Enterprise App Release Access Control: Grayscale, Crash Rate, and Security Boundaries of Hot Repair

Problems with enterprise apps are rarely as simple as "a wrong line of code";The wrong version has reached enough people. Google Play official help states: Staged rollout only applies to updates, not to first launches; the percentage will not increase automatically and needs to be manually expanded by the person in charge of the release. Apple's developer documentation calls the update a phased release: for users who turn on automatic updates, the volume will be released at a fixed pace of 7 days, 1%, 2%, 5%, 10%, 20%, 50%, and finally 100%. Both sides are doing the same thing - locking the blast radius into a retractable window.

1. Two sets of stores, two sets of grayscale grammar

Bitrise's comparison of release management is very clear: Apple does not let you manually change the percentage, but allows multiple pauses within a maximum of 30 days; after resumption, continue from the day of suspension instead of starting over. Play is more flexible. You can set the intervals and proportions yourself, but there is a hard constraint——The enlarged percentage cannot be rolled back, can only "abort". After the suspension, users who have upgraded to the new version will continue to stay in the new version, but no new users will enter the batch. If an app is removed from the shelf or the developer program expires, Apple's phasing will stop and it will be immediately visible to everyone after it is re-listed. If you want to control the volume, you can only re-submit a version.

2. The crash rate must be written as a "stop if you can't pass" access control

document.getElementById('af-error-page').style.display = 'none';Error 500 (Server Error)!!1*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;}* > body{background:url("//www.google.com/images/errors/robot.png") 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url("//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png") no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat 0% 0%/100% 100%;-moz-border-image:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}500. That’s an error.There was an error. Please try again later. That’s all we know.(function() {window.ERROR_PAGE = false; function replaceCurrentPageWithErrorPage() {if (!window.ERROR_PAGE) {var errorPage = document.getElementById('af-error-page2'); document.open('text/html'); document.close(); document.documentElement.setAttribute('lang', 'en'); document.documentElement.setAttribute('dir', 'ltr'); document.body.appendChild(errorPage); window.ERROR_PAGE = true;}}if (document.addEventListener) {document.addEventListener('DOMContentLoaded', replaceCurrentPageWithErrorPage, false); window.addEventListener('load', replaceCurrentPageWithErrorPage, false);} else {document.attachEvent('onreadystatechange', function() {if (document.readyState === 'complete') {replaceCurrentPageWithErrorPage();}}); window.attachEvent('onload', replaceCurrentPageWithErrorPage);}}());Session crash-free rate 99.95%, the head team can reach 99.99%. Most teams set the volume threshold between 99.5% and 99.9%, with finance and medical care being higher. In practice, don’t just look at the absolute value, but also compare it with the previous version: if the crash rate doubles at any stage, or the ANR continues to exceed 0.5%, you should stop it instead of “observe it for another night”. Play also reminds: Users can write reviews publicly in stages, and the wave of negative reviews will hurt the brand earlier than the collapse curve.

document.getElementById('af-error-page').style.display = 'none';Error 500 (Server Error)!!1*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;}* > body{background:url("//www.google.com/images/errors/robot.png") 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url("//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png") no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat 0% 0%/100% 100%;-moz-border-image:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}500. That’s an error.There was an error. Please try again later. That’s all we know.(function() {window.ERROR_PAGE = false; function replaceCurrentPageWithErrorPage() {if (!window.ERROR_PAGE) {var errorPage = document.getElementById('af-error-page2'); document.open('text/html'); document.close(); document.documentElement.setAttribute('lang', 'en'); document.documentElement.setAttribute('dir', 'ltr'); document.body.appendChild(errorPage); window.ERROR_PAGE = true;}}if (document.addEventListener) {document.addEventListener('DOMContentLoaded', replaceCurrentPageWithErrorPage, false); window.addEventListener('load', replaceCurrentPageWithErrorPage, false);} else {document.attachEvent('onreadystatechange', function() {if (document.readyState === 'complete') {replaceCurrentPageWithErrorPage();}}); window.attachEvent('onload', replaceCurrentPageWithErrorPage);}}());

Using the consumer-grade grayscale version of the store cannot solve the problem of "only updating for field engineers". There are three common ways for internal distribution within an enterprise: the store public version uses the official grayscale version; the employee version uses the TestFlight/internal test track; and the on-site reinforcement package uses the MDM mandatory version. Access control should be set according to track: the public version looks at crashes and scores, the internal version looks at whether key processes are running smoothly, and the MDM package also looks at certificates, device binding, and whether downgrades are allowed. Mix the three tracks into one "all-staff push", and problems will be reported to customers, sales and workshops at the same time.

3. Hot fix is ​​not a second app store

document.getElementById('af-error-page').style.display = 'none';Error 500 (Server Error)!!1*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;}* > body{background:url("//www.google.com/images/errors/robot.png") 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url("//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png") no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat 0% 0%/100% 100%;-moz-border-image:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}500. That’s an error.There was an error. Please try again later. That’s all we know.(function() {window.ERROR_PAGE = false; function replaceCurrentPageWithErrorPage() {if (!window.ERROR_PAGE) {var errorPage = document.getElementById('af-error-page2'); document.open('text/html'); document.close(); document.documentElement.setAttribute('lang', 'en'); document.documentElement.setAttribute('dir', 'ltr'); document.body.appendChild(errorPage); window.ERROR_PAGE = true;}}if (document.addEventListener) {document.addEventListener('DOMContentLoaded', replaceCurrentPageWithErrorPage, false); window.addEventListener('load', replaceCurrentPageWithErrorPage, false);} else {document.attachEvent('onreadystatechange', function() {if (document.readyState === 'complete') {replaceCurrentPageWithErrorPage();}}); window.attachEvent('onload', replaceCurrentPageWithErrorPage);}}());

• Allow OTA: Copywriting, layout, non-critical business logic, and switches that have been pre-embedded in the store package.
• Prohibited OTAdocument.getElementById('af-error-page').style.display = 'none';Error 500 (Server Error)!!1*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;}* > body{background:url("//www.google.com/images/errors/robot.png") 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url("//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png") no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat 0% 0%/100% 100%;-moz-border-image:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url("//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png") no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}500. That’s an error.There was an error. Please try again later. That’s all we know.(function() {window.ERROR_PAGE = false; function replaceCurrentPageWithErrorPage() {if (!window.ERROR_PAGE) {var errorPage = document.getElementById('af-error-page2'); document.open('text/html'); document.close(); document.documentElement.setAttribute('lang', 'en'); document.documentElement.setAttribute('dir', 'ltr'); document.body.appendChild(errorPage); window.ERROR_PAGE = true;}}if (document.addEventListener) {document.addEventListener('DOMContentLoaded', replaceCurrentPageWithErrorPage, false); window.addEventListener('load', replaceCurrentPageWithErrorPage, false);} else {document.attachEvent('onreadystatechange', function() {if (document.readyState === 'complete') {replaceCurrentPageWithErrorPage();}}); window.attachEvent('onload', replaceCurrentPageWithErrorPage);}}());
• Must be re-arraigned: Ability to handle native crashes, system API behavior changes, and store policy naming.

Enterprise customers often overestimate thermal remediation. If an "early morning push script" changes to the authentication or collection fields, it is equivalent to bypassing the app store and legal review. The contract and operation and maintenance manual should state that OTA has a list, audits, and one-click closure; after closure, the device must be able to return to the confirmed version of the store package.

4. A volume card that can be hung on the wall

Don’t rely on the feeling in the chat group on launch day. It is recommended to make a one-page card: current percentage, no crash rate, ANR, startup time, key conversions, number of negative reviews, person in charge, and which console the abort button is on. On the Play side, remember to wait until the store material is 100% before changing it to prevent half of the users from seeing inappropriate screenshots. If Apple decides to fully sell in advance, it must realize that it is irreversibly giving up the rest of the rhythm. For fatal flaws that cannot be repaired by the native package, Apple provides an expedited review channel. Play’s regular review is usually faster, but both channels requireResubmit binary, the percentage of old packages that have been terminated cannot be adjusted back.

Field operation apps should also look at weak networks separately: if the grayscale samples are all office Wi-Fi, a beautiful crash rate cannot represent the workshop. Writing the device portraits in the test track into the access control is closer to the enterprise scenario than just looking at the global average. If the hot fix channel must be used on the same day, a review of "why it was not fixed in the binary" should be added afterwards to prevent OTA from becoming the default release method.

The essence of enterprise app release access control is to admit that "new versions are not trustworthy by default." Grayscale buys observation time, crash rate buys the power to stop, and hot fix buys a patch channel rather than a lawless place. If you are still debating "whether to use grayscale" at the next version meeting, print out this card: who has the right to Halt, how many numbers must be Halted, and how long after Halting, a new binary must be given. Discussing these three sentences clearly will protect the scene more than adding two more functions.