Updates

Updates

Two things need keeping up to date — Flotilla itself, and Apple's container — and on two kinds of Mac. The rule that shapes all of it: an admin Mac updates itself, and hosts are updated by their admin. A host is usually a Mac mini with nobody at it, and keeping every one current by copying builds across by hand does not scale.

Version numbers

Flotilla has its own version number, in the form X.Y.Z, such as 1.5.0-beta.5. Betas add a -beta.N. It is not the same as container's number: Flotilla 1.5.0-beta.5 was tested with container 1.5.0, and Settings ▸ About says both. The status bar shows the Flotilla version.

Updates work as before. Flotilla orders its builds by build number, not by the label, so a build is never replaced by an older one.

Flotilla on an admin Mac

An admin updates through Sparkle, the standard updater for Mac apps outside the App Store. Updates are signed, notarised zips on GitHub releases, listed in a signed feed. Every update is checked against the signing key built into Flotilla before it is installed, so a tampered download is refused.

Consent, not a default

Flotilla promises not to phone home, and an automatic check reaches GitHub. So Sparkle asks once, on the second launch, whether to check automatically, and Flotilla does nothing until you answer. If you or a managed profile have already set the update settings, Sparkle uses them and does not ask.

Check for Updates… is always your explicit request. It is in the Flotilla menu, the menu-bar menu, and the version menu in the status bar at the bottom left of the window.

Settings ▸ Updates

• Automatically check for updates — what Sparkle asked you.
• Automatically download updates — off by default. On, Sparkle downloads and installs in the background without asking.
• Check every — in hours; at least one, a day by default.
• Update channel — Stable sees releases only; Prerelease sees betas too. Betas are published on the prerelease channel, so a beta tester needs it.

A development build has no update feed. Its menu item and version say so, and are disabled.

The suggestions library and vulnerability reports

Apart from Flotilla itself, Flotilla keeps the suggestions library current: the apps, stacks and logos in Suggestions. Once a day it also fetches the signed vulnerability report for the library's images. See Vulnerability reports.

Both files are the same for everyone, are checked against a key built into Flotilla, and carry nothing about your Mac. Check for new suggestions daily in Settings ▸ Updates turns the daily check off. Check Now, in the version menu in the status bar, checks when you ask.

Update checks show their steps

An update check says what it is doing: checking, downloading, verifying, installing. You see it in the status bar, next to Tasks, while Tasks is quiet.

Flotilla on hosts

A host never checks Sparkle. Its menu item reads Updated by Your Admin Mac, and its version menu says the same.

Instead, the admin sends its own copy of Flotilla to each host that is behind it, over the same connection it uses for everything else. The host checks it before anything is replaced:

• It is Flotilla, signed with an Apple Developer ID from the same team as the copy already installed there, and every binary inside it is valid.
• Its build number is higher than the one running there. Never a downgrade, never a sideways swap.

That makes the admin's power "install a newer, genuine Flotilla", never "run code". Then the host waits until it is idle — nothing running for its admin, no log being followed, no other transfer — for up to ten minutes, swaps the app in, answers the admin, and relaunches. Its containers run under container's own services and are not touched.

Where a package installed Flotilla in /Applications, owned by root, the app cannot replace itself, so the Flotilla Helper makes the swap after checking it all again as root.

How the admin rolls it out

• Update Hosts Automatically, in the Hosts toolbar's updates menu, is on by default. Whenever this Mac is newer, it updates its hosts one at a time and stops at the first failure, so a bad build never reaches the whole fleet.
• Update N Hosts Now in the same menu, or Update 2 Hosts Now on Overview, does the same regardless of the setting.
• Update on a host's row, where its Flotilla version shows, or Update Now on its page's Updates tab, updates one.

After sending, the admin waits up to four minutes for the host to come back on the new build. If it does not, the update counts as failed, and a red notice with Retry says why. A failure is not dismissible: it means a host is not running what you think it is.

Limits

• Old hosts update by hand once. Updating from an admin needs both Macs on beta 2 or later. A host on an older build is marked Too old to update from here — install by hand. A host that a package installed before the Helper could make the swap gets the same instruction: install the new build there once with the package, and after that it updates like the others.
• Update the admin first. It can only send the build it is running. Some controls also need the host on the same release: starting and stopping a host's container from the admin, and setting its auto-start, need the host on beta 4 or later. The health-check and restart-policy actions need beta 5.
• The host's owner can refuse. Install Flotilla updates from its admin, in the host's Settings ▸ Hosts and Fleet, is on by default. Off, the host refuses and says its owner turned it off. A profile can lock it off, so that a management tool stays in charge of updates on managed Macs.
• An admin cannot update a host that is newer than itself. That host shows Newer than This Mac. Update the admin first.

container on hosts

Each Flotilla release expects one container version — 1.5.0 for beta 5. A host brings itself to that version through its Helper, which downloads Apple's signed installer and checks, as root on its own copy, that it is Apple's, notarised and the version asked for.

Install and upgrade container by itself, in the host's Settings ▸ Hosts and Fleet, lets the host do this on its own, at launch and every half hour. On its own, it will:

• install container where there is none;
• upgrade only when no container is running, because an upgrade restarts container and stops everything.

Otherwise the upgrade waits for the admin. Overview's Updates box offers Upgrade 2 Hosts…, and a host's row and page offer Upgrade… or Install…. The confirmation says how many containers will stop, and the button reads Stop Containers and Upgrade when any will. They do not start again by themselves.

An upgrade you start from the admin runs on the host even with that setting off: you asked for it, having seen what stops. It still needs the host's Helper switched on. Several hosts upgrade one at a time, so the fleet is never all restarting at once, but unlike a Flotilla rollout a failure on one does not stop the rest — each container upgrade stands alone.

After container, Flotilla installs the recommended kernel if the host has none. That goes through container itself, not the Helper.

container on an admin

On the Mac you sit at, installing container is always your choice. Flotilla downloads Apple's installer, checks it, and opens it in Apple's Installer, where you approve with your password. Upgrading an older container there is up to you. See Requirements and install.