Updates and privacy

SolidCraft tells you when a newer release is out. It never updates itself without asking, and the check sends nothing about you or your designs.

What you see

When a newer stable release exists, a small accent-coloured pill reading Update to 0.14.0 (the new version) appears in the title bar next to Report a bug. Nothing pops up by itself: clicking the pill opens a small window with the new version, its release notes and three choices. In a narrower window the pill shortens to Update so the document tabs keep their room, then to its icon alone.

• Download opens the file that fits your installation (see the table below) in your browser, or the release page when there isn’t one.
• Skip this version hides the pill until an even newer release comes out.
• Remind me later hides it for three days.

SolidCraft checks every time it starts, so a release that came out since you last opened it shows up straight away, and again once a day while it stays open.

Preferences ▸ General ▸ Updates has Check for updates automatically (on by default) and Check now, which checks right away and shows the window even for a version you skipped.

Updating in one click

Where SolidCraft can replace itself safely, the window also has Update now:

Every download is verified before anything changes: its SHA-256 must match the release’s SHA256SUMS.txt, fetched over HTTPS from the same release, and, once the project signs its releases, that list must carry a valid signature by SolidCraft’s release key that names the release (see releasing). A download that doesn’t verify is deleted and the installed copy is left as it was; Download still gets the package for a manual install. On macOS SolidCraft opens the disk image rather than replacing the app itself, because the app is ad-hoc signed and not notarized: replacing it in the background would install code macOS can’t vouch for without you seeing it.

Update now needs write access to the installed file: an AppImage in a folder you can’t write to fails with a message, and Download is the way to update it.

What is sent

One HTTPS request each time SolidCraft starts, and once a day while it stays open:

GET https://api.github.com/repos/bherbruck/solidcraft/releases/latest
User-Agent: SolidCraft-update-check
Accept: application/vnd.github+json
X-GitHub-Api-Version: 2022-11-28

Update now then downloads SHA256SUMS.txt (and its signature) and the one package from the release’s own github.com/bherbruck/solidcraft/releases/download/… links, with the same User-Agent. That’s all: no version number, no machine or user identifier, no usage data, no cookies. GitHub sees the request like any other visit to the API (your IP address, the time); see GitHub’s privacy statement. SolidCraft compares the answer with its own version on your computer.

• Offline, or GitHub doesn’t answer within 15 seconds: nothing is shown, and the check is tried again an hour later (or at the next start, whichever comes first).
• GitHub’s rate limit for anonymous requests (60 an hour per address) is respected: when GitHub says to wait, SolidCraft waits that long, Check now and the check at start included.
• Turning off Check for updates automatically stops the checks; only Check now asks.
• Setting the environment variable SOLIDCRAFT_UPDATE_CHECK=0 turns all checks off, for example on managed machines.

Builds you compile yourself, the Flatpak and the browser app (which updates itself) never check.

Which file Download gets

Releases attach the main packages under fixed names (see releasing), and SolidCraft picks the one matching how it was installed:

The window shows the command for Snap, .deb and .rpm installations, with a Copy button. The Flatpak has no network permission and Flatpak itself (or your software center) offers its updates, so it never checks. Release builds compare versions as semver: a nightly build counts as the release it was built after, so it’s offered only a newer stable release, and release candidates are offered their final release.