Secure Updater Options

[agwin]

We're investigating ways to secure our installation/update files using Advanced Installer. We are going to be hosting our initial installer in an S3 bucket that users will download via an AWS S3 Signed Url. I'd like to use the same sort of security during updates, but I'm only seeing the option of username:password as part of the "Updates configuration file URL" like so:

Code: Select all

http://<username>:<pwd>@www.myurl.com/<client>/downloads/setup.exe

Is this the ONLY means by which the updater process can access secure files?

I have an idea I wanted to run by support.... Could I change the configuration file URL to access an API that would serve up a configuration file that is constructed at request time? The API would be responsible for generating the signed S3 url and returning it inside the config file.

Thanks in advance.

[Catalin]

Hello,

Is this the ONLY means by which the updater process can access secure files?

Currently yes.

I have an idea I wanted to run by support.... Could I change the configuration file URL to access an API that would serve up a configuration file that is constructed at request time? The API would be responsible for generating the signed S3 url and returning it inside the config file.

To be honest with you, I do not think this will work. However, we can try and test this.

If it doesn't work, could you please elaborate a bit on this approach that in your vision will be secure? I will need this to run it by our dev team and maybe we can improve our current support.

Best regards,
Catalin

[agwin]

Sorry for the delay @Catalin. After some thought, and realizing there's no way to 100% secure the update process, we decided that we're going to go with a more simple, scaled back process where the MSI is secured, and we put a long lived Cloudfront signed URL into our configuration file on our server. The updater will use the signed URL to download updates instead of a completely public file.

Not totally secure, but seems there's not really any way to accomplish that right now. Thanks.

[Catalin]

Hello,

Thank you for your followup on this and for sharing the solution with us!

I'm sure this will be of help for further users facing a similar scenario.

Best regards,
Catalin