What it is
The app checks by itself whether a new version is out, downloads and installs it, so the user never hunts for a file. The version list is signed with a key so it cannot be spoofed.
How we use it
OshaVPN checks hourly: Android downloads an APK for its architecture, Windows downloads only changed files and rolls back on failure. There is a tester channel.
Where self-updating helps a business
- The app is handed out as a file, without a store, and sending everyone each new version by hand is unrealistic.
- A bug fix must reach everyone within hours, not whenever a user happens to notice.
- A substituted update must not install, even if someone takes over the release server.
- Updating must not get in the way: interrupt music, drop the VPN or demand clicks.
How we use it
- A signed release list. In OshaVPN and OshaPlay the release list is signed with an ECDSA P-256 key, and the public key is built into the app. A substituted list or a foreign key is rejected, and tests lock this in.
- Silent install. Android downloads the APK for its own architecture and installs it by itself while the screen is off; OshaPlay installs an update when no music is playing. On Windows installation happens with the window hidden and with no user input.
- Only the changes, plus rollback. The Windows client downloads only the changed files, and the updater rolls back the replacement if it fails.
- Channels. There is a tester channel and a regular one, the check runs hourly, and updates can be turned off under "For developers".
- Verified live. With the VPN on, an update installs in seconds and the tunnel comes back up by itself.
We build self-updating into apps under Android and Windows apps.
Common problems
- The first install is still manual. Self-updating works only once the app has been installed from a file. For the first install we hand out a universal APK and a Windows archive with a built-in installer.
- A failed file replacement. If an update breaks off halfway, the app must not be left broken: it needs a rollback to the previous version.
- The signing key is the main secret. Whoever gets the private key can release an "update". That is why only the public key is built into the app, and the list signature is verified on every update check.
- Updating at a bad moment. Installing in the middle of music or work annoys people, so an update is applied only when the app is idle.
When you do not need it
If the app is published in RuStore or Google Play, the store delivers updates and you do not need your own mechanism. Self-updating pays off when the app is distributed as a file: internal and corporate apps and test builds.