Make devpod upgrade compare versions and check permissions first

CHANGELOG.md

@@ -14,6 +14,17 @@ Add new entries to the top of the "Unreleased" section.
 
 ### Changed
 
+- `devpod upgrade` only upgrades to a newer stable release: it compares versions instead of installing the latest
+  release whenever it differs from the running one, which could downgrade the CLI, and it never picks a
+  pre-release or a tag that isn't a plain `major.minor.patch` version. It checks that it can replace the binary
+  before downloading anything, without touching it (directory permissions, sticky directories, immutable and
+  append-only flags, and on Windows access control lists and other processes holding the file), accepts
+  `--version` with or without the leading `v` (and for any release, not just recent ones), and has a new
+  `--dry-run` flag that only reports whether a newer version is available, and fails if the upgrade would fail.
+  The new binary keeps the mode and owner of the one it replaces, and the upgrade warns if the current user
+  can't give it the same owner or group. When the CLI runs through a symlink, the upgrade downloads the new
+  release next to the file the link points to and points the link to it, leaving the previous release alone.
+  DevPod no longer depends on `rhysd/go-github-selfupdate` and the five modules it brought in.
 - `devpod up` of a local folder in a git repository only uploads the files git doesn't ignore, instead of the
   whole folder, when the workspace runs on another machine or in Kubernetes. Ignored files (build output,
   `node_modules`, ...) and nested repositories and git worktrees stay behind. Instead of the repository's

cmd/upgrade.go

@@ -1,6 +1,10 @@
 package cmd
 
 import (
+	"os"
+	"os/signal"
+	"syscall"
+
 	"github.com/loft-sh/devpod/pkg/log"
 	"github.com/loft-sh/devpod/pkg/upgrade"
 	"github.com/pkg/errors"
@@ -11,6 +15,7 @@ import (
 type UpgradeCmd struct {
 	log     log.Logger
 	Version string
+	DryRun  bool
 }
 
 // NewUpgradeCmd creates a new upgrade command
@@ -23,13 +28,18 @@ func NewUpgradeCmd() *cobra.Command {
 		RunE:  cmd.Run,
 	}
 
-	upgradeCmd.Flags().StringVar(&cmd.Version, "version", "", "The version to update to. Defaults to the latest stable version available")
+	upgradeCmd.Flags().StringVar(&cmd.Version, "version", "", "The release to install, such as v0.8.0. Defaults to the latest stable release, if it is newer than this CLI")
+	upgradeCmd.Flags().BoolVar(&cmd.DryRun, "dry-run", false, "Only check whether a newer version is available and whether the CLI could be replaced, without downloading anything. Fails if the upgrade would fail")
 	return upgradeCmd
 }
 
 // Run executes the command logic
-func (cmd *UpgradeCmd) Run(*cobra.Command, []string) error {
-	err := upgrade.Upgrade(cmd.Version, cmd.log)
+func (cmd *UpgradeCmd) Run(cobraCmd *cobra.Command, _ []string) error {
+	// Cancelling the context on Ctrl-C lets an interrupted download clean up after itself.
+	ctx, stop := signal.NotifyContext(cobraCmd.Context(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	err := upgrade.Upgrade(ctx, upgrade.Options{Version: cmd.Version, DryRun: cmd.DryRun}, cmd.log)
 	if err != nil {
 		return errors.Errorf("unable to upgrade: %v", err)
 	}

docs/pages/getting-started/install.mdx

@@ -123,3 +123,31 @@ curl -L -o devpod "https://github.com/curityio/devpod/releases/latest/download/d
 
 </TabItem>
 </Tabs>
+
+## Upgrade DevPod CLI
+
+`devpod upgrade` replaces the CLI with the newest stable release, if it is newer than the one you have.
+Pre-releases (such as `v0.9.0-alpha.1`) are never picked, but you can install one, or go back to an older
+release, with `--version`:
+
+```bash
+devpod upgrade --version v0.8.0
+```
+
+To only check whether a newer version is available, without downloading anything or touching the CLI, run the
+following. It fails if the upgrade would fail, for example because the current user can't replace the CLI.
+
+```bash
+devpod upgrade --dry-run
+```
+
+The upgrade needs to create files in the directory the CLI is in. If you installed it in `/usr/local/bin` as
+shown above, run it with `sudo`. If the GitHub API rate limit stops it, set `GITHUB_TOKEN` to a GitHub token.
+The new CLI gets the mode, owner and group of the one it replaces. Without root, the upgrade can't make another
+user its owner, or give it a group you aren't in; then it warns about what it couldn't keep and shows the `chown`
+command that fixes it.
+
+If you run the CLI through a symlink (for example `~/bin/devpod` pointing to `~/tools/devpod-v0.8.0`), the upgrade
+doesn't replace the file the link points to. It downloads the new release next to that file, named after the
+release (`~/tools/devpod-v0.9.0`), and points the link to it, so the previous release stays where it was. This
+needs permission to create files in both directories. A symlink to another symlink isn't supported.

docs/pages/licenses/devpod.mdx

@@ -79,8 +79,6 @@ Some packages may only be included on certain architectures or operating systems
  - [github.com/golang/protobuf/ptypes](https://pkg.go.dev/github.com/golang/protobuf/ptypes) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/golang/protobuf/LICENSE))
  - [github.com/google/go-cmp/cmp](https://pkg.go.dev/github.com/google/go-cmp/cmp) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/google/go-cmp/LICENSE))
  - [github.com/google/go-containerregistry](https://pkg.go.dev/github.com/google/go-containerregistry) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/google/go-containerregistry/LICENSE))
- - [github.com/google/go-github/v30/github](https://pkg.go.dev/github.com/google/go-github/v30/github) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/google/go-github/v30/LICENSE))
- - [github.com/google/go-querystring/query](https://pkg.go.dev/github.com/google/go-querystring/query) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/google/go-querystring/LICENSE))
  - [github.com/google/gofuzz](https://pkg.go.dev/github.com/google/gofuzz) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/google/gofuzz/LICENSE))
  - [github.com/google/shlex](https://pkg.go.dev/github.com/google/shlex) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/google/shlex/COPYING))
  - [github.com/google/uuid](https://pkg.go.dev/github.com/google/uuid) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/google/uuid/LICENSE))
@@ -90,9 +88,6 @@ Some packages may only be included on certain architectures or operating systems
  - [github.com/hashicorp/go-cleanhttp](https://pkg.go.dev/github.com/hashicorp/go-cleanhttp) ([MPL-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/hashicorp/go-cleanhttp/LICENSE))
  - [github.com/hashicorp/go-multierror](https://pkg.go.dev/github.com/hashicorp/go-multierror) ([MPL-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/hashicorp/go-multierror/LICENSE))
  - [github.com/in-toto/in-toto-golang/in_toto](https://pkg.go.dev/github.com/in-toto/in-toto-golang/in_toto) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/in-toto/in-toto-golang/LICENSE))
- - [github.com/inconshreveable/go-update](https://pkg.go.dev/github.com/inconshreveable/go-update) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/inconshreveable/go-update/LICENSE))
- - [github.com/inconshreveable/go-update/internal/binarydist](https://pkg.go.dev/github.com/inconshreveable/go-update/internal/binarydist) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/inconshreveable/go-update/internal/binarydist/License))
- - [github.com/inconshreveable/go-update/internal/osext](https://pkg.go.dev/github.com/inconshreveable/go-update/internal/osext) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/inconshreveable/go-update/internal/osext/LICENSE))
  - [github.com/joho/godotenv](https://pkg.go.dev/github.com/joho/godotenv) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/joho/godotenv/LICENCE))
  - [github.com/json-iterator/go](https://pkg.go.dev/github.com/json-iterator/go) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/json-iterator/go/LICENSE))
  - [github.com/klauspost/compress](https://pkg.go.dev/github.com/klauspost/compress) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/klauspost/compress/LICENSE))
@@ -133,7 +128,6 @@ Some packages may only be included on certain architectures or operating systems
  - [github.com/pkg/sftp](https://pkg.go.dev/github.com/pkg/sftp) ([BSD-2-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/pkg/sftp/LICENSE))
  - [github.com/planetscale/vtprotobuf](https://pkg.go.dev/github.com/planetscale/vtprotobuf) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/planetscale/vtprotobuf/LICENSE))
  - [github.com/ramr/go-reaper](https://pkg.go.dev/github.com/ramr/go-reaper) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/ramr/go-reaper/LICENSE))
- - [github.com/rhysd/go-github-selfupdate/selfupdate](https://pkg.go.dev/github.com/rhysd/go-github-selfupdate/selfupdate) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/rhysd/go-github-selfupdate/LICENSE))
  - [github.com/rivo/uniseg](https://pkg.go.dev/github.com/rivo/uniseg) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/rivo/uniseg/LICENSE.txt))
  - [github.com/secure-systems-lab/go-securesystemslib](https://pkg.go.dev/github.com/secure-systems-lab/go-securesystemslib) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/secure-systems-lab/go-securesystemslib/LICENSE))
  - [github.com/shibumi/go-pathspec](https://pkg.go.dev/github.com/shibumi/go-pathspec) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/shibumi/go-pathspec/LICENSE))
@@ -142,13 +136,11 @@ Some packages may only be included on certain architectures or operating systems
  - [github.com/spf13/cobra](https://pkg.go.dev/github.com/spf13/cobra) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/spf13/cobra/LICENSE.txt))
  - [github.com/spf13/pflag](https://pkg.go.dev/github.com/spf13/pflag) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/spf13/pflag/LICENSE))
  - [github.com/takama/daemon](https://pkg.go.dev/github.com/takama/daemon) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/takama/daemon/LICENSE))
- - [github.com/tcnksm/go-gitconfig](https://pkg.go.dev/github.com/tcnksm/go-gitconfig) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/tcnksm/go-gitconfig/LICENSE))
  - [github.com/tidwall/jsonc](https://pkg.go.dev/github.com/tidwall/jsonc) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/tidwall/jsonc/LICENSE))
  - [github.com/tonistiigi/fsutil](https://pkg.go.dev/github.com/tonistiigi/fsutil) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/tonistiigi/fsutil/LICENSE))
  - [github.com/tonistiigi/go-csvvalue](https://pkg.go.dev/github.com/tonistiigi/go-csvvalue) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/tonistiigi/go-csvvalue/LICENSE))
  - [github.com/tonistiigi/units](https://pkg.go.dev/github.com/tonistiigi/units) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/tonistiigi/units/LICENSE))
  - [github.com/tonistiigi/vt100](https://pkg.go.dev/github.com/tonistiigi/vt100) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/tonistiigi/vt100/LICENSE))
- - [github.com/ulikunitz/xz](https://pkg.go.dev/github.com/ulikunitz/xz) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/ulikunitz/xz/LICENSE))
  - [github.com/vbatts/tar-split/archive/tar](https://pkg.go.dev/github.com/vbatts/tar-split/archive/tar) ([BSD-3-Clause](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/vbatts/tar-split/LICENSE))
  - [github.com/x448/float16](https://pkg.go.dev/github.com/x448/float16) ([MIT](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/x448/float16/LICENSE))
  - [github.com/xeipuuv/gojsonpointer](https://pkg.go.dev/github.com/xeipuuv/gojsonpointer) ([Apache-2.0](https://github.com/curityio/devpod/blob/HEAD/vendor/github.com/xeipuuv/gojsonpointer/LICENSE-APACHE-2.0.txt))

go.mod

@@ -32,7 +32,6 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/sftp v1.13.6
 	github.com/ramr/go-reaper v0.2.3
-	github.com/rhysd/go-github-selfupdate v1.2.3
 	github.com/sirupsen/logrus v1.9.3
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
 	github.com/spf13/cobra v1.8.1
@@ -100,16 +99,13 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
-	github.com/google/go-github/v30 v30.1.0 // indirect
-	github.com/google/go-querystring v1.0.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/in-toto/in-toto-golang v0.9.0 // indirect
-	github.com/inconshreveable/go-update v0.0.0-20160112193335-8152e7eb6ccf // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
@@ -135,9 +131,7 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.8.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
-	github.com/tcnksm/go-gitconfig v0.1.2 // indirect
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
-	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect