How does BackupWall update itself?

Updates arrive as a signed release file offered by the licence service to a licensed server. BackupWall downloads and verifies it, waits until nothing is running, swaps the program files, checks the new version is healthy, and rolls back by itself if it is not. Nothing is applied without your approval unless you choose Automatic.

The five steps

Offered. While the server is Licensed, its lease names the newest release for you. An unlicensed server, or one in Grace, gets no offer. A server whose own program files were modified gets no offer and no download ticket either, while its licence and backups carry on. Put the files back (install the release again) and the offer returns at the next check-in. The file check runs at most once a day; python -m app.licensing attest --force runs it now.
Downloaded and checked. Every hour BackupWall fetches the offered release into a staging folder and verifies it: a signature chain up to a key built into BackupWall, the signature of the release's file list, the file's hash and every file in it. A release that fails is not unpacked. If you filter outbound traffic, allow HTTPS to hub.backupwall.com, dl.backupwall.com and release-assets.githubusercontent.com (the download is redirected there).
Approved. Settings → Software updates has the policy: Off, Notify (the default; you approve one exact version) or Automatic. See Software updates settings.
Installed. A timer (backupwall-updater.timer, every 5 minutes) installs an approved release. It waits until no backup, restore, migration or download is running and never interrupts one. Then it stops the services, saves a copy of the database, swaps the program files, starts the new version and checks that it answers. The console is unavailable for a few seconds.
Rolled back, if it fails. If the new version does not come up healthy or a database change fails, the previous version and the database copy are put back by themselves, and that release is marked failed on this server: it is not tried again until you approve it again.

Updates are a signed file, not a package

An update is a tarball, not a yum or apt package. dnf update and apt upgrade will not update BackupWall.

What an update does not change

Python packages, system service units, install.sh and the panel plugins. A release that needs any of these says so in Settings → Software updates and must be installed by hand from its tarball. Run the plugin installers again after any update that changes them. See Upgrade BackupWall by hand.

Which builds can update

v277 is the first build that can be licensed and updated. A server on build v276 or older trusts no release key, so it cannot update itself: install v277 or later by hand once. From there on the Software updates page works.

Waiting for an idle server

An update waits for the server to be idle. A server where something runs all the time can wait a long time for its update; it tries every 5 minutes.

Safety

Releases are verified against pinned keys, the check fails closed, and an older release cannot be installed over a newer one.
A restore is never interrupted, queued behind or changed by an update.
The download host recognizes a licensed server by the public address its request comes from. A download that leaves from another address than the licence is tied to (a proxy, a second route out) is refused and the update fails without changing anything.