# UniGetUI Auto-Update Testing Guide (ProductInfo-only path)

This guide validates the ProductInfo-only auto-update flow that reads from `productinfo.json`.

UniGetUI no longer falls back to the legacy updater logic. If the ProductInfo lookup fails, the update check fails.

## Files used

- `testing/productinfo.unigetui.test.json`
- Test artifacts expected by that file:
	- `UniGetUI.Installer.x64.exe`
	- `UniGetUI.Installer.arm64.exe`
	- `UniGetUI.x64.zip`
	- `UniGetUI.arm64.zip`

## What is being tested

- Default updater source is ProductInfo-based.
- Product key lookup for `Devolutions.UniGetUI`.
- Architecture-aware installer selection (`x64`/`arm64`, `exe` preferred).
- Hash validation (enabled by default).
- Debug-only override behavior via registry keys under `HKLM\Software\Devolutions\UniGetUI`.

## Release vs Debug behavior

- Release builds honor only `UpdaterProductInfoUrl` from `HKLM\Software\Devolutions\UniGetUI`.
- Release builds ignore `UpdaterProductKey` and all validation-bypass flags.
- Debug builds can read updater overrides from `HKLM\Software\Devolutions\UniGetUI` for local testing.
- Dangerous validation bypasses are for Debug/dev testing only:
	- `UpdaterAllowUnsafeUrls`
	- `UpdaterSkipHashValidation`
	- `UpdaterSkipSignerThumbprintCheck`
	- `UpdaterDisableTlsValidation`

## 1) Host the test files locally

From repository root:

```powershell
Push-Location testing
python -m http.server 8080
Pop-Location
```

Make sure these URLs are reachable:

- `http://127.0.0.1:8080/productinfo.unigetui.test.json`
- `http://127.0.0.1:8080/UniGetUI.Installer.x64.exe`
- `http://127.0.0.1:8080/UniGetUI.Installer.arm64.exe`

## 2) Configure updater overrides (test mode)

These steps apply to a Debug build only.

Run in PowerShell:

```powershell
$regPath = 'HKLM:\Software\Devolutions\UniGetUI'
New-Item -Path $regPath -Force | Out-Null

# Point updater to local productinfo
Set-ItemProperty -Path $regPath -Name 'UpdaterProductInfoUrl' -Value 'http://127.0.0.1:8080/productinfo.unigetui.test.json'

# Product key inside productinfo JSON
Set-ItemProperty -Path $regPath -Name 'UpdaterProductKey' -Value 'Devolutions.UniGetUI'

# Allow local http URL and local domain for package downloads
Set-ItemProperty -Path $regPath -Name 'UpdaterAllowUnsafeUrls' -Type DWord -Value 1

# Keep hash validation enabled for normal test pass
Set-ItemProperty -Path $regPath -Name 'UpdaterSkipHashValidation' -Type DWord -Value 0

# Keep signer thumbprint validation enabled for normal test pass
Set-ItemProperty -Path $regPath -Name 'UpdaterSkipSignerThumbprintCheck' -Type DWord -Value 0

# Optional only for HTTPS cert troubleshooting in test environments
Set-ItemProperty -Path $regPath -Name 'UpdaterDisableTlsValidation' -Type DWord -Value 0
```

## 3) Trigger update check in UniGetUI

1. Launch UniGetUI.
2. Go to **Settings → General**.
3. Click **Check for updates**.

Expected result:

- Updater reads the local `productinfo.unigetui.test.json`.
- It picks the correct architecture `exe` installer.
- Download starts and hash is validated.
- Update banner/toast appears when update is ready.

## 4) Negative test: hash mismatch protection

Use one of these methods:

- Replace installer file content but keep original hash in JSON, or
- Edit hash in JSON to an incorrect value.

Expected result:

- Hash validation fails.
- Update is aborted with installer authenticity error.

## 5) Negative test: block unsafe URLs

Set:

```powershell
Set-ItemProperty -Path 'HKLM:\Software\Devolutions\UniGetUI' -Name 'UpdaterAllowUnsafeUrls' -Type DWord -Value 0
```

Expected result with local `http://127.0.0.1` URLs:

- Updater rejects source/download URL as unsafe.
- No installer launch.

## 6) Negative test: broken ProductInfo source

Use one of these methods:

- Point `UpdaterProductInfoUrl` to a missing URL, or
- Point `UpdaterProductInfoUrl` to a malformed JSON file, or
- In a Debug build only, point `UpdaterProductKey` to a non-existent product.

Example:

```powershell
Set-ItemProperty -Path 'HKLM:\Software\Devolutions\UniGetUI' -Name 'UpdaterProductInfoUrl' -Value 'http://127.0.0.1:8080/does-not-exist.json'
```

Expected result:

- Productinfo check fails.
- UniGetUI reports the update-check failure.
- No fallback source is used.

## 7) Optional: disable signer thumbprint check (test-only)

Use this only if your local installer is unsigned or signed with a non-Devolutions certificate.

```powershell
Set-ItemProperty -Path 'HKLM:\Software\Devolutions\UniGetUI' -Name 'UpdaterSkipSignerThumbprintCheck' -Type DWord -Value 1
```

## 8) Release-build hardening check

Run the same registry override setup against a Release build.

Expected result:

- Release build honors `UpdaterProductInfoUrl` only if it still passes normal source validation.
- Release build ignores `UpdaterProductKey`.
- Release build ignores validation bypass flags.
- Updater uses the configured ProductInfo URL and the built-in `Devolutions.UniGetUI` product key.

## 9) Cleanup after testing

Reset to default production behavior:

```powershell
$regPath = 'HKLM:\Software\Devolutions\UniGetUI'
Remove-ItemProperty -Path $regPath -Name 'UpdaterProductInfoUrl' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $regPath -Name 'UpdaterProductKey' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $regPath -Name 'UpdaterAllowUnsafeUrls' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $regPath -Name 'UpdaterSkipHashValidation' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $regPath -Name 'UpdaterSkipSignerThumbprintCheck' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $regPath -Name 'UpdaterDisableTlsValidation' -ErrorAction SilentlyContinue
```

With all override values removed, UniGetUI uses:

- `https://devolutions.net/productinfo.json`
- product key `Devolutions.UniGetUI`
- safety checks enabled
- hash validation enabled