433e375def
Phase 2 security audit follow-up. Three independent hardenings against the unauthenticated daemon surface, the long-lived agent SSE stream and the self-update channel. UPnP is now opt-in. The stream port + /hls endpoints have no auth, so publishing them on the WAN via the gateway was a default that exposed active downloads to anyone scanning the operator's external IP. New config downloads.enable_upnp (default false) gates the mapping; LAN and Tailscale clients continue to work unchanged. A startup log makes the new default visible. The agent SSE reader now uses a bounded bufio.Scanner instead of an unbounded ReadString. A hostile or buggy server can no longer grow daemon memory by streaming a single line forever or by emitting unbounded data: continuation lines — both are capped at 256 KiB and 1 MiB respectively, and an error is surfaced so SignalLoop reconnects. Self-update now verifies an ed25519 signature over checksums.txt when the binary was built with a release public key embedded (injected via goreleaser ldflags from RELEASE_SIGNING_PUBKEY). The companion scripts/sign-checksums runs in the release workflow when both the public-key variable and the private-key secret are present, uploading checksums.txt.sig next to the existing checksums file. Builds without the embedded key continue to update with SHA256-only verification; a --allow-unsigned flag is provided so users on a signed build can still install pre-signing releases or recover from an accidental unsigned release. A new scripts/gen-release-key helper documents the one-time keypair generation procedure required before flipping signing on.
118 lines
3.3 KiB
Go
118 lines
3.3 KiB
Go
package cmd
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/fatih/color"
|
|
"github.com/spf13/cobra"
|
|
"github.com/torrentclaw/unarr/internal/agent"
|
|
"github.com/torrentclaw/unarr/internal/upgrade"
|
|
)
|
|
|
|
func newSelfUpdateCmd() *cobra.Command {
|
|
var force bool
|
|
var allowUnsigned bool
|
|
|
|
cmd := &cobra.Command{
|
|
Use: "self-update",
|
|
Short: "Update unarr to the latest version",
|
|
Long: `Download and install the latest version of unarr.
|
|
|
|
Checks GitHub for the latest release, verifies the checksum, and
|
|
replaces the current binary. A backup is kept at <binary>.backup.
|
|
|
|
If the daemon is running, it is automatically restarted so the new
|
|
version is loaded into memory (otherwise heartbeat would keep
|
|
reporting the old version until a manual restart).`,
|
|
Example: ` unarr self-update
|
|
unarr self-update --force
|
|
unarr self-update --allow-unsigned # accept releases missing checksums.txt.sig`,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
return runSelfUpdate(force, allowUnsigned)
|
|
},
|
|
}
|
|
|
|
cmd.Flags().BoolVarP(&force, "force", "f", false, "reinstall even if already up to date")
|
|
cmd.Flags().BoolVar(&allowUnsigned, "allow-unsigned", false, "continue with SHA256-only verification when checksums.txt.sig is missing")
|
|
|
|
return cmd
|
|
}
|
|
|
|
func runSelfUpdate(force, allowUnsigned bool) error {
|
|
bold := color.New(color.Bold)
|
|
green := color.New(color.FgGreen)
|
|
yellow := color.New(color.FgYellow)
|
|
red := color.New(color.FgRed)
|
|
|
|
fmt.Println()
|
|
bold.Println(" unarr self-update")
|
|
fmt.Println()
|
|
|
|
fmt.Print(" Checking latest version... ")
|
|
ctx := context.Background()
|
|
latest, err := upgrade.CheckLatest(ctx)
|
|
if err != nil {
|
|
fmt.Println()
|
|
return fmt.Errorf("could not check latest version: %w", err)
|
|
}
|
|
|
|
currentClean := strings.TrimPrefix(Version, "v")
|
|
fmt.Printf("v%s\n", latest)
|
|
fmt.Printf(" Current version: v%s\n", currentClean)
|
|
|
|
if currentClean == latest && !force {
|
|
fmt.Println()
|
|
green.Println(" ✓ Already up to date!")
|
|
fmt.Println()
|
|
return nil
|
|
}
|
|
|
|
if currentClean == latest && force {
|
|
yellow.Println(" Forcing reinstall...")
|
|
}
|
|
|
|
fmt.Println()
|
|
|
|
upgrader := &upgrade.Upgrader{
|
|
CurrentVersion: currentClean,
|
|
AllowUnsigned: allowUnsigned,
|
|
OnProgress: func(msg string) {
|
|
fmt.Printf(" %s\n", msg)
|
|
},
|
|
}
|
|
|
|
result := upgrader.Execute(ctx, latest)
|
|
|
|
fmt.Println()
|
|
if !result.Success {
|
|
return fmt.Errorf("upgrade failed: %v", result.Error)
|
|
}
|
|
|
|
green.Printf(" ✓ Upgraded v%s → v%s\n", result.OldVersion, result.NewVersion)
|
|
if result.BackupPath != "" {
|
|
fmt.Printf(" Backup: %s\n", result.BackupPath)
|
|
}
|
|
|
|
// Auto-restart daemon if it is running, otherwise the live process keeps
|
|
// serving the old version (heartbeat reports old version → web gates
|
|
// features against the wrong version).
|
|
if state := agent.ReadState(); state != nil && isDaemonAlive(state) {
|
|
fmt.Println()
|
|
fmt.Printf(" → Daemon running (PID %d), restarting to load new version...\n", state.PID)
|
|
if err := runDaemonSvcRestart(); err != nil {
|
|
fmt.Println()
|
|
red.Printf(" ✗ Auto-restart failed: %v\n", err)
|
|
fmt.Println(" The new binary is on disk but the daemon is still running the old version.")
|
|
fmt.Println(" Run manually: unarr daemon restart")
|
|
fmt.Println(" (If the daemon runs under a different user/session, restart it there.)")
|
|
fmt.Println()
|
|
return nil
|
|
}
|
|
green.Println(" ✓ Daemon restarted")
|
|
}
|
|
|
|
fmt.Println()
|
|
return nil
|
|
}
|