Public Access
Let the desktop client replace itself, and give the repository one version
Packaging for Windows, and the updater that only exists once something is
packaged. Velopack, win-x64, fed from the project's own forge — never from the
deployment a client signs in to, which is ADR 0011 rule 2 carried over
unchanged and is why the feed address is a constant in the code rather than a
setting. See docs/adr/0012-desktop-distribution-and-updates.md.
**Nothing is ever installed while somebody is using it.** A newer build is found
on a six-hourly pass, downloaded in the background, and then waits — for a
restart the user presses, or for the next launch they were going to do anyway.
That is a policy rather than caution: this application argues at length that
locking keeps shells running, because a lock that destroyed work would stop
being used, and a restart does not keep them. Having taught that, it owes the
user the choice at the one moment it stops being true, and the sentence saying
so counts the shells it would close.
**The version is now derived from the v* tag**, by MinVer, for everything. There
was no version before this — no property anywhere, so every assembly reported
the SDK's 1.0.0 and the API served that string as its serverVersion to every
client that asked. The tag was already the version of record for the container
image; this makes it the version of record full stop. MinVer's failure mode is
answering plausibly rather than failing, and here a wrong version is a client
that never updates, so it is guarded twice: fetch-depth 0 on every checkout, and
a step that fails a tag build when the tag and the computed version disagree.
**The pack id is DodoSSH.Desktop and not DodoSSH**, which is the one decision
here that would have destroyed data. Velopack installs to %LOCALAPPDATA%\<packId>
and removes that whole directory on uninstall, and %LOCALAPPDATA%\DodoSSH is
where ClientPaths keeps the encrypted cache, the outbox of changes not yet
pushed, and the device key. The obvious id would have had the uninstaller
silently delete work the server has never seen — the thing the application
refuses to do without a counted confirmation. Velopack's own advice to move user
data to roaming %APPDATA% is declined for the reason ClientPaths already gives.
**Releases are cut by a person, and CI gains no job that could.** The tempting
argument is that a forge write token is not a signing key. It does not survive
contact with what the token does: Velopack clients trust their feed and do not
verify a package signature when they apply one, so whoever can write a release
can ship an update every install runs. That is the capability ADR 0011 rule 1
puts on a machine which is not a runner, reached through a different door. The
mechanical objection — vpk needs Windows and the runners are Linux — is the
smaller of the two and is recorded beside it, because somebody will fix one and
believe they are done.
Unsigned for now, deliberately and with the cost stated where a user reads it:
SmartScreen warns once per person, on Setup.exe, because Mark-of-the-Web is
applied by the browser that downloaded it. In-app updates are fetched by the
application and applied from a local file, and never trip it.
The banner is a fourth row of the window rather than an overlay. Anything drawn
in the terminal's rectangle is sliced by the native child window that composites
above it — the defect this window has shipped once — and a sibling row is the
arrangement TitleBar and StatusBar already prove works.
----
Three defects surfaced on the way, none of them in the feature being built.
**A settings key absent from the file came back as the CLR default, not the
declared one.** The JSON source generator builds a record through a synthesised
parameterised constructor and assigns every property from its argument array, so
a property initializer runs and is then overwritten by a default for anything the
file did not contain. A settings.json of {} read back a font size of 0, clamped
up to the 8px floor rather than the 13px the renderer draws at. It could not bite
while there was one setting, because that setting was written on every save and
so was never absent; adding a second would have turned automatic update checks
off for every existing profile, silently, the opposite of the documented default.
Reflection-based deserialisation of the same JSON answers correctly, which is why
every way of checking it by hand agrees except the one that ships. The defaults
now live on the constructor parameters, which is the only place the generator
reads them from.
**Declaring a RuntimeIdentifier on the desktop head broke the server's image
build.** It is the obvious way to let a self-contained publish restore under
locked mode, and it writes a net10.0/win-x64 target into the lock file of every
project the head references transitively — including DodoSSH.Contracts and
DodoSSH.Crypto, which the API builds too. The Dockerfile restores those with no
RID and fails NU1004. Found by running docker build rather than by reading. The
RID stays out of the committed state; the two commands that need one ask for it
unlocked, and the release script puts the lock files back.
**A Docker ARG named VERSION silently sets MSBuild's Version.** An ARG is an
environment variable for the rest of the stage, MSBuild reads environment
variables as properties, and property names are case-insensitive. With the
workflow passing main-<short sha> on a main build the publish died with
NETSDK1018 pointing at DodoSSH.Contracts, a project nobody had touched. The build
stage's argument is ASSEMBLY_VERSION now, empty except on a tag build.
All three are in docs/platform-flags.md, which is where the next person will look.
----
Verified: the whole solution builds and restores locked; 289 shell, 93 layout and
54 session tests pass, including the regression test for the settings defect and
a measurement of the banner at the window's minimum width. vpk pack runs end to
end and reports "Verified VelopackApp.Run()" against Program.Main. The API image
builds correctly both as a main build and as a tag build, carrying 1.0.0 and
0.1.0 respectively.
Not verified, and it needs a published release to be: installing, updating and
uninstalling on a real machine. That is Phase 15 of docs/manual-checks.md, and
the pack id and the WebView2 profile fix are reasoned and commented but only
proved by walking it. Two things to watch at the first upload — the reverse
proxy's body-size limit for a 64 MB asset, and whether vpk upload gitea is happy
with Gitea 1.27.1.
This commit is contained in:
@@ -70,7 +70,7 @@
|
||||
fires only for its own IsVisible.
|
||||
-->
|
||||
|
||||
<Grid RowDefinitions="Auto,*,Auto">
|
||||
<Grid RowDefinitions="Auto,*,Auto,Auto">
|
||||
|
||||
<views:TitleBar Grid.Row="0" />
|
||||
|
||||
@@ -334,7 +334,24 @@
|
||||
|
||||
</Panel>
|
||||
|
||||
<views:StatusBar Grid.Row="2" />
|
||||
<!--
|
||||
A fourth row, and a row rather than an overlay for the reason the occlusion rule above gives: this
|
||||
appears while a terminal may be open, and anything drawn in the WebView's rectangle is sliced. Taking
|
||||
height from the row above moves the native control's bounds instead of covering it, which is the one
|
||||
arrangement that works — the same one TitleBar and StatusBar already rely on.
|
||||
|
||||
It is a separate control because nothing in this file can be measured by a test, and a strip with two
|
||||
buttons and a version string of unknown length is exactly the shape that arranges one of them off the
|
||||
edge. See UpdateBanner.axaml.
|
||||
|
||||
FallbackValue, for the reason the WebView and the connecting card carry one: a compiled binding with
|
||||
no DataContext yields UnsetValue, IsVisible falls back to true, and the previewer would show a banner
|
||||
announcing an update that does not exist.
|
||||
-->
|
||||
<views:UpdateBanner Grid.Row="2"
|
||||
IsVisible="{Binding Updates.IsBannerShowing, FallbackValue=False}" />
|
||||
|
||||
<views:StatusBar Grid.Row="3" />
|
||||
|
||||
</Grid>
|
||||
|
||||
|
||||
@@ -61,6 +61,79 @@
|
||||
|
||||
<Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
|
||||
|
||||
<TextBlock Classes="mono" Text="UPDATES" FontSize="14" FontWeight="SemiBold"
|
||||
LetterSpacing="1" Foreground="{StaticResource Text}" />
|
||||
|
||||
<!--
|
||||
Not on the design at all, unlike everything else here. It arrived with packaging: an installed
|
||||
client can replace itself, and the moment that is true the question of where a replacement comes
|
||||
from stops being theoretical. The answer is the security content of this section rather than a
|
||||
footnote to it, which is why it is printed under the version instead of hidden in a tooltip.
|
||||
-->
|
||||
<TextBlock Classes="mono" Text="{Binding Updates.CurrentVersion}" FontSize="12" Margin="0,8,0,0"
|
||||
Foreground="{StaticResource Info}" TextTrimming="CharacterEllipsis" />
|
||||
<TextBlock Classes="hint" FontSize="11" Margin="0,4,0,0"
|
||||
Text="Builds come from the project's own release page, and never from the server you sign in to. That is deliberate: whoever hands you the client can hand you a client that copies your passphrase, and the operator of a DodoSSH deployment is the party the trust model is about. A deployment may tell you where to get it. It is not where it comes from." />
|
||||
|
||||
<Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0">
|
||||
<StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
|
||||
<TextBlock Text="Check for updates" Foreground="{StaticResource Text}" FontSize="13"
|
||||
FontWeight="Medium" />
|
||||
<TextBlock Classes="hint" FontSize="11"
|
||||
Text="Asks the release page whether there is a newer build, and downloads it if there is. Nothing is ever installed while you are using it — a downloaded update waits for a restart you ask for, or for the next time you start DodoSSH." />
|
||||
</StackPanel>
|
||||
<Button x:Name="CheckNowButton" Grid.Column="1" Classes="ghost" Content="CHECK NOW"
|
||||
Command="{Binding Updates.CheckNowCommand}"
|
||||
IsEnabled="{Binding Updates.CanCheckNow}" />
|
||||
</Grid>
|
||||
|
||||
<Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0">
|
||||
<StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
|
||||
<TextBlock Text="Check on its own" Foreground="{StaticResource Text}" FontSize="13"
|
||||
FontWeight="Medium" />
|
||||
<TextBlock Classes="hint" FontSize="11"
|
||||
Text="Every six hours while DodoSSH is running, starting a couple of minutes after launch. It keeps checking while the keychain is locked, because where builds come from has nothing to do with your vault." />
|
||||
</StackPanel>
|
||||
<CheckBox x:Name="AutomaticUpdatesToggle" Grid.Column="1" VerticalAlignment="Top"
|
||||
IsChecked="{Binding Updates.IsAutomatic}"
|
||||
IsEnabled="{Binding Updates.IsSupported}" />
|
||||
</Grid>
|
||||
|
||||
<!-- The only other ProgressBar in the application is the transfers one; same height, same brushes. -->
|
||||
<ProgressBar Height="4" Minimum="0" Maximum="100" Margin="0,12,0,0"
|
||||
Value="{Binding Updates.DownloadPercent}"
|
||||
Foreground="{StaticResource Accent}" Background="{StaticResource Raised}"
|
||||
IsVisible="{Binding Updates.IsDownloading}" />
|
||||
|
||||
<!--
|
||||
The restart, with the sentence the banner only has room for in a tooltip. This screen scrolls, so
|
||||
this is where the warning can be as long as it needs to be — and it needs to be, because this
|
||||
application has spent a lot of words teaching that locking keeps shells running.
|
||||
-->
|
||||
<Grid ColumnDefinitions="*,Auto" Margin="0,14,0,0" IsVisible="{Binding Updates.IsReady}">
|
||||
<StackPanel Grid.Column="0" Spacing="2" Margin="0,0,16,0">
|
||||
<TextBlock Text="{Binding Updates.ReadyHeadline}" Foreground="{StaticResource Text}"
|
||||
FontSize="13" FontWeight="Medium" TextWrapping="Wrap" />
|
||||
<TextBlock Classes="hint" FontSize="11" Text="{Binding Updates.RestartWarning}" />
|
||||
</StackPanel>
|
||||
<Button Grid.Column="1" Classes="accent" Content="RESTART NOW"
|
||||
Command="{Binding Updates.RestartNowCommand}" />
|
||||
</Grid>
|
||||
|
||||
<TextBlock Classes="hint" FontSize="11" Margin="0,8,0,0"
|
||||
Text="{Binding Updates.Status}"
|
||||
IsVisible="{Binding Updates.Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
|
||||
|
||||
<!--
|
||||
The HasNoDeviceKeyOption precedent, one section up: a machine that gets none of the above is told
|
||||
why rather than shown three controls that cannot do anything.
|
||||
-->
|
||||
<TextBlock Classes="hint" FontSize="11" Margin="0,8,0,0"
|
||||
Text="This copy of DodoSSH cannot replace itself, so none of the above does anything. That is what a build run from a source checkout looks like, and also what a copy somebody unzipped by hand looks like — it is the installer that registers the update path."
|
||||
IsVisible="{Binding Updates.IsUnsupported}" />
|
||||
|
||||
<Border Height="1" Background="{StaticResource BorderSubtle}" Margin="0,20" />
|
||||
|
||||
<TextBlock Classes="mono" Text="TERMINAL" FontSize="14" FontWeight="SemiBold"
|
||||
LetterSpacing="1" Foreground="{StaticResource Text}" />
|
||||
|
||||
@@ -185,7 +258,7 @@
|
||||
<TextBlock Classes="gap"
|
||||
Text="Terminal font, size, cursor and scrollback — the renderer hard-codes them, and nothing carries a change to it." />
|
||||
<TextBlock Classes="gap"
|
||||
Text="Any preference at all, saved — there is no preferences store in the local cache and no preference item type in the keychain." />
|
||||
Text="A beta channel — there is one release channel, and a switch offering a second would be a preference with nothing behind it." />
|
||||
<TextBlock Classes="gap"
|
||||
Text="Auto-lock after idle — nothing tracks idleness, and the lock policy would have to decide what to do about a shell mid-job." />
|
||||
<TextBlock Classes="gap"
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
<UserControl xmlns="https://github.com/avaloniaui"
|
||||
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
||||
xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
|
||||
x:Class="DodoSSH.Client.App.Views.UpdateBanner"
|
||||
x:DataType="vm:UpdateViewModel">
|
||||
|
||||
<!--
|
||||
The strip that says a newer build has been fetched, and asks when.
|
||||
|
||||
── WHERE IT LIVES, WHICH IS THE WHOLE DESIGN ──────────────────────────────────────────────────────────
|
||||
|
||||
A row of MainWindow's root grid, between the content and the status bar. Not an overlay, and that is not
|
||||
a preference: NativeWebView hosts a real Win32 child window that composites above everything Avalonia
|
||||
paints in the same rectangle, so anything drawn over the terminal is sliced at its left edge with its
|
||||
buttons unreachable — a defect this window has shipped once. See the occlusion rule in MainWindow.axaml
|
||||
and docs/platform-flags.md.
|
||||
|
||||
A sibling row is the arrangement that is already proven here twice over: TitleBar sits above the
|
||||
terminal and StatusBar below it, and both draw and take clicks correctly. Taking height from the row the
|
||||
WebView is in moves its bounds rather than covering it, which is what NativeControlHost re-pushes on
|
||||
layout.
|
||||
|
||||
The cost, stated rather than discovered: the terminal gets 48 fewer pixels while this is up, so the grid
|
||||
reflows and the remote is told it has fewer rows. That is the same reflow any window resize causes and
|
||||
the renderer already handles it — and the alternative is the arrangement that does not work at all.
|
||||
|
||||
── WHY IT IS ITS OWN FILE ─────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
Nothing inside MainWindow can be laid out by a test — WebView2's adapter refuses the headless session's
|
||||
thread, see LayoutHarnessTests.WhyTheWindowItselfIsNeverShown — so markup left there is markup nobody can
|
||||
measure. This control has two buttons and a version string of unknown length in one fixed-height row,
|
||||
which is exactly the shape that arranges something off the right edge. UpdateBannerTests measures it.
|
||||
|
||||
── ONE LINE HIGH ──────────────────────────────────────────────────────────────────────────────────────
|
||||
|
||||
Fixed height and trimmed rather than wrapped, for the reason StatusBar gives about itself and with more
|
||||
force: a message that grew this row would shrink the terminal further, and it would do it while somebody
|
||||
is reading it.
|
||||
-->
|
||||
|
||||
<Border Height="48" Background="{StaticResource AccentWash}"
|
||||
BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0">
|
||||
|
||||
<Grid ColumnDefinitions="Auto,*,Auto" Margin="14,0">
|
||||
|
||||
<Border Grid.Column="0" Classes="chip" BorderBrush="{StaticResource Accent}">
|
||||
<TextBlock Classes="mono" Text="UPDATE" FontSize="10" FontWeight="SemiBold"
|
||||
LetterSpacing="1" Foreground="{StaticResource Accent}" />
|
||||
</Border>
|
||||
|
||||
<TextBlock Grid.Column="1" Margin="12,0,16,0" VerticalAlignment="Center"
|
||||
FontSize="13" Foreground="{StaticResource Text}"
|
||||
TextTrimming="CharacterEllipsis"
|
||||
Text="{Binding ReadyHeadline}" />
|
||||
|
||||
<StackPanel Grid.Column="2" Orientation="Horizontal" Spacing="6" VerticalAlignment="Center">
|
||||
|
||||
<!--
|
||||
LATER is honest, which is what makes it safe to offer at all. The dismissal lasts this run, the
|
||||
preferences row goes on offering the restart, and the build that has already been fetched is what
|
||||
starts next time regardless — so nothing is given up by pressing it, and the tooltip says so
|
||||
rather than leaving somebody to wonder whether they have just refused the update.
|
||||
-->
|
||||
<Button Classes="ghost" Content="LATER" Command="{Binding DismissBannerCommand}"
|
||||
ToolTip.Tip="Hides this until the next launch. The update is already downloaded and will be running the next time you start DodoSSH, so nothing is lost by waiting." />
|
||||
|
||||
<!--
|
||||
The warning is on the tooltip rather than in the strip because it is a sentence and this is one
|
||||
line — and because its whole job is to be read before the button is pressed, not after. The long
|
||||
form is on the preferences screen, which scrolls.
|
||||
-->
|
||||
<Button x:Name="RestartNowButton" Classes="accent" Content="RESTART NOW"
|
||||
Command="{Binding RestartNowCommand}"
|
||||
ToolTip.Tip="{Binding RestartWarning}" />
|
||||
|
||||
</StackPanel>
|
||||
|
||||
</Grid>
|
||||
|
||||
</Border>
|
||||
|
||||
</UserControl>
|
||||
@@ -0,0 +1,8 @@
|
||||
using Avalonia.Controls;
|
||||
|
||||
namespace DodoSSH.Client.App.Views;
|
||||
|
||||
internal sealed partial class UpdateBanner : UserControl
|
||||
{
|
||||
public UpdateBanner() => InitializeComponent();
|
||||
}
|
||||
Reference in New Issue
Block a user