To upgrade or not to upgrade, that is the question.

[leoj3n]

My initial instinct was to disable self-upgrades in all cask-managed apps, but now many apps are outdated because:

• casks versioned "latest" with no_checksum never trigger updates and
• many casks are never updated.

Having releases soon as available is important for security and other reasons, so What are the plans in regards to keeping apps updated & upgraded when using cask?

Allowing apps to self-upgrade (via Sparkle or otherwise) makes no logical sense for cask-managed apps having a checksum, downloaded into version-numbered directories.

How does Bodega keep apps fresh? Do Bodega-managed apps publish updates via RSS with their new download URLs? This begs the question: Who is responsible for getting new download URLs into cask? Will it always have to be done by hand? Can it be automated? What about "latest" app downloads that have no version associated; How can brew update?

I'm fundamentally confused about how I should be using homebrew-cask and its design.

[phinze]

Hi @leoj3n - thanks for writing this.

There are a few things you touch on that are areas where we know we need improvement, and others that just need clarification.

Having releases soon as available is important for security and other reasons

100% agreed!

Allowing apps to self-upgrade (via Sparkle or otherwise) makes no logical sense for cask-managed apps having a checksum, downloaded into version-numbered directories.

This is true, and so this is why in general we have leaned towards URLs which provide the always latest version and we skip the checksum since the URL will be changing out from under cask with updates.

Sparkle (and sparkle-alike) app updating will update your app in place, so for latest casks it's the de-facto standard to just let do its thing. Theoretically you could, when you see an update notification, run brew cask install my-app --force and that would have the same effect as clicking "Install and Relaunch" from the notification.

How does Bodega keep apps fresh? Do Bodega-managed apps publish updates via RSS with their new download URLs?

I'm not sure how Bodega fits into this conversation - just as a similar effort in the space?

Who is responsible for getting new download URLs into cask?

For versioned applications, the current answer is: maintainers and contributors. For latest casks, no changes need to be made.

Can it be automated?

We've kicked around the idea of parsing Sparkle-compatible RSS fields to detect updates (#260), but no work has been done on this right yet.

What about "latest" app downloads that have no version associated; How can brew update?

As I say above, you can either brew cask install --force app-name or you can just let the internal auto-update process do its thing. Both should be equivalent.

I'm fundamentally confused about how I should be using homebrew-cask and its design.

Sorry 'bout the confusion. This is definitely a part of homebrew-cask that's been waiting for some love for quite some time. See also #309.

I hope this helps to clarify a bit of the "state of the union" on upgrades. Let me know if you have any follow up questions.

[leoj3n]

@phinze Thanks for the detailed response, that clears the air. Bodega seems to be pretty good about knowing when apps have updates; I wasn't aware Sparkle used RSS for updates. It will be interesting to see the evolution of the issue within homebrew-cask. Thanks again.