Extraction Initiated Manually

[nathan-courtney-pieces]

Hello!

I was wondering if it is possible to programmatically trigger extracting the archive after it was already downloaded. After messing around for a while, it appears that there isn't currently a way to wait or pause before manually invoking to extract the update.

I have been working on implementing my own programmatic UI set up in Swift for my application using SPUUpdaterDelegate and SPUUserDriver. All of this works out great, although I cannot create my own trigger for extracting the update without hanging the UI with the rainbow spinner of death.

This goes back to the issue of the application being owned by the system (root) instead of the user.

Sparkle is able to download the update without elevated permissions, but extracting the archive will always throw up a pop up asking the user for their password.

Now, I know that using a PKG installer will, by default, write the app to /Applications as root, which is why this is happening. I have already 'fixed' my PKG installer by changing the ownership within a post-installation script (which will prompt the user for their password upon installation).

After 'fixing' my installer, If I automatically download and extract the update in the background, I can throw up a button that will allow the user to just click to install and restart upon handling the 'reply' (kinda like the Squirrel Framework or Google's OMAHA) by utilizing:

func showReadyToInstallAndRelaunch() async -> SPUUserUpdateChoice

Which will wait asynchronously for a trigger.

However, my existing users are subjected to my past ignorance, and if an update starts downloading automatically in the background without them knowing about it, they will get a random password prompt without triggering anything themselves, which I would think looks a little shady to the user.

What I would love to do in this case, is have the ability to have the update downloaded, but then throw up something in the UI to allow the user to trigger the extraction which will throw up the password prompt, then install and restart all in one click of a button after the user enters their password.

If anyone has ideas or recommendations to handle this case, I would be open to trying them out!

If none of this is possible, I will have my app check for an available update and if it finds one, then prompt the user to click a button to download/extract, then prompt them to install/restart in the case that the app is owned by system (root). This would be a two step process like how sparkle works by default with its built in pop ups. Wanted to avoid that if I could!

Thanks!

[zorgiepoo]

Now, I know that using a PKG installer will, by default, write the app to /Applications as root, which is why this is happening. I have already 'fixed' my PKG installer by changing the ownership within a post-installation script (which will prompt the user for their password upon installation).

Sparkle always tries to run installer as root and will and always assumes asking for authorization is needed if pkg installs are involved. (In fact I thought running installer as non-root was unsupported, but maybe I'm not remembering the minor details here).

What you're trying to do is incorrect; the user driver should not be trying to start downloading the update automatically behind the user's back. Instead, if you don’t want to show the update downloading, opt into SUAutomaticallyUpdate and have your app perform a background update check (either automatically on a scheduled basis or manually depending on your use case).

Normally with this automatic setting, Sparkle tries to silently install the update on quit without notifying the user, but there are a few cases where Sparkle will show the update (via your user driver) to the user. One of these cases is when the update requires authorization, which is always the case for pkg installs. Here you may see that the update's stage is already SPUUserUpdateStageDownloaded in -showUpdateFoundWithAppcastItem:state:reply:

Side note: pkg installations are generally discouraged on macOS; there are many developers that use them and really shouldn't be using them.

[buzunboy]

Hi, thanks for directing me that discussion @zorgiepoo!
I see the point, but since Sparkle already have an option to start downloading updates behind the user's back for other type of distributions, and it doesn't have root privileges during downloading the package, I'm trying to understand why it is not a correct choice?
Informing the user and proceeding further to asking for admin password could be useful.

[zorgiepoo]

The point is the wrong APIs are being used. If you want to automatically download updates in the background, use the correct API for it (SUAutomaticallyUpdate). Then the user driver comes to play after the update has been downloaded in the background to show the user of the update that has been downloaded and to begin extracting/installing, which will also involve the authorization prompt.

Also note package installs are not unique to this regard because authorized installs can still occur for regular installs. However package installs make authorized installs occur 100% of the time.

checkForUpdates is also intended for manual/user-initiated update checks. If I were to guess you were probably also not showing progress in showUserInitiatedUpdateCheckWithCancellation: which is also incorrect. checkForUpdatesInBackground on other hand is intended for background update checks (by default Sparkle automatically schedules calling this API).

[buzunboy]

I see, but anyway SUAutomaticallyDownloadUpdates doesn't have much of an effect for pkg distributions. I used checkForUdpatesInBackground in my case, however if the download never completed before the sparkle returns notDownloaded for every updates that it finds first time.

One more question/idea while mentioning authorization. Why installer is being installed/submitted to the privileged tools using SMJobSubmit? It could use SMJobBless instead, and helper could be installed one time as long as it doesn't need to be updated. Have it's ever discussed?

[zorgiepoo]

I see, but anyway SUAutomaticallyDownloadUpdates doesn't have much of an effect for pkg distributions. I used checkForUdpatesInBackground in my case, however if the download never completed before the sparkle returns notDownloaded for every updates that it finds first time.

This should be completely incorrect. It is SUAutomaticallyUpdate not SUAutomaticallyDownloadUpdates. Perhaps you tried with the wrong key.. Check also the value of automaticallyDownloadsUpdate property (note SUAutomaticallyUpdate is for setting the initial value and setting automaticallyDownloadsUpdate is for user setting changes).

One more question/idea while mentioning authorization. Why installer is being installed/submitted to the privileged tools using SMJobSubmit? It could use SMJobBless instead, and helper could be installed one time as long as it doesn't need to be updated. Have it's ever discussed?

Yes, like over here. SMAppService and SMJobBless are not a great fit for Sparkle. They could partially help app developers looking into not using pkg installs which are strongly disliked by users and developers, though..