A3S Updater
Installation Safety
Executable replacement, backup restore, Unix permissions, temp-dir ownership, and updater boundaries.
Installation Safety
replace_binary(new_binary_path) performs the final in-place replacement of the
currently running executable.
Replacement Steps
- Resolve
std::env::current_exe(). - Canonicalize the executable path.
- Rename the current binary to a
.bakpath. - Copy the new binary into the original path.
- Restore the backup if the copy fails.
- On Unix, set permissions to
0755. - Remove the backup after successful replacement.
The caller owns the temporary directory returned by download_and_extract.
Dropping that TempDir cleans up extracted files after replacement.
Failure Handling
| Failure | Behavior |
|---|---|
| Cannot determine current executable | Return an error before changing files. |
| Cannot canonicalize current executable | Return an error before changing files. |
| Cannot rename to backup | Return an error before copying. |
| Copy fails | Attempt to rename the backup back into place, then return an error. |
| Permission update fails | Return an error after copy. |
Legacy CLI Path Boundaries
The GitHub Release CLI replacement path does not:
- refresh Homebrew taps
- manage package-manager installations
- restart the caller into the new binary
- verify signed fleet metadata (use
FleetUpdaterfor the separate Ed25519-verified Linux service lifecycle) - support Windows binary replacement
- infer asset names outside the configured naming convention
Those responsibilities belong to the embedding CLI or release pipeline.