software update popups still shown during sparkle update process in certain cases - follow up to 9562

[LaurenWags]

Description

Follow up to #9562

While testing above issue, found that I'm still getting the update popup in some cases, probably specific to using .pkg instead of .dmg.

Steps to Reproduce

As a general note, these were recorded using Catalina (Intel), but also occurred using Monterey (M1). Generally when retesting I think we should probably cover all previous checks from #9562 to ensure no regressions.

Case 1 - background updates, Admin user - .pkg file - prompt 1

1. as an Admin, download and install an old version of the appropriate build - I downloaded 1.37.92 .pkg file from https://github.com/brave/brave-browser/releases/tag/v1.37.92
2. launch (I didn't use any cmd line args, since there are versions on the normal beta channel to upgrade to)
   ---> got update popup immediately
3. shut down and relaunch
   ---> no update popup now
4. close browser, advance system time 3+ hours
5. launch using --enable-logging=stderr --vmodule=sparkle_glue=5,brave_relaunch_handler_mac=5 2>&1
   ---> get update popup immediately
6. watch logs, saw mention of an update, but no indication that the update was being downloaded (brave update: did find valid update with AppcastItem(Date: Fri, 18 Mar 2022 00:21:26 +0000, Version: 1.37.97.0))
7. shut down
8. launch Brave
9. check brave://version
   ---> still on 1.37.92, no update was performed
   ---> no update popup
10. shut down Brave
11. advance computer clock 3hr again
12. relaunch brave
    ---> update popup is shown immediately

Case 2 - background updates, Admin user - .pkg file - prompt 2

Pre-req: make sure the following are gone:

• previous install of channel (this example uses Beta)
• previous profile folder (this example would need Brave-Browser-Beta under ~/Library/Application Support/BraveSoftware to be deleted)
• previous profile folder's cache (this example would need Brave-Browser-Beta under ~/Library/Caches/BraveSoftware to be deleted)
• previous profile's sparkle artifacts removed (this example would need com.brave.Browser.beta under /Users/USERNAME/Library/Preferences to be deleted - see https://bravesoftware.slack.com/archives/C0112349LKB/p1648024034087219?thread_ts=1647649970.484209&cid=C0112349LKB for more information)

1. as an Admin, download and install an old version of the appropriate build - I downloaded 1.37.92 .pkg file from https://github.com/brave/brave-browser/releases/tag/v1.37.92
2. launch (I didn't use any cmd line args, since there are versions on the normal beta channel to upgrade to)
3. shut down and relaunch
   ---> get update prompt 2

Case 3 - (continuation of Case 2) - prompt 3

Pre-req: make sure the following are gone:

• previous install of channel (this example uses Beta)
• previous profile folder (this example would need Brave-Browser-Beta under ~/Library/Application Support/BraveSoftware to be deleted)
• previous profile folder's cache (this example would need Brave-Browser-Beta under ~/Library/Caches/BraveSoftware to be deleted)
• previous profile's sparkle artifacts removed (this example would need com.brave.Browser.beta under /Users/USERNAME/Library/Preferences to be deleted - see https://bravesoftware.slack.com/archives/C0112349LKB/p1648024034087219?thread_ts=1647649970.484209&cid=C0112349LKB for more information)

1. Do Case 2 steps
2. On the prompt, select Don't check.
3. Shut down browser.
4. Advance computer clock 3 hours
5. launch using --enable-logging=stderr --vmodule=sparkle_glue=5,brave_relaunch_handler_mac=5 2>&1
6. watch logs, no mention of update (as expected per selection in step 4)
7. Shut down browser.
8. Relaunch
9. Go to brave://settings/help to trigger update
10. Wait for update to be downloaded, then close browser (I didn't select the relaunch button, I quit the browser entirely)
11. Get prompt 3

Case 4 - update from brave://settings/help, Admin user - .pkg file - prompt 3

Remove as many Brave artifacts from previous installations as possible (.app from Applications, profile folder from Application Support/BraveSoftware, corresponding ache folder from Caches/BraveSoftware, com.brave.Browser.* folder from Caches, com.brave.Browser.* from Caches/Preferences)

1. as an Admin, download and install an old version of the appropriate build - I downloaded 1.37.92 x64 .pkg file from https://github.com/brave/brave-browser/releases/tag/v1.37.92
2. launch using --enable-logging=stderr --vmodule=sparkle_glue=5,brave_relaunch_handler_mac=5 2>&1
3. click on Brave on the top menu bar
4. click on About Brave (brave://settings/help)
5. ensure it checks for and downloads an update
6. click Relaunch
   ---> get prompt 3 pictured below
   ---> if I enter credentials, browser is updated. If I select cancel, browser is not updated.

Note, this also happens on 1.36.x but with additional update prompts (prompt 1), so this is better than it was previously.

Case 5 - allow update from brave://settings/help, non-admin user - .pkg file - prompt 2

Remove as many Brave artifacts from previous installations as possible (.app from Applications, profile folder from Application Support/BraveSoftware, corresponding ache folder from Caches/BraveSoftware, com.brave.Browser.* folder from Caches, com.brave.Browser.* from Caches/Preferences)

1. as an Admin, download and install an old version of the appropriate build - I downloaded 1.37.92 x64 .pkg file from https://github.com/brave/brave-browser/releases/tag/v1.37.92
2. open Users & Groups in macOS System Preferences
3. Add a non-admin user if one does not exist.
4. log out and log back in as the non admin user
5. launch Brave using --enable-logging=stderr --vmodule=sparkle_glue=5,brave_relaunch_handler_mac=5 2>&1
6. Navigate to brave://settings/help in some way
7. Once update is downloaded, click "Relaunch"
8. when prompted, grant Admin permissions
   ---> after entering admin permissions, got prompt 2 from below, selected to check automatically
9. confirm Brave relaunches
10. confirm update is applied

Case 6 - background update, non-admin user - .pkg file - prompt 1

Brave	1.37.104 Chromium: 100.0.4896.46 (Official Build) (x86_64) 
Revision	5ca33821b2211805855c77d334353d27c616a7ca-refs/branch-heads/4896@{#584}
OS	macOS Version 10.15.7 (Build 19H1824)

Remove as many Brave artifacts from previous installations as possible (.app from Applications, profile folder from Application Support/BraveSoftware, corresponding ache folder from Caches/BraveSoftware, com.brave.Browser.* folder from Caches, com.brave.Browser.* from Caches/Preferences)

1. as an Admin, download and install an old version of the appropriate build - I downloaded 1.37.104 x64 .pkg file from https://github.com/brave/brave-browser/releases/tag/v1.37.104
2. open Users & Groups in macOS System Preferences
3. Add a non-admin user if one does not exist.
4. log out and log back in as the non admin user
5. launch Brave using --enable-logging=stderr --vmodule=sparkle_glue=5,brave_relaunch_handler_mac=5 2>&1 --update-feed-url=https://updates.bravesoftware.com/sparkle/Brave-Browser/test/appcast.xml
6. Open brave://version, shut down browser
7. advance system time 3+ hours
8. restart Brave with same command line parameters as step 5
   ---> get update popup 1
   ---> Logs show update was found

Case 7 - background update, non-admin user - .dmg file - prompt 1

Brave	1.37.104 Chromium: 100.0.4896.46 (Official Build) (x86_64) 
Revision	5ca33821b2211805855c77d334353d27c616a7ca-refs/branch-heads/4896@{#584}
OS	macOS Version 10.15.7 (Build 19H1824)

Remove as many Brave artifacts from previous installations as possible (.app from Applications, profile folder from Application Support/BraveSoftware, corresponding ache folder from Caches/BraveSoftware, com.brave.Browser.* folder from Caches, com.brave.Browser.* from Caches/Preferences)

1. as an Admin, download and install an old version of the appropriate build - I downloaded 1.37.104 x64 .dmg file from https://github.com/brave/brave-browser/releases/tag/v1.37.104
2. open Users & Groups in macOS System Preferences
3. Add a non-admin user if one does not exist.
4. log out and log back in as the non admin user
5. launch Brave using --enable-logging=stderr --vmodule=sparkle_glue=5,brave_relaunch_handler_mac=5 2>&1 --update-feed-url=https://updates.bravesoftware.com/sparkle/Brave-Browser/test/appcast.xml
6. Open brave://version, shut down browser
7. advance system time 3+ hours
8. restart Brave with same command line parameters as step 5
   ---> get update popup 1
   ---> Logs show update was found

Actual result:

Prompt 1 (Case 1,6,7)	Prompt 2 (Case 2,5)	Prompt 3 (Case 3,4)

Expected result:

no software update popup in any case

Reproduces how often:

100%

Brave version (brave://version info)

1.37.92 (need to use .pkg file not .dmg)

Version/Channel Information:

• Can you reproduce this issue with the current release? 1.36.x yes
• Can you reproduce this issue with the beta channel? 1.37.x yes
• Can you reproduce this issue with the nightly channel? 1.38.x yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields?
• Does the issue resolve itself when disabling Brave Rewards?
• Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

cc @stephendonner @kjozwiak @mherrmann @rebron

[mherrmann]

Thank you for catching this @LaurenWags. I have a hunch for the reason and would like to ask what you think.

Could it be that on the machine where you performed the test, you previously got the following popup, and accepted it with "Check automatically"?

My suspicion is that this setting got remembered and you're still seeing the update popup because of this. It would be a bug either way but I'd have a better idea for a fix.

Thanks!

[LaurenWags]

@mherrmann it's a pretty old machine so while that popup doesn't stand out in my mind, it's possible!

if it helps, it was a completely clean install of Beta, not an upgrade of an existing profile/install.

If there's a way I can check on your question let me know - happy to provide more information if I can!

[mherrmann]

Thank you @LaurenWags, I don't think there's a way to check on my question. But your reply already helps. I'm beginning work on a fix.

[mherrmann]

I want to give some explanation on this issue (cc @LaurenWags @stephendonner @rebron).

In #9562, we encountered the question what should happen when Brave tries to update itself but can't due to lacking permissions. The classic case is when Brave was installed as Admin (eg. in /Applications) but runs as the Guest user. In addition to removing all unnecessary update popups, we decided there that when Brave doesn't have write access to its installation directory, then it should not attempt to update itself in the background. However, on-demand updates via brave://settings/help should still be possible.

In implementing the fix for #9562, I missed a small case. This lead to #21802, which affects Brave's .dmg installer. In the present issue, @LaurenWags found a lot of cases where Brave's .pkg installer is affected.

I found out why that is the case: When Brave is installed with the .pkg and then run - even as Admin - it does not have write access to the installation directory. So when it comes to updating, Brave installed with pkg and run as Admin behaves like Brave installed with dmg and run as Guest.

My fix brave/brave-core#12713 now prevents the unwanted update popups in the remaining cases. (At least in my tests.) But I wanted to give the above background info to highlight that a consequence of the decision made in #9562 is that people who installed Brave via .pkg no longer get background updates. They also no longer get random popups about updating, some of which are to elevate to Admin. But if they want to get an update, then they must go to brave://settings/help.

[rebron]

This is being reverted in 1.39.x: brave/brave-core#12916

We still need people who installed Brave via .pkg to receive update notifications.
#21813 (comment)