feat(update): examine release downloads with checksums.txt - #36
Merged
Merged
Conversation
nabil1440
added this pull request to stack #38
September 22, 2026 10:40
nabil1440
changed the title
nabil1440
force-pushed
the
agent/9-checksums
branch
from
September 22, 2026 11:03
4c68e67 to
d9fab65
Compare
- fly update downloads checksums.txt of the release and compares the sha256 of the archive before it extracts the binary. A release without checksums.txt, or without a line for the archive, is not installed. - fly update now uses the same download and check code as agent.update, with a limit of 10 minutes. - install.sh downloads checksums.txt and runs sha256sum -c. It stops when the file is missing or the checksum does not agree. Refs #9
…trl-C Fixes from the adversarial review of this layer. - checksums.txt with two different sums for the same file is not valid. Before, fly update used the first line and install.sh refused. - Ctrl-C or SIGTERM during fly update stops the download and removes the partial file. - README: releases before v0.2.0 have no checksums.txt, so push the tag right after the merge into main. - Tests for CRLF line ends, upper case hex, repeated and similar lines, an empty checksum file, and no files left after a successful update. Refs #9
nabil1440
force-pushed
the
agent/9-checksums
branch
from
September 24, 2026 08:09
d9fab65 to
468ae84
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Layer 6 of 7 of the monitoring agent (#31 → #37).
Summary
fly updateandinstall.shnow examine each download with thechecksums.txtof the release. If the checksum is not correct, they stop, and the old binary continues.fly updateuse the same check code.Change
internal/release:fly updatereadschecksums.txt, then usesDownloadandInstall, with a limit of 10 minutes.install.sh: it downloadschecksums.txtand runssha256sum -c.checksums.txt, so push the release tag right after the merge intomain.Adversarial review
Not refuted. These smaller items are fixed in this PR:
checksums.txtnot valid, infly updateand ininstall.sh.fly updatestops the download and removes the partial file.Tests
install.shin Ubuntu 24.04: a correct checksum installs, a wrong or a missing checksum stops.Closes #9