I would like to implement a java application (server application) that can download a new version (.jar file) from a given url, and then update itself at runtime.
What is the best way to do this and is it possible?
I guess that the application can download a new .jar file and start it. But how should I do the handover, e.g. know when the new application is started and then exit. Or is there a better way to do this?
The basic structure of a solution is as follows:
There is a main loop responsible for repeatedly loading the latest version of the app (if required) and launching it.
The application does its thing, but periodically checks the download URL. If it detects a new version it exits back to the launcher.
There are a number of ways you could implement this. For example:
The launcher could be a wrapper script or binary application that starts a new JVM to run the application from a JAR file that gets replaced.
The launcher could be a Java application that creates a classloader for the new JAR, loads an entrypoint class and calls some method on it. If you do it this way, you have to watch for classloader storage leaks, but that's not difficult. (You just need to make sure that no objects with classes loaded from the JAR are reachable after you relaunch.)
The advantages of the external wrapper approach are:
you only need one JAR,
you can replace the entire Java app,
any secondary threads created by the app, etc will go away without special shutdown logic, and
you can also deal with recovery from application crashes, etc.
The second approach requires two JARs, but has the following advantages:
the solution is pure Java and portable,
the changeover will be quicker, and
you can more easily retain state across the restart (modulo leakage issues).
The "best" way depends on your specific requirements.
It should also be noted that:
There are security risks with auto-updating. In general, if the server that provides the updates is compromised, or if the mechanisms for providing the updates are susceptible to attack, then auto-updating can lead to a compromise of the client(s).
Pushing a update to a client that cause damage to the client could have legal risks, and risks to your business' reputation.
If you can find a way to avoid reinventing the wheel, that would be good. See the other answers for suggestions.
I am currently developing a JAVA Linux Daemon and also had the need to implement an auto-update mechanism. I wanted to limit my application to one jar file, and came up with a simple solution:
Pack the updater application in the update itself.
Application: When the application detects a newer version it does the following:
Download update (Zipfile)
Extract Application and ApplicationUpdater (all in the zipfile)
Run updater
ApplicationUpdater: When the updater runs it does the following:
Stop the Application (in my case a daemon via init.d)
Copy the downloaded jar file to overwrite current Application
Start the Application
Cleanup.
Hope it helps someone.
I've recently created update4j which is fully compatible with Java 9's module system.
It will seamlessly start the new version without a restart.
This is a known problem and I recommend against reinventing a wheel - don't write your own hack, just use what other people have already done.
Two situations you need to consider:
App needs to be self-updatable and keep running even during update (server app, embedded apps). Go with OSGi: Bundles or Equinox p2.
App is a desktop app and has an installer. There are many installers with update option. Check installers list.
I've written a Java application that can load plugins at runtime and start using them immediately, inspired by a similar mechanism in jEdit. jEdit is open source so you have the option of looking to see how it works.
The solution uses a custom ClassLoader to load files from the jar. Once they're loaded you can invoke some method from the new jar that will act as its main method. Then the tricky part is making sure you get rid of all references to the old code so that it can be garbage collected. I'm not quite an expert on that part, I've made it work but it wasn't easy.
First way: use tomcat and it's deploy facilities.
Second way: to split application on two parts (functional and update) and let update part replace function part.
Third way: In your server appliction just download new version, then old version releases bound port, then old version runs new version (starts process), then old version sends a request on application port to the new version to delete old version, old version terminates and new version deletes old version. Like this:
This isn't necessarily the best way, but it might work for you.
You can write a bootstrap application (ala the World of Warcraft launcher, if you've played WoW). That bootstrap is responsible for checking for updates.
If an update is available, it will offer it to the user, handle the download, installation, etc.
If the application is up to date, it will allow the user to launch the application
Optionally, you can allow the user to launch the application, even if it isn't up to date
This way you don't have to worry about forcing an exit of your application.
If your application is web based, and if it is important that they have an up to date client, then you can also do version checks while the application runs. You can do them at intervals, while performing normal communication with the server (some or all calls), or both.
For a product I recently worked on, we did version checks upon launch (without a boot strapper app, but before the main window appeared), and during calls to the server. When the client was out of date, we relied on the user to quit manually, but forbid any action against the server.
Please note that I don't know if Java can invoke UI code before you bring up your main window. We were using C#/WPF.
If you build your application using Equinox plugins, you can use the P2 Provisioning System to get a ready-made solution to this problem. This will require the server to restart itself after an update.
I see a security problem when downloading a new jar (etc.), e.g., a man in the middle attack. You always have to sign your downloadable update.
On JAX2015, Adam Bien told about using JGit for updating the binaries.
Sadly I could not find any tutorials.
Source in German.
Adam Bien created the updater see here
I forked it here with some javaFX frontend. I am also working on an automatic signing.
Some relevant background:
My application is a Java app compiled into a .exe via JSmooth. The anticipated user base would likely be a few hundred users, but could grow well beyond that, as it's a community specific application.
How it works:
2 .jar files, one that preforms initial checks, another with the meat of the application.
Ideally, the init jar displays the splash, checks the version in desktop.txt against server.txt, if they differ, it prompts the user to update.
What I need to figure out:
1) What is a cheap, scalable hosting service that I could use as the file host for updates?
2) How can I create an "updater" to actually preform the jar replacement? My current solution is simply writing an updater in Java, but I was hoping for something like the installers people are more familiar with.
All of the research I've done has resulted in lackluster results, as 99% of hosting searches result in site hosting results. I just need an update repository with reasonable security. i.e., decent DDoS resistance and not left wide open to the Internet.
Edit: formatting
Easy to do and very foolish cheap with Amazon S3 or Joyent Manta as both support time-limited signed URLs and headers (which can contain a SHA-1 of the file) to check to see if the update is needed before downloading
On startup your app would check the update URL to see if it has changed. If it has changed, download the JARs. Do this before the app loads classes from those JARs. Updating the updater itself will be trickier so consider that an update might need a new update URL to prevent expiry.
I read SO q&a about launch java as windows service wrappers, but can't find/choose product, suitable for my requirements :
Wrapper reads all java launch parameters from config file. In registry must be only commands to run wrapper itself - path to exe and maybe path to config. Always grant admin rights to change app parameters in registry is not comfortable.
Working dir and path to application also must be in config. I want to place all wrapper files deep into program, because user not intrested in it.
No dependencies(.net, python, etc). I don't want to extend requirements of my program.
Free for every windows OS, include win64.
Simple and lightweight. Size of my program with all 3rd party jars is 12Mbytes. I don't want to add 20Mbytes wrapper.
Automaticaly restart if app process dies.
Preferably single exe files for all windows platform.
I try and lookinkg throught different wrappers and tired a bit. Best suitable till now is:
jslwin (http://jslwin.sourceforge.net), but i don't know how mature it is(version 0.99). Also parameter lists in config is a bit complex(need to edit parameters quantity).
winrun4j (http://winrun4j.sourceforge.net), but i don't know how mature it is(version 0.45). Also it needs a special class for working as a service.
Also i try or look throught:
YAJWS (http://yajsw.sourceforge.net/) too big (30mb), can't make it work with custom files layout.
Advanced Installer (http://www.advancedinstaller.com) too big (50mb).
nssm (http://nssm.cc/) store launch parameters in registry(no config)
winsw (https://kenai.com/projects/winsw) .net required, stops after process dies
commons-daemon, procrun (http://commons.apache.org/proper/commons-daemon/index.html) store launch parameters in registry(no config), can't understand this product, i think it's complex.
jsmooth (http://jsmooth.sourceforge.net) complex and old(last update 2007)
javaservice (http://forge.ow2.org/projects/javaservice/) old (last update 2006)
runasservice (http://runasservice.sourceforge.net/) requires .net
windows rktools - sc, instsrv, srvany (http://support.microsoft.com/?scid=kb%3Ben-us%3B137890&x=16&y=7) - store launch parameters in registry(no config)
jwrapper (http://www.jwrapper.com/) seems not what i need. It packs java program in exe file with JRE. It's not about windows services.
firedaemon (http://www.firedaemon.com/) not free. And maybe it's not what i need.
launch4j (http://launch4j.sourceforge.net/) cool ability "search or download java". Maybe i add something like this to simplify installation, but it is still not about subj.
Java service wrapper (http://wrapper.tanukisoftware.com/) not free for win64.
Tell me please which wrappers suits my needs? Or maybe i think wrong about wrappers above and some of them suits my needs to?
I have had similar issues over the years. Its not that they all are inferior, its that they are all pretty hard to integrate nicely with your own project.
You may want to check out stork: https://github.com/fizzed/stork
It'll help create launchers for your Java console or daemon apps, and they will work across all major platforms. There is also a maven plugin in case you wanted to tie it into your existing build process.
I'm not sure if JWrapper will fulfil all the requirements like 1 and 2 in the way that you want it since rather than you dictating how it does the launch and where it puts things etc JWrapper instead handles that stuff in its own way but it does produce executables for win/mac/linux and more importantly it does support windows service installation as well as macos and linux daemon installation:
http://www.jwrapper.com/guide-installing-a-service.html
The service support though is for paid licenses, the free version doesn't currently support it.
Disclosure: I work for JWrapper
I'm not really clear on how Java WebStart manages its files.
Should I trust that files saved from my code in the WebStart working directory "." should would stick around?
I'm wondering if a good alternative might be to use a folder under the user's home directory; or perhaps I should let the user configure the data directory to allow for another partition (for backups or space). Having to do all of this seems to be defeating the purpose of Java WebStart. At one point, I even deleted the web start application from the Java Console but I as still able to start the application with the network card disabled (offline).
I think I covered every lesson here but they just did not cover this at all.
The PersistenceService is part of the JNLP API. Here is a demo. of the service. which can be used by sand-boxed apps as well.
I'm currently developing a support system for a university. The system is written in PHP and I would like to be able to get a current list of software and basic computer information on a computer. Basically when one of the faculty or staff creates a ticket from our web interface, I would like to have a Java Applet or similar that could be run and would return the information to the help desk PHP script. Does something like this exist?
There are lots of programs that do this sort of thing. Googling for "CMDB" should give you a reasonable start -- a couple of them are open source, though others aren't even close to free (e.g., BMC Atrium).
To keep things closer to topical (i.e., programming related), one of the main frameworks for this sort of situation is called Web-Based Enterprise Management (WBEM). On Windows this is implemented as WMI. On Linux there are a couple of implementations including OpenWBEM and HP WBEM.
In Java? You'd probably have a hard time even finding, let alone making, an applet that can get that info without already having some software installed on the user's end. The biggest features of java are (1) that it runs in a virtual machine (read: getting to the underlying OS/hardware is not something it likes to do), and (2) that in a browser, applets generally run in a "sandbox" that keeps the applet from doing anything remotely dangerous. Basically the most it can do is tie up resources.
Number 2 can be worked around by signing the applet, but that'll require you either buy a code signing certificate or install a self-signed certificate on any computer that'll run your app.
Number 1 might be worked around with some help from Runtime.exec and ...\wmic.exe, but that assumes the WMI stuff is installed -- which is rarely the case unless someone does a full install.