Documentation
¶
Overview ¶
Package selfupdate replaces the running vigolium binary with a newer signed release, in process: no shell, no curl, no install script.
Every file comes from one base URL (the CDN release prefix), so the version pointer, the checksums and the archive cannot skew against each other:
- metadata.json names the target version;
- checksums.txt and checksums.txt.minisig are fetched and the signature is verified against the built-in release keys (keys.go), failing closed. The signature's trusted comment must name the target version;
- vigolium_<v>_<os>_<arch>.tar.gz (.zip on Windows) is downloaded to a temp file in the target's own directory and must match its signed sha256;
- the single vigolium entry is extracted with a size cap, and `<tmp> version --json` must report the target version;
- the temp binary is renamed over the target (os.Executable resolved through symlinks), atomically on unix and via target.old on Windows.
A target directory the user cannot write is an error that names the fix (sudo or --install-dir); nothing is silently installed somewhere else.
Index ¶
Constants ¶
const ( // DefaultBaseURL is the public release prefix on the CDN; `make // public-release` uploads metadata.json, checksums.txt, its .minisig and // the archives there. DefaultBaseURL = "https://cdn.vigolium.com/vigolium-release" // EnvBaseURL overrides the release prefix (for example the nightly prefix, // https://cdn.vigolium.com/vigolium-nightly-release). Signatures are still // required, so pointing it elsewhere cannot install an unsigned build. EnvBaseURL = "VIGOLIUM_UPDATE_BASE_URL" // DefaultMaxArchiveBytes caps the archive download; DefaultMaxBinaryBytes // caps the extracted binary. Release binaries embed their helpers and run // to a few hundred MiB, so both leave ample room while still bounding a // hostile or corrupt stream. DefaultMaxArchiveBytes int64 = 1 << 30 DefaultMaxBinaryBytes int64 = 1 << 30 )
Variables ¶
var ErrBadSignature = errors.New("signature verification failed")
ErrBadSignature is returned when no trusted key verifies a signature.
var ErrNoTrustedKeys = errors.New("this build has no release signing key configured; " +
"reinstall with the install script (https://vigolium.com/install.sh) instead")
ErrNoTrustedKeys means this build carries no usable release signing key.
Functions ¶
func BinaryName ¶
BinaryName is the executable's file name on goos.
func CleanupOld ¶
func CleanupOld(exe string)
CleanupOld removes the <exe>.old file a Windows update leaves behind (the replaced binary cannot be deleted while it is still running). Best effort; a no-op everywhere else.
func NormalizeVersion ¶
NormalizeVersion trims v and ensures a leading "v", so it can be fed to golang.org/x/mod/semver. "" stays "".
func ResolveExecutable ¶
ResolveExecutable returns the running binary's path with symlinks resolved: the file an in-place update must replace (not the symlink in $PATH).
Types ¶
type NotWritableError ¶
NotWritableError is returned when the target's directory cannot be written.
func (*NotWritableError) Error ¶
func (e *NotWritableError) Error() string
func (*NotWritableError) Unwrap ¶
func (e *NotWritableError) Unwrap() error
type Options ¶
type Options struct {
// BaseURL is the release prefix. "" uses $VIGOLIUM_UPDATE_BASE_URL, then
// DefaultBaseURL. It must be https (plain http only to a loopback host).
BaseURL string
// CurrentVersion is the running binary's version ("v0.5.2"). A value that
// is not semver (a dev build) is always treated as behind.
CurrentVersion string
// Target is the binary to replace. "" resolves the running executable
// through symlinks.
Target string
// InstallDir, when set, installs <InstallDir>/vigolium instead of replacing
// Target. The directory is created when missing.
InstallDir string
// GOOS/GOARCH select the archive; "" uses the running platform.
GOOS, GOARCH string
// DryRun resolves the version, verifies the signed checksums and probes
// that the target is writable, but downloads and replaces nothing.
DryRun bool
// Client is the HTTP client; nil uses a client with a 10 minute timeout.
Client *http.Client
// TrustedKeys overrides the built-in release keys. For tests only.
TrustedKeys []string
// MaxArchiveBytes / MaxBinaryBytes override the size caps (0 = default).
MaxArchiveBytes int64
MaxBinaryBytes int64
// VerifyBinary checks the extracted binary before it replaces anything.
// nil runs `<path> version --json` and compares the reported version.
VerifyBinary func(ctx context.Context, path, wantVersion string) error
// Logf receives one line per step for human progress output. Optional.
Logf func(format string, args ...any)
}
Options configures Check and Update. The zero value updates the running binary from DefaultBaseURL (or $VIGOLIUM_UPDATE_BASE_URL).
type Result ¶
type Result struct {
From string `json:"from"`
To string `json:"to"`
Path string `json:"path"`
BaseURL string `json:"base_url"`
UpdateAvailable bool `json:"update_available"`
Changed bool `json:"changed"`
DryRun bool `json:"dry_run,omitempty"`
Archive string `json:"archive,omitempty"`
SHA256 string `json:"sha256,omitempty"`
}
Result describes what Check or Update found and did.