buckit/cmd/update.go

// Copyright (c) 2015-2021 MinIO, Inc.
//
// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package cmd

import (
	"bufio"
	"bytes"
	"crypto"
	"crypto/sha256"
	"crypto/tls"
	"encoding/hex"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"os"
	"path"
	"path/filepath"
	"regexp"
	"runtime"
	"strings"
	"sync/atomic"
	"time"

	xhttp "github.com/buckit-io/buckit/internal/http"
	"github.com/buckit-io/buckit/internal/logger"
	"github.com/klauspost/compress/zstd"
	"github.com/minio/pkg/v3/env"
	xnet "github.com/minio/pkg/v3/net"
	"github.com/minio/selfupdate"
	gopsutilcpu "github.com/shirou/gopsutil/v3/cpu"
)

const (
	envMinisignPubKey = "MINIO_UPDATE_MINISIGN_PUBKEY"
	updateTimeout     = 10 * time.Second
)

var (
	// Newer official download info URLs appear earlier below.
	minioReleaseInfoURL = MinioReleaseURL + "buckit.sha256sum"

	// For windows our files have .exe additionally.
	minioReleaseWindowsInfoURL = MinioReleaseURL + "buckit.sha256sum"
)

var releaseTagRegex = regexp.MustCompile(`RELEASE\.\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}Z(?:\.[A-Za-z0-9._-]+)?`)

// minioVersionToReleaseTime - parses a standard official release
// MinIO version string.
//
// An official binary's version string is the release time formatted
// with RFC3339 (in UTC) - e.g. `2017-09-29T19:16:56Z`
func minioVersionToReleaseTime(version string) (releaseTime time.Time, err error) {
	return time.Parse(time.RFC3339, version)
}

// releaseTimeToReleaseTag - converts a time to a string formatted as
// an official MinIO release tag.
//
// An official minio release tag looks like:
// `RELEASE.2017-09-29T19-16-56Z`
func releaseTimeToReleaseTag(releaseTime time.Time) string {
	return "RELEASE." + releaseTime.Format(MinioReleaseTagTimeLayout)
}

// releaseTagToReleaseTime - reverse of `releaseTimeToReleaseTag()`
func releaseTagToReleaseTime(releaseTag string) (releaseTime time.Time, err error) {
	fields := strings.Split(releaseTag, ".")
	if len(fields) < 2 || len(fields) > 4 {
		return releaseTime, fmt.Errorf("%s is not a valid release tag", releaseTag)
	}
	if fields[0] != "RELEASE" {
		return releaseTime, fmt.Errorf("%s is not a valid release tag", releaseTag)
	}
	return time.Parse(MinioReleaseTagTimeLayout, fields[1])
}

// getModTime - get the file modification time of `path`
func getModTime(path string) (t time.Time, err error) {
	// Convert to absolute path
	absPath, err := filepath.Abs(path)
	if err != nil {
		return t, fmt.Errorf("Unable to get absolute path of %s. %w", path, err)
	}

	// Version is minio non-standard, we will use minio binary's
	// ModTime as release time.
	fi, err := Stat(absPath)
	if err != nil {
		return t, fmt.Errorf("Unable to get ModTime of %s. %w", absPath, err)
	}

	// Return the ModTime
	return fi.ModTime().UTC(), nil
}

// GetCurrentReleaseTime - returns this process's release time.  If it
// is official minio version, parsed version is returned else minio
// binary's mod time is returned.
func GetCurrentReleaseTime() (releaseTime time.Time, err error) {
	if releaseTime, err = minioVersionToReleaseTime(Version); err == nil {
		return releaseTime, err
	}

	// Looks like version is minio non-standard, we use minio
	// binary's ModTime as release time:
	return getModTime(os.Args[0])
}

// IsDocker - returns if the environment minio is running in docker or
// not. The check is a simple file existence check.
//
// https://github.com/moby/moby/blob/master/daemon/initlayer/setup_unix.go
// https://github.com/containers/podman/blob/master/libpod/runtime.go
//
//	"/.dockerenv":        "file",
//	"/run/.containerenv": "file",
func IsDocker() bool {
	var err error
	for _, envfile := range []string{
		"/.dockerenv",
		"/run/.containerenv",
	} {
		_, err = os.Stat(envfile)
		if err == nil {
			return true
		}
	}
	if osIsNotExist(err) {
		// if none of the files are present we may be running inside
		// CRI-O, Containerd etc..
		// Fallback to our container specific ENVs if they are set.
		return env.IsSet("MINIO_ACCESS_KEY_FILE")
	}

	// Log error, as we will not propagate it to caller
	internalLogIf(GlobalContext, err)

	return err == nil
}

// IsDCOS returns true if minio is running in DCOS.
func IsDCOS() bool {
	// http://mesos.apache.org/documentation/latest/docker-containerizer/
	// Mesos docker containerizer sets this value
	return env.Get("MESOS_CONTAINER_NAME", "") != ""
}

// IsKubernetes returns true if minio is running in kubernetes.
func IsKubernetes() bool {
	// Kubernetes env used to validate if we are
	// indeed running inside a kubernetes pod
	// is KUBERNETES_SERVICE_HOST
	// https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/kubelet_pods.go#L541
	return env.Get("KUBERNETES_SERVICE_HOST", "") != ""
}

// IsBOSH returns true if minio is deployed from a bosh package
func IsBOSH() bool {
	// "/var/vcap/bosh" exists in BOSH deployed instance.
	_, err := os.Stat("/var/vcap/bosh")
	if osIsNotExist(err) {
		return false
	}

	// Log error, as we will not propagate it to caller
	internalLogIf(GlobalContext, err)

	return err == nil
}

// MinIO Helm chart uses DownwardAPIFile to write pod label info to /podinfo/labels
// More info: https://kubernetes.io/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/#store-pod-fields
// Check if this is Helm package installation and report helm chart version
func getHelmVersion(helmInfoFilePath string) string {
	// Read the file exists.
	helmInfoFile, err := Open(helmInfoFilePath)
	if err != nil {
		// Log errors and return "" as MinIO can be deployed
		// without Helm charts as well.
		if !osIsNotExist(err) {
			reqInfo := (&logger.ReqInfo{}).AppendTags("helmInfoFilePath", helmInfoFilePath)
			ctx := logger.SetReqInfo(GlobalContext, reqInfo)
			internalLogIf(ctx, err)
		}
		return ""
	}
	defer helmInfoFile.Close()
	scanner := bufio.NewScanner(helmInfoFile)
	for scanner.Scan() {
		if strings.Contains(scanner.Text(), "chart=") {
			helmChartVersion := strings.TrimPrefix(scanner.Text(), "chart=")
			// remove quotes from the chart version
			return strings.Trim(helmChartVersion, `"`)
		}
	}

	return ""
}

// IsSourceBuild - returns if this binary is a non-official build from
// source code.
func IsSourceBuild() bool {
	_, err := minioVersionToReleaseTime(Version)
	return err != nil
}

// IsPCFTile returns if server is running in PCF
func IsPCFTile() bool {
	return env.Get("MINIO_PCF_TILE_VERSION", "") != ""
}

// DO NOT CHANGE USER AGENT STYLE.
// The style should be
//
//	MinIO (<OS>; <ARCH>[; <MODE>][; dcos][; kubernetes][; docker][; source]) MinIO/<VERSION> MinIO/<RELEASE-TAG> MinIO/<COMMIT-ID> [MinIO/universe-<PACKAGE-NAME>] [MinIO/helm-<HELM-VERSION>]
//
// Any change here should be discussed by opening an issue at
// https://github.com/buckit-io/buckit/issues.
func getUserAgent(mode string) string {
	userAgentParts := []string{}
	// Helper function to concisely append a pair of strings to a
	// the user-agent slice.
	uaAppend := func(p, q string) {
		userAgentParts = append(userAgentParts, p, q)
	}
	uaAppend(MinioUAName, " (")
	uaAppend("", runtime.GOOS)
	uaAppend("; ", runtime.GOARCH)
	if mode != "" {
		uaAppend("; ", mode)
	}
	if IsDCOS() {
		uaAppend("; ", "dcos")
	}
	if IsKubernetes() {
		uaAppend("; ", "kubernetes")
	}
	if IsDocker() {
		uaAppend("; ", "docker")
	}
	if IsBOSH() {
		uaAppend("; ", "bosh")
	}
	if IsSourceBuild() {
		uaAppend("; ", "source")
	}

	uaAppend(" ", Version)
	uaAppend(" ", ReleaseTag)
	uaAppend(" ", CommitID)
	if IsDCOS() {
		universePkgVersion := env.Get("MARATHON_APP_LABEL_DCOS_PACKAGE_VERSION", "")
		// On DC/OS environment try to the get universe package version.
		if universePkgVersion != "" {
			uaAppend(" universe-", universePkgVersion)
		}
	}

	if IsKubernetes() {
		// In Kubernetes environment, try to fetch the helm package version
		helmChartVersion := getHelmVersion("/podinfo/labels")
		if helmChartVersion != "" {
			uaAppend(" helm-", helmChartVersion)
		}
		// In Kubernetes environment, try to fetch the Operator, VSPHERE plugin version
		opVersion := env.Get("MINIO_OPERATOR_VERSION", "")
		if opVersion != "" {
			uaAppend(" operator-", opVersion)
		}
		vsphereVersion := env.Get("MINIO_VSPHERE_PLUGIN_VERSION", "")
		if vsphereVersion != "" {
			uaAppend(" vsphere-plugin-", vsphereVersion)
		}
	}

	if IsPCFTile() {
		pcfTileVersion := env.Get("MINIO_PCF_TILE_VERSION", "")
		if pcfTileVersion != "" {
			uaAppend(" pcf-tile-", pcfTileVersion)
		}
	}
	uaAppend("; ", "")

	if cpus, err := gopsutilcpu.Info(); err == nil && len(cpus) > 0 {
		cpuMap := make(map[string]struct{}, len(cpus))
		coreMap := make(map[string]struct{}, len(cpus))
		for i := range cpus {
			cpuMap[cpus[i].PhysicalID] = struct{}{}
			coreMap[cpus[i].CoreID] = struct{}{}
		}
		cpu := cpus[0]
		uaAppend(" CPU ", fmt.Sprintf("(total_cpus:%d, total_cores:%d; vendor:%s; family:%s; model:%s; stepping:%d; model_name:%s)",
			len(cpuMap), len(coreMap), cpu.VendorID, cpu.Family, cpu.Model, cpu.Stepping, cpu.ModelName))
	}
	uaAppend(")", "")

	return strings.Join(userAgentParts, "")
}

func downloadReleaseURL(u *url.URL, timeout time.Duration, mode string) (content string, err error) {
	req, err := http.NewRequest(http.MethodGet, u.String(), nil)
	if err != nil {
		return content, AdminError{
			Code:       AdminUpdateUnexpectedFailure,
			Message:    err.Error(),
			StatusCode: http.StatusInternalServerError,
		}
	}
	req.Header.Set("User-Agent", getUserAgent(mode))

	client := &http.Client{Transport: getUpdateTransport(timeout)}
	resp, err := client.Do(req)
	if err != nil {
		if xnet.IsNetworkOrHostDown(err, false) {
			return content, AdminError{
				Code:       AdminUpdateURLNotReachable,
				Message:    err.Error(),
				StatusCode: http.StatusServiceUnavailable,
			}
		}
		return content, AdminError{
			Code:       AdminUpdateUnexpectedFailure,
			Message:    err.Error(),
			StatusCode: http.StatusInternalServerError,
		}
	}
	if resp == nil {
		return content, AdminError{
			Code:       AdminUpdateUnexpectedFailure,
			Message:    fmt.Sprintf("No response from server to download URL %s", u),
			StatusCode: http.StatusInternalServerError,
		}
	}
	defer xhttp.DrainBody(resp.Body)

	if resp.StatusCode != http.StatusOK {
		return content, AdminError{
			Code:       AdminUpdateUnexpectedFailure,
			Message:    fmt.Sprintf("Error downloading URL %s. Response: %v", u, resp.Status),
			StatusCode: resp.StatusCode,
		}
	}

	contentBytes, err := io.ReadAll(resp.Body)
	if err != nil {
		return content, AdminError{
			Code:       AdminUpdateUnexpectedFailure,
			Message:    fmt.Sprintf("Error reading response. %s", err),
			StatusCode: http.StatusInternalServerError,
		}
	}

	return string(contentBytes), nil
}

func releaseInfoToReleaseTime(releaseInfo string) (releaseTime time.Time, err error) {
	// Split release of style minio.RELEASE.2019-08-21T19-40-07Z.<hotfix>
	nfields := strings.SplitN(releaseInfo, ".", 2)
	if len(nfields) != 2 {
		err = fmt.Errorf("Unknown release information `%s`", releaseInfo)
		return releaseTime, err
	}
	if nfields[0] != "minio" && nfields[0] != "buckit" {
		err = fmt.Errorf("Unknown release `%s`", releaseInfo)
		return releaseTime, err
	}

	releaseTime, err = releaseTagToReleaseTime(nfields[1])
	if err != nil {
		err = fmt.Errorf("Unknown release tag format. %w", err)
	}
	return releaseTime, err
}

// parseReleaseData - parses release info file content fetched from
// official minio download server.
//
// The expected format is a single line with two words like:
//
// fbe246edbd382902db9a4035df7dce8cb441357d minio.RELEASE.2016-10-07T01-16-39Z.<hotfix_optional>
//
// The second word must be `minio.` appended to a standard release tag.
func parseReleaseData(data string) (sha256Sum []byte, releaseTime time.Time, releaseInfo string, err error) {
	defer func() {
		if err != nil {
			err = AdminError{
				Code:       AdminUpdateUnexpectedFailure,
				Message:    err.Error(),
				StatusCode: http.StatusInternalServerError,
			}
		}
	}()

	fields := strings.Fields(data)
	if len(fields) != 2 {
		err = fmt.Errorf("Unknown release data `%s`", data)
		return sha256Sum, releaseTime, releaseInfo, err
	}

	sha256Sum, err = hex.DecodeString(fields[0])
	if err != nil {
		return sha256Sum, releaseTime, releaseInfo, err
	}

	releaseInfo = fields[1]

	releaseTime, err = releaseInfoToReleaseTime(releaseInfo)
	return sha256Sum, releaseTime, releaseInfo, err
}

func parseChecksumData(data string) (sha256Sum []byte, fileName string, err error) {
	fields := strings.Fields(data)
	if len(fields) < 1 {
		return nil, "", fmt.Errorf("Unknown checksum data `%s`", data)
	}

	sha256Sum, err = hex.DecodeString(fields[0])
	if err != nil {
		return nil, "", err
	}

	if len(fields) > 1 {
		fileName = fields[1]
	}

	return sha256Sum, fileName, nil
}

func candidateChecksumURLs(u *url.URL) []*url.URL {
	base := *u
	return []*url.URL{
		func() *url.URL {
			v := base
			v.Path = base.Path + ".sha256sum"
			return &v
		}(),
		func() *url.URL {
			v := base
			v.Path = base.Path + ".sha256"
			return &v
		}(),
	}
}

func fetchChecksumForBinaryURL(u *url.URL, timeout time.Duration, mode string) (sha256Sum []byte, source string, err error) {
	var lastErr error
	for _, candidate := range candidateChecksumURLs(u) {
		content, derr := downloadReleaseURL(candidate, timeout, mode)
		if derr != nil {
			lastErr = derr
			continue
		}
		sum, _, perr := parseChecksumData(content)
		if perr != nil {
			lastErr = perr
			continue
		}
		return sum, candidate.String(), nil
	}
	if lastErr == nil {
		lastErr = fmt.Errorf("no checksum URL candidates for %s", u.String())
	}
	return nil, "", lastErr
}

func extractReleaseTag(data []byte) (string, error) {
	tag := releaseTagRegex.Find(data)
	if len(tag) == 0 {
		return "", fmt.Errorf("release tag not found in downloaded binary")
	}
	return string(tag), nil
}

func extractReleaseTime(data []byte) (releaseTime time.Time, releaseInfo string, err error) {
	releaseTag, err := extractReleaseTag(data)
	if err != nil {
		return time.Time{}, "", err
	}

	releaseTime, err = releaseTagToReleaseTime(releaseTag)
	if err != nil {
		return time.Time{}, "", err
	}

	return releaseTime, "buckit." + releaseTag, nil
}

func getUpdateTransport(timeout time.Duration) http.RoundTripper {
	var updateTransport http.RoundTripper = &http.Transport{
		Proxy:                 http.ProxyFromEnvironment,
		DialContext:           xhttp.NewInternodeDialContext(timeout, globalTCPOptions),
		IdleConnTimeout:       timeout,
		TLSHandshakeTimeout:   timeout,
		ExpectContinueTimeout: timeout,
		TLSClientConfig: &tls.Config{
			RootCAs:            globalRootCAs,
			ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
		},
		DisableCompression: true,
	}
	return updateTransport
}

func getLatestReleaseTime(u *url.URL, timeout time.Duration, mode string) (sha256Sum []byte, releaseTime time.Time, err error) {
	data, err := downloadReleaseURL(u, timeout, mode)
	if err != nil {
		return sha256Sum, releaseTime, err
	}

	sha256Sum, releaseTime, _, err = parseReleaseData(data)
	return sha256Sum, releaseTime, err
}

// getBinaryURL returns the final binary URL for an update.
//
// The input URL is interpreted differently depending on the source:
//   - Default update flow: u points at the built-in release info file
//     (buckit.sha256sum) on GitHub Pages. releaseInfo comes from that checksum
//     file. When releaseInfo contains a release tag, the binary is resolved to
//     the matching GitHub Releases asset, because Buckit does not publish large
//     server binaries directly on gh-pages.
//   - User-provided update flow: u is expected to already point at the direct
//     binary download URL. The existing non-gh-pages branch keeps the original
//     sibling-directory behavior, so callers should supply a direct binary URL,
//     not a release HTML page, checksum file, or directory URL.
func getBinaryURL(u *url.URL, releaseInfo string) *url.URL {
	binURL := *u
	if strings.Contains(u.Host, "github.io") {
		if tag := releaseTagRegex.FindString(releaseInfo); tag != "" {
			// e.g. "linux-amd64" from .../release/linux-amd64/buckit.sha256sum
			platform := path.Base(path.Dir(u.Path))
			ext := ""
			if strings.HasPrefix(platform, "windows") {
				ext = ".exe"
			}
			binURL.Scheme = "https"
			binURL.Host = "github.com"
			binURL.Path = fmt.Sprintf("/buckit-io/buckit/releases/download/%s/buckit-%s%s.%s", tag, platform, ext, tag)
			return &binURL
		}
		// Fallback when sha256sum carries no release tag.
		name := "buckit"
		if strings.Contains(u.Path, "/windows-") || strings.HasSuffix(u.Path, ".exe.sha256sum") || runtime.GOOS == "windows" {
			name = "buckit.exe"
		}
		binURL.Path = path.Join(path.Dir(u.Path), name)
	} else {
		// User-provided URL: binary is a sibling in the same directory.
		binURL.Path = path.Join(path.Dir(u.Path), releaseInfo)
	}
	return &binURL
}

const (
	// Kubernetes deployment doc link.
	kubernetesDeploymentDoc = "https://buckit-io.github.io/docs/community/minio-object-store/operations/deployments/kubernetes.html"

	// Mesos deployment doc link.
	mesosDeploymentDoc = "https://buckit-io.github.io/docs/community/minio-object-store/operations/deployments/kubernetes.html"
)

func getDownloadURL(releaseTag string) (downloadURL string) {
	// Check if we are in DCOS environment, return
	// deployment guide for update procedures.
	if IsDCOS() {
		return mesosDeploymentDoc
	}

	// Check if we are in kubernetes environment, return
	// deployment guide for update procedures.
	if IsKubernetes() {
		return kubernetesDeploymentDoc
	}

	// Check if we are docker environment, return docker update command
	if IsDocker() {
		// Construct release tag name.
		return fmt.Sprintf("podman pull quay.io/minio/minio:%s", releaseTag)
	}

	// For binary only installations, we return link to the latest binary.
	if runtime.GOOS == "windows" {
		return MinioReleaseURL + "buckit.exe"
	}

	return MinioReleaseURL + "buckit"
}

func getUpdateReaderFromURL(u *url.URL, transport http.RoundTripper, mode string) (io.ReadCloser, error) {
	clnt := &http.Client{
		Transport: transport,
	}
	req, err := http.NewRequest(http.MethodGet, u.String(), nil)
	if err != nil {
		return nil, AdminError{
			Code:       AdminUpdateUnexpectedFailure,
			Message:    err.Error(),
			StatusCode: http.StatusInternalServerError,
		}
	}

	req.Header.Set("User-Agent", getUserAgent(mode))

	resp, err := clnt.Do(req)
	if err != nil {
		if xnet.IsNetworkOrHostDown(err, false) {
			return nil, AdminError{
				Code:       AdminUpdateURLNotReachable,
				Message:    err.Error(),
				StatusCode: http.StatusServiceUnavailable,
			}
		}
		return nil, AdminError{
			Code:       AdminUpdateUnexpectedFailure,
			Message:    err.Error(),
			StatusCode: http.StatusInternalServerError,
		}
	}
	return resp.Body, nil
}

func checksumBytes(b []byte) []byte {
	sum := sha256.Sum256(b)
	return sum[:]
}

var updateInProgress atomic.Uint32

// Function to get the reader from an architecture
func downloadBinary(u *url.URL, mode string) (binCompressed []byte, bin []byte, err error) {
	logger.Info("Admin update: downloading binary from %s", u.String())
	transport := getUpdateTransport(30 * time.Second)
	var reader io.ReadCloser
	if u.Scheme == "https" || u.Scheme == "http" {
		reader, err = getUpdateReaderFromURL(u, transport, mode)
		if err != nil {
			return nil, nil, err
		}
	} else {
		return nil, nil, fmt.Errorf("unsupported protocol scheme: %s", u.Scheme)
	}
	defer xhttp.DrainBody(reader)

	// Use local buffers (not bytebufferpool) so the returned slices solely own
	// their backing arrays. Pooling here is unsafe (the returned slices would
	// alias buffers handed back to the pool) and inappropriate for binaries that
	// can be hundreds of MB, which would also bloat the shared pool.
	var b, bc bytes.Buffer

	w, err := zstd.NewWriter(&bc)
	if err != nil {
		return nil, nil, err
	}

	if _, err = io.Copy(w, io.TeeReader(reader, &b)); err != nil {
		return nil, nil, err
	}

	w.Close()
	return bc.Bytes(), b.Bytes(), nil
}

const (
	// Buckit minisign public key for release signature verification.
	// Key ID: 62EB8D2A3DCDDA31
	defaultMinisignPubkey = "RWQx2s09Ko3rYmr64TBI992Oppjy00FUMQAUM9Ezf9czdMFOhB7CmKKU"
)

func verifyBinary(u *url.URL, sha256Sum []byte, releaseInfo, mode string, reader io.Reader) (err error) {
	if !updateInProgress.CompareAndSwap(0, 1) {
		return errors.New("update already in progress")
	}
	defer updateInProgress.Store(0)

	logger.Info("Admin update: preparing binary verification for %s", u.String())

	transport := getUpdateTransport(30 * time.Second)
	opts := selfupdate.Options{
		Hash:     crypto.SHA256,
		Checksum: sha256Sum,
	}

	if err := opts.CheckPermissions(); err != nil {
		return AdminError{
			Code:       AdminUpdateApplyFailure,
			Message:    fmt.Sprintf("server update failed with: %s, do not restart the servers yet", err),
			StatusCode: http.StatusInternalServerError,
		}
	}

	minisignPubkey := env.Get(envMinisignPubKey, defaultMinisignPubkey)
	if minisignPubkey != "" {
		logger.Info("Admin update: loading minisign signature for %s", u.String())
		v := selfupdate.NewVerifier()
		// Derive .minisig URL as a sibling of the final binary URL.
		// This applies both to the default release-channel flow and to an
		// operator-supplied direct binary URL.
		u.Path += ".minisig"
		if err = v.LoadFromURL(u.String(), minisignPubkey, transport); err != nil {
			return AdminError{
				Code:       AdminUpdateApplyFailure,
				Message:    fmt.Sprintf("signature loading failed for %v with %v", u, err),
				StatusCode: http.StatusInternalServerError,
			}
		}
		opts.Verifier = v
	}

	logger.Info("Admin update: verifying and preparing replacement binary")
	if err = selfupdate.PrepareAndCheckBinary(reader, opts); err != nil {
		var pathErr *os.PathError
		if errors.As(err, &pathErr) {
			return AdminError{
				Code: AdminUpdateApplyFailure,
				Message: fmt.Sprintf("Unable to update the binary at %s: %v",
					filepath.Dir(pathErr.Path), pathErr.Err),
				StatusCode: http.StatusForbidden,
			}
		}
		return AdminError{
			Code:       AdminUpdateApplyFailure,
			Message:    err.Error(),
			StatusCode: http.StatusInternalServerError,
		}
	}

	logger.Info("Admin update: binary verification and prepare succeeded")
	return nil
}

func commitBinary() (err error) {
	if !updateInProgress.CompareAndSwap(0, 1) {
		return errors.New("update already in progress")
	}
	defer updateInProgress.Store(0)

	logger.Info("Admin update: committing prepared binary")

	opts := selfupdate.Options{}

	if err = selfupdate.CommitBinary(opts); err != nil {
		if rerr := selfupdate.RollbackError(err); rerr != nil {
			return AdminError{
				Code:       AdminUpdateApplyFailure,
				Message:    fmt.Sprintf("Failed to rollback from bad update: %v", rerr),
				StatusCode: http.StatusInternalServerError,
			}
		}
		var pathErr *os.PathError
		if errors.As(err, &pathErr) {
			return AdminError{
				Code: AdminUpdateApplyFailure,
				Message: fmt.Sprintf("Unable to update the binary at %s: %v",
					filepath.Dir(pathErr.Path), pathErr.Err),
				StatusCode: http.StatusForbidden,
			}
		}
		return AdminError{
			Code:       AdminUpdateApplyFailure,
			Message:    err.Error(),
			StatusCode: http.StatusInternalServerError,
		}
	}

	logger.Info("Admin update: binary commit succeeded")
	return nil
}