Documentation
¶
Overview ¶
Package agentupdate mirrors the fallbck-agent release of the server's own version for agents that update themselves. The goreleaser archive, the checksums file and its Sigstore bundle are fetched from GitHub once per OS/arch, the bundle is verified against the release workflow identity, the archive against the signed checksums, and everything is kept under <data dir>/agent-releases/<version>/. Agents fetch the archive plus the signed checksums and verify again themselves (the extracted binary is still served for agents from before release signing).
Index ¶
- Constants
- func ArchiveName(goos, goarch string) string
- func ExtractBinary(r io.Reader, dst string) (string, error)
- type Cache
- func (c *Cache) ArchivePath(goos, goarch string) string
- func (c *Cache) Binary(goos, goarch string) (sha string, ok bool)
- func (c *Cache) BundlePath() string
- func (c *Cache) ChecksumsPath() string
- func (c *Cache) Enabled() bool
- func (c *Cache) Errors() map[string]string
- func (c *Cache) Path(goos, goarch string) string
Constants ¶
const ReleaseBase = "https://github.com/OSShield/fallbck/releases/download"
ReleaseBase is where goreleaser publishes the archives
Variables ¶
This section is empty.
Functions ¶
func ArchiveName ¶
ArchiveName is the goreleaser archive for the agent on os/arch
Types ¶
type Cache ¶
type Cache struct {
Version string
Dir string
// BaseURL is the release download base (ReleaseBase); tests point it elsewhere
BaseURL string
Client *http.Client
// Verify checks the checksums file against its Sigstore bundle (releasesig.Verify;
// tests substitute it)
Verify func(bundle, checksums []byte) error
// contains filtered or unexported fields
}
Cache is the per-server mirror; Version is the server's release version
func (*Cache) ArchivePath ¶ added in v0.14.12
ArchivePath is where the verified release archive for os/arch lives
func (*Cache) Binary ¶
Binary returns the sha256 of the cached binary for os/arch when it is ready. When it is not, the fetch starts in the background and ok is false until it completes; the next heartbeat picks it up.
func (*Cache) BundlePath ¶ added in v0.14.12
func (*Cache) ChecksumsPath ¶ added in v0.14.12
ChecksumsPath and BundlePath are the release's signed checksums file and its Sigstore bundle
func (*Cache) Enabled ¶
Enabled reports whether the server runs a release build (dev builds never update agents)
Source Files