feat(node): Phase 7 slice 2b — self-contained update helper + channel-agnostic API - #408
Merged
Conversation
The pdn repos went public; redact internal ops detail that a secret-scanner won't flag but needn't be broadcast: the lab hostname (packetdotnet -> pdn-lab, repo-wide incl. deploy-node.sh's env-overridable default + a compose comment) and the real LAN IPs in the docs narrative (10.45.0.x -> 10.x.x.x). RFC1918 / internal-only throughout, so no security exposure either way; cosmetic. deploy-node.sh stays functional (PACKETNET_HOST override unchanged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-agnostic API The heart of the self-contained channel. packaging/packetnet-selfupdate — shipped by the (coming) install.sh as /usr/lib/packetnet/packetnet-update (same packetnet-update.service unit as apt, different body): fetch latest.json from the feed → pick this arch's tarball → download → sha256-verify (checksum-only; cosign seam marked) → unpack into releases/<new> via temp dir + atomic rename → flip the `current` symlink → restart → /healthz-gate → roll back to $prev on failure → GC keeping current+$prev. Parses the manifest without jq; paths/restart/health are PDN_*-overridable for testing. scripts/selfupdate-smoke.sh (wired into deb-smoke) proves happy-path / checksum-mismatch-refused / rollback against a file:// fixture — and caught a real bug: GC by mtime deleted the rollback target ($prev isn't necessarily 2nd-newest); fixed to protect current+$prev explicitly. API generalized: ISystemUpdateLauncher.StartAptUpdateAsync → StartUpdateAsync (channel-agnostic), and POST /api/v1/system/update now launches for BOTH apt and self-contained with a channel-aware `via`/audit; only unknown → 409 (self-contained stopped returning 501). SystemUpdateApiTests updated; 797 Node tests green. Remaining (slice 2c): installers/install.sh, the feed URL in node config, the available-version check feeding the UI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ined-node # Conflicts: # docs/plan.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The heart of the self-contained update channel.
packaging/packetnet-selfupdate— the helperShipped by the (coming)
install.shas/usr/lib/packetnet/packetnet-update— samepacketnet-update.serviceunit as the apt channel, different body:fetch
latest.jsonfrom the configured feed → pick this arch's tarball → download → sha256-verify (checksum-only; cosignverify-blobseam marked for later) → unpack intoreleases/<new>via a temp dir + atomic rename → flip thecurrentsymlink (the unit's ExecStart target) → restart → poll/healthz→ on failure flip back to$prev+ restart → GC keeping exactlycurrent+$prev.Parses the manifest without a jq dependency; paths/restart/health are
PDN_*-overridable so it's testable without systemd.scripts/selfupdate-smoke.sh(wired intodeb-smoke)Proves happy-path / checksum-mismatch-refused / rollback against a
file://fixture — no network, no systemd. It caught a real bug mid-build: GC by mtime deleted the rollback target (it's$prev, not necessarily the 2nd-newest by mtime) — fixed to protectcurrent+$prevexplicitly.API generalized
ISystemUpdateLauncher.StartAptUpdateAsync→StartUpdateAsync(channel-agnostic — starts the one oneshot whatever the install's helper does).POST /api/v1/system/updatenow launches for both apt and self-contained, with a channel-awarevia/audit; onlyunknown→ 409 (self-contained stopped returning 501).SystemUpdateApiTestsupdated.797 Node tests green; helper smoke green.
Remaining (slice 2c)
installers/install.sh(lay outreleases/current+ the self-contained unit + theselfcontainedmarker + the helper + polkit +/etc/packetnet/update.conf+ user/dirs + bootstrap), the feed URL in node config, and the available-version check feeding the UI.