Native Windows deployment: config file, service, signed auto-update
- internal/config: .env-style config file (gpu-turnstile.env next to the exe, -config flag or GPU_TURNSTILE_CONFIG); process env overrides file. - internal/service: Windows service via golang.org/x/sys/windows/svc — graceful SCM stop, 'service install/remove' commands, restart-on-failure recovery (also applies staged updates). First external dependency, Windows-only; Linux/Docker build unaffected (go.mod stays at 1.23). - internal/update: polls the Gitea releases API, verifies the Ed25519 signature of the downloaded binary against an embedded public key (openssl-signed by CI), swaps it in next to the running exe, and once the GPU lock is idle exits with code 3 so service recovery restarts onto the new version. Dev builds and empty pubkey never update. - CI: tag builds additionally produce gpu-turnstile.exe + .sig + .sha256 attached to a Gitea release. - LOG_FILE env var so the service has somewhere to log.
This commit is contained in:
mram
@@ -0,0 +1,13 @@
|
||||
package update
|
||||
|
||||
// publicKeyPEM is the PEM-encoded Ed25519 public key that matches the
|
||||
// SIGNING_KEY secret used by CI to sign release binaries. Generate a
|
||||
// keypair once with:
|
||||
//
|
||||
// openssl genpkey -algorithm ed25519 -out private.pem
|
||||
// openssl pkey -in private.pem -pubout -out public.pem
|
||||
//
|
||||
// Paste the contents of public.pem here and commit; store private.pem as
|
||||
// the SIGNING_KEY repository secret. When empty, the updater refuses to
|
||||
// update (e.g. development builds).
|
||||
var publicKeyPEM = ""
|
||||
@@ -0,0 +1,254 @@
|
||||
// Package update implements gpu-turnstile's self-updater: it polls the
|
||||
// Gitea releases API, downloads the Windows binary of newer releases, and
|
||||
// verifies its Ed25519 signature (produced by CI with OpenSSL) before
|
||||
// swapping it in next to the running executable.
|
||||
package update
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"crypto/sha256"
|
||||
"crypto/x509"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// maxAssetSize bounds release asset downloads.
|
||||
const maxAssetSize = 512 << 20
|
||||
|
||||
// Updater checks one Gitea repository for newer releases.
|
||||
type Updater struct {
|
||||
Repo string // e.g. https://git.rambossek.at/PUBLIC/gpu-turnstile
|
||||
Asset string // e.g. gpu-turnstile.exe
|
||||
Version string // current version, e.g. v0.1.2 ("dev" disables updates)
|
||||
Log *slog.Logger
|
||||
Client *http.Client
|
||||
}
|
||||
|
||||
type release struct {
|
||||
TagName string `json:"tag_name"`
|
||||
Assets []struct {
|
||||
Name string `json:"name"`
|
||||
BrowserDownloadURL string `json:"browser_download_url"`
|
||||
} `json:"assets"`
|
||||
}
|
||||
|
||||
func (u *Updater) logger() *slog.Logger {
|
||||
if u.Log != nil {
|
||||
return u.Log
|
||||
}
|
||||
return slog.Default()
|
||||
}
|
||||
|
||||
func (u *Updater) httpClient() *http.Client {
|
||||
if u.Client != nil {
|
||||
return u.Client
|
||||
}
|
||||
return &http.Client{Timeout: 5 * time.Minute}
|
||||
}
|
||||
|
||||
// apiURL derives <scheme>://<host>/api/v1/repos/<owner>/<name> from Repo.
|
||||
func (u *Updater) apiURL() (string, error) {
|
||||
repoURL, err := url.Parse(u.Repo)
|
||||
if err != nil || repoURL.Scheme == "" || repoURL.Host == "" {
|
||||
return "", fmt.Errorf("invalid UPDATE_REPO %q", u.Repo)
|
||||
}
|
||||
ownerName := strings.Trim(repoURL.Path, "/")
|
||||
if len(strings.Split(ownerName, "/")) != 2 {
|
||||
return "", fmt.Errorf("UPDATE_REPO %q: expected path /<owner>/<name>", u.Repo)
|
||||
}
|
||||
return fmt.Sprintf("%s://%s/api/v1/repos/%s", repoURL.Scheme, repoURL.Host, ownerName), nil
|
||||
}
|
||||
|
||||
// newerVersion reports whether latest is a higher vX.Y.Z version than
|
||||
// current. Both may carry a leading "v".
|
||||
func newerVersion(current, latest string) (bool, error) {
|
||||
parse := func(s string) ([3]int, error) {
|
||||
var v [3]int
|
||||
parts := strings.Split(strings.TrimPrefix(s, "v"), ".")
|
||||
if len(parts) != 3 {
|
||||
return v, fmt.Errorf("not a vX.Y.Z version: %q", s)
|
||||
}
|
||||
for i, p := range parts {
|
||||
n, err := strconv.Atoi(p)
|
||||
if err != nil {
|
||||
return v, fmt.Errorf("not a vX.Y.Z version: %q", s)
|
||||
}
|
||||
v[i] = n
|
||||
}
|
||||
return v, nil
|
||||
}
|
||||
cur, err := parse(current)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
lat, err := parse(latest)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
for i := 0; i < 3; i++ {
|
||||
if lat[i] != cur[i] {
|
||||
return lat[i] > cur[i], nil
|
||||
}
|
||||
}
|
||||
return false, nil
|
||||
}
|
||||
|
||||
func (u *Updater) get(ctx context.Context, url string) ([]byte, error) {
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
resp, err := u.httpClient().Do(req)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
io.Copy(io.Discard, resp.Body)
|
||||
return nil, fmt.Errorf("GET %s: %s", url, resp.Status)
|
||||
}
|
||||
return io.ReadAll(io.LimitReader(resp.Body, maxAssetSize))
|
||||
}
|
||||
|
||||
func verifySignature(pubKeyPEM string, data, sig []byte) error {
|
||||
block, _ := pem.Decode([]byte(pubKeyPEM))
|
||||
if block == nil {
|
||||
return fmt.Errorf("invalid embedded public key PEM")
|
||||
}
|
||||
key, err := x509.ParsePKIXPublicKey(block.Bytes)
|
||||
if err != nil {
|
||||
return fmt.Errorf("parse public key: %w", err)
|
||||
}
|
||||
pub, ok := key.(ed25519.PublicKey)
|
||||
if !ok {
|
||||
return fmt.Errorf("public key is not Ed25519")
|
||||
}
|
||||
if !ed25519.Verify(pub, data, sig) {
|
||||
return fmt.Errorf("signature verification failed")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// stage swaps data into place at exePath: the running executable is
|
||||
// renamed aside (allowed on Windows) and the new file takes its name.
|
||||
func stage(exePath string, data []byte) error {
|
||||
newPath := exePath + ".new"
|
||||
oldPath := exePath + ".old"
|
||||
os.Remove(oldPath) // leftover from a previous update
|
||||
if err := os.WriteFile(newPath, data, 0o755); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(exePath, oldPath); err != nil {
|
||||
os.Remove(newPath)
|
||||
return err
|
||||
}
|
||||
if err := os.Rename(newPath, exePath); err != nil {
|
||||
os.Rename(oldPath, exePath) // roll back
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// CleanupOld removes the .old binary left behind by a staged update.
|
||||
// Call once at startup.
|
||||
func CleanupOld(exePath string) {
|
||||
os.Remove(exePath + ".old")
|
||||
os.Remove(exePath + ".new")
|
||||
}
|
||||
|
||||
// Check performs a single update check. staged is true when a newer,
|
||||
// signature-verified binary has been swapped into place at exePath; the
|
||||
// caller should then restart the process. A nil error with staged=false
|
||||
// means "no action" (up to date, disabled, or dev build); a non-nil error
|
||||
// means the check failed and the running binary is untouched.
|
||||
func (u *Updater) Check(ctx context.Context, exePath string) (staged bool, err error) {
|
||||
log := u.logger()
|
||||
if u.Version == "" || u.Version == "dev" {
|
||||
log.Debug("auto-update: dev build, skipping")
|
||||
return false, nil
|
||||
}
|
||||
if publicKeyPEM == "" {
|
||||
log.Debug("auto-update: no public key embedded, skipping")
|
||||
return false, nil
|
||||
}
|
||||
api, err := u.apiURL()
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
body, err := u.get(ctx, api+"/releases/latest")
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("fetch latest release: %w", err)
|
||||
}
|
||||
var rel release
|
||||
if err := json.Unmarshal(body, &rel); err != nil {
|
||||
return false, fmt.Errorf("parse release: %w", err)
|
||||
}
|
||||
newer, err := newerVersion(u.Version, rel.TagName)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
if !newer {
|
||||
log.Debug("auto-update: up to date", "version", u.Version, "latest", rel.TagName)
|
||||
return false, nil
|
||||
}
|
||||
|
||||
urls := make(map[string]string, len(rel.Assets))
|
||||
for _, a := range rel.Assets {
|
||||
urls[a.Name] = a.BrowserDownloadURL
|
||||
}
|
||||
assetURL, ok := urls[u.Asset]
|
||||
if !ok {
|
||||
return false, fmt.Errorf("release %s has no asset %q", rel.TagName, u.Asset)
|
||||
}
|
||||
sigURL, ok := urls[u.Asset+".sig"]
|
||||
if !ok {
|
||||
return false, fmt.Errorf("release %s has no signature asset %q", rel.TagName, u.Asset+".sig")
|
||||
}
|
||||
|
||||
data, err := u.get(ctx, assetURL)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("download %s: %w", u.Asset, err)
|
||||
}
|
||||
sig, err := u.get(ctx, sigURL)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("download signature: %w", err)
|
||||
}
|
||||
|
||||
if sumURL, ok := urls[u.Asset+".sha256"]; ok {
|
||||
sumText, err := u.get(ctx, sumURL)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("download checksum: %w", err)
|
||||
}
|
||||
want := strings.Fields(string(sumText))[0]
|
||||
got := hex.EncodeToString(sha256Bytes(data))
|
||||
if !strings.EqualFold(want, got) {
|
||||
return false, fmt.Errorf("sha256 mismatch: got %s, want %s", got, want)
|
||||
}
|
||||
}
|
||||
if err := verifySignature(publicKeyPEM, data, sig); err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
if err := stage(exePath, data); err != nil {
|
||||
return false, fmt.Errorf("stage update: %w", err)
|
||||
}
|
||||
log.Info("auto-update: new version staged", "from", u.Version, "to", rel.TagName)
|
||||
return true, nil
|
||||
}
|
||||
|
||||
func sha256Bytes(data []byte) []byte {
|
||||
sum := sha256.Sum256(data)
|
||||
return sum[:]
|
||||
}
|
||||
@@ -0,0 +1,186 @@
|
||||
package update
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// fakeGitea serves a Gitea-flavored releases API with one release.
|
||||
type fakeGitea struct {
|
||||
srv *httptest.Server
|
||||
pubPEM string
|
||||
asset []byte
|
||||
tag string
|
||||
tamper bool
|
||||
noSig bool
|
||||
}
|
||||
|
||||
func newFakeGitea(t *testing.T, tag string, assetContent []byte) *fakeGitea {
|
||||
t.Helper()
|
||||
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
der, err := x509.MarshalPKIXPublicKey(pub)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
f := &fakeGitea{
|
||||
pubPEM: string(pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: der})),
|
||||
asset: assetContent,
|
||||
tag: tag,
|
||||
}
|
||||
sign := func() []byte { return ed25519.Sign(priv, f.asset) }
|
||||
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/api/v1/repos/o/r/releases/latest", func(w http.ResponseWriter, r *http.Request) {
|
||||
assets := []map[string]string{
|
||||
{"name": "gpu-turnstile.exe", "browser_download_url": f.srv.URL + "/dl/exe"},
|
||||
{"name": "gpu-turnstile.exe.sha256", "browser_download_url": f.srv.URL + "/dl/sha"},
|
||||
}
|
||||
if !f.noSig {
|
||||
assets = append(assets, map[string]string{"name": "gpu-turnstile.exe.sig", "browser_download_url": f.srv.URL + "/dl/sig"})
|
||||
}
|
||||
json.NewEncoder(w).Encode(map[string]any{"tag_name": f.tag, "assets": assets})
|
||||
})
|
||||
mux.HandleFunc("/dl/exe", func(w http.ResponseWriter, r *http.Request) { w.Write(f.asset) })
|
||||
mux.HandleFunc("/dl/sig", func(w http.ResponseWriter, r *http.Request) {
|
||||
sig := sign()
|
||||
if f.tamper {
|
||||
sig[0] ^= 0xff
|
||||
}
|
||||
w.Write(sig)
|
||||
})
|
||||
mux.HandleFunc("/dl/sha", func(w http.ResponseWriter, r *http.Request) {
|
||||
fmt.Fprintf(w, "%x gpu-turnstile.exe\n", sha256Bytes(f.asset))
|
||||
})
|
||||
f.srv = httptest.NewServer(mux)
|
||||
t.Cleanup(f.srv.Close)
|
||||
return f
|
||||
}
|
||||
|
||||
func (f *fakeGitea) updater(version string) *Updater {
|
||||
return &Updater{Repo: f.srv.URL + "/o/r", Asset: "gpu-turnstile.exe", Version: version}
|
||||
}
|
||||
|
||||
func fakeExe(t *testing.T) string {
|
||||
t.Helper()
|
||||
exe := filepath.Join(t.TempDir(), "gpu-turnstile.exe")
|
||||
if err := os.WriteFile(exe, []byte("old-binary"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return exe
|
||||
}
|
||||
|
||||
func withPublicKey(t *testing.T, pem string) {
|
||||
t.Helper()
|
||||
old := publicKeyPEM
|
||||
publicKeyPEM = pem
|
||||
t.Cleanup(func() { publicKeyPEM = old })
|
||||
}
|
||||
|
||||
func TestCheckStagesUpdate(t *testing.T) {
|
||||
f := newFakeGitea(t, "v9.9.9", []byte("new-binary"))
|
||||
withPublicKey(t, f.pubPEM)
|
||||
exe := fakeExe(t)
|
||||
|
||||
staged, err := f.updater("v0.1.2").Check(context.Background(), exe)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !staged {
|
||||
t.Fatal("expected staged update")
|
||||
}
|
||||
content, _ := os.ReadFile(exe)
|
||||
if string(content) != "new-binary" {
|
||||
t.Fatalf("exe content = %q", content)
|
||||
}
|
||||
old, _ := os.ReadFile(exe + ".old")
|
||||
if string(old) != "old-binary" {
|
||||
t.Fatalf(".old content = %q", old)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckRejectsTamperedSignature(t *testing.T) {
|
||||
f := newFakeGitea(t, "v9.9.9", []byte("new-binary"))
|
||||
f.tamper = true
|
||||
withPublicKey(t, f.pubPEM)
|
||||
exe := fakeExe(t)
|
||||
|
||||
staged, err := f.updater("v0.1.2").Check(context.Background(), exe)
|
||||
if err == nil {
|
||||
t.Fatal("expected signature error")
|
||||
}
|
||||
if staged {
|
||||
t.Fatal("must not stage on bad signature")
|
||||
}
|
||||
content, _ := os.ReadFile(exe)
|
||||
if string(content) != "old-binary" {
|
||||
t.Fatal("exe was modified despite bad signature")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckSkipsOlderOrEqual(t *testing.T) {
|
||||
for _, tag := range []string{"v0.1.2", "v0.1.1", "v0.0.9"} {
|
||||
f := newFakeGitea(t, tag, []byte("new-binary"))
|
||||
withPublicKey(t, f.pubPEM)
|
||||
staged, err := f.updater("v0.1.2").Check(context.Background(), fakeExe(t))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if staged {
|
||||
t.Fatalf("tag %s must not stage over v0.1.2", tag)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckSkipsWithoutPublicKey(t *testing.T) {
|
||||
f := newFakeGitea(t, "v9.9.9", []byte("new-binary"))
|
||||
withPublicKey(t, "")
|
||||
staged, err := f.updater("v0.1.2").Check(context.Background(), fakeExe(t))
|
||||
if err != nil || staged {
|
||||
t.Fatalf("staged=%v err=%v, want no action without key", staged, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckSkipsDevBuild(t *testing.T) {
|
||||
f := newFakeGitea(t, "v9.9.9", []byte("new-binary"))
|
||||
withPublicKey(t, f.pubPEM)
|
||||
staged, err := f.updater("dev").Check(context.Background(), fakeExe(t))
|
||||
if err != nil || staged {
|
||||
t.Fatalf("staged=%v err=%v, want no action for dev build", staged, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewerVersion(t *testing.T) {
|
||||
cases := []struct {
|
||||
cur, lat string
|
||||
want bool
|
||||
}{
|
||||
{"v0.1.2", "v0.1.3", true},
|
||||
{"0.1.2", "0.2.0", true},
|
||||
{"v0.1.2", "v1.0.0", true},
|
||||
{"v0.1.2", "v0.1.2", false},
|
||||
{"v1.2.3", "v1.2.10", true},
|
||||
{"v1.2.10", "v1.2.3", false},
|
||||
}
|
||||
for _, c := range cases {
|
||||
got, err := newerVersion(c.cur, c.lat)
|
||||
if err != nil || got != c.want {
|
||||
t.Errorf("newerVersion(%s, %s) = %v, %v; want %v", c.cur, c.lat, got, err, c.want)
|
||||
}
|
||||
}
|
||||
if _, err := newerVersion("v0.1", "v0.1.2"); err == nil {
|
||||
t.Error("expected error for malformed version")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user