Software Update

Overview

This page describes a plan for improving software update for Firefox, Thunderbird and other applications. (I'll refer specifically to Firefox from now on.)

Requirements

• Support for silent or explicit downloading
• Support for binary patching or full upgrade
• Support for cryptographic signatures
• Minimize impact on backend build and distribution processes
• Allow users to easily view and control the process

Schedule

Security updates are a reality, so we need a better way to push out updates to people who desire them. With that in mind, the goal is to implement this system for Firefox 1.1.

The Plan

Add a module to Firefox to support the downloading of an update XPI. Provide a silent mode that will be used for security updates. Do this only if the user has agreed (via some UI during installation perhaps) and only if the user has write permission to the installation directory. We don't want this update system to get in the way of RPM or MSI based solutions, etc.

Use XPIs to deliver the update. The update itself will be an executable that will be run by Firefox when it detects that a XPI has been fully downloaded. This may happen once the download is complete, at app shutdown, or the next time Firefox is launched. That behavior is a policy decision yet to be decided upon. Using XPIs to deliver the update executable allows us to leverage the existing support for signed XPIs. Moreover, we have the option of packaging an entire install executable in the XPI if that is deemed appropriate.

The Windows filesystem does not allow files to be unlinked from their parent directory while they are in use. This means that we have to shutdown Firefox before updating it. The update executable will wait for Firefox to shutdown before it begins updating Firefox. It may either replace individual files or leverage binary patching (see bsdiff) to update Firefox. Once the update executable completes, it will launch Firefox passing it a command line flag to instruct Firefox that it has just been updated. This will allow Firefox to perform any post upgrade steps (e.g., modifying registry keys, etc.).

Users will have the option to view silent upgrade progress, and choose to cancel, suspend, or "complete it now." They will also be provided with simple controls to alter the upgrade policy (notifications, silent or not, etc.).

Downloading the Update

Firefox will periodically check the Mozilla.org update servers for available updates. The update server will return a manifest file (which is currently an RDF file) that will point Firefox at the right XPI to download.

In silent download mode, Firefox will use byte-range requests (supported by HTTP and FTP) to download the XPI in small pieces. Each time Firefox starts up it will check to see if it should resume downloading the XPI. It will not try to download the XPI while Firefox is not running. This simplifies the implementation of the downloading system because it enables us to make use of the Firefox networking stack. Firefox will try to minimally impact the user's network bandwidth in the process.

Once the XPI has been completely downloaded, it's signature will be verified. If the signature checks out, then assuming that Firefox has permission from the user, it will install the XPI. The XPI will have a very simple install.js file that will copy the upgrade executable into the correct location within the Firefox installation directory.

Processing the Update

At startup, Firefox will look for an update executable in a fixed location. If it finds the executable, then assuming it has permission from the user it will launch the update executable and exit. Once the update executable determines that Firefox has exited, it will begin applying the updates.

Before making any changes to the existing Firefox installation, the update executable will scan all files to be modified and verify that they are the expected version. If it finds that any files are not in sync with what it expects to find, then it will not apply the update. Otherwise, it will proceed to either: add, remove, replace, or patch existing files.

Before the update executable exits, it will record status to a log file that will be read by Firefox on next launch to determine if the update was successfully applied. This will allow Firefox to present good UI to the user in the advent of an unexpected problem.

Comments

If you have any comments on this plan, please feel free to drop me a line: darin@meer.net