From 85f8790e1e5f2502286f689b4cb59a6a5b44836f Mon Sep 17 00:00:00 2001 From: MengMengCode Date: Sun, 9 Aug 2026 20:09:44 +0800 Subject: [PATCH] fix: allow verified in-place updates --- internal/update/update.go | 4 ++-- scripts/install.sh | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/internal/update/update.go b/internal/update/update.go index b3bd128..d108653 100644 --- a/internal/update/update.go +++ b/internal/update/update.go @@ -7,8 +7,8 @@ // Trust model: GitHub TLS guarantees the channel; the repository owner controls // which assets are published; SHA256SUMS guards integrity. There is no GPG // signature verification — an accepted trade-off for a closed-network testing -// tool. The web UI's check-update button remains an intentional no-op; only the -// CLI performs code replacement. +// tool. Both the CLI and authenticated web UI use this same verified replacement +// path. package update import ( diff --git a/scripts/install.sh b/scripts/install.sh index 48a747e..075a0d1 100644 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -229,7 +229,9 @@ ProtectKernelLogs=true ProtectKernelModules=true ProtectKernelTunables=true ProtectControlGroups=true -ReadWritePaths=/opt/vocat/data +# The web/CLI self-updater verifies a release in this directory and atomically +# renames it over the running binary. Keep the rest of the host read-only. +ReadWritePaths=/opt/vocat/data /opt/vocat/bin RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK RestrictRealtime=true LockPersonality=true