vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-19 10:33:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

Bind runtime version to packaged binary

Browse source
This commit is contained in:
rcourtman 2026-08-15 03:30:20 +01:00
parent 5cffa54620
commit 0460797aab
3 changed files with 42 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/release-control/v6/internal/subsystems/security-privacy.md
View file

@ -2239,3 +2239,15 @@ reports that effective policy rather than the environment variable alone, and
the root and shipped security guides remain byte-for-byte synchronized. The
router matrix proves that malformed and otherwise valid denied requests read no
body and perform no export, import, config replacement, or runtime reload.
### Packaged server identity outranks inherited image metadata
`pkg/server.Run` binds the version supplied by the executing binary into the
canonical update/version subsystem before runtime initialization. Wrapper
binaries such as Pulse Pro therefore report the same packaged identity through
`/api/version` that they report through `--version`, even when a derived test
container inherits a stale `VERSION` file from its base image. The public
endpoint remains non-secret release metadata; this binding does not expose
inventory, credentials, update selections, or command authority.
`TestRunBindsPackagedVersionIdentity` in `pkg/server/server_test.go` pins the
wrapper-runtime boundary.

11
pkg/server/server.go
View file

@ -29,6 +29,7 @@ import (
"github.com/rcourtman/pulse-go-rewrite/internal/models"
"github.com/rcourtman/pulse-go-rewrite/internal/monitoring"
"github.com/rcourtman/pulse-go-rewrite/internal/telemetry"
"github.com/rcourtman/pulse-go-rewrite/internal/updates"
"github.com/rcourtman/pulse-go-rewrite/internal/websocket"
"github.com/rcourtman/pulse-go-rewrite/pkg/aicontracts"
@ -139,8 +140,18 @@ func runtimeIdentityForBusinessHooks(h BusinessHooks) pkglicensing.RuntimeIdenti
return pkglicensing.CommunityRuntimeIdentity()
}
func bindRuntimeVersion(version string) {
// The server package is also the entry point for wrapper binaries such as
// Pulse Pro. Keep the update/version subsystem bound to the version supplied
// by the executing binary so /api/version cannot fall back to a VERSION file
// inherited from its container image.
updates.BuildVersion = strings.TrimSpace(version)
}
// Run starts the Pulse monitoring server.
func Run(ctx context.Context, version string) error {
bindRuntimeVersion(version)
// Initialize logger with baseline defaults for early startup logs
logging.Init(logging.Config{
Format: "auto",

19
pkg/server/server_test.go
View file

@ -16,11 +16,30 @@ import (
"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
"github.com/rcourtman/pulse-go-rewrite/internal/config"
"github.com/rcourtman/pulse-go-rewrite/internal/securityutil"
"github.com/rcourtman/pulse-go-rewrite/internal/updates"
"github.com/rcourtman/pulse-go-rewrite/pkg/extensions"
pkglicensing "github.com/rcourtman/pulse-go-rewrite/pkg/licensing"
"github.com/rcourtman/pulse-go-rewrite/pkg/metrics"
)
func TestRunBindsPackagedVersionIdentity(t *testing.T) {
previous := updates.BuildVersion
t.Cleanup(func() {
updates.BuildVersion = previous
})
updates.BuildVersion = "stale-image-version"
bindRuntimeVersion(" 6.2.2-patrol.qualification.5cffa5462 ")
versionInfo, err := updates.GetCurrentVersion()
if err != nil {
t.Fatalf("get current version: %v", err)
}
if got, want := versionInfo.Version, "6.2.2-patrol.qualification.5cffa5462"; got != want {
t.Fatalf("runtime version = %q, want packaged version %q", got, want)
}
}
func TestAgentIngestHandler(t *testing.T) {
var innerCalled bool
inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {