Public Access
Let the desktop client replace itself, and give the repository one version
Packaging for Windows, and the updater that only exists once something is
packaged. Velopack, win-x64, fed from the project's own forge — never from the
deployment a client signs in to, which is ADR 0011 rule 2 carried over
unchanged and is why the feed address is a constant in the code rather than a
setting. See docs/adr/0012-desktop-distribution-and-updates.md.
**Nothing is ever installed while somebody is using it.** A newer build is found
on a six-hourly pass, downloaded in the background, and then waits — for a
restart the user presses, or for the next launch they were going to do anyway.
That is a policy rather than caution: this application argues at length that
locking keeps shells running, because a lock that destroyed work would stop
being used, and a restart does not keep them. Having taught that, it owes the
user the choice at the one moment it stops being true, and the sentence saying
so counts the shells it would close.
**The version is now derived from the v* tag**, by MinVer, for everything. There
was no version before this — no property anywhere, so every assembly reported
the SDK's 1.0.0 and the API served that string as its serverVersion to every
client that asked. The tag was already the version of record for the container
image; this makes it the version of record full stop. MinVer's failure mode is
answering plausibly rather than failing, and here a wrong version is a client
that never updates, so it is guarded twice: fetch-depth 0 on every checkout, and
a step that fails a tag build when the tag and the computed version disagree.
**The pack id is DodoSSH.Desktop and not DodoSSH**, which is the one decision
here that would have destroyed data. Velopack installs to %LOCALAPPDATA%\<packId>
and removes that whole directory on uninstall, and %LOCALAPPDATA%\DodoSSH is
where ClientPaths keeps the encrypted cache, the outbox of changes not yet
pushed, and the device key. The obvious id would have had the uninstaller
silently delete work the server has never seen — the thing the application
refuses to do without a counted confirmation. Velopack's own advice to move user
data to roaming %APPDATA% is declined for the reason ClientPaths already gives.
**Releases are cut by a person, and CI gains no job that could.** The tempting
argument is that a forge write token is not a signing key. It does not survive
contact with what the token does: Velopack clients trust their feed and do not
verify a package signature when they apply one, so whoever can write a release
can ship an update every install runs. That is the capability ADR 0011 rule 1
puts on a machine which is not a runner, reached through a different door. The
mechanical objection — vpk needs Windows and the runners are Linux — is the
smaller of the two and is recorded beside it, because somebody will fix one and
believe they are done.
Unsigned for now, deliberately and with the cost stated where a user reads it:
SmartScreen warns once per person, on Setup.exe, because Mark-of-the-Web is
applied by the browser that downloaded it. In-app updates are fetched by the
application and applied from a local file, and never trip it.
The banner is a fourth row of the window rather than an overlay. Anything drawn
in the terminal's rectangle is sliced by the native child window that composites
above it — the defect this window has shipped once — and a sibling row is the
arrangement TitleBar and StatusBar already prove works.
----
Three defects surfaced on the way, none of them in the feature being built.
**A settings key absent from the file came back as the CLR default, not the
declared one.** The JSON source generator builds a record through a synthesised
parameterised constructor and assigns every property from its argument array, so
a property initializer runs and is then overwritten by a default for anything the
file did not contain. A settings.json of {} read back a font size of 0, clamped
up to the 8px floor rather than the 13px the renderer draws at. It could not bite
while there was one setting, because that setting was written on every save and
so was never absent; adding a second would have turned automatic update checks
off for every existing profile, silently, the opposite of the documented default.
Reflection-based deserialisation of the same JSON answers correctly, which is why
every way of checking it by hand agrees except the one that ships. The defaults
now live on the constructor parameters, which is the only place the generator
reads them from.
**Declaring a RuntimeIdentifier on the desktop head broke the server's image
build.** It is the obvious way to let a self-contained publish restore under
locked mode, and it writes a net10.0/win-x64 target into the lock file of every
project the head references transitively — including DodoSSH.Contracts and
DodoSSH.Crypto, which the API builds too. The Dockerfile restores those with no
RID and fails NU1004. Found by running docker build rather than by reading. The
RID stays out of the committed state; the two commands that need one ask for it
unlocked, and the release script puts the lock files back.
**A Docker ARG named VERSION silently sets MSBuild's Version.** An ARG is an
environment variable for the rest of the stage, MSBuild reads environment
variables as properties, and property names are case-insensitive. With the
workflow passing main-<short sha> on a main build the publish died with
NETSDK1018 pointing at DodoSSH.Contracts, a project nobody had touched. The build
stage's argument is ASSEMBLY_VERSION now, empty except on a tag build.
All three are in docs/platform-flags.md, which is where the next person will look.
----
Verified: the whole solution builds and restores locked; 289 shell, 93 layout and
54 session tests pass, including the regression test for the settings defect and
a measurement of the banner at the window's minimum width. vpk pack runs end to
end and reports "Verified VelopackApp.Run()" against Program.Main. The API image
builds correctly both as a main build and as a tag build, carrying 1.0.0 and
0.1.0 respectively.
Not verified, and it needs a published release to be: installing, updating and
uninstalling on a real machine. That is Phase 15 of docs/manual-checks.md, and
the pack id and the WebView2 profile fix are reasoned and commented but only
proved by walking it. Two things to watch at the first upload — the reverse
proxy's body-size limit for a 64 MB asset, and whether vpk upload gitea is happy
with Gitea 1.27.1.
This commit is contained in:
@@ -0,0 +1,194 @@
|
||||
using DodoSSH.Client.Session;
|
||||
using Velopack;
|
||||
using Velopack.Sources;
|
||||
|
||||
namespace DodoSSH.Client.App.Platform;
|
||||
|
||||
/// <summary>
|
||||
/// Chooses the update channel this machine can actually use.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Decided once, at composition, from a property of the machine — the same shape as
|
||||
/// <c>DesktopDeviceKeyStores.ForThisMachine</c>, and for the same reason: whether this copy can replace
|
||||
/// itself does not change while it runs, and a check repeated at each call site is a check somebody
|
||||
/// eventually forgets.
|
||||
/// </remarks>
|
||||
internal static class UpdateChannels
|
||||
{
|
||||
/// <summary>The channel for this machine, or one that reports itself unavailable.</summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Two conditions, and the second is the one that matters in development. Velopack's
|
||||
/// <c>IsInstalled</c> is false when the process is not running from an installed layout — which is
|
||||
/// every <c>dotnet run</c>, every build started from an IDE, and every copy somebody extracted from
|
||||
/// an archive by hand. Reaching into the updater from one of those does not fail politely.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Constructing an <see cref="UpdateManager"/> is what answers the question, and constructing one is
|
||||
/// cheap — it reads the layout on disk and talks to nothing. The network is not touched until
|
||||
/// somebody asks for a check.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal static IUpdateChannel ForThisMachine()
|
||||
{
|
||||
if (!OperatingSystem.IsWindows())
|
||||
{
|
||||
return new UnavailableUpdateChannel();
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
var manager = VelopackUpdateChannel.CreateManager();
|
||||
|
||||
return manager.IsInstalled
|
||||
? new VelopackUpdateChannel(manager)
|
||||
: new UnavailableUpdateChannel();
|
||||
}
|
||||
catch (Exception exception) when (exception is not OutOfMemoryException)
|
||||
{
|
||||
// A machine whose install layout cannot be read is a machine with no updater, which is a
|
||||
// state this application already knows how to be in. Refusing to start an SSH client over
|
||||
// it would be the wrong trade by a wide margin.
|
||||
return new UnavailableUpdateChannel();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The Windows update channel, backed by Velopack against the project's own forge.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The one file in the repository that names Velopack. It lives beside <c>WindowsDeviceKeyStore</c>
|
||||
/// rather than in a project of its own because it is the same kind of thing — a Windows-only
|
||||
/// implementation of an interface declared in <c>DodoSSH.Client.Session</c> — and because
|
||||
/// <c>DodoSSH.Client.Shell</c> is shared with the Android head, which must never acquire an updater.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// See <c>docs/adr/0012-desktop-distribution-and-updates.md</c>.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal sealed class VelopackUpdateChannel : IUpdateChannel
|
||||
{
|
||||
/// <summary>
|
||||
/// Where builds come from, and it is a constant on purpose.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <b>This must never become a setting.</b> ADR 0011 rule 2 says the deployment a client signs in to
|
||||
/// is never where the client comes from, and it says the same about the update check: an operator who
|
||||
/// can answer "is there a newer version" can answer "no" forever, and pin a chosen user to a build
|
||||
/// with a known hole without holding any key. A configurable feed URL is exactly the knob that would
|
||||
/// hand them that, whether through a settings screen or through somebody editing the plaintext
|
||||
/// settings.json by hand. A constant is that rule expressed structurally rather than as a convention
|
||||
/// somebody has to keep.
|
||||
/// </remarks>
|
||||
private const string RepositoryUrl = "https://git.dodotech.cloud/DodoTech/DodoSSH";
|
||||
|
||||
/// <summary>
|
||||
/// The release channel to read, and it is stated rather than left to the default.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// A contract with <c>scripts/release-windows.ps1</c>, which passes the same word to <c>vpk pack</c>.
|
||||
/// It happens to be Velopack's Windows default, so leaving it unsaid on both sides would work too —
|
||||
/// but unsaid on one side and stated on the other is how a feed goes quiet with no error anywhere:
|
||||
/// the check succeeds, finds nothing, and reports that the client is up to date forever.
|
||||
/// </remarks>
|
||||
private const string ReleaseChannel = "win";
|
||||
|
||||
private readonly UpdateManager manager;
|
||||
|
||||
/// <summary>
|
||||
/// The last thing a check found, kept so that a download and an apply can name it.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Velopack's <c>UpdateInfo</c> carries the delta chain and the target asset, and none of that should
|
||||
/// cross the seam — the shell has no use for it and a test would have to construct it. So the record
|
||||
/// handed upwards is a version string, and this is where the real answer waits to be matched back up.
|
||||
/// </remarks>
|
||||
private UpdateInfo? found;
|
||||
|
||||
internal VelopackUpdateChannel(UpdateManager manager) => this.manager = manager;
|
||||
|
||||
/// <inheritdoc />
|
||||
public bool IsSupported => true;
|
||||
|
||||
/// <inheritdoc />
|
||||
/// <remarks>
|
||||
/// From the assembly rather than from <c>manager.CurrentVersion</c>, so that this and the version an
|
||||
/// un-updatable build reports come from one place. Two ways of answering the same question is how
|
||||
/// they come to disagree.
|
||||
/// </remarks>
|
||||
public string CurrentVersion => ClientVersion.Current;
|
||||
|
||||
internal static UpdateManager CreateManager() =>
|
||||
new(
|
||||
new GiteaSource(RepositoryUrl, accessToken: null, prerelease: false),
|
||||
new UpdateOptions { ExplicitChannel = ReleaseChannel });
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<AvailableUpdate?> CheckAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
// CheckForUpdatesAsync takes no token of its own, so cancellation is observed on either side of
|
||||
// it rather than during. The call is one HTTPS request against a small JSON document; the worst
|
||||
// case is a lock-up already bounded by the handler's own timeout.
|
||||
cancellationToken.ThrowIfCancellationRequested();
|
||||
|
||||
var update = await manager.CheckForUpdatesAsync().ConfigureAwait(false);
|
||||
|
||||
cancellationToken.ThrowIfCancellationRequested();
|
||||
|
||||
if (update is null)
|
||||
{
|
||||
found = null;
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
found = update;
|
||||
|
||||
return new AvailableUpdate(update.TargetFullRelease.Version.ToString());
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public Task DownloadAsync(
|
||||
AvailableUpdate update,
|
||||
IProgress<int> progress,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(update);
|
||||
ArgumentNullException.ThrowIfNull(progress);
|
||||
|
||||
// Velopack reports progress as an Action<int> and the rest of this codebase speaks IProgress<T>,
|
||||
// so the adaptation happens here rather than leaking the older shape into the view models.
|
||||
return manager.DownloadUpdatesAsync(Matched(update), progress.Report, cancellationToken);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public void ApplyAndRestart(AvailableUpdate update)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(update);
|
||||
|
||||
// Does not return: the process is replaced. Anything that needed to happen before the window
|
||||
// closes has to have happened already — see the shell's restart command, which disposes first.
|
||||
manager.ApplyUpdatesAndRestart(Matched(update).TargetFullRelease);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The guard exists because the seam narrows <c>UpdateInfo</c> down to a version string, so nothing in
|
||||
/// the type system stops a caller inventing one. Every legitimate caller passes back exactly what
|
||||
/// <see cref="CheckAsync"/> returned; a mismatch is a bug in this application rather than anything a
|
||||
/// user did, which is why it throws rather than resolving to some safe-looking default.
|
||||
/// </remarks>
|
||||
private UpdateInfo Matched(AvailableUpdate update)
|
||||
{
|
||||
if (found is not { } info
|
||||
|| !string.Equals(info.TargetFullRelease.Version.ToString(), update.Version, StringComparison.Ordinal))
|
||||
{
|
||||
throw new InvalidOperationException(
|
||||
$"No update matching {update.Version} has been found by this channel. "
|
||||
+ "Call CheckAsync and pass back what it returned.");
|
||||
}
|
||||
|
||||
return info;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user