⚠️ Auto-Update Removed in v1.0.0-alpha.5 — Here's Why

[altaskur]

Summary

Starting with v1.0.0-alpha.5, the auto-update feature has been completely removed from OpenTimeTracker. This decision was made after encountering several critical issues that made the feature unreliable and potentially harmful to the user experience. Below is a detailed explanation of what happened and why.

---

What Happened

1. ERR_MODULE_NOT_FOUND in alpha.4

Error: Cannot find module 'electron-updater'

The root cause was related to how electron-builder handles dependency bundling: electron-updater must be present at runtime, but was excluded from the packaged build due to its dependency scope.

2. Windows Smart App Control Blocking

After fixing the dependency issue and rebuilding, a second problem appeared: Windows Smart App Control actively blocked the unsigned .exe from running — with no "Run anyway" option.

Unlike the traditional SmartScreen warning (which allows users to proceed), Smart App Control completely prevents execution of unsigned applications on systems where it is enabled.

This means the auto-update feature was effectively delivering updates that users couldn't run.
In managed or corporate environments, this behavior is a hard blocker and cannot be bypassed by the user.

3. Code Signing Is Not Viable (Yet)

We explored multiple options for signing the application. At the moment, none of them provide a viable path that aligns with the current project structure and developer profile.

Azure Trusted Signing
Requires identity validation. Individual developers in the EU can only validate through an organization — there is no individual validation path available for EU residents. Since OpenTimeTracker is maintained by an individual developer, this option is not currently viable.

SignPath.io
Offers free code signing for open-source projects. This remains a potential future option but requires additional setup and integration with the CI/CD pipeline.

---

What Changed in alpha.5

The entire auto-update system was removed from both the Electron backend and the Angular frontend:

• Electron side: UpdateManager service, IPC handlers, update-related menu items, and preload API bindings were all deleted.
• Angular side: UpdateService, settings page for updates, and the update dialog component were removed.
• Build config: The publish section was removed from electron-builder configuration, and the electron-updater dependency was removed entirely.
• 31 files changed, approximately 4,300 lines of code deleted.

The application is otherwise unchanged — all existing functionality (time tracking, projects, tasks, calendar, etc.) remains intact.

---

How to Update Going Forward

For now, updates will need to be installed manually:

1. Go to the Releases page.
2. Download the latest version for your platform.
3. Install it over the existing version (your data is stored separately and will be preserved).

---

Future Plans

• Code signing: We will revisit code signing in the future, potentially through SignPath.io or when Azure Trusted Signing becomes available for individual EU developers.
• Auto-update: Once we have a reliable signing solution, auto-update may be reintroduced.
• Portable builds: We're considering adding portable/zip builds to the release pipeline so users don't need to run an installer.

---

Related PRs

• PR #51 — Remove auto-update feature (develop)
• PR #52 — Merge to main
• Release v1.0.0-alpha.5

---

Thank you for your patience! If you have any questions or suggestions (especially regarding code signing solutions), feel free to comment below.