Auto-Updater may fail for signed electron apps

[jfaltermeier]

Bug Description:

When testing updating from Theia-Blueprint 1.13.0 (https://download.eclipse.org/theia/1.13.0/windows/) to the latest version, it fails with this log message:
[error] Error: Error: sha512 checksum mismatch, expected YYK4Rj/MMIRE/MeFSfVuQOeShXxrwdM5TMgjgPc5uvNxLkQpqUMqTX7MoqYeLpW2gvcgaeVDYPfFROu8LIhtSw==, got EwV8hwXMsQ+5qIjZ1HFGcdPJyBqdkXyCZCSopvhPzhRzwltCZRWvthszWrVUGb/ranElMKAH38YFLo8Y0IfRSw==

This is probably caused because we sign the installers after this checksum was computed. So we will have to update the metadata file https://download.eclipse.org/theia/latest/windows/latest.yml with the checksum after signing

Auto-Update works for the unsigned Linux AppImage

Steps to Reproduce:

1. Download 1.13.0 and attempt an update
2. Check logs at C:\Users\<username>\AppData\Roaming\Theia Blueprint\logs\main.log

[jfaltermeier]

@brianking Could you please check this for Mac by updating the 1.13 version: https://download.eclipse.org/theia/1.13.0/macos/
As this is signed as well, I would expect the same issue as for windows.

[brianking]

It's failing on macOS, but with a different error.

[2021-06-30 10:54:08.685] [info]  Checking for update
[2021-06-30 10:54:09.385] [info]  Found version 1.14.0 (url: TheiaBlueprint.dmg)
[2021-06-30 10:54:37.295] [info]  Downloading update from TheiaBlueprint.dmg
[2021-06-30 10:54:37.299] [error] Error: Error: ZIP file not provided: [
  {
    "url": "https://download.eclipse.org/theia/latest/macos/TheiaBlueprint.dmg",
    "info": {
      "url": "TheiaBlueprint.dmg",
      "sha512": "...",
      "size": 341751733
    }
  }
]

I have omitted the sha512 value on purpose, not sure if it is sensitive info.

[jfaltermeier]

It's failing on macOS, but with a different error.

[2021-06-30 10:54:08.685] [info]  Checking for update
[2021-06-30 10:54:09.385] [info]  Found version 1.14.0 (url: TheiaBlueprint.dmg)
[2021-06-30 10:54:37.295] [info]  Downloading update from TheiaBlueprint.dmg
[2021-06-30 10:54:37.299] [error] Error: Error: ZIP file not provided: [
  {
    "url": "https://download.eclipse.org/theia/latest/macos/TheiaBlueprint.dmg",
    "info": {
      "url": "TheiaBlueprint.dmg",
      "sha512": "...",
      "size": 341751733
    }
  }
]

I have omitted the sha512 value on purpose, not sure if it is sensitive info.

Thanks! Seems like electron-userland/electron-builder#2199
I'll have a look at this as well

[jfaltermeier]

Short update on the windows situation. Updating file size and hash in the metadata file is possible and then leads to the installer being downloaded and invoked. However we then hit a further bug: electron-userland/electron-builder#4711

[brianking]

@jfaltermeier Any updates about macOS?

For Windows, do you see any possible workarounds?

I presume we don't want to get out of beta (1.0?) without having updates fixed, right?

[jfaltermeier]

For Windows I have applied a manual fix at the moment, which then leads to a working update: https://download.eclipse.org/theia/latest/windows/
In PR #129 I am working on integrating this into the build process, so that no manual fixes are required. This already fixes the issue mentioned in #116 (comment)

Once this is done, I will continue with Mac, as this is a blocker for getting out of beta.

[jfaltermeier]

@brianking I've set up a small testing environment and I think updating from e.g 1.16.0 (https://download.eclipse.org/theia/1.16.0/) to 1.17.1 on mac os should work now.
It does not work when the dmg is launched from the Downloads directory directly, as this is then mounted as read-only (for this we should probably open a ticket to improve error reporting, because this was only visible in the logs).
But when I copy blueprint to the Applications directory, the update worked for me. Could you please test this as well?

[brianking]

@brianking I've set up a small testing environment and I think updating from e.g 1.16.0 (https://download.eclipse.org/theia/1.16.0/) to 1.17.1 on mac os should work now.
It does not work when the dmg is launched from the Downloads directory directly, as this is then mounted as read-only (for this we should probably open a ticket to improve error reporting, because this was only visible in the logs).
But when I copy blueprint to the Applications directory, the update worked for me. Could you please test this as well?

This update worked successfully for me @jfaltermeier. The only thing missing for me is a progress indicator for the download. It appeared for a while that nothing was happening, until the notification came up prompting me to apply the update.

[jfaltermeier]

@brianking I've set up a small testing environment and I think updating from e.g 1.16.0 (https://download.eclipse.org/theia/1.16.0/) to 1.17.1 on mac os should work now.
It does not work when the dmg is launched from the Downloads directory directly, as this is then mounted as read-only (for this we should probably open a ticket to improve error reporting, because this was only visible in the logs).
But when I copy blueprint to the Applications directory, the update worked for me. Could you please test this as well?

This update worked successfully for me @jfaltermeier. The only thing missing for me is a progress indicator for the download. It appeared for a while that nothing was happening, until the notification came up prompting me to apply the update.

Thanks! I've opened #160 and #161