mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-11 23:40:28 -10:00
* feat(update): add zero upgrade command to apply self-updates Extends the existing `zero update --check` (which only reported an available release) with an actual install step: - `zero update --apply` / `zero upgrade` download, sha256-verify, and install the latest release. - npm installs delegate to `npm install -g @gitlawb/zero@latest`. - Standalone installs download the release archive, verify its checksum, extract it (zip-slip guarded), and atomically replace the running binary plus any pre-existing optional sandbox helpers. On Windows, the running exe is renamed aside (NTFS allows this even while it's executing) since it can't be overwritten directly; the leftover ".old" file is cleaned up on a later invocation. Closes #459. * fix(update): correct macOS expectations in apply test The optional-helper assertion in TestApplyStandaloneUpdateReplacesBinary assumed every non-Windows platform has a linux-style "zero-seccomp" helper to refresh, but applyStandaloneUpdate correctly ships no optional helpers on macOS (matching scripts/postinstall.mjs). This made the test fail on macOS CI. Only assert the helper refresh on linux/windows. * fix(update): address CodeRabbit review findings on zero upgrade - Reject --target when combined with --apply/upgrade: applying installs onto the current machine, so a mismatched --target could replace the running binary with an incompatible-arch build. - Bound archive/checksum downloads with a dedicated timeout separate from the release-metadata check timeout, so a stalled connection can't hang zero upgrade forever. - Surface a failed rollback in the Windows replaceBinary path instead of swallowing it, so a botched install is reported rather than silently leaving the binary missing. - Run CleanupStaleBinary regardless of whether an update is available, so a leftover Windows ".old" file isn't stuck waiting for a future upgrade that may never come. - Report optional sandbox-helper refresh failures as warnings on ApplyResult (surfaced in text and JSON output) instead of discarding them silently. * fix(oauth): retry secret-lock on Windows delete-pending race to unblock CI TestLoadOrCreateSecretConcurrentConverges was failing this PR's Windows smoke job with "create token secret lock: ...Access is denied." — a pre-existing flake in internal/oauth, not in the upgrade code. On Windows a concurrent holder's os.Remove leaves the .lock in a delete-pending state, so an O_EXCL create races it with ERROR_ACCESS_DENIED (os.ErrPermission) rather than ErrExist; createSecretFile only treated ErrExist as contention and hard-failed otherwise. Treat os.ErrPermission as retryable too, mirroring acquireFileLock in lock.go. This is the same root-cause fix as #445 (diagnosis by @gnanam1990); folded in here to make this PR's CI green. Verified on Windows: the concurrent-converge test passes 30/30. --------- Co-authored-by: Vasanthdev2004 <[email protected]>
46 lines
1.3 KiB
Go
46 lines
1.3 KiB
Go
package update
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
)
|
|
|
|
// npmPackageName is the published package name for the npm distribution of
|
|
// zero (see package.json). scripts/postinstall.mjs downloads the native
|
|
// binary into the same directory as package.json and leaves a
|
|
// ".zero-binary-version" marker file next to it — both are reliable signals
|
|
// that a given executable came from an npm install.
|
|
const npmPackageName = "@gitlawb/zero"
|
|
|
|
// InstallMethod identifies how the running zero binary was installed.
|
|
type InstallMethod string
|
|
|
|
const (
|
|
InstallMethodNpm InstallMethod = "npm"
|
|
InstallMethodStandalone InstallMethod = "standalone"
|
|
)
|
|
|
|
// DetectInstallMethod inspects the directory containing executablePath for
|
|
// npm-install markers left by scripts/postinstall.mjs.
|
|
func DetectInstallMethod(executablePath string) InstallMethod {
|
|
dir := filepath.Dir(executablePath)
|
|
if _, err := os.Stat(filepath.Join(dir, ".zero-binary-version")); err == nil {
|
|
return InstallMethodNpm
|
|
}
|
|
data, err := os.ReadFile(filepath.Join(dir, "package.json"))
|
|
if err != nil {
|
|
return InstallMethodStandalone
|
|
}
|
|
var pkg struct {
|
|
Name string `json:"name"`
|
|
}
|
|
if err := json.Unmarshal(data, &pkg); err != nil {
|
|
return InstallMethodStandalone
|
|
}
|
|
if pkg.Name == npmPackageName {
|
|
return InstallMethodNpm
|
|
}
|
|
return InstallMethodStandalone
|
|
}
|