selfupdate

package
v0.5.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 10, 2026 License: MIT Imports: 30 Imported by: 0

Documentation

Overview

Package selfupdate replaces the running vigolium binary with a newer signed release, in process: no shell, no curl, no install script.

Every file comes from one base URL (the CDN release prefix), so the version pointer, the checksums and the archive cannot skew against each other:

  1. metadata.json names the target version;
  2. checksums.txt and checksums.txt.minisig are fetched and the signature is verified against the built-in release keys (keys.go), failing closed. The signature's trusted comment must name the target version;
  3. vigolium_<v>_<os>_<arch>.tar.gz (.zip on Windows) is downloaded to a temp file in the target's own directory and must match its signed sha256;
  4. the single vigolium entry is extracted with a size cap, and `<tmp> version --json` must report the target version;
  5. the temp binary is renamed over the target (os.Executable resolved through symlinks), atomically on unix and via target.old on Windows.

A target directory the user cannot write is an error that names the fix (sudo or --install-dir); nothing is silently installed somewhere else.

Index

Constants

View Source
const (
	// DefaultBaseURL is the public release prefix on the CDN; `make
	// public-release` uploads metadata.json, checksums.txt, its .minisig and
	// the archives there.
	DefaultBaseURL = "https://cdn.vigolium.com/vigolium-release"

	// EnvBaseURL overrides the release prefix (for example the nightly prefix,
	// https://cdn.vigolium.com/vigolium-nightly-release). Signatures are still
	// required, so pointing it elsewhere cannot install an unsigned build.
	EnvBaseURL = "VIGOLIUM_UPDATE_BASE_URL"

	// DefaultMaxArchiveBytes caps the archive download; DefaultMaxBinaryBytes
	// caps the extracted binary. Release binaries embed their helpers and run
	// to a few hundred MiB, so both leave ample room while still bounding a
	// hostile or corrupt stream.
	DefaultMaxArchiveBytes int64 = 1 << 30
	DefaultMaxBinaryBytes  int64 = 1 << 30
)

Variables

View Source
var ErrBadSignature = errors.New("signature verification failed")

ErrBadSignature is returned when no trusted key verifies a signature.

View Source
var ErrNoTrustedKeys = errors.New("this build has no release signing key configured; " +
	"reinstall with the install script (https://vigolium.com/install.sh) instead")

ErrNoTrustedKeys means this build carries no usable release signing key.

Functions

func BinaryName

func BinaryName(goos string) string

BinaryName is the executable's file name on goos.

func CleanupOld

func CleanupOld(exe string)

CleanupOld removes the <exe>.old file a Windows update leaves behind (the replaced binary cannot be deleted while it is still running). Best effort; a no-op everywhere else.

func NormalizeVersion

func NormalizeVersion(v string) string

NormalizeVersion trims v and ensures a leading "v", so it can be fed to golang.org/x/mod/semver. "" stays "".

func ResolveExecutable

func ResolveExecutable() (string, error)

ResolveExecutable returns the running binary's path with symlinks resolved: the file an in-place update must replace (not the symlink in $PATH).

Types

type NotWritableError

type NotWritableError struct {
	Path string
	Err  error
}

NotWritableError is returned when the target's directory cannot be written.

func (*NotWritableError) Error

func (e *NotWritableError) Error() string

func (*NotWritableError) Unwrap

func (e *NotWritableError) Unwrap() error

type Options

type Options struct {
	// BaseURL is the release prefix. "" uses $VIGOLIUM_UPDATE_BASE_URL, then
	// DefaultBaseURL. It must be https (plain http only to a loopback host).
	BaseURL string
	// CurrentVersion is the running binary's version ("v0.5.2"). A value that
	// is not semver (a dev build) is always treated as behind.
	CurrentVersion string
	// Target is the binary to replace. "" resolves the running executable
	// through symlinks.
	Target string
	// InstallDir, when set, installs <InstallDir>/vigolium instead of replacing
	// Target. The directory is created when missing.
	InstallDir string
	// GOOS/GOARCH select the archive; "" uses the running platform.
	GOOS, GOARCH string
	// DryRun resolves the version, verifies the signed checksums and probes
	// that the target is writable, but downloads and replaces nothing.
	DryRun bool

	// Client is the HTTP client; nil uses a client with a 10 minute timeout.
	Client *http.Client
	// TrustedKeys overrides the built-in release keys. For tests only.
	TrustedKeys []string
	// MaxArchiveBytes / MaxBinaryBytes override the size caps (0 = default).
	MaxArchiveBytes int64
	MaxBinaryBytes  int64
	// VerifyBinary checks the extracted binary before it replaces anything.
	// nil runs `<path> version --json` and compares the reported version.
	VerifyBinary func(ctx context.Context, path, wantVersion string) error
	// Logf receives one line per step for human progress output. Optional.
	Logf func(format string, args ...any)
}

Options configures Check and Update. The zero value updates the running binary from DefaultBaseURL (or $VIGOLIUM_UPDATE_BASE_URL).

type Result

type Result struct {
	From            string `json:"from"`
	To              string `json:"to"`
	Path            string `json:"path"`
	BaseURL         string `json:"base_url"`
	UpdateAvailable bool   `json:"update_available"`
	Changed         bool   `json:"changed"`
	DryRun          bool   `json:"dry_run,omitempty"`
	Archive         string `json:"archive,omitempty"`
	SHA256          string `json:"sha256,omitempty"`
}

Result describes what Check or Update found and did.

func Check

func Check(ctx context.Context, opts Options) (Result, error)

Check resolves the latest release version and whether it is newer than the running one. It fetches metadata.json only: nothing is verified or written.

func Update

func Update(ctx context.Context, opts Options) (Result, error)

Update installs the latest signed release over the target binary (see the package doc for the steps). When the running version is already current it returns Changed=false without downloading anything.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL