fix: v0.15.1 — self-update converges on artifact identity (varve#38) - #39
Merged
Conversation
varve#38: the v0.14.0 binary reported 0.13.1, so `self-update --check`
compared self-reported version strings (is_newer("v0.14.0","0.13.1") = true
forever) and looped — every run re-installing identical bytes.
REQ-UPDATE-002 — self-update now decides on ARTIFACT IDENTITY, not version
strings. A new core `resolve_update` fetches and VERIFIES the candidate against
the trust root, then compares it to what is on disk: identical bytes ->
AlreadyCurrent (a no-op — the loop terminates), differing bytes -> Available,
not-newer -> UpToDate. The CLI handler is a thin wrapper over it. So a
mis-reported version string degrades to a no-op instead of an infinite loop.
`perform` is refactored into `fetch_verified_binary` + `install_binary`, keeping
verify-before-write intact.
REQ-RELVER-001 strengthened — the release now also runs the freshly built
binary and asserts `--version` == the tag (native targets), the exact
artifact-level oracle varve#38 suggested, on top of the pre-build version-guard.
Independently reviewed twice (VER-REVIEW-v0.15.1): the first review passed all
refutations but DISSENTED that the handler behaviour was tested only by a pure
helper; resolved by adding behavioural tests through the real release-API mock
server (signed archive, real ed25519 verify) — loop-break and
impostor-refused-before-offer both asserted end-to-end — and a second
independent review confirmed the dissent closed. Residual handler-glue coverage
tracked as a follow-up.
128 lib + 6 self-update-double + 34 CLI green; clippy/fmt clean; --locked
synced; rivet validate + verification-evidence (106 steps) + claim-check green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.15.1 — fixes the second half of #38
#38: the v0.14.0 binary reported
0.13.1, soself-update --checkcompared self-reported version strings (is_newer("v0.14.0","0.13.1")= true forever) and looped — every run re-installing identical bytes. v0.15.0 fixed the version string + added a guard; this fixes the fragility underneath.REQ-UPDATE-002 — decide on artifact identity, not version strings
A new core
resolve_updatefetches and verifies the candidate against the trust root, then compares it to what's on disk:AlreadyCurrent(no-op — the loop terminates)AvailableUpToDateThe CLI handler is now a thin wrapper over it, so a mis-reported version degrades to a no-op instead of looping.
performwas split intofetch_verified_binary+install_binary, keeping verify-before-write intact.REQ-RELVER-001 strengthened
The release now also runs the freshly built binary and asserts
--version== the tag (native targets) — the exact artifact-level oracle #38 suggested, on top of the pre-build version-guard.Independent review — twice (VER-REVIEW-v0.15.1)
The first review passed all refutations but dissented that the handler behaviour was tested only by a pure helper. Resolved by adding behavioural tests through the real release-API mock server (signed archive, real ed25519 verify) — loop-break and impostor-refused-before-offer asserted end-to-end — and a second independent review confirmed the dissent closed. Residual handler-glue coverage tracked as a follow-up (#not-blocking).
Gate
128 lib + 6 self-update-double + 34 CLI green; clippy/fmt clean;
--lockedsynced; rivet validate + verification-evidence (106 steps) + claim-check (12) + review-check (3 verdicts) all green.Closes the loop half of #38 (version-string half shipped in v0.15.0).
🤖 Generated with Claude Code
https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu