Lazarus components · in testing · alpha

Houston

Your Lazarus program gets signed self-updates, encrypted bug reports from its users and optional postcards, and you get a simple bug tracker to read them in. It all runs from one small script on your own web host. No accounts for your users, no services to sign up for, no server to run.

How it works Tell me what you think

Three pieces

Most hobby programs never get updates or bug reports because the plumbing is a project of its own. Houston is the plumbing, in three parts.

Five components

Drop them on your main form and paste one configuration line into the Object Inspector. Updates, bug reports, postcards and per-user installation, each with a window your users can read.

Ground Control

The developer's desktop program: makes the keys, publishes releases, collects reports into a simple tracker with states and notes, and counts postcards. With a command line for scripts.

🛰️

Houston Station

One Perl CGI script you put in the cgi-bin of any ordinary web host. It holds your signed releases and your users' sealed reports, and keeps its own access log. HTTPS is welcome, not required.

What your users see

Every window says what it is about to do, and nothing is sent until the user has read it.

Report a problem — A bug report: their words, an optional screenshot, everything shown before sending.

Update — An update: the release notes first, then a download checked against your signature.

Postcard — A postcard: an optional note with basic machine facts, offered once.

Installation for the user's account, with a menu entry, no administrator rights.

What you see

Ground Control keeps each program you publish as a project.

Reports, with a state for each (New, Read, Needs info, Fixed, Closed) and your own notes.

Overview — The overview: latest release, new reports, and collection every few minutes while it is open.

Releases: add a build per platform, write what is new, sign and publish.

Destinations — The station: save the script, upload it, give its address, check it.

Set up in under an hour

That is the goal Houston is held to: a Lazarus hobbyist goes from nothing to a test bug report in their own tracker in one sitting.

10 min

Install the package

Xor-el's three libraries from the Online Package Manager (CryptoLib4Pascal, HashLib4Pascal and SimpleBaseLib4Pascal), then Houston itself. The components appear on a Houston tab.

2 min

Make a project in Ground Control

New project makes the keys and settings in one step. A checklist on the Overview shows what comes next.

5–10 min

Put the station on your host

Save the station script, upload it to its own folder in cgi-bin, make it executable, type its address, press Check station.

10 min

Drop the components on your form

Paste the configuration line into the link's Configuration property and give each menu item a one-line handler.

5 min

Send yourself a report

Run your program, send a report and a postcard, and watch them arrive in Ground Control.

Security, plainly

A small host, plain files, and no trust where none is needed. The cryptography is not homemade: every signature, key and seal comes from Xor-el's CryptoLib4Pascal.

Signed updates

Programs accept a release only with your signature, and a download only with the size and SHA-256 the signed release names. A changed file never replaces your program.

Sealed reports

Reports and postcards are encrypted to your key before they leave the user's computer. The host and anyone on the way see only ciphertext.

A station only you can change

Ground Control signs every request, and the token never crosses the network. Messages are written once and cannot be replaced or deleted by anyone else.

Your program decides

An update never closes your program on its own. You say when, and a postponed update can install when the program closes.

Nothing about your users

No accounts, no user or machine identifiers. Users read every word of a report before sending it.

Leaves no mess

Deleting a project can remove its station from the host too: files, log and the script itself, after you confirm it more than once.

Where it stands

Tested by scripts that drive the real programs and windows, on Linux and in Windows and macOS test machines.

Linux	Tested end to end: reports, postcards, updates with restart, tampered downloads refused, installation and removal.
Windows	Tested end to end against a real station over HTTPS.
macOS	Ground Control and the demo build and run. Installation and updates are still to test.
Next	A first real program adopting it, a timed setup by a beginner, near-instant report collection, and a standalone station for a VPS or home server.

How Houston got here

Houston started inside Heckers Sketch: its bug report postbox, its hello postcard and its self-updater, lifted out so any Lazarus program could have them.

The first working prototypes used free file sharing services, Filebin and Catbox. No server, no account, nothing to pay for... perfect for a small developer with a small program and a small user base. With a few workarounds they worked, and the tests passed. But anyone can upload to those services too. Updates were signed, so nobody could slip in a fake one, but someone could still be a nuisance and keep your program from ever getting its updates.

That is why Houston needs its own small station: one CGI script on an ordinary web host. Yes, CGI is old school. Who cares, if it works. It runs on almost any cheap host, and it keeps the whole thing as simple as possible.

If you know a better way, I would love to hear it. A free service with no account needed that keeps this workflow secure, without running your own web service, would be ideal. I have looked at file sharing and crowd storage platforms, and nothing has struck me as reliable yet. Tell me in the comments.

Why I might not release it

Trust

I have used AI a lot on Houston, and it came up with some solutions I'm just not sure I trust yet. Anything that handles keys and updates for other people's programs has to be right, so I want to understand every part of it before anyone depends on it.

Looks

The components bring their own windows (reports, updates, postcards), built on the plain LCL so they work everywhere. That means they may not match a program's own theme or look. sysrpl recently showed themes for the Lazarus IDE on Windows and Linux, and it looks like there may be an LCL theming approach there worth learning from later. That could put this worry to rest.

Comments

What would you want from it? What would stop you using it? Know a free, no-account way to host the updates securely? Comments show here once posted.

Loading comments…