* feat(update): verify signed update metadata
* fix(update): harden metadata publishing and app names
- share strict app-name validation across Windows and macOS
- preserve published sidecars until replacements are ready
- select macOS test features by target architecture
- update the signing dependency and URL validation coverage
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): prevent replacing published release assets
- block reruns after signed update metadata is published
- clarify the security rationale for app-name validation
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): cache TLS responses and avoid double translations
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact: reduce the diffs
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): remove obsolete update paths
- remove unused FFI update branches
- delete legacy Windows and macOS update helpers
- simplify macOS daemon updates and redundant gating
Signed-off-by: fufesou <linlong1266@gmail.com>
* feat(update): secure same-identity macOS offline updates
- verify DMGs using signed metadata, size, and SHA-256
- enforce package and bundle identity plus macOS signature checks
- support custom release policies and propagate manual update failures
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): verify Windows installers with Authenticode
Reject unsigned or untrusted EXE/MSI updates
before elevation, clean up failed verified copies,
and fix the macOS manual updater logging import.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): clear stale URL on response body errors
Keep body-read failures in the common cleanup path and document the
cache-only Authenticode verification policy.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refactor(update): remove OS signature sanity checks
Remove Windows Authenticode and macOS codesign/Gatekeeper verification.
Keep metadata, artifact integrity, bundle identity, and transaction checks.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): move update scripts into res/update
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): secure Windows MSI handoff against junction races
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): secure Windows EXE handoff against junction races
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): preserve legacy custom client app names
- allow names starting with digits or underscores
- preserve leading hyphens on Windows for compatibility
- reject leading hyphens on macOS to avoid pgrep option parsing
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): remove some simple wrappers
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): simple refactor
* refact(update): comments on update.scpt
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): comments
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): create download destinations exclusively
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): roll back updates when final readiness checks fail
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(msi): propagate MSI installation failures
Signed-off-by: fufesou <linlong1266@gmail.com>
* chore
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): reject stale IPC sockets during updates
Require open IPC sockets in addition to launchd running state before committing the privileged update transaction. Inspect sockets with lsof to avoid triggering IPC authentication.
Add native socket regression coverage to macOS CI. Remove the unused Windows helper, combine offline metadata exports, and restore unrelated formatting changed by the PR.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): allow offline updates without an installed bundle
Validate app-only updates against the running client's bundle identifier and check the destination identity when it exists. Replace source-text assertions with behavioral identity tests and run the macOS update tests in CI.
Signed-off-by: fufesou <linlong1266@gmail.com>
* ci, gate test with PUBLISH_UPDATE_METADATA == 'true'
Signed-off-by: fufesou <linlong1266@gmail.com>
---------
Signed-off-by: fufesou <linlong1266@gmail.com>
