Update in place on macOS and Windows

[IAmJSD]

The update check knew how to say a release existed and nothing else — the status line named a version and pointed at a URL, and the rest was the user's problem. It now downloads and installs the release on the two platforms where Schist owns its own install, and stays out of the way on the one where it does not.

What it does

macOS unpacks the release's Schist.zip beside the running bundle (a rename cannot cross volumes) and swaps it in with a rename. The download is held to this copy's signature first: a signed bundle only takes an update signed by the same team, and any signature present must pass codesign --verify --strict. The old bundle steps aside rather than being deleted, so a failed swap rolls back. A relauncher waits on our PID and opens the new bundle.

Windows hands Schist-<version>-setup.exe to a detached process that waits for this one to exit — a running schist.exe cannot be overwritten — then runs it /S elevated and starts the result unelevated.

Linux installs nothing. A copy from pacman, apt or an AppImage belongs to whatever put it there, so the dialog names the new version and links to the release.

Self-updating only offers itself where the copy is one Schist may replace: a writable .app bundle, or the directory holding the uninstall.exe the NSIS installer writes. A loose schist.exe or a cargo run build is left alone, and gets the Linux treatment.

The dialog

Later · Release Notes · Update and Restart, with a progress bar while the download runs and a Cancel that abandons it. Escaping the dialog mid-download is a cancel too — dismissing the thing that asked must not leave an update to land on its own. Restarting goes through request_quit, so unsaved documents are still prompted for; backing out of one of those prompts leaves the update staged rather than lost.

Preferences gains "Check for new releases at launch" (on by default). That check runs at most once a day, does not consume the day when it fails to reach GitHub, and yields to any dialog the user already has open.

Notes

• Update handling moves out of crash.rs into crates/app/src/update.rs; what is left there is crash reporting, which is all its name claimed.
• The downloaded file is checked against the SHA-256 GitHub records for the asset, when the release has one. The Windows installer is still unsigned, so that download rests on HTTPS plus the digest, where macOS gets a real signature check.
• The updater matches release assets by name (Schist.zip, Schist-<version>-setup.exe). Renaming either in release.yml without changing update.rs would silently end self-updating — written down in the new "Updating" section of docs/versioning.md.

Testing

cargo fmt --check, cargo clippy -p schist-app --all-targets -- -D warnings and cargo test -p schist-app (40 passed) are green. Both platform paths that Linux compiles away were type-checked as well: macOS by retargeting its cfg, Windows through the x86_64-pc-windows-gnu cross-check. Neither install path has been exercised against a real release yet — that wants a tagged build on each platform.

🤖 Generated with Claude Code