rtb_update/lib.rs
1//! Self-update subsystem for tools built on RTB.
2//!
3//! # What this crate is
4//!
5//! A composition of three standards-grade primitives:
6//! - [`rtb_forge`] — fetches release metadata and streams asset bytes.
7//! - `ed25519-dalek` — verifies the vendor's detached signature.
8//! - `self-replace` — atomically swaps the running binary.
9//!
10//! The contribution is the *flow*: selection, download, verification,
11//! swap, report, rollback. Every step is a point at which a failure
12//! must be survivable — the binary on disk must remain either the old
13//! version or the fully-verified new one, never anything in between.
14//!
15//! See `docs/development/specs/2026-04-23-rtb-update-v0.1.md` for the
16//! full contract.
17
18// `deny` (not `forbid`) so the CLI-command module can allow
19// `unsafe_code` for its `linkme::distributed_slice` registration —
20// same rationale as `rtb-forge`. Every hand-rolled block in this crate
21// is safe, and the workspace-level `deny` still enforces the guarantee.
22#![deny(unsafe_code)]
23
24pub mod asset;
25pub mod command;
26pub mod error;
27pub mod flow;
28pub mod options;
29pub mod policy;
30pub mod prerun;
31pub mod updater;
32pub mod verify;
33
34pub use error::UpdateError;
35pub use options::{CheckOutcome, ProgressEvent, ProgressSink, RunOptions, RunOutcome};
36pub use policy::{evaluate as evaluate_update_policy, PolicyDecision, UpdatePolicy, UpdateState};
37pub use updater::{Updater, UpdaterBuilder};