daupdate

Documentation

Overview

Package daupdate verifies and atomically activates signed release artifacts. It performs no network or filesystem work during construction and never derives process or shell authority.

Index

• Variables
• type Authorization
• type HTTPSource
  • func NewHTTPSource(client *http.Client, manifestBaseURL string) *HTTPSource
  • func (source *HTTPSource) FetchArtifact(ctx context.Context, value string, maxBytes int64) (io.ReadCloser, error)
  • func (source *HTTPSource) FetchManifest(ctx context.Context, channel string, maxBytes int64) (io.ReadCloser, error)
• type Options
• type Result
• type Source
• type Status
• type Updater
  • func New(channel, artifact string, publicKey ed25519.PublicKey, source Source, ...) *Updater
  • func (updater *Updater) Apply(ctx context.Context, currentVersion, target string, ...) (Result, error)
  • func (updater *Updater) Check(ctx context.Context, currentVersion string) (Result, error)
  • func (updater *Updater) DryRun(ctx context.Context, currentVersion string) (Result, error)

Variables

var (
	ErrInvalidManifest   = errors.New("invalid update manifest")
	ErrUntrustedManifest = errors.New("update manifest signature is not trusted")
	ErrUpdateCheckFailed = errors.New("update check failed")
	ErrArtifactMismatch  = errors.New("update artifact does not match the signed manifest")
	ErrAuthorization     = errors.New("update activation requires explicit authorization")
	ErrApplyFailed       = errors.New("update activation failed")
	ErrInvalidVersion    = errors.New("invalid release version")
)

Types

type Authorization

type Authorization string

Authorization is the explicit capability required to replace an executable.

const (
	AuthorizationDenied  Authorization = ""
	AuthorizationGranted Authorization = "update-approved"
)

type HTTPSource

type HTTPSource struct {
	// contains filtered or unexported fields
}

HTTPSource retrieves a signed channel manifest and same-origin artifacts. The caller-owned transport retains DNS, TLS, certificate, and IP policy.

func NewHTTPSource

func NewHTTPSource(client *http.Client, manifestBaseURL string) *HTTPSource

NewHTTPSource constructs a source rooted at an explicit HTTPS release directory. It performs no request. Static invalid inputs panic.

func (*HTTPSource) FetchArtifact

func (source *HTTPSource) FetchArtifact(ctx context.Context, value string, maxBytes int64) (io.ReadCloser, error)

func (*HTTPSource) FetchManifest

func (source *HTTPSource) FetchManifest(ctx context.Context, channel string, maxBytes int64) (io.ReadCloser, error)

type Options

type Options struct {
	MaxManifestBytes int64
	MaxArtifactBytes int64
	Timeout          time.Duration
	LockWait         time.Duration
	LockPath         string
}

Options configures finite work. Zero values select conservative defaults.

type Result

type Result struct {
	Channel        string `json:"channel"`
	Artifact       string `json:"artifact"`
	CurrentVersion string `json:"current_version"`
	LatestVersion  string `json:"latest_version"`
	Status         Status `json:"status"`
	Verified       bool   `json:"verified"`
	Applied        bool   `json:"applied"`
	SHA256         string `json:"sha256,omitempty"`
}

Result is the authority-free update outcome. It deliberately omits release URLs.

type Source

type Source interface {
	FetchManifest(context.Context, string, int64) (io.ReadCloser, error)
	FetchArtifact(context.Context, string, int64) (io.ReadCloser, error)
}

Source supplies bounded readers. Implementations must honor context and should enforce maxBytes before allocating; Updater independently caps reads.

type Status

type Status string

Status compares the current binary with the signed channel release.

const (
	UpdateAvailable Status = "update_available"
	UpToDate        Status = "up_to_date"
	CurrentNewer    Status = "current_newer"
)

type Updater

type Updater struct {
	// contains filtered or unexported fields
}

Updater binds one release channel and platform artifact to a trust root.

func New

func New(channel, artifact string, publicKey ed25519.PublicKey, source Source, options Options) *Updater

New constructs an Updater. Channel, artifact, trust root, and source are mandatory positional inputs. Static invalid configuration panics.

func (*Updater) Apply

func (updater *Updater) Apply(ctx context.Context, currentVersion, target string, authorization Authorization) (Result, error)

Apply verifies and atomically replaces target. A current or newer target is a successful no-op. Authorization is checked before any network or filesystem I/O.

func (*Updater) Check

func (updater *Updater) Check(ctx context.Context, currentVersion string) (Result, error)

Check verifies signed release metadata without downloading or changing the artifact.

func (*Updater) DryRun

func (updater *Updater) DryRun(ctx context.Context, currentVersion string) (Result, error)

DryRun verifies both signed metadata and artifact bytes without filesystem mutation.