Proposal Update Checking

Proposed Feature

 * Check for Audacity updates.
 * When a user clicks on a menu item
 * Possibly periodically e.g. if haven't checked in the last week.
 * Possibly download updated version in the background and install
 * Options/Preferences for user to control this functionality.

Developer/QA Backing

 * Martyn
 * Gale - for a simple, no-security-issue menu item that user clicks voluntarily, going to a web page (interactive or not) that displays current Audacity versions.
 * Peter: +1 for Gale's suggestion ( -1 for auto-update )
 * Steve

Use Cases

 * Users using an old version of Audacity, not realising there is a newer version available that has bugfixes and new functionality.

Details
Audacity does not currently have an automated update checking mechanism.


 * Users can subscribe to audacity-announce and learn of new versions in their e-mail.
 * We can maintain a page on the manual wiki that describes the current versions. Users could then follow a link in the manual (or from a menu item) to that page to check it and read the details in a browser window.

Unfortunately, neither of those methods (except for a menu item going to a web page) are the expected way on Windows of discovering updates, which limits their usefulness. Supporters of an update menu item believe this will encourage more people to update sooner to current versions of Audacity.

However, there are details such as whether and how often to check and when to announce a new version to a user which still need to be defined, and fundamental security concerns. As a result there is little developer support for automate update of Audacity. That introduces too many security concerns and possible issues with testing scenarios for what is a small development team to address. Applications like Firefox and Thunderbird which are already TCP/IP enabled have automated updates in them in part to be able to address exploits rapidly. We're not keen on having TCP/IP functionality in core Audacity for a number of reasons. It potentially opens Audacity up to remote exploits. Encryption would be needed. It would have to be a plug-in from the start.

JC: On Linux it seems clear that updates through distribution, e.g. Ubuntu update manager, are the right way to go and that we should work more closely with those distributions. This would likely be a Windows only feature, and one that users would explicitly need to enable.
 * GA: AWD suggested update checking could be in Linux, but disabled in distro builds. "As it stands if you don't have a distro build of Audacity you probably built it from source yourself. Notifying users that built from source that there's another release available that they can use to build from source would be useful."

At the end of 2009 there was discussion on -devel and prototyping of an update checking menu item by Ed Musgrove. In essence it gathered information from the web on the latest available version and displayed it in Audacity using this code:

wxURL url(wxT("http://home.wavecable.com/~edgarmusgrove/PrefNew")); if(url.GetError==wxURL_NOERR)  { wxInputStream *inputStream = url.GetInputStream; if (inputStream) { if(inputStream->IsOk) { wxFileConfig configuration(*inputStream);

This idea was rejected for security reasons.

GA: Roger Whitcomb suggested an alternative which goes to a page on a web site with a parameter (?current_version=xx.yy) giving the installed version. The web page on the main site then takes this parameter and checks if the version is the latest or not and presents appropriate links to download the latest, or simply says "Your version is the latest available". The page could also take the platform as a separate parameter. This page gives an example of a similar idea in other software. I understand from JC's comments that this is safe, and therefore I support an idea like this, and  Steve TF suggested similarly on the Talk page. It does require someone with web scripting knowledge to implement it. IMO even a menu item that went to a web page that did not interpret information from Audacity would be a considerable advance - we could display version info in the Audacity Title bar to remind users, instead of removing the program name when opening a file or project. This may create user pressure to provide more functionality such as actually finding and installing the new version - as Markus said, do it properly or not at all - but I feel the benefits outweigh having to explain to some users what the security issues are.