Agent WranglersUpdate integrity
Install only updates signed by your own key and never an older version. Roll each update out in stages, with a switch that stops it.
- Required 1
- Recommended 3
Required
Verify every update's signature before installing it
DSK-6Sign every update file with a key held apart from your update server, and ship the public key inside the app. The app installs an update only after its signature checks out, and fetches it over HTTPS.
Recommended
Refuse updates older than the installed version
DSK-7The app installs only a version higher than the one it runs, and it reads that version from the signed update data. A downgrade happens only when a person chooses it.
Roll out each update in stages with a stop switch
DSK-8Offer each update to at most 10% of installs first, and widen it only while the crash rate stays at the last version's level. Keep a switch on the update server that stops the rollout within 5 minutes.
Keep the bundled browser engine current
DSK-9When the app ships its own browser engine, as Electron does, move to each new major version within 8 weeks of its release. Never ship on a version its makers no longer patch.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/update-integrity">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.