Updates to hosting docs inline with policy changes

[chromium-blink-merge.git] / chrome / common / extensions / docs / templates / articles / autoupdate.html

<h1>Autoupdating</h1>


<p>We want extensions and apps to be autoupdated for some of the same reasons as Google Chrome itself: to incorporate bug and security fixes, add new features or performance enhancements, and improve user interfaces.</p>

<p>If you publish using the <a href="https://chrome.google.com/webstore/developer/dashboard">Chrome Developer Dashboard</a>, you can <em>ignore this page</em>. You can use the dashboard to release updated versions to users, as well as to the Chrome Web Store.</p>

<p>If you want to host somewhere other than the store, keep reading.
You should also read <a href="hosting.html">Hosting</a> and
<a href="packaging.html">Packaging</a>.</p>

<p class="warning"><b>Warning:</b>
As of M33,
Windows stable/beta channel users can only download extensions hosted
in the Chrome Web Store (see
<a href="http://blog.chromium.org/2013/11/protecting-windows-users-from-malicious.html">Protecting Windows users from malicious extensions</a>).
</p>
 
<p>
Previously when off-store extensions were supported,
it was possible to have the native binaries and the extension be updated in lock step.
However, extensions hosted on the Chrome Web Store are updated
via the Chrome update mechanism which developers do not control.
Extension developers should be careful about updating extensions
that have a dependency on the native binary
(for example, legacy extensions using <a href="npapi.html">NPAPI</a>).
</p>

<h2 id="overview">Overview</h2>
<ul><li>A manifest may contain an "update_url" field, pointing to a location for doing update checks.</li>
<li>The content returned by an update check is an <em>update manifest</em> XML document listing the latest version of an extension.</li></ul>

<p>Every few hours, the browser checks whether any installed extensions or apps have an update URL. For each one, it makes a request to that URL looking for an update manifest XML file. If the update manifest mentions a version that is more recent than what's installed, the browser downloads and installs the new version. As with manual updates, the new <code>.crx</code> file must be signed with the same private key as the currently installed version.</p>


<h2 id="update_url">Update URL</h2>
<p>If you're hosting your own extension or app, you need to add the "update_url" field to your <a href="manifest.html"><code>manifest.json</code></a> file,
like this:</p>

<pre data-filename="manifest.json">
{
  "name": "My extension",
  ...
  <b>"update_url": "http://myhost.com/mytestextension/updates.xml"</b>,
  ...
}
</pre>

<h2 id="update_manifest">Update manifest</h2>
<p>The update manifest returned by the server should be an XML document that looks like this (highlights indicate parts you should modify):</p>

<pre data-filename="updates.xml">
&lt;?xml version='1.0' encoding='UTF-8'?&gt;
&lt;gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'&gt;
  &lt;app appid='<b>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</b>'&gt;
   &nbsp;&lt;updatecheck&nbsp;codebase='<b>http://myhost.com/mytestextension/mte_v2.crx</b>'&nbsp;version='<b>2.0</b>' /&gt;
  &lt;/app&gt;
&lt;/gupdate&gt;
</pre>

<p>This XML format is borrowed from that used by Omaha, Google's update infrastructure. See <a href="http://code.google.com/p/omaha/">http://code.google.com/p/omaha/</a> for more details.
The extensions system uses the following attributes
for the <strong>&lt;app></strong>
and <strong>&lt;updatecheck></strong> elements of the update manifest:
</p>

<p><b>appid</b><br>
The extension or app ID, generated based on a hash of the public key,
as described in <a href="packaging.html">Packaging</a>. You can find the
ID of an extension or Chrome App by going to the Extensions page (<b>chrome://extensions</b>).
</p>
{{?is_apps}}
<p>
Hosted apps, however, are not listed on the Extensions page.  You can find the ID of any
app using the following steps:
</p>
{{/is_apps}}

{{?is_apps}}
<ul>
  <li> Open the app. You can do this by clicking its icon on the New Tab page.</li>
  <li> Open the JavaScript console.  You can do this by clicking the wrench icon
       and choosing <b>Tools &gt; JavaScript Console</b>.</li>
  <li> Enter the following expression into the JavaScript console: <code>chrome.app.getDetails().id</code>
      <p>The console shows the app's ID as a quoted string.</p>
  </li>
</ul>
{{/is_apps}}

<p><b>codebase</b><br>
A URL to the <code>.crx</code> file.</p>

<p><b>version</b><br>
Used by the client to determine whether it should download the <code>.crx</code> file specified by <code>codebase</code>. It should match the value of "version" in the <code>.crx</code> file's <code>manifest.json</code> file.</p>
<p>The update manifest XML file may contain information about multiple extensions by including multiple &lt;app&gt; elements.</p>


<h2 id="testing">Testing</h2>
<p>The default update check frequency is several hours,
but you can force an update using the Extensions page's
<b>Update extensions now</b> button.
</p>

<p>
Another option is to use the --extensions-update-frequency command-line flag to set a more frequent interval in seconds. For example, to make checks run every 45 seconds, run Google Chrome like this:</p>
<pre>
chrome.exe <b>--extensions-update-frequency=45</b></pre>

<p>Note that this affects checks for all installed extensions and apps, so consider the bandwidth and server load implications of this. You may want to temporarily uninstall all but the one you are testing with, and should not run with this option turned on during normal browser usage.</p>


<h2 id="request_parameters">Advanced usage: request parameters</h2>
<p>The basic autoupdate mechanism is designed to make the server-side work as easy as just dropping a static XML file onto any plain web server such as Apache, and updating that XML file as you release new versions of your extensions.</p>
<p>More advanced developers may wish to take advantage of the fact that we add on parameters to the request for the update manifest to indicate the extension ID and version. Then they can use the same update URL for all of their extensions, pointing to a URL running dynamic server-side code instead of a static XML file.</p>
<p>The format of the request parameters is:</p>
<p><code>&nbsp;&nbsp;?x=<em>&lt;extension_data&gt;</em></code></p>
<p>Where <code><em>&lt;extension_data&gt;</em></code> is a URL-encoded string of the format:</p>
<p><code>&nbsp;&nbsp;<em>id=&lt;id&gt;</em>&amp;v=<em>&lt;version&gt;</em></code></p>

<p>For example, say you have two extensions,
both of which point to the same update URL
(<code>http://test.com/extension_updates.php</code>):
</p>

<ul>
<li> Extension 1
  <ul>
    <li> ID: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" </li>
    <li> Version: "1.1"</li>
  </ul>
<li> Extension 2
  <ul>
    <li> ID: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" </li>
    <li> Version: "0.4"</li>
  </ul>
</ul>


<p>The request to update each individual extension would be:</p>

<ul>
  <li> <code>http://test.com/extension_updates.php?x=id%3Daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%26v%3D1.1</code> </li>
  <li> <code>http://test.com/extension_updates.php?x=id%3Dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%26v%3D0.4</code> </li>
</ul>

<p>
Multiple extensions can be listed in a single request for each unique update URL.
For the above example, if a user has both of the extensions installed,
then the two requests are merged into a single request:</p>
<p><code>http://test.com/extension_updates.php?x=id%3Daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%26v%3D1.1&amp;x=id%3Dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb%26v%3D0.4</code></p>

<p>If the number of installed extensions using the same update URL is large enough that a GET request URL is too long (over 2000 characters or so), the update check issues additional GET requests as necessary.</p>

<p class="note">
<b>Note:</b>
In the future, instead of issuing multiple GET requests,
a single POST request might be issued
with the request parameters in the POST body.
</p>

<h2 id="minimum_browser_version">Advanced usage: minimum browser version</h2>
<p>As we add more APIs to the extensions system, it's possible you will want to release an updated version of an extension or app that will work only with newer versions of the browser. While Google Chrome itself is autoupdated, it can take a few days before the majority of the user base has updated to any given new release. To ensure that a given update will apply only to Google Chrome versions at or higher than a specific version, you add the "prodversionmin" attribute to the &lt;app&gt; element in your update manifest. For example:</p>

<pre data-filename="updates.xml">
&lt;?xml version='1.0' encoding='UTF-8'?&gt;
&lt;gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'&gt;
&nbsp;&nbsp;&lt;app appid='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'&gt;
&nbsp;&nbsp; &nbsp;&lt;updatecheck&nbsp;codebase='http://myhost.com/mytestextension/mte_v2.crx'&nbsp;version='2.0' <b>prodversionmin='3.0.193.0'</b>/&gt;
&nbsp;&nbsp;&lt;/app&gt;
&lt;/gupdate&gt;
</pre>

<p>This would ensure that users would autoupdate to version 2 only if they are running Google Chrome 3.0.193.0 or greater.</p>