# Updates and privacy SolidCraft tells you when a newer release is out. It never updates itself without asking, and the check sends nothing about you or your designs. ## What you see When a newer stable release exists, an **Update** button appears in the title bar next to **Report a bug**. It opens a small window with the new version, its release notes and three choices: - **Download** opens the file that fits your installation (see the table below) in your browser, or the release page when there isn't one. - **Skip this version** hides the button until an even newer release comes out. - **Remind me later** hides it for three days. **Preferences ▸ General ▸ Updates** has **Check for updates automatically** (on by default) and **Check now**, which checks right away and shows the window even for a version you skipped. ## Updating in one click Where SolidCraft can replace itself safely, the window also has **Update now**: | Installed as | Update now does | |---|---| | AppImage | Downloads the new AppImage next to the old one, verifies it, renames it over the old file and offers **Restart now** | | Windows installer (`.msi`) | **Install (closes SolidCraft)**: downloads and verifies the `.msi`, closes SolidCraft (asking about unsaved designs first) and starts the installer | | Windows portable `.zip` or `.exe` | Downloads and verifies the package, swaps in the new `solidcraft.exe` (and `solidcraft-cli.exe`) and offers **Restart now**; the old file is removed at the next start | | macOS | **Download and open**: downloads and verifies the `.dmg` and opens it; drag SolidCraft to Applications to replace the old copy | | Flatpak, Snap, `.deb`, `.rpm`, `.tar.gz` | Nothing: your package manager updates these (the window shows the command), or you unpack the new archive | Every download is verified before anything changes: its SHA-256 must match the release's `SHA256SUMS.txt`, fetched over HTTPS from the same release, and, once the project signs its releases, that list must carry a valid signature by SolidCraft's release key that names the release (see [releasing](https://github.com/bherbruck/solidcraft/blob/main/docs/releasing.md#update-signing)). A download that doesn't verify is deleted and the installed copy is left as it was; **Download** still gets the package for a manual install. On macOS SolidCraft opens the disk image rather than replacing the app itself, because the app is ad-hoc signed and not notarized: replacing it in the background would install code macOS can't vouch for without you seeing it. Update now needs write access to the installed file: an AppImage in a folder you can't write to fails with a message, and **Download** is the way to update it. ## What is sent One HTTPS request, at start and at most once a day while SolidCraft runs: ```text GET https://api.github.com/repos/bherbruck/solidcraft/releases/latest User-Agent: SolidCraft-update-check Accept: application/vnd.github+json X-GitHub-Api-Version: 2022-11-28 ``` **Update now** then downloads `SHA256SUMS.txt` (and its signature) and the one package from the release's own `github.com/bherbruck/solidcraft/releases/download/…` links, with the same User-Agent. That's all: no version number, no machine or user identifier, no usage data, no cookies. GitHub sees the request like any other visit to the API (your IP address, the time); see [GitHub's privacy statement](https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement). SolidCraft compares the answer with its own version on your computer. - Offline, or GitHub doesn't answer within 15 seconds: nothing is shown, and the check is tried again an hour later. - GitHub's rate limit for anonymous requests (60 an hour per address) is respected: when GitHub says to wait, SolidCraft waits that long, Check now included. - Turning off **Check for updates automatically** stops the checks; only **Check now** asks. - Setting the environment variable `SOLIDCRAFT_UPDATE_CHECK=0` turns all checks off, for example on managed machines. Builds you compile yourself, the Flatpak and the browser app (which updates itself) never check. ## Which file Download gets Releases attach the main packages under fixed names (see [releasing](https://github.com/bherbruck/solidcraft/blob/main/docs/releasing.md)), and SolidCraft picks the one matching how it was installed: | Installed as | Detected by | Download | How to update | |---|---|---|---| | AppImage | `APPIMAGE` is set | `solidcraft-linux-.AppImage` | Replace the old AppImage with the new one | | Flatpak | `FLATPAK_ID` is set | doesn't check (see below) | `flatpak update ai.storyteller.solidcraft` | | Snap from the Snap Store | `SNAP` is set | release page | `sudo snap refresh solidcraft` (snapd also refreshes by itself) | | Snap from a downloaded file | `SNAP_REVISION` starts with `x` | `solidcraft-linux-.snap` | `sudo snap install --dangerous ./solidcraft-linux-.snap` | | `.deb` | under `/usr`, dpkg knows `solidcraft` | `solidcraft-linux-.deb` | `sudo apt install ./solidcraft-linux-.deb` | | `.rpm` | under `/usr`, an rpm database exists | `solidcraft-linux-.rpm` | `sudo dnf install ./solidcraft-linux-.rpm` | | `.tar.gz` | anywhere else on Linux | `solidcraft--linux-.tar.gz` | Unpack over the old copy | | Windows installer | under Program Files | `solidcraft-windows-.msi` | Run the installer | | Windows portable | `solidcraft-cli.exe` beside it | `solidcraft-windows--portable.zip` | Unzip over the old copy | | Windows `.exe` | anywhere else on Windows | `SolidCraft--windows-x64.exe` | Replace the old `.exe` | | macOS | inside `SolidCraft.app` | `solidcraft-macos-universal.dmg` | Drag the new app to Applications | The window shows the command for Snap, `.deb` and `.rpm` installations, with a Copy button. The Flatpak has no network permission and Flatpak itself (or your software center) offers its updates, so it never checks. Release builds compare versions as [semver](https://semver.org): a nightly build counts as the release it was built after, so it's offered only a newer stable release, and release candidates are offered their final release.