Auto-updating feature about secure-electron-template HOT 8 CLOSED

Thanks for starting this conversation @dpieski . I've thought about it a little bit and it looks like auto-updating is pretty dependent on your own environment/services/storage capacity, so I'm against making something fit in this template that is for one purpose.

The idea I like more is a package or something we can install into this template which allows anyone to deploy auto-updating as they like.

I'm a little concerned about your "security concern" you list, we wouldn't want that to be in place for a secure template.

from secure-electron-template.

My security concern is essentially specific to when I am using a private GitLab project on the free GitLab tier.

• Free GitLab does not allow Project Tokens, so I would have to use a personal access token.

My electron app would need to access the artifacts of the CI job that compiles the app, so, since it is a private project, I have to use a read_api Personal Access Token to get there. But that read permission is to the whole account, not just the project.

I do not yet know how to get GitLab CI to compile the app with the Personal Access Token if the Personal Access Token is not committed. Then there is also the issue of decompiling the electron app to retrieve the Personal Access Token.

Of course, this is not an issue if you are using a public project since the artifacts from the CI build are openly accessible at that point so you would not need any authentication.

from secure-electron-template.

Sorry for not replying in a timely manner @dpieski. I've thought of this a bit and I feel your particular use case can't be extrapolated in a generic way. I feel I would be open to an auto-updating feature that is provider-agnostic, do you feel your work can get you there or is it solely with GitLab?

from secure-electron-template.

@reZach I upvote this feature.
We could create a separate module for this that takes some environment variables and does everything for you. I don't see any security concerns for that.

from secure-electron-template.

@dragonDScript is this something you can research and began to create as a separate NPM package that this template could use?

from secure-electron-template.

@dragonDScript is this something you can research and began to create as a separate NPM package that this template could use?

Well, I don't have a lot of time right now? Could you create it?

from secure-electron-template.

@dragonDScript is this something you can research and began to create as a separate NPM package that this template could use?

Well, I don't have a lot of time right now? Could you create it?

I do not either, that is why I asked you 😄.

from secure-electron-template.

@dragonDScript @dpieski I was able to find a repo that should give you all the information you need to set up auto-updating. Since updating really depends on the project, I feel this example can help you both (but I did now provide guidance in the source code for others in case they have the same question).

from secure-electron-template.