Module update 

Self-update (REQ-UPDATE-001) — updating the updater, without a flag day.

The chain: the RUNNING varve verifies the candidate release against the pinned trust root before anything is replaced — old-verifies-new, the same shape as a TUF root rotation. Explicit invocation only: varve makes no network request the user did not command (no phone-home), and any verification failure refuses rather than warns. The one unavoidable TOFU moment is the very first install, established out-of-band (cosign + build provenance); every update after that rides this chain.

Structs

UpdatePlan

What an update check found.

Enums

UpdateDecision

The self-update decision, resolved on ARTIFACT IDENTITY (varve#38).

UpdateError

Functions

already_current

Whether the running binary is already the latest release’s binary, decided on ARTIFACT IDENTITY rather than self-reported version strings (varve#38). A binary that mis-reports its own version (as v0.14.0 did) would otherwise loop forever: is_newer stays true, every check re-installs the same bytes. Comparing digests makes a stale version string degrade to a no-op.

check_latest

Ask the release API for the latest tag and locate this platform’s assets. api_latest_url is the GitHub “latest release” endpoint (or a mirror / test double — the URL changes availability, never acceptance).

extract_tool_from_targz

Extract one file from a gzipped tarball.

fetch_verified_binary

Download and verify the successor binary WITHOUT installing it — the running varve verifies its successor against the trust root. Returns the verified binary bytes and the archive digest. Splitting this from the write lets the caller decide on artifact identity before touching disk (varve#38).

install_binary

Atomically install already-verified successor bytes at dest.

is_newer

parse_version

Strictly-parsed x.y.z (a leading v is tolerated).

perform

Download, verify against the trust root, extract, and atomically install at dest. Returns the verified archive digest.

resolve_update

Resolve whether an update is needed, deciding on artifact identity rather than self-reported version strings (varve#38). on_disk is the current binary’s bytes (None if the destination does not yet exist). Fetches and VERIFIES the candidate against the trust root before comparing or offering it, so a reported “available” is always a genuinely-verified update.