feat(windows): automatic startup and recoverable BF-hosted updates - #37
Merged
Merged
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
bcbetterninja
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows installs now start the desktop app at sign-in and install an automatic LocalSystem updater service. The desktop launches without a console and prevents duplicate agents in the same session. MSI repair, upgrades and removal own the startup entry and service.
Windows release builds embed the publisher key, sign the MSI, and upload immutable bytes to BF before publishing the GitHub asset. Devices check and download only from their configured BF origin, reject redirects, and verify signature, hash, size, product, platform and version before execution.
The updater runs independently of enrollment and the desktop. It persists maintenance windows, IANA timezone, channel and pin; failed authentication can recover through BF public endpoints using that saved policy. Authenticated admin pushes are version/policy-bound and expire. Public responses cannot bypass the window. Cancellation invalidates cached policy, and rate limiting defers downloads without consuming installation attempts.
Before replacement, the service retains a verified full installer for the installed version. A separate worker installs silently, probes both executables and waits for local display health. Failed candidates roll back; a durable journal recovers interrupted transactions. Retries are bounded and the service survives installer failure. The archived delivery design is now tracked in
docs/release-delivery.md; deployment and recovery details are indocs/windows-updates.md.Validation: validate run 36209161574 passed on c08773a. This includes native Windows workspace tests, full MSI install/startup/service/repair/uninstall checks, and SYSTEM-service recovery after missing enrollment, rejected authentication, a broken candidate and an interrupted transaction. Server (154 PostgreSQL-backed tests), Linux client, deployment and ioBOX checks also passed. The publication gate was exercised with simulated acknowledgments: valid storage acknowledgment succeeds; redirects, wrong checksums and missing release IDs fail. The separate Android workflow, including Android 16 smoke tests, also passed. The release-only clean-host job and production publication/deployment have not been run.
Deployment requires the server migration/proxy configuration and an initial updater-enabled MSI installation. Current and previous signed Windows releases must be retained on BF. This PR does not configure automatic Windows logon, deploy the server, or publish a release.