title: A safe auto-updater for my program
body: <p>I've written a program in Python which is often modified.  I have about a dozen testers (hopefully, that number will increase) and they use the program in a portable version, which doesn't require them to install anything.  I've tried recently to provide an auto-updater in the program, so they could benefit from the last updates without losing their configuration, or needing to manually download the new build.</p>
  
  <p>I would like to do it as securely as possible, however, considering the possible security risks such an updater can present.  Here's what I've come up with.</p>
  
  <ol>
  <li>When the program starts, it checks it's build version (hard-coded).</li>
  <li>It compares this build version with the most recent build version available on the server.  This check is done through https, and doesn't do much, except getting the information on the server and comparing it.</li>
  <li>If a newer build is available, the user is asked whether he/she wants to download and install it.  If yes, the program closes after launching the updater (a different program).</li>
  <li>The updater downloads the new build from the server.  It's a zip archive at this point.</li>
  <li>The updater extracts the zip archive in a temporary directory created for this purpose.  Then it calls a batch file.  The updater is closed before the batch file is launched.</li>
  <li>The batch file copies everything in the temporary directory to the current directory, except for the settings that are kept as they are.  Then, when it's about to close, it calls the client again.</li>
  <li>Which starts again, updated.</li>
  </ol>
  
  <p>The batch file is used because the updater cannot replace itself (the operating system doesn't seem to like that very much, and I can't blame it).</p>
  
  <p>This works pretty well.  Some users have told me the initial connection in https doesn't work, which is quite puzzling, but I don't think doing the same thing by http is a good idea, too easy to alter the zip file.  Is it, though?</p>
  
  <p>Perhaps my list of step is really wrong for security.  I'd like to have your ideas and comments, on what should be dropped and what could be strengthened.</p>
  
  <p>Thank you in advance,</p>