selfupdate

Documentation

Overview

Package selfupdate replaces the running argus binary with the latest published release.

This is the most security-sensitive thing in the codebase, and it sits in a tool whose entire pitch is that it cannot write anything. So the rules here are strict and deliberately fail closed:

• HTTPS only, and only to the release host.
• The published SHA-256 must be fetched and must match. If the checksum cannot be retrieved, the update is abandoned — an unverifiable download is treated as a hostile one.
• Nothing downloaded is ever executed during the update.
• The replacement is atomic: verify fully, write beside the target, then rename over it. A failure at any point leaves the existing binary untouched rather than truncated.
• A locally-built binary is never silently clobbered.

Note this writes only to the local filesystem. It gives argus no ability to write to a cluster, which remains enforced by TestNoMutatingVerbs.

Index

• Constants
• func AssetName(tag string) string
• func Decide(opts Options, latest string) (note string, err error)
• func IsRelease(v string) bool
• func Update(ctx context.Context, opts Options, w io.Writer) error
• type Options
• type Release
  • func Latest(ctx context.Context) (*Release, error)

Constants

const Repo = "backendArchitect/argus"

Repo is the source of releases. A constant, not a flag: letting a caller redirect where the binary comes from would hand an attacker the whole update channel.

Functions

func AssetName

func AssetName(tag string) string

AssetName is the archive this platform needs, matching what the release workflow publishes.

func Decide

func Decide(opts Options, latest string) (note string, err error)

Decide works out whether to install, and is separated from the download so the rules can be tested without a network. The ordering matters and got it wrong once: -check used to fail with the local-build refusal, when a dry run must never fail — it changes nothing, so there is nothing to protect against.

Returns a note to print and stop on, or ("", nil) to proceed with the install.

func IsRelease

func IsRelease(v string) bool

IsRelease reports whether a version string is a clean release tag rather than a local build.

Go stamps a locally-built binary with a pseudo-version ("v0.1.6-0.2026...") and appends "+dirty" when the tree has uncommitted changes. Overwriting that with a published release would silently throw away someone's work in progress, so Update refuses unless forced.

func Update

func Update(ctx context.Context, opts Options, w io.Writer) error

Update replaces the running executable with the latest release.

Types

type Options

type Options struct {
	Current string // the running version
	Force   bool   // replace even a locally-built binary
	DryRun  bool   // check and report, change nothing
}

Options controls an update.

type Release

type Release struct {
	TagName string `json:"tag_name"`
	Assets  []struct {
		Name string `json:"name"`
		URL  string `json:"browser_download_url"`
	} `json:"assets"`
}

Release is the subset of GitHub's release JSON that matters.

func Latest

func Latest(ctx context.Context) (*Release, error)

Latest fetches the newest published release.