Auto-updater for Windows and Linux tarball installs (signed feed, background download, verified apply, rollback)

sky_line commented

2026-10-05 11:03:23 +00:00

Owner

Builds on #293 (update check / notification). Linux users on the apt repo, Flatpak and (soon) the pacman repo (#419) already get updates from their package manager. Windows installs and Linux tarball installs have no way to update except downloading by hand.

Goal

An opt-in auto-updater for:

Windows, from the NSIS installer / zip;
Linux tarball installs (not package-managed ones: detect apt / Flatpak / AUR / pacman installs and defer to the package manager, showing the right command instead).

Pieces

Update feed: a signed manifest on the website / Forgejo per channel (stable / beta) with version, release-notes URL, per-platform download URL, size and SHA-256. Sign it with the release key (C28FDB4A40AA8360D8DF0470AD8E61526C06E929, CI subkey). #293's check reads the same feed.
Download in the background (resumable, bandwidth-friendly), and verify the SHA-256 plus the signature before use. Never run anything unverified.
Apply:
- Windows: at quit (or "Restart to update"), run the downloaded installer silently (/S) to the same install path, or swap the zip contents through a small updater helper exe, since the running viewer can't replace itself. Handle UAC (per-user installs in %LOCALAPPDATA% avoid admin), and keep the previous version so a failed update can roll back. Windows Authenticode signing is tracked separately (the Windows signing ticket): unsigned installers trigger SmartScreen.
- Linux tarball: download the new tarball, verify it, unpack it next to the current one (Slipstream-<version>/), atomically switch a symlink / the launcher, keep the previous version for rollback, and clean up old ones (keep 1-2).
UI:
- Preferences > Setup: "Updates: automatically install / ask me / only notify / off" and a channel choice (stable / beta).
- A notification when an update is ready, with release notes and a "Restart now / Later" choice.
- Remove or replace the dead LL updater options (UpdaterServiceSetting, UpdaterWillingToTest; LL's updater is #if 0'd in llappviewer.cpp ~1228); the wiki currently notes that they do nothing.
Safety: never update mid-session without consent; skip if the install directory isn't writable; detect package-managed installs; rate-limit checks; telemetry-free.

Done when

Windows and tarball installs can update themselves (opt-in), verified and with rollback.
Package-managed installs are detected and pointed to their package manager.
The dead LL updater controls are gone or wired to the new updater.

Builds on #293 (update check / notification). Linux users on the apt repo, Flatpak and (soon) the pacman repo (#419) already get updates from their package manager. **Windows installs and Linux tarball installs** have no way to update except downloading by hand. ## Goal An opt-in auto-updater for: - **Windows**, from the NSIS installer / zip; - **Linux tarball** installs (not package-managed ones: detect apt / Flatpak / AUR / pacman installs and defer to the package manager, showing the right command instead). ## Pieces 1. **Update feed:** a signed manifest on the website / Forgejo per channel (stable / beta) with version, release-notes URL, per-platform download URL, size and SHA-256. Sign it with the release key (`C28FDB4A40AA8360D8DF0470AD8E61526C06E929`, CI subkey). #293's check reads the same feed. 2. **Download in the background** (resumable, bandwidth-friendly), and verify the SHA-256 plus the signature before use. Never run anything unverified. 3. **Apply:** - **Windows:** at quit (or "Restart to update"), run the downloaded installer silently (`/S`) to the same install path, or swap the zip contents through a small updater helper exe, since the running viewer can't replace itself. Handle UAC (per-user installs in `%LOCALAPPDATA%` avoid admin), and keep the previous version so a failed update can roll back. Windows Authenticode signing is tracked separately (the Windows signing ticket): unsigned installers trigger SmartScreen. - **Linux tarball:** download the new tarball, verify it, unpack it next to the current one (`Slipstream-<version>/`), atomically switch a symlink / the launcher, keep the previous version for rollback, and clean up old ones (keep 1-2). 4. **UI:** - Preferences > Setup: "Updates: automatically install / ask me / only notify / off" and a channel choice (stable / beta). - A notification when an update is ready, with release notes and a "Restart now / Later" choice. - **Remove or replace the dead LL updater options** (`UpdaterServiceSetting`, `UpdaterWillingToTest`; LL's updater is `#if 0`'d in `llappviewer.cpp` ~1228); the wiki currently notes that they do nothing. 5. **Safety:** never update mid-session without consent; skip if the install directory isn't writable; detect package-managed installs; rate-limit checks; telemetry-free. ## Done when - [ ] Windows and tarball installs can update themselves (opt-in), verified and with rollback. - [ ] Package-managed installs are detected and pointed to their package manager. - [ ] The dead LL updater controls are gone or wired to the new updater.

sky_line added the

platform

feature

labels

2026-10-05 11:03:23 +00:00

sky_line referenced this issue

2026-10-06 09:30:24 +00:00

Windows installer: optional 'Install for all users' (Program Files) alongside the per-user default #482

sky_line added this to the Slipstream project

2026-10-06 15:04:13 +00:00

sky_line referenced this issue

2026-10-07 22:01:01 +00:00

Update check: notify when a new Slipstream version is available (foundation for an auto-updater) #293

sky_line added the

status

up-next

label

2026-10-10 04:52:41 +00:00

sky_line referenced this issue from a commit

2026-10-10 10:17:52 +00:00

Auto-updater: signed manifests, background download, verified apply (#421)

sky_line commented

2026-10-10 11:04:13 +00:00

Author

Owner

Shipped in 1.3.0 Beta 1, off by default (Preferences checkbox UpdateAutoInstall). The signing key is set up (Forgejo variable UPDATE_PUBKEY_HEX, secret UPDATE_SIGNING_KEY), and 1.3.0-beta.1 is the first release with a signed update-manifest.json. To test: Linux tarball update and rollback with the checkbox on, and once on a real Windows machine (the installer hand-off has never run) before telling users about it.

sky_line added

and removed

labels

2026-10-10 11:04:13 +00:00

sky_line commented

2026-10-18 22:26:34 +00:00

Author

Owner

Fixed in Slipstream 1.3.0 (stable): https://git.slipstreamviewer.org/sky_line/Slipstream/releases/tag/v1.3.0

If you still see this on 1.3.0, reply here and we'll reopen it.

Fixed in **Slipstream 1.3.0** (stable): https://git.slipstreamviewer.org/sky_line/Slipstream/releases/tag/v1.3.0 If you still see this on 1.3.0, reply here and we'll reopen it.

sky_line closed this issue

2026-10-18 22:26:34 +00:00

Rows
Columns

Auto-updater for Windows and Linux tarball installs (signed feed, background download, verified apply, rollback) #421

Goal

Pieces

Done when