Move autoupdater to its own repo (https://github.com/ioquake/autoupdater)
This commit is contained in:
Tim Angus
parent
a9a6ccb103
commit
7bd2c17f9d
File diff suppressed because it is too large
Load Diff
8
code/autoupdater/rsa_tools/.gitignore
vendored
8
code/autoupdater/rsa_tools/.gitignore
vendored
|
|
@ -1,8 +0,0 @@
|
||||||
crypt-*.tar.bz2
|
|
||||||
tfm-*.tar.xz
|
|
||||||
libtomcrypt-*
|
|
||||||
tomsfastmath-*
|
|
||||||
rsa_make_keys
|
|
||||||
rsa_sign
|
|
||||||
rsa_verify
|
|
||||||
*.exe
|
|
||||||
|
|
@ -1,79 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
TFMVER=0.13.1
|
|
||||||
LTCVER=1.17
|
|
||||||
set -e
|
|
||||||
|
|
||||||
OSTYPE=`uname -s`
|
|
||||||
if [ "$OSTYPE" = "Linux" ]; then
|
|
||||||
NCPU=`cat /proc/cpuinfo |grep vendor_id |wc -l`
|
|
||||||
let NCPU=$NCPU+1
|
|
||||||
elif [ "$OSTYPE" = "Darwin" ]; then
|
|
||||||
NCPU=`sysctl -n hw.ncpu`
|
|
||||||
export CFLAGS="$CFLAGS -mmacosx-version-min=10.7 -DMAC_OS_X_VERSION_MIN_REQUIRED=1070"
|
|
||||||
export LDFLAGS="$LDFLAGS -mmacosx-version-min=10.7"
|
|
||||||
elif [ "$OSTYPE" = "SunOS" ]; then
|
|
||||||
NCPU=`/usr/sbin/psrinfo |wc -l |sed -e 's/^ *//g;s/ *$//g'`
|
|
||||||
else
|
|
||||||
NCPU=1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -z "$NCPU" ]; then
|
|
||||||
NCPU=1
|
|
||||||
elif [ "$NCPU" = "0" ]; then
|
|
||||||
NCPU=1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ ! -f tfm-$TFMVER.tar.xz ]; then
|
|
||||||
echo "Downloading TomsFastMath $TFMVER sources..."
|
|
||||||
curl -L -o tfm-$TFMVER.tar.xz https://github.com/libtom/tomsfastmath/releases/download/v$TFMVER/tfm-$TFMVER.tar.xz || exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ ! -f ./crypt-$LTCVER.tar.bz2 ]; then
|
|
||||||
echo "Downloading LibTomCrypt $LTCVER sources..."
|
|
||||||
curl -L -o crypt-$LTCVER.tar.bz2 https://github.com/libtom/libtomcrypt/releases/download/$LTCVER/crypt-$LTCVER.tar.bz2 || exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ ! -d tomsfastmath-$TFMVER ]; then
|
|
||||||
echo "Checking TomsFastMath archive hash..."
|
|
||||||
if [ "`shasum -a 256 tfm-$TFMVER.tar.xz |awk '{print $1;}'`" != "47c97a1ada3ccc9fcbd2a8a922d5859a84b4ba53778c84c1d509c1a955ac1738" ]; then
|
|
||||||
echo "Uhoh, tfm-$TFMVER.tar.xz does not have the sha256sum we expected!"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "Unpacking TomsFastMath $TFMVER sources..."
|
|
||||||
tar -xJvvf ./tfm-$TFMVER.tar.xz
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ ! -d libtomcrypt-$LTCVER ]; then
|
|
||||||
if [ "`shasum -a 256 crypt-$LTCVER.tar.bz2 |awk '{print $1;}'`" != "e33b47d77a495091c8703175a25c8228aff043140b2554c08a3c3cd71f79d116" ]; then
|
|
||||||
echo "Uhoh, crypt-$LTCVER.tar.bz2 does not have the sha256sum we expected!"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "Unpacking LibTomCrypt $LTCVER sources..."
|
|
||||||
tar -xjvvf ./crypt-$LTCVER.tar.bz2
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo
|
|
||||||
echo
|
|
||||||
echo "Will use make -j$NCPU. If this is wrong, check NCPU at top of script."
|
|
||||||
echo
|
|
||||||
echo
|
|
||||||
|
|
||||||
set -e
|
|
||||||
set -x
|
|
||||||
|
|
||||||
# Some compilers can't handle the ROLC inline asm; just turn it off.
|
|
||||||
cd tomsfastmath-$TFMVER
|
|
||||||
make -j$NCPU
|
|
||||||
cd ..
|
|
||||||
|
|
||||||
export CFLAGS="$CFLAGS -DTFM_DESC -DLTC_NO_ROLC -I ../tomsfastmath-$TFMVER/src/headers"
|
|
||||||
cd libtomcrypt-$LTCVER
|
|
||||||
make -j$NCPU
|
|
||||||
cd ..
|
|
||||||
|
|
||||||
set +x
|
|
||||||
echo "All done."
|
|
||||||
|
|
||||||
# end of build-libtom-unix.sh ...
|
|
||||||
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
export TFMDIR="tomsfastmath-0.13.1"
|
|
||||||
export LTCDIR="libtomcrypt-1.17"
|
|
||||||
|
|
||||||
OSTYPE=`uname -s`
|
|
||||||
if [ -z "$CC" ]; then
|
|
||||||
if [ "`uname -o`" = "Cygwin" ]; then
|
|
||||||
export CC=/usr/bin/i686-w64-mingw32-gcc
|
|
||||||
else
|
|
||||||
export CC=cc
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
function build {
|
|
||||||
if [ "$OSTYPE" = "Darwin" ]; then
|
|
||||||
$CC -mmacosx-version-min=10.7 -DMAC_OS_X_VERSION_MIN_REQUIRED=1070 -I $TFMDIR/src/headers -I $LTCDIR/src/headers -o "$1" -Wall -O3 "$1.c" rsa_common.c $LTCDIR/libtomcrypt.a $TFMDIR/libtfm.a
|
|
||||||
else
|
|
||||||
$CC -I $TFMDIR/src/headers -I $LTCDIR/src/headers -o "$1" -Wall -O3 "$1.c" rsa_common.c $LTCDIR/libtomcrypt.a $TFMDIR/libtfm.a
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
set -e
|
|
||||||
set -x
|
|
||||||
|
|
||||||
./build-libtom-unix.sh
|
|
||||||
build rsa_make_keys
|
|
||||||
build rsa_sign
|
|
||||||
build rsa_verify
|
|
||||||
|
|
||||||
set +x
|
|
||||||
echo "rsa_tools are compiled!"
|
|
||||||
|
|
||||||
|
|
@ -1,61 +0,0 @@
|
||||||
#include "rsa_common.h"
|
|
||||||
|
|
||||||
void fail(const char *fmt, ...)
|
|
||||||
{
|
|
||||||
va_list ap;
|
|
||||||
va_start(ap, fmt);
|
|
||||||
vfprintf(stderr, fmt, ap);
|
|
||||||
va_end(ap);
|
|
||||||
fputs("\n", stderr);
|
|
||||||
fflush(stderr);
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
void write_file(const char *fname, const void *buf, const unsigned long len)
|
|
||||||
{
|
|
||||||
FILE *io = fopen(fname, "wb");
|
|
||||||
if (!io) {
|
|
||||||
fail("Can't open '%s' for writing: %s", fname, strerror(errno));
|
|
||||||
}
|
|
||||||
|
|
||||||
if (fwrite(buf, len, 1, io) != 1) {
|
|
||||||
fail("Couldn't write '%s': %s", fname, strerror(errno));
|
|
||||||
}
|
|
||||||
|
|
||||||
if (fclose(io) != 0) {
|
|
||||||
fail("Couldn't flush '%s' to disk: %s", fname, strerror(errno));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void read_file(const char *fname, void *buf, unsigned long *len)
|
|
||||||
{
|
|
||||||
ssize_t br;
|
|
||||||
FILE *io = fopen(fname, "rb");
|
|
||||||
if (!io) {
|
|
||||||
fail("Can't open '%s' for reading: %s", fname, strerror(errno));
|
|
||||||
}
|
|
||||||
|
|
||||||
br = fread(buf, 1, *len, io);
|
|
||||||
if (ferror(io)) {
|
|
||||||
fail("Couldn't read '%s': %s", fname, strerror(errno));
|
|
||||||
} else if (!feof(io)) {
|
|
||||||
fail("Buffer too small to read '%s'", fname);
|
|
||||||
}
|
|
||||||
fclose(io);
|
|
||||||
|
|
||||||
*len = (unsigned long) br;
|
|
||||||
}
|
|
||||||
|
|
||||||
void read_rsakey(rsa_key *key, const char *fname)
|
|
||||||
{
|
|
||||||
unsigned char buf[4096];
|
|
||||||
unsigned long len = sizeof (buf);
|
|
||||||
int rc;
|
|
||||||
|
|
||||||
read_file(fname, buf, &len);
|
|
||||||
|
|
||||||
if ((rc = rsa_import(buf, len, key)) != CRYPT_OK) {
|
|
||||||
fail("rsa_import for '%s' failed: %s", fname, error_to_string(rc));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
#ifndef _INCL_RSA_COMMON_H_
|
|
||||||
#define _INCL_RSA_COMMON_H_ 1
|
|
||||||
|
|
||||||
#include <stdarg.h>
|
|
||||||
#include <stdio.h>
|
|
||||||
#include <errno.h>
|
|
||||||
|
|
||||||
#define TFM_DESC
|
|
||||||
#define LTC_NO_ROLC
|
|
||||||
#include "tomcrypt.h"
|
|
||||||
|
|
||||||
#define SALT_LEN 8
|
|
||||||
|
|
||||||
#if defined(__GNUC__) || defined(__clang__)
|
|
||||||
#define NEVER_RETURNS __attribute__((noreturn))
|
|
||||||
#define PRINTF_FUNC(fmtargnum, dotargnum) __attribute__ (( format( __printf__, fmtargnum, dotargnum )))
|
|
||||||
#else
|
|
||||||
#define NEVER_RETURNS
|
|
||||||
#define PRINTF_FUNC(fmtargnum, dotargnum)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
void fail(const char *fmt, ...) NEVER_RETURNS PRINTF_FUNC(1, 2);
|
|
||||||
void write_file(const char *fname, const void *buf, const unsigned long len);
|
|
||||||
void read_file(const char *fname, void *buf, unsigned long *len);
|
|
||||||
void read_rsakey(rsa_key *key, const char *fname);
|
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
/* end of rsa_common.h ... */
|
|
||||||
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
||||||
#include "rsa_common.h"
|
|
||||||
|
|
||||||
static void write_rsakey(rsa_key *key, const int type, const char *fname)
|
|
||||||
{
|
|
||||||
unsigned char buf[4096];
|
|
||||||
unsigned long len = sizeof (buf);
|
|
||||||
int rc;
|
|
||||||
|
|
||||||
if ((rc = rsa_export(buf, &len, type, key)) != CRYPT_OK) {
|
|
||||||
fail("rsa_export for '%s' failed: %s", fname, error_to_string(rc));
|
|
||||||
}
|
|
||||||
write_file(fname, buf, len);
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
int rc = 0;
|
|
||||||
prng_state prng;
|
|
||||||
int prng_index;
|
|
||||||
rsa_key key;
|
|
||||||
|
|
||||||
ltc_mp = tfm_desc;
|
|
||||||
prng_index = register_prng(&sprng_desc); /* (fortuna_desc is a good choice if your platform's PRNG sucks.) */
|
|
||||||
|
|
||||||
if (prng_index == -1) {
|
|
||||||
fail("Failed to register a RNG");
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((rc = rng_make_prng(128, prng_index, &prng, NULL)) != CRYPT_OK) {
|
|
||||||
fail("rng_make_prng failed: %s", error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((rc = rsa_make_key(&prng, prng_index, 256, 65537, &key)) != CRYPT_OK) {
|
|
||||||
fail("rng_make_key failed: %s", error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
write_rsakey(&key, PK_PRIVATE, "privatekey.bin");
|
|
||||||
write_rsakey(&key, PK_PUBLIC, "publickey.bin");
|
|
||||||
|
|
||||||
rsa_free(&key);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* end of rsa_make_keys.c ... */
|
|
||||||
|
|
@ -1,75 +0,0 @@
|
||||||
#include "rsa_common.h"
|
|
||||||
|
|
||||||
static void sign_file(const char *fname, rsa_key *key, prng_state *prng, const int prng_index, const int hash_index)
|
|
||||||
{
|
|
||||||
const size_t sigfnamelen = strlen(fname) + 5;
|
|
||||||
char *sigfname = (char *) malloc(sigfnamelen);
|
|
||||||
unsigned char hash[256];
|
|
||||||
unsigned long hashlen = sizeof (hash);
|
|
||||||
unsigned char sig[1024];
|
|
||||||
unsigned long siglen = sizeof (sig);
|
|
||||||
int rc = 0;
|
|
||||||
int status = 0;
|
|
||||||
|
|
||||||
if (!sigfname) {
|
|
||||||
fail("out of memory");
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((rc = hash_file(hash_index, fname, hash, &hashlen)) != CRYPT_OK) {
|
|
||||||
fail("hash_file for '%s' failed: %s", fname, error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((rc = rsa_sign_hash(hash, hashlen, sig, &siglen, prng, prng_index, hash_index, SALT_LEN, key)) != CRYPT_OK) {
|
|
||||||
fail("rsa_sign_hash for '%s' failed: %s", fname, error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((rc = rsa_verify_hash(sig, siglen, hash, hashlen, hash_index, SALT_LEN, &status, key)) != CRYPT_OK) {
|
|
||||||
fail("rsa_verify_hash for '%s' failed: %s", fname, error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!status) {
|
|
||||||
fail("Generated signature isn't valid! Bug in the program!");
|
|
||||||
}
|
|
||||||
|
|
||||||
snprintf(sigfname, sigfnamelen, "%s.sig", fname);
|
|
||||||
write_file(sigfname, sig, siglen);
|
|
||||||
free(sigfname);
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
int rc = 0;
|
|
||||||
prng_state prng;
|
|
||||||
int prng_index, hash_index;
|
|
||||||
rsa_key key;
|
|
||||||
int i;
|
|
||||||
|
|
||||||
ltc_mp = tfm_desc;
|
|
||||||
|
|
||||||
prng_index = register_prng(&sprng_desc); /* (fortuna_desc is a good choice if your platform's PRNG sucks.) */
|
|
||||||
if (prng_index == -1) {
|
|
||||||
fail("Failed to register a RNG");
|
|
||||||
}
|
|
||||||
|
|
||||||
hash_index = register_hash(&sha256_desc);
|
|
||||||
if (hash_index == -1) {
|
|
||||||
fail("Failed to register sha256 hasher");
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((rc = rng_make_prng(128, prng_index, &prng, NULL)) != CRYPT_OK) {
|
|
||||||
fail("rng_make_prng failed: %s", error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
read_rsakey(&key, "privatekey.bin");
|
|
||||||
|
|
||||||
for (i = 1; i < argc; i++) {
|
|
||||||
sign_file(argv[i], &key, &prng, prng_index, hash_index);
|
|
||||||
}
|
|
||||||
|
|
||||||
rsa_free(&key);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* end of rsa_sign.c ... */
|
|
||||||
|
|
||||||
|
|
@ -1,60 +0,0 @@
|
||||||
#include "rsa_common.h"
|
|
||||||
|
|
||||||
static void verify_file(const char *fname, rsa_key *key, const int hash_index)
|
|
||||||
{
|
|
||||||
const size_t sigfnamelen = strlen(fname) + 5;
|
|
||||||
char *sigfname = (char *) malloc(sigfnamelen);
|
|
||||||
unsigned char hash[256];
|
|
||||||
unsigned long hashlen = sizeof (hash);
|
|
||||||
unsigned char sig[1024];
|
|
||||||
unsigned long siglen = sizeof (sig);
|
|
||||||
int status = 0;
|
|
||||||
int rc = 0;
|
|
||||||
|
|
||||||
if (!sigfname) {
|
|
||||||
fail("out of memory");
|
|
||||||
}
|
|
||||||
|
|
||||||
snprintf(sigfname, sigfnamelen, "%s.sig", fname);
|
|
||||||
read_file(sigfname, sig, &siglen);
|
|
||||||
free(sigfname);
|
|
||||||
|
|
||||||
if ((rc = hash_file(hash_index, fname, hash, &hashlen)) != CRYPT_OK) {
|
|
||||||
fail("hash_file for '%s' failed: %s", fname, error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
if ((rc = rsa_verify_hash(sig, siglen, hash, hashlen, hash_index, SALT_LEN, &status, key)) != CRYPT_OK) {
|
|
||||||
fail("rsa_verify_hash for '%s' failed: %s", fname, error_to_string(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!status) {
|
|
||||||
fail("Invalid signature for '%s'! Don't trust this file!", fname);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(int argc, char **argv)
|
|
||||||
{
|
|
||||||
int hash_index;
|
|
||||||
rsa_key key;
|
|
||||||
int i;
|
|
||||||
|
|
||||||
ltc_mp = tfm_desc;
|
|
||||||
|
|
||||||
hash_index = register_hash(&sha256_desc);
|
|
||||||
if (hash_index == -1) {
|
|
||||||
fail("Failed to register sha256 hasher");
|
|
||||||
}
|
|
||||||
|
|
||||||
read_rsakey(&key, "publickey.bin");
|
|
||||||
|
|
||||||
for (i = 1; i < argc; i++) {
|
|
||||||
verify_file(argv[i], &key, hash_index);
|
|
||||||
}
|
|
||||||
|
|
||||||
rsa_free(&key);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* end of rsa_verify.c ... */
|
|
||||||
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
if [ -f privatekey.bin ]; then
|
|
||||||
echo "move your existing keys out of the way."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
( ./rsa_make_keys && echo "key making okay") || echo "key making NOT okay"
|
|
||||||
echo "The quick brown fox jumped over the lazy dog." >testmsg.txt
|
|
||||||
( ./rsa_sign testmsg.txt && echo "signing okay" ) || echo "signing NOT okay"
|
|
||||||
( ./rsa_verify testmsg.txt && echo "basic verifying okay" ) || echo "basic verifying NOT okay"
|
|
||||||
echo "The quick brown fox jumped over the lazy dog!" >testmsg.txt
|
|
||||||
( ./rsa_verify testmsg.txt 2>/dev/null && echo "tamper test NOT okay" ) || echo "tamper test okay"
|
|
||||||
echo "The quick brown fox jumped over the lazy dog." >testmsg.txt
|
|
||||||
( ./rsa_verify testmsg.txt && echo "reverify okay" ) || echo "reverify NOT okay"
|
|
||||||
rm -f testmsg.txt testmsg.txt.sig publickey.bin privatekey.bin
|
|
||||||
|
|
||||||
|
|
@ -1,165 +0,0 @@
|
||||||
The updater program's code is public domain. The rest of ioquake3 is not.
|
|
||||||
|
|
||||||
The source code to the autoupdater is in the code/autoupdater directory.
|
|
||||||
There is a small piece of code in ioquake3 itself at startup, too; this is
|
|
||||||
in code/sys/sys_autoupdater.c ...
|
|
||||||
|
|
||||||
(This is all Unix terminology, but similar approaches on Windows apply.)
|
|
||||||
|
|
||||||
The updater is a separate program, written in C, with no dependencies on
|
|
||||||
the game. It (statically) links to libcurl and uses the C runtime, but
|
|
||||||
otherwise has no external dependencies. It has to be a single binary file
|
|
||||||
with no shared libraries.
|
|
||||||
|
|
||||||
The basic flow looks like this:
|
|
||||||
|
|
||||||
- The game launches as usual.
|
|
||||||
- Right after main() starts, the game creates a pipe, forks off a new process,
|
|
||||||
and execs the updater in that process. The game won't ever touch the pipe
|
|
||||||
again. It's just there to block the child app until the game terminates.
|
|
||||||
- The updater has no UI. It writes a log file.
|
|
||||||
- The updater downloads a manifest from a known URL over https://, using
|
|
||||||
libCurl. The base URL is platform-specific (it might be
|
|
||||||
https://example.com/mac/, or https://example.com/linux-x86/, whatever).
|
|
||||||
The url might have other features, like a updater version or a specific
|
|
||||||
product name, etc.
|
|
||||||
The manifest is at $BASEURL/manifest.txt
|
|
||||||
- The updater also downloads $BASEURL/manifest.txt.sig, which is a digital
|
|
||||||
signature for the manifest. It checks the manifest against this signature
|
|
||||||
and a known public RSA key; if the manifest doesn't match the signature,
|
|
||||||
the updater refuses to continue.
|
|
||||||
- The manifest looks like this: three lines per item...
|
|
||||||
|
|
||||||
Contents/MacOS/baseq3/uix86_64.dylib
|
|
||||||
332428
|
|
||||||
a49bbe77f8eb6c195265ea136f881f7830db58e4d8a883b27f59e1e23e396a20
|
|
||||||
|
|
||||||
- That's the file's path, its size in bytes, and an sha256 hash of the data.
|
|
||||||
- The file will be at this path under the base url on the webserver.
|
|
||||||
- The manifest only lists files that ever needed updating; it's not necessary
|
|
||||||
to list every file in the game's installation (unless you want to allow the
|
|
||||||
entire game to download).
|
|
||||||
- The updater will check each item in the manifest:
|
|
||||||
- Does the file not exist in the install? Needs downloading.
|
|
||||||
- Does the file have a different size? Needs downloading.
|
|
||||||
- Does the file have a different sha256sum? Needs downloading.
|
|
||||||
- Otherwise, file is up to date, leave it alone.
|
|
||||||
- If an item needs downloading, do these same checks against the file in the
|
|
||||||
download directory (if it's already there and matches, don't download again.)
|
|
||||||
- Download necessary files with libcurl, put it in a download directory.
|
|
||||||
- The downloaded file is also checked for size and sha256 vs the manifest, to
|
|
||||||
make sure there was no corruption or confusion. If a downloaded file doesn't
|
|
||||||
match what was expected, the updater aborts and will try again next time.
|
|
||||||
This could fail checksum due to i/o errors and compromised security, but
|
|
||||||
it might just be that a new version was being published and bad luck
|
|
||||||
happened, and a retry later could correct everything.
|
|
||||||
- If the updater itself needs upgrading, we deal with that first. It's
|
|
||||||
downloaded, then the updater relaunches from the downloaded binary with
|
|
||||||
a special command line. That relaunched process copies itself to the proper
|
|
||||||
location, and then relaunches _again_ to restart the normal updating
|
|
||||||
process with the new updater in its correct position.
|
|
||||||
- Once the downloads are complete and the updater itself doesn't need
|
|
||||||
upgrading, we are ready to start the normal upgrade. Since we can't replace
|
|
||||||
executables on some platforms while they are running, and swapping out a
|
|
||||||
game's data files at runtime isn't wise in general, the updater will now
|
|
||||||
block until the game terminates. It does this by reading on the pipe that
|
|
||||||
the game created when forking the updater; since the game never writes
|
|
||||||
anything to this pipe, it causes the updater to block until the pipe closes.
|
|
||||||
Since the game never deliberately closes the pipe either, it remains open
|
|
||||||
until the OS forcibly closes it as the game process terminates. Being an
|
|
||||||
unnamed pipe, it just vaporizes at this point, leaving no state that might
|
|
||||||
accidentally hang us up later, like a global semaphore or whatnot. This
|
|
||||||
technique also lets us localize the game's code changes to one small block
|
|
||||||
of C code, with no need to manage these resources elsewhere.
|
|
||||||
- As a sanity check, the updater will also kill(game_process_id, 0) until it
|
|
||||||
fails, sleeping for 100 milliseconds between each attempt, in case the
|
|
||||||
process is still being cleaned up by the OS after closing the pipe.
|
|
||||||
- Once the updater is confident the game process is gone, it will start
|
|
||||||
upgrading the appropriate files. It does this in two steps: it moves
|
|
||||||
the old file to a "rollback" directory so it's out of the way but still
|
|
||||||
available, then it moves the newly-downloaded file into place. Since these
|
|
||||||
are all simple renames and not copies, this can move fast. Any missing
|
|
||||||
parent directories are created, in case the update is adding a new file
|
|
||||||
in a directory that didn't previously exist.
|
|
||||||
- If something goes wrong at this point (file i/o error, etc), the updater
|
|
||||||
will roll back the changes by deleting the updated files, and moving the
|
|
||||||
files in the "rollback" directory back to their original locations. Then
|
|
||||||
the updater aborts.
|
|
||||||
- If nothing went wrong, the rollback files are deleted. And we are officially
|
|
||||||
up to date! The updater terminates.
|
|
||||||
|
|
||||||
|
|
||||||
The updater is designed to fail at any point. If a download fails, it'll
|
|
||||||
pick up and try again next time, etc. Completed downloads will remain, so it
|
|
||||||
will just need to download any missing/incomplete files.
|
|
||||||
|
|
||||||
The server side just needs to be able to serve static files over HTTPS from
|
|
||||||
any standard Apache/nginx/whatever process.
|
|
||||||
|
|
||||||
Failure points:
|
|
||||||
- If the updater fails when still downloading data, it just picks up on next
|
|
||||||
restart.
|
|
||||||
- If the updater fails when replacing files, it rolls back any changes it has
|
|
||||||
made.
|
|
||||||
- If the updater fails when rolling back, then running the updater again after
|
|
||||||
fixing the specific problem (disk error, etc?) will redownload and replace
|
|
||||||
any files that were left in an uncertain state. The only true point of
|
|
||||||
risk is crashing during a rollback and then having the updater bricked for
|
|
||||||
some reason, but that's an extremely small surface area, knock on wood.
|
|
||||||
- If the updater crashes or totally bricks, ioquake3 should just keep being
|
|
||||||
ioquake3. It will still launch and play, even if the updater is quietly
|
|
||||||
segfaulting in the background on startup.
|
|
||||||
- If an update bricks ioquake3 to the point where it can't run the updater,
|
|
||||||
running the updater directly should let it recover (assuming a future update
|
|
||||||
fixes the problem).
|
|
||||||
- If the download server is compromised, they would need the private key
|
|
||||||
(not stored on the download server) to alter the manifest to serve
|
|
||||||
compromised files to players. If they try to change a file or the manifest,
|
|
||||||
the updater will know to abort without updating anything.
|
|
||||||
- If the private key is compromised, we generate a new one, ship new
|
|
||||||
installers with an updated public key, and re-sign the manifest with the
|
|
||||||
new private key. Existing installations will never update again until they
|
|
||||||
do a fresh install, or at least update their copy of the public key.
|
|
||||||
|
|
||||||
|
|
||||||
How manifest signing works:
|
|
||||||
|
|
||||||
Some admin will generate a public/private key with the rsa_make_keys program,
|
|
||||||
keeping the private key secret. Using the private key and the rsa_sign
|
|
||||||
program, the admin will sign the manifest, generating manifest.txt.sig.
|
|
||||||
|
|
||||||
The public key ships with the game (adding 270 bytes to the download), the
|
|
||||||
.sig is downloaded with the manifest by the autoupdater (256 bytes extra
|
|
||||||
download), then the autoupdater checks the manifest against the signature
|
|
||||||
with the public key. if the signature isn't valid (the manifest was tampered
|
|
||||||
with or corrupt), the autoupdater refuses to continue.
|
|
||||||
|
|
||||||
If the manifest is to be trusted, it lists sha256 checksums for every file to
|
|
||||||
download, so there's no need to sign every file; if they can't tamper with the
|
|
||||||
manifest, they can't tamper with any other file to be updated since the file's
|
|
||||||
listed sha256 won't match.
|
|
||||||
|
|
||||||
If the private key is compromised, we generate new keys and ship new
|
|
||||||
installers, so new installations will be able to update but existing ones
|
|
||||||
will need to do a new install to keep getting updates. Don't let the private
|
|
||||||
key get compromised. The private key doesn't go on a public server. Maybe it
|
|
||||||
doesn't even live on the admin's laptop hard drive.
|
|
||||||
|
|
||||||
If the download server is compromised and serving malware, the autoupdater
|
|
||||||
will reject it outright if they haven't compromised the private key, generated
|
|
||||||
a new manifest, and signed it with the private key.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Items to consider for future revisions:
|
|
||||||
- Maybe put a limit on the number manifest downloads, so we only check once
|
|
||||||
every hour? Every day?
|
|
||||||
- Channels? Stable (what everyone gets by default), Nightly (once a day),
|
|
||||||
Experimental (some other work-in-progress branch), Bloody (literally the
|
|
||||||
latest commit).
|
|
||||||
- Let mods update, separate from the main game?
|
|
||||||
|
|
||||||
Questions? Ask Ryan: icculus@icculus.org
|
|
||||||
|
|
||||||
--ryan.
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user