Skip to main content

Module self_update

mkit_cli::commands

Module self_update 

Source
Expand description

mkit self — self-management of an installer-managed mkit binary.

mkit self update [--version <tag>] [--check] [--allow-downgrade]
                 [--format human|json]

Updates the running binary in place from GitHub Releases. The downloaded archive is checked against its sha256 sidecar asset when the release publishes one; verification is fully in-process: no cosign, no GitHub attestation API.

Management contract (shared with install.sh):

  • The binary is “installer-managed” iff <bin_dir>/.mkit-installed-tag exists next to the (canonicalized) executable. Homebrew, cargo, and other package-manager installs don’t have it — for those we refuse with channel-specific guidance instead of fighting the package manager.
  • Receipts: <bin_dir>/.mkit-installed-tag plus the global $MKIT_STATE_DIR/installed-tag (default ~/.local/state/mkit). Both are re-written after a successful swap, in the installer’s exact format (vX.Y.Z\n, atomic .new + rename), so installer and updater stay interchangeable.
  • Downgrade policy mirrors the installer: latest never downgrades; an explicit --version may only with --allow-downgrade, loudly.

There is deliberately no background update check — this command only ever runs when invoked. Network egress: api.github.com and the release-asset host, HTTPS only, with an https→http redirect downgrade refused (mirrors mkit-transport-http, #223).

Environment:

  • GH_TOKEN / GITHUB_TOKEN — bearer for the GitHub API. Optional; raises the unauthenticated GitHub API rate limit.
  • MKIT_STATE_DIR — receipt state dir override (installer parity).
  • MKIT_SELF_UPDATE_API_BASE — override the API base URL (https://api.github.com/repos/officialunofficial/mkit). For tests and mirrors.

Windows: not yet supported (there are no Windows release binaries); exits UNAVAILABLE with a clear message. The swap step needs the rename-old-then-move dance on Windows — revisit when a windows-msvc target ships.

Structs§

Opts
UpdateEnv
Everything run_update touches outside pure computation, so the integration tests can point the whole flow at a mock server, a temp install dir, and a test trust root. Production wiring is UpdateEnv::production (private).

Enums§

Outcome
What happened, for output rendering.

Functions§

run
run_update
The full update flow. Everything before the swap is read-only.