Additionally, if I include the latest.yml, pointing to the real latest vanilla app, autoupdater still tries to get the artefacts from the wrong tag. It's a catch-22 situation.

[Jaifroid]

I've found a workaround, which is a hack: upload the latest.xxx files to the numercally latest release, but alter the urls by inserting ../v3.x.x/ in them. This works for Linux, and starts to work for Windows, but now I'm running into a different issue on Windows: https://github.com/electron-userland/electron-builder/issues/7127. There seems to be a fault in Electron Updater at least when used with the Web installer. It is unable to use PowerShell correctly to verify the file's signature...

Sadly, this error blocks the ability of the app to search for and notify that there is a new update using JS methods, which was always the fallback feature so that users at least got a notification to install it manually.

[Jaifroid]

Someone appears to have fixed similar issue here: https://github.com/electron-userland/electron-builder/issues/4233#issuecomment-852244772. Perhaps setting the flag not to verify the signature in the case of the Web installer (which verifies its own packages) would be acceptable.

[Jaifroid]

For the record, here is the code purported to work. This should be added before next update:

"build": {
  ...
  "directories": {
    ...
  },
  "win": {
    "target": "nsis",
    "verifyUpdateCodeSignature": false,
    "publish": {
      "provider": "generic",
      "url": "http://xx.xx.xx.xx:port/update/win64",
      "useMultipleRangeRequest": false
    }
  },
  "nsis": {
    "deleteAppDataOnUninstall": true
  }
},
...