rtb_update/lib.rs
1//! Self-update subsystem for tools built on RTB.
2//!
3//! # What this crate is
4//!
5//! A composition of three standards-grade primitives:
6//! - [`rtb_forge`] — fetches release metadata and streams asset bytes.
7//! - `minisign-verify` — verifies the vendor's minisign signature.
8//! The same crate cargo-binstall uses, so both consumers of a
9//! release agree by construction.
10//! - `self-replace` — atomically swaps the running binary.
11//!
12//! The contribution is the *flow*: selection, download, verification,
13//! swap, report, rollback. Every step is a point at which a failure
14//! must be survivable — the binary on disk must remain either the old
15//! version or the fully-verified new one, never anything in between.
16//!
17//! See `docs/development/specs/2026-04-23-rtb-update-v0.1.md` for the
18//! full contract.
19
20// `deny` (not `forbid`) so the CLI-command module can allow
21// `unsafe_code` for its `linkme::distributed_slice` registration —
22// same rationale as `rtb-forge`. Every hand-rolled block in this crate
23// is safe, and the workspace-level `deny` still enforces the guarantee.
24#![deny(unsafe_code)]
25
26pub mod asset;
27pub mod command;
28pub mod error;
29pub mod flow;
30pub mod options;
31pub mod policy;
32pub mod prerun;
33pub mod updater;
34pub mod verify;
35
36pub use error::UpdateError;
37pub use options::{CheckOutcome, ProgressEvent, ProgressSink, RunOptions, RunOutcome};
38pub use policy::{evaluate as evaluate_update_policy, PolicyDecision, UpdatePolicy, UpdateState};
39pub use updater::{Updater, UpdaterBuilder};