We Keep Coding

Automated updates for Java applications [duplicate]

I would like to implement a java application (server application) that can download a new version (.jar file) from a given url, and then update itself at runtime.
What is the best way to do this and is it possible?
I guess that the application can download a new .jar file and start it. But how should I do the handover, e.g. know when the new application is started and then exit. Or is there a better way to do this?

The basic structure of a solution is as follows:
There is a main loop responsible for repeatedly loading the latest version of the app (if required) and launching it.
The application does its thing, but periodically checks the download URL. If it detects a new version it exits back to the launcher.
There are a number of ways you could implement this. For example:
The launcher could be a wrapper script or binary application that starts a new JVM to run the application from a JAR file that gets replaced.
The launcher could be a Java application that creates a classloader for the new JAR, loads an entrypoint class and calls some method on it. If you do it this way, you have to watch for classloader storage leaks, but that's not difficult. (You just need to make sure that no objects with classes loaded from the JAR are reachable after you relaunch.)
The advantages of the external wrapper approach are:
you only need one JAR,
you can replace the entire Java app,
any secondary threads created by the app, etc will go away without special shutdown logic, and
you can also deal with recovery from application crashes, etc.
The second approach requires two JARs, but has the following advantages:
the solution is pure Java and portable,
the changeover will be quicker, and
you can more easily retain state across the restart (modulo leakage issues).
The "best" way depends on your specific requirements.
It should also be noted that:
There are security risks with auto-updating. In general, if the server that provides the updates is compromised, or if the mechanisms for providing the updates are susceptible to attack, then auto-updating can lead to a compromise of the client(s).
Pushing a update to a client that cause damage to the client could have legal risks, and risks to your business' reputation.
If you can find a way to avoid reinventing the wheel, that would be good. See the other answers for suggestions.

I am currently developing a JAVA Linux Daemon and also had the need to implement an auto-update mechanism. I wanted to limit my application to one jar file, and came up with a simple solution:
Pack the updater application in the update itself.
Application: When the application detects a newer version it does the following:
Download update (Zipfile)
Extract Application and ApplicationUpdater (all in the zipfile)
Run updater
ApplicationUpdater: When the updater runs it does the following:
Stop the Application (in my case a daemon via init.d)
Copy the downloaded jar file to overwrite current Application
Start the Application
Cleanup.
Hope it helps someone.

I've recently created update4j which is fully compatible with Java 9's module system.
It will seamlessly start the new version without a restart.

This is a known problem and I recommend against reinventing a wheel - don't write your own hack, just use what other people have already done.
Two situations you need to consider:
App needs to be self-updatable and keep running even during update (server app, embedded apps). Go with OSGi: Bundles or Equinox p2.
App is a desktop app and has an installer. There are many installers with update option. Check installers list.

I've written a Java application that can load plugins at runtime and start using them immediately, inspired by a similar mechanism in jEdit. jEdit is open source so you have the option of looking to see how it works.
The solution uses a custom ClassLoader to load files from the jar. Once they're loaded you can invoke some method from the new jar that will act as its main method. Then the tricky part is making sure you get rid of all references to the old code so that it can be garbage collected. I'm not quite an expert on that part, I've made it work but it wasn't easy.

First way: use tomcat and it's deploy facilities.
Second way: to split application on two parts (functional and update) and let update part replace function part.
Third way: In your server appliction just download new version, then old version releases bound port, then old version runs new version (starts process), then old version sends a request on application port to the new version to delete old version, old version terminates and new version deletes old version. Like this:

This isn't necessarily the best way, but it might work for you.
You can write a bootstrap application (ala the World of Warcraft launcher, if you've played WoW). That bootstrap is responsible for checking for updates.
If an update is available, it will offer it to the user, handle the download, installation, etc.
If the application is up to date, it will allow the user to launch the application
Optionally, you can allow the user to launch the application, even if it isn't up to date
This way you don't have to worry about forcing an exit of your application.
If your application is web based, and if it is important that they have an up to date client, then you can also do version checks while the application runs. You can do them at intervals, while performing normal communication with the server (some or all calls), or both.
For a product I recently worked on, we did version checks upon launch (without a boot strapper app, but before the main window appeared), and during calls to the server. When the client was out of date, we relied on the user to quit manually, but forbid any action against the server.
Please note that I don't know if Java can invoke UI code before you bring up your main window. We were using C#/WPF.

If you build your application using Equinox plugins, you can use the P2 Provisioning System to get a ready-made solution to this problem. This will require the server to restart itself after an update.

I see a security problem when downloading a new jar (etc.), e.g., a man in the middle attack. You always have to sign your downloadable update.
On JAX2015, Adam Bien told about using JGit for updating the binaries.
Sadly I could not find any tutorials.
Source in German.
Adam Bien created the updater see here
I forked it here with some javaFX frontend. I am also working on an automatic signing.

Is the Google Drive web host link feature in danger of being phased out?

I am working on an Android app that stores log on a client's Google Drive. We push static HTML/Javascript files to said Drive in order for the user to be able to read their logs in an user friendly way via their browser. This feature worked relatively well until now (notwithstanding some glitches due to server updates in the last few months).
2 weeks ago (.e. from the beginning of October 2014) we saw that the newer user interface of Google Drive has dropped the web host link capability altogether. For legacy accounts this feature is still there, but not for newer created accounts from the aforementioned date.
Does that mean that Google is planning to ultimately drop this feature, or is it going to be available for the foreseeable future, even if only accessible programmatically via SDK?
Note that we tested to see if programmatic access is affected, and it seems to work fine. We used java SDK function getWebViewLink() (class File) in order to get the link programmatically, and it still works no 1 for now. But the change in UI from Google does worry us that this feature will be dropped, like Dropbox dropped theirs recently. Is that the case? If so, what is the expected timeline of feature deprecation and eventual disappearance?

It looks like they moved/changed it but didn't remove it altogether. The instructions from Google on how to host webpages with Drive worked for me using an account I created after the UI change (after you posted this question).
Since their latest blog post on deprecating APIs does not say anything about getting rid of the web host feature, you are probably fine.
If so, what is the expected timeline of feature deprecation and eventual disappearance?
If the APIs they're deprecating are anything to go by, even if they do get rid of web hosting it will be a couple of years between the time they announce it and it actually being unavailable. It's not a perfect comparison since those are entire APIs and this is just a feature but it doesn't seem like they make a habit of making something unavailable at the drop of a hat.

Creating a new Thread in Vaadin Java with GWT Graphics

I'm creating my first Vaadin Project and I have lots of problems understanding how it works. I created a new widget, that uses GWT Graphics and I drew some objects on the screen. However sometimes, instead of displaying the DrawingArea, my browser shows me this error
Widgetset 'com.example.jtpwebapp.JtpwebappWidgetset' does not contain implementation for com.example.jtpwebapp.MyComponent. Check its component connector's #Connect mapping, widgetsets GWT module description file and re-compile your widgetset. In case you have downloaded a vaadin add-on package, you might want to refer to add-on instructions.
The other components are just fine. For example, this error shows up if I simply create a new Thread
new Thread() {
public void run() {}
}.start();
The widgetset re-compilation gives me no errors. I'm not changing the #Connect mapping nor editing the module file.
There is really not much code to share, I created a new Vaadin widget using the Eclipse plugin and edited only in a few places.
I get this error also, when I try to make my widget implement a ClickHandler.

GWT only contains an emulated subset of the Java runtime environment. Thread is one of the classes that's not included; JavaScript doesn't support threading so there's no way for the GWT compiler to generate the code for it. The full reference of what's supported is available here.
Now, missing emulation does unfortunately not show up at compile-time, but GWT does perform checks against the JRE emulation library. You just have to run your app in developer mode. The Debugging Client-Side Code section in Book of Vaadin does a pretty good job at explaining how to achieve that with Vaadin.

Play recompiles all files on refresh?

I'm starting to use Play framework,
I've tried some examples and i wonder how exactly it acts on page refresh : does it recompile all files or just those which were modified?

You can read this article which explains how Play's hot reload works: http://jto.github.io/articles/play_anatomy_part2_sbt/
Basically, on file change SBT (building tool used in Play) recognise what to recompile and re-insert the new code in your instance.
Note that it only works in a state-less environnement, because it doesn't trash nor reinitiate old objects. In a stateless world, every request create all the objects it needs and keep nothing from outside. If you use websockets with Play, you may encounter some weird behaviours since websockets are stateful (you have to open a new socket to get the changes).

It only recompiles relevant files after your modification. Here's what Play official website says:
Running the server in development mode
In this mode, the server will be launched with the auto-reload feature enabled,
meaning that for each request Play will check your project and recompile required sources.
If needed the application will restart automatically.
As a side note, Play uses JNotify to monitor the changes in your file system.
Here's a link for JNotify: http://jnotify.sourceforge.net/

Play only compiles the whole project the first time you open your browser. This means that the first time you run it in browser it might be a little slow to load. I'm not exactly sure how play recognize which files that were modified from the last compile, but to answer your question it only compiles the modified files.

Automatically update jar files

I am currently working on desktop software based on java.It's quite a big code base (more than 40 jar files).
I wish to provide an automatic update functionality. The desktop software constantly checks one back end system to see if there are new versions of the jar files available.
The problem now is: How to replace the updated jar files?

If you deploy your application using Java Webstart (JNLP), you get this mechanism almost for free...
From http://mindprod.com/jgloss/javawebstart.html
The key benefit for Java Web Start is automatic update without having to download the entire program every time.

Easiest would be to check for updates on each startup, download the updates and then launch your application. I think this is the way that Java Web Start works (see aioobes answer).
More complex would be to use either the netbeans or eclipse framework for your application. Both are rather complex and you will have to rewrite your application to work with them. This solution supports live updates.
As far as I am aware there is no easy way to update a running application. It is possible to load new versions of a class with a different classloader, but not possible to unload old versions while they are still referenced.

You can make a little server and a launcher which downloads the newest version, replaces the old one, and starts the jar with:
Runtime.getRuntime().exec("java yourjar -jar");
And you terminate the launcher with:
System.exit(1)

You can also serialize down your state (keep it in memory) and then create a new ClassLoader instance pointing to the new .jar files. Then serialize up your state again using this new classloader. You have just changed the underlaying .jars within a executing product.
Please note that you do not need to change the classloader for everything only for the part that is actually using the .jar files. This can be tricky to conclude what parts that are. And you might get nasty linking errors if done wrongly. So..
.. to keep it simple, use WebStart or a preloader that updates the .jars and then starts the main app (basically what WebStart does for you).
A reason for rolling your own, is that you can use your own format for the .jars, encryption, other packing formats etc.

After reading some answers to many auto-update questions, I thought of a solution. This is how I would implement a secure auto-update for a Java/Kotlin jar application.
Assumption: the installer will contain two jars: a launcher and the main application. Any shortcuts created will point to the launcher, but still be the name of the application. The release will contain the main application and the installer.
The launcher is launched first:
First check if an update has already been downloaded as app_name_update.jar
if an update has been downloaded, rename app_name_update.jar to app_name.jar
Start app_name.jar
This part does not have to be in the launcher, but it's preferred as to not slow down the main application: at this point, the launcher should check for an update (e.g. GitHub releases API) and download it to {CWD}/unverified_app_name_update.jar.
Compare the hash of unverified_app_name_update.jar to an online location containing hashes for all published versions. hashes.txt would be an example found in the same github repository. If the software is open-source, GPG signed commits is a must and the launcher should check if the latest update is a verified commit! If its a proprietary application, keep the hashes.txt at a separate URL from the release where your company does not control the infrastructure (e.g. GitHub).
Main app launched:
No need to check for updates unless updates are mandatory, in which case check for update -> if update found, start loading animation "updating" while you can detect that the launcher is still running. Ensure that the launcher has no race condition while loops!

I found ready project to solve automatically updating.
You can update your app, in your cases you can update jars and resources of your desktop app. The idea of the this is next: wrap you app with starter which can control updating and running you app. In details you can find here.