Patchbay 0.1.3 — it tells you when there is a new one

Patchbay checks for its own updates now. On Windows it installs them; on macOS
it hands you the download. Either way nothing happens without you pressing
something.

This is an app-only release: qc_mcp, the daemon and the protocol are
identical to 0.1.2.

What it does

• A check every six hours, and once three seconds after launch. It asks
  GitHub for the newest release and compares it with the version you are
  running. A release candidate is never offered — those are published as
  prereleases and the check skips them.
• A chip in the rail when there is something newer, and only then. A check
  that finds nothing, or fails, says so in Preferences rather than putting a
  button in the corner of your window.
• Windows installs it. The installer downloads in the background and goes in
  the next time you quit Patchbay — or immediately, from Restart to update,
  which puts the app back when it is done.
• macOS opens the release page and you install the dmg yourself. Not a
  signing question: the dmg is Developer ID-signed and notarized, has been since
  0.1.1. It is packaging. In-place updates on macOS install from a zip feed and
  Patchbay ships a dmg, so giving it one means a third artifact through
  Apple's notary queue on every release. That is its own piece of work.
• Preferences has the switch that turns the automatic check off, a Check
  now that ignores the switch, and the result of the last check in words.
  Turning the switch off also clears the chip.

The last one you install by hand

0.1.2 has no updater in it, so it cannot tell you about this release — you are
reading these notes because you came looking. Install 0.1.3 the usual way and
that is the last time on Windows; from here the app does it.

macOS keeps handing you the dmg, by design, but at least it will now tell you
there is one.

Also

The version in the bottom-right corner said 0.1.0 for three releases. It was
hardcoded. It reads the running version now, which is the same number the update
check compares against — one version, not two that can drift apart.

Windows

Still unsigned: SmartScreen asks on first run, More info → Run anyway.
The same is true of the installer the updater downloads for you.

Worth being plain about what that means. The update is fetched over HTTPS from
this repository's releases and checked against the SHA-512 recorded in the
release's latest.yml, so a corrupted or swapped file is rejected. What is
missing is an Authenticode signature — there is no publisher certificate to
verify it against, because the build does not have one. That is unchanged from
installing the exe by hand; it is not something the updater weakens.

Verified

The Windows path was exercised end to end on real hardware rather than
reasoned about: a 0.1.2 installed from its own installer, a 0.1.3 served from a
local feed, and the app left to find it. It read the feed, tried a differential
download, fell back to the full installer when the older block map was not
there, reported itself ready, and on Restart to update installed 0.1.3 and
came back — the registry's recorded version moving 0.1.2 → 0.1.3 at the end of
it.

Pointed at this repository while the newest release was 0.1.2 — which carries
no update metadata, being older than the updater — the check fails, and that is
what Preferences reports. From this release on, the metadata is there.

The version comparison and the check that a release URL is really GitHub over
https now have unit tests, and CI runs them.