From c98acb9e85cb995f5aa6869174049650f1b6f8db Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Thu, 9 Jul 2026 11:31:43 +0100
Subject: [PATCH] Harden the installers against piped execution and v-prefixed
 versions

Two installer bugs reported after the v5 to v6 upgrades:

- The server installer (install.sh) guarded its "am I being sourced?" check
  with a bare ${BASH_SOURCE[0]}. When piped to bash (curl ... | bash) there is
  no source file, so under `set -u` the run aborted with "BASH_SOURCE[0]:
  unbound variable" before the installer body. Default the lookup and only
  early-return on a genuine source. Regression of the v5 fix in #1396. (#1526)

- The agent installer (scripts/install.sh) compared the downloaded binary's
  version ("v6.0.4") against the server /api/version value ("6.0.4") verbatim,
  raising a spurious mismatch warning on matching versions. Strip a leading "v"
  from both sides before comparing so only a genuine difference warns. (#1527)

Refs #1526 #1527
---
 install.sh         | 8 ++++++--
 scripts/install.sh | 8 +++++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/install.sh b/install.sh
index ab4baaa6f..607840c4c 100755
--- a/install.sh
+++ b/install.sh
@@ -5121,8 +5121,12 @@ reset_pulse() {
 }
 
 # When sourced (e.g. by tests) rather than executed, define the functions above
-# but do not run the installer.
-[[ "${BASH_SOURCE[0]}" == "$0" ]] || return 0
+# but do not run the installer. BASH_SOURCE is empty when the script is piped to
+# bash (curl ... | bash), which is an execution and not a source, so guard the
+# lookup with a default to avoid an "unbound variable" abort under `set -u`.
+if [[ -n "${BASH_SOURCE[0]:-}" && "${BASH_SOURCE[0]}" != "$0" ]]; then
+    return 0
+fi
 
 # Parse command line arguments
 while [[ $# -gt 0 ]]; do
diff --git a/scripts/install.sh b/scripts/install.sh
index 88ce8acd5..653401733 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -2731,7 +2731,13 @@ verify_download_signature "$TMP_BIN" "$SSH_SIGNATURE_HEADER"
 chmod +x "$TMP_BIN"
 NEW_VERSION=$("$TMP_BIN" --version 2>/dev/null | head -1 || echo "unknown")
 
-if [[ -n "$SERVER_VERSION" && -n "$NEW_VERSION" && "$NEW_VERSION" != "unknown" && "$NEW_VERSION" != "$SERVER_VERSION" ]]; then
+# Compare versions with any leading "v" stripped so the agent binary's "v6.0.4"
+# and the server /api/version "6.0.4" are treated as equal. Only a genuine
+# version difference (e.g. 6.0.3 vs 6.0.4) should raise the mismatch warning.
+NEW_VERSION_NORMALIZED="${NEW_VERSION#v}"
+SERVER_VERSION_NORMALIZED="${SERVER_VERSION#v}"
+
+if [[ -n "$SERVER_VERSION" && -n "$NEW_VERSION" && "$NEW_VERSION" != "unknown" && "$NEW_VERSION_NORMALIZED" != "$SERVER_VERSION_NORMALIZED" ]]; then
     log_warn "Downloaded agent version (${NEW_VERSION}) does not match Pulse server version (${SERVER_VERSION}). Check that Pulse is upgraded and that any reverse proxy is not serving a stale cached binary."
 fi