feat: implement self-update for nali #177

DateBro · 2023-09-25T01:13:26Z

implemented self-update for nali, used creativeprojects/go-selfupdate.

locally tested, this is the log:

~/Documents/code_projects/nali/nali   go install
 ~/Documents/code_projects/nali/nali  nali 1.2.3.4                
1.2.3.4 [澳大利亚 APNIC Debogon-prefix网络] 
~/Documents/code_projects/nali/nali  nali --version
nali version unknown version
~/Documents/code_projects/nali/nali  nali update --version v0.7.2
2023/09/24 20:58:34 Decompressing gzip file
2023/09/24 20:58:34 Executable file "nali-darwin-arm64" was found in gzip file
2023/09/24 20:58:34 Will update /Users/zhaozhiyong/go/bin/nali to v0.7.2 downloaded from https://github.com/zu1k/nali/releases/download/v0.7.2/nali-darwin-arm64-v0.7.2.gz
2023/09/24 20:58:34 Successfully updated to version 0.7.2
~/Documents/code_projects/nali/nali  nali 1.2.3.4                
1.2.3.4 [澳大利亚 APNIC Debogon-prefix网络] 
 ~/Documents/code_projects/nali/nali  nali --version
nali version v0.7.2

issue: #171

cmd/update.go

internal/repo/decompress.go

internal/repo/update.go

zu1k · 2023-09-25T06:57:55Z

Our binary increased by 40% due to the introduction of a lot of non-essential code, which could have been avoided. We can no longer use go-selfupdate to do this, but need to implement this in nali itself.

The logic here is simple:

Access https://api.github.com/repos/zu1k/nali/releases/latest
Compare version numbers
Filtering assets by GOOS and GOARCH
Download the new version nali and its sha256 via the given browser_download_url
Verifying files with sha256
Unzip and replace nali itself

issue: 171

internal/repo/github.go

internal/repo/update.go

cmd/update.go

internal/repo/github.go

zu1k · 2023-09-26T14:08:28Z

internal/repo/github.go

+func download(ctx context.Context, assetId int64) (data []byte, err error) {
+	var rc io.ReadCloser
+
+	rc, _, err = client.Repositories.DownloadReleaseAsset(ctx, constant.Owner, constant.Repo, assetId, http.DefaultClient)


Do not use the default http client, which has no timeout control and does not use proxies.

See

nali/pkg/common/httpclient.go

Line 30 in f91569c

func GetHttpClient() *HttpClient {

internal/repo/update.go

cmd/update.go

internal/repo/decompress.go

internal/repo/github.go

zu1k · 2023-09-27T01:47:48Z

internal/repo/github.go

+	hash := fmt.Sprintf("%s", vData[:sha256.BlockSize])
+	calculatedHash := fmt.Sprintf("%x", sha256.Sum256(data))
+
+	if calculatedHash != hash {
+		return fmt.Errorf("expected %q, found %q: sha256 validation failed", hash, calculatedHash)
+	}


Instead of converting bytes to a string (and you're not dealing with case issues), decode the hexadecimal sha256 and then use
https://pkg.go.dev/bytes#Equal

internal/repo/update.go

zu1k · 2023-09-27T16:24:37Z

internal/repo/update.go

+
+		return latest.GreaterThan(cur)
+	}
+	return true


unknown version means that the user compiled it manually instead of downloading it from the release, in which case we don't take the liberty of updating it to a potentially older version.

Suggested change

return true

return false

zu1k · 2023-09-27T16:37:47Z

internal/repo/update.go

+	// get the directory the executable exists in
+	updateDir := filepath.Dir(cmdPath)
+	filename := filepath.Base(cmdPath)
+
+	// Copy the contents of new binary to a new executable file
+	newPath := filepath.Join(updateDir, fmt.Sprintf(".%s.new", filename))
+	fp, err := os.OpenFile(newPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)


It is necessary to check the permissions of folders and files before updating, because some of our users install nali through package management, which results in no write permissions, in which case we give a friendly reminder to the user to inform about the latest version and skip the automatic update.

zu1k · 2023-09-27T16:38:33Z

internal/repo/update.go

+	}
+
+	if _, err = io.Copy(fp, bytes.NewReader(newBytes)); err != nil {
+		fp.Close()


Suggested change

fp.Close()

_ = fp.Close()

zu1k · 2023-09-27T16:38:47Z

internal/repo/update.go

+	fp, err := os.OpenFile(newPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
+
+	if err != nil {
+		fp.Close()


Suggested change

fp.Close()

_ = fp.Close()

zu1k · 2023-09-27T16:40:24Z

internal/repo/update.go

+	}
+	// if we don't call fp.Close(), windows won't let us move the new executable
+	// because the file will still be "in use"
+	fp.Close()


We should handle the error here, although the probability of the error here is extremely low, we need to make sure that we don't cause file corruption here, and if an error occurs we need to cancel the update process

internal/repo/update.go

+func canWriteFile(path string) bool {
+	f, err := os.OpenFile(path, os.O_WRONLY, 0644)
+	if err == nil {
+		defer f.Close()


zu1k · 2023-09-28T14:40:34Z

LGTM

zu1k · 2023-09-28T14:41:29Z

Thanks

zu1k requested changes Sep 25, 2023

View reviewed changes

cmd/update.go Outdated Show resolved Hide resolved

cmd/update.go Outdated Show resolved Hide resolved

internal/repo/decompress.go Outdated Show resolved Hide resolved

internal/repo/update.go Outdated Show resolved Hide resolved

internal/repo/update.go Outdated Show resolved Hide resolved

DateBro force-pushed the master branch 2 times, most recently from b38f115 to cc570ef Compare September 25, 2023 04:35

DateBro force-pushed the master branch 3 times, most recently from d300edc to 8999671 Compare September 26, 2023 13:51

feat: implement self-update for nali

8f06ee4

issue: 171

DateBro force-pushed the master branch from 8999671 to 8f06ee4 Compare September 26, 2023 13:53

zu1k requested changes Sep 26, 2023

View reviewed changes

DateBro added 2 commits September 26, 2023 15:53

chore: resolve comments in CR

8c48a6e

chore: fix CodeFactor issue

1fb953f

github-advanced-security bot found potential problems Sep 26, 2023

View reviewed changes

internal/repo/update.go Fixed Show fixed Hide fixed

zu1k requested changes Sep 27, 2023

View reviewed changes

fix CR comments

a3ad2a3

github-advanced-security bot found potential problems Sep 27, 2023

View reviewed changes

internal/repo/update.go Fixed Show fixed Hide fixed

internal/repo/update.go Fixed Show fixed Hide fixed

fix missing unresolved comments

14f8157

zu1k requested changes Sep 27, 2023

View reviewed changes

zu1k assigned DateBro Sep 27, 2023

DateBro added 3 commits September 27, 2023 21:00

fix comments

7dc405d

fix comments

f4a451d

fix check file and dir write permissions func

d78cb51

github-advanced-security bot found potential problems Sep 28, 2023

View reviewed changes

zu1k merged commit 43a3080 into zu1k:master Sep 28, 2023
6 checks passed

chenrui333 mentioned this pull request Oct 3, 2023

nali 0.8.0 Homebrew/homebrew-core#149247

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: implement self-update for nali #177

feat: implement self-update for nali #177

DateBro commented Sep 25, 2023

zu1k commented Sep 25, 2023

zu1k Sep 26, 2023

zu1k Sep 27, 2023

zu1k Sep 27, 2023

zu1k Sep 27, 2023

zu1k Sep 27, 2023

zu1k Sep 27, 2023

zu1k Sep 27, 2023

zu1k commented Sep 28, 2023

zu1k commented Sep 28, 2023

feat: implement self-update for nali #177

feat: implement self-update for nali #177

Conversation

DateBro commented Sep 25, 2023

zu1k commented Sep 25, 2023

zu1k Sep 26, 2023

Choose a reason for hiding this comment

zu1k Sep 27, 2023

Choose a reason for hiding this comment

zu1k Sep 27, 2023

Choose a reason for hiding this comment

zu1k Sep 27, 2023

Choose a reason for hiding this comment

zu1k Sep 27, 2023

Choose a reason for hiding this comment

zu1k Sep 27, 2023

Choose a reason for hiding this comment

zu1k Sep 27, 2023

Choose a reason for hiding this comment

zu1k commented Sep 28, 2023

zu1k commented Sep 28, 2023