github.com/rhysd/go-github-selfupdate
go-github-selfupdate is a Go library to provide a self-update mechanism to command line tools.
Go does not provide a way to install/update the stable version of tools. By default, Go command line tools are updated:
go get -u, but it is not stable because HEAD of the repository is builtgo-github-selfupdate resolves the problem of 3 by detecting the latest release, downloading it and
putting it in $GOPATH/bin automatically.
go-github-selfupdate detects the information of the latest release via GitHub Releases API and checks the current version. If a newer version than itself is detected, it downloads the released binary from GitHub and replaces itself.
And small wrapper CLIs are provided:
go get, but install a release binary from GitHub insteadSlide at GoCon 2018 Spring (Japanese)
Example to understand what this library does is prepared as CLI.
Install it at first.
$ go get -u github.com/rhysd/go-github-selfupdate/cmd/selfupdate-example
And check the version by -version. -help flag is also available to know all flags.
$ selfupdate-example -version
It should show v1.2.3.
Then run -selfupdate
$ selfupdate-example -selfupdate
It should replace itself and finally show a message containing release notes.
Please check the binary version is updated to v1.2.4 with -version. The binary is up-to-date.
So running -selfupdate again only shows 'Current binary is the latest version'.
Following tools are using this library.
It provides selfupdate package.
selfupdate.UpdateSelf(): Detect the latest version of itself and run self update.selfupdate.UpdateCommand(): Detect the latest version of given repository and update given command.selfupdate.DetectLatest(): Detect the latest version of given repository.selfupdate.DetectVersion(): Detect the user defined version of given repository.selfupdate.UpdateTo(): Update given command to the binary hosted on given URL.selfupdate.Updater: Context manager of self-update process. If you want to customize some behavior
of self-update (e.g. specify API token, use GitHub Enterprise, ...), please make an instance of
Updater and use its methods.Following is the easiest way to use this package.
import (
"log"
"github.com/blang/semver"
"github.com/rhysd/go-github-selfupdate/selfupdate"
)
const version = "1.2.3"
func doSelfUpdate() {
v := semver.MustParse(version)
latest, err := selfupdate.UpdateSelf(v, "myname/myrepo")
if err != nil {
log.Println("Binary update failed:", err)
return
}
if latest.Version.Equals(v) {
// latest version is the same as current version. It means current binary is up to date.
log.Println("Current binary is the latest version", version)
} else {
log.Println("Successfully updated to version", latest.Version)
log.Println("Release note:\n", latest.ReleaseNotes)
}
}
Following asks user to update or not.
import (
"bufio"
"github.com/blang/semver"
"github.com/rhysd/go-github-selfupdate/selfupdate"
"log"
"os"
)
const version = "1.2.3"
func confirmAndSelfUpdate() {
latest, found, err := selfupdate.DetectLatest("owner/repo")
if err != nil {
log.Println("Error occurred while detecting version:", err)
return
}
v := semver.MustParse(version)
if !found || latest.Version.LTE(v) {
log.Println("Current version is the latest")
return
}
fmt.Print("Do you want to update to", latest.Version, "? (y/n): ")
input, err := bufio.NewReader(os.Stdin).ReadString('\n')
if err != nil || (input != "y\n" && input != "n\n") {
log.Println("Invalid input")
return
}
if input == "n\n" {
return
}
exe, err := os.Executable()
if err != nil {
log.Println("Could not locate executable path")
return
}
if err := selfupdate.UpdateTo(latest.AssetURL, exe); err != nil {
log.Println("Error occurred while updating binary:", err)
return
}
log.Println("Successfully updated to version", latest.Version)
}
If GitHub API token is set to [token] section in gitconfig or $GITHUB_TOKEN environment variable,
this library will use it to call GitHub REST API. It's useful when reaching rate limits or when using
this library with private repositories.
Note that os.Args[0] is not available since it does not provide a full path to executable. Instead,
please use os.Executable().
Please see the documentation page for more detail.
This library should work with GitHub Enterprise. To configure API base URL, please setup Updater
instance and use its methods instead (actually all functions above are just a shortcuts of methods of an
Updater instance).
Following is an example of usage with GitHub Enterprise.
import (
"log"
"github.com/blang/semver"
"github.com/rhysd/go-github-selfupdate/selfupdate"
)
const version = "1.2.3"
func doSelfUpdate(token string) {
v := semver.MustParse(version)
up, err := selfupdate.NewUpdater(selfupdate.Config{
APIToken: token,
EnterpriseBaseURL: "https://github.your.company.com/api/v3",
})
latest, err := up.UpdateSelf(v, "myname/myrepo")
if err != nil {
log.Println("Binary update failed:", err)
return
}
if latest.Version.Equals(v) {
// latest version is the same as current version. It means current binary is up to date.
log.Println("Current binary is the latest version", version)
} else {
log.Println("Successfully updated to version", latest.Version)
log.Println("Release note:\n", latest.ReleaseNotes)
}
}
If APIToken field is not given, it tries to retrieve API token from [token] section of .gitconfig
or $GITHUB_TOKEN environment variable. If no token is found, it raises an error because GitHub Enterprise
API does not work without authentication.
If your GitHub Enterprise instance's upload URL is different from the base URL, please also set the EnterpriseUploadURL
field.
go-github-selfupdate assumes that released binaries are put for each combination of platforms and archs. Binaries for each platform can be easily built using tools like gox
You need to put the binaries with the following format.
{cmd}_{goos}_{goarch}{.ext}
{cmd} is a name of command.
{goos} and {goarch} are the platform and the arch type of the binary.
{.ext} is a file extension. go-github-selfupdate supports .zip, .gzip, .tar.gz and .tar.xz.
You can also use blank and it means binary is not compressed.
If you compress binary, uncompressed directory or file must contain the executable named {cmd}.
And you can also use - for separator instead of _ if you like.
For example, if your command name is foo-bar, one of followings is expected to be put in release
page on GitHub as binary for platform linux and arch amd64.
foo-bar_linux_amd64 (executable)foo-bar_linux_amd64.zip (zip file)foo-bar_linux_amd64.tar.gz (tar file)foo-bar_linux_amd64.xz (xzip file)foo-bar-linux-amd64.tar.gz (- is also ok for separator)If you compress and/or archive your release asset, it must contain an executable named one of followings:
foo-bar (only command name)foo-bar_linux_amd64 (full name)foo-bar-linux-amd64 (- is also ok for separator)To archive the executable directly on Windows, .exe can be added before file extension like
foo-bar_windows_amd64.exe.zip.
go-github-selfupdate searches binaries' versions via Git tag names (not a release title).
When your tool's version is 1.2.3, you should use the version number for tag of the Git
repository (i.e. 1.2.3 or v1.2.3).
This library assumes you adopt semantic versioning. It is necessary for comparing versions systematically.
Prefix before version number \d+\.\d+\.\d+ is automatically omitted. For example, ver1.2.3 or
release-1.2.3 are also ok.
Tags which don't contain a version number are ignored (i.e. nightly). And releases marked as pre-release
are also ignored.
In summary, structure of releases on GitHub looks like:
v1.2.0
foo-bar-linux-amd64.tar.gzfoo-bar-linux-386.tar.gzfoo-bar-darwin-amd64.tar.gzfoo-bar-windows-amd64.zipv1.1.3
foo-bar-linux-amd64.tar.gzfoo-bar-linux-386.tar.gzfoo-bar-darwin-amd64.tar.gzfoo-bar-windows-amd64.zipgo-github-selfupdate supports hash or signature validatiom of the downloaded files. It comes
with support for sha256 hashes or ECDSA signatures. In addition to internal functions the
user can implement the Validator interface for own validation mechanisms.
// Validator represents an interface which enables additional validation of releases.
type Validator interface {
// Validate validates release bytes against an additional asset bytes.
// See SHA2Validator or ECDSAValidator for more information.
Validate(release, asset []byte) error
// Suffix describes the additional file ending which is used for finding the
// additional asset.
Suffix() string
}
To verify the integrity by SHA256 generate a hash sum and save it within a file which has the
same naming as original file with the suffix .sha256.
For e.g. use sha256sum, the file selfupdate/testdata/foo.zip.sha256 is generated with:
sha256sum foo.zip > foo.zip.sha256
To verify the signature by ECDSA generate a signature and save it within a file which has the
same naming as original file with the suffix .sig.
For e.g. use openssl, the file selfupdate/testdata/foo.zip.sig is generated with:
openssl dgst -sha256 -sign Test.pem -out foo.zip.sig foo.zip
go-github-selfupdate makes use of go internal crypto package. Therefore the used private key has to be compatbile with FIPS 186-3.
All library sources are put in /selfupdate directory. So you can run tests as following
at the top of the repository:
$ go test -v ./selfupdate
Some tests are not run without setting a GitHub API token because they call GitHub API too many times. To run them, please generate an API token and set it to an environment variable.
$ export GITHUB_TOKEN="{token generated by you}"
$ go test -v ./selfupdate
The above command runs almost all tests and it's enough to check the behavior before creating a pull request. Some tests are still not tested because they depend on my personal API access token, though; for repositories on GitHub Enterprise or private repositories on GitHub.
This library can output logs for debugging. By default, logger is disabled. You can enable the logger by the following and can know the details of the self update.
selfupdate.EnableLog()
Tests run on CIs (Travis CI, Appveyor) are run with the token I generated. However, because of security reasons, it is not used for the tests for pull requests. In the tests, a GitHub API token is not set and API rate limit is often exceeding. So please ignore the test failures on creating a pull request.
This library utilizes
Copyright (c) 2013 The go-github AUTHORS. All rights reserved.
Copyright 2015 Alan Shreve
Copyright (c) 2014 Benedikt Lang
Copyright (c) 2014-2016 Ulrich Kunitz
This library's goal is the same as tj/go-update, but it's different in following points.
tj/go-update:
v for version prefixDistributed under the MIT License
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.