be11074 Merge pull request #139 from mi-skam/fix/semver-update-check · zut

M go.mod +1 -0


@@ -9,6 +9,7 @@ require (
9	9		github.com/mattn/go-runewidth v0.0.16
10	10		github.com/sahilm/fuzzy v0.1.1
11	11		golang.org/x/image v0.43.0
	12	+	golang.org/x/mod v0.35.0
12	13		golang.org/x/sys v0.26.0
13	14		golang.org/x/term v0.25.0
14	15		)


@@ -9,6 +9,7 @@ require (
9	github.com/mattn/go-runewidth v0.0.16	9		github.com/mattn/go-runewidth v0.0.16
10	github.com/sahilm/fuzzy v0.1.1	10		github.com/sahilm/fuzzy v0.1.1
11	golang.org/x/image v0.43.0	11		golang.org/x/image v0.43.0
		12	+	golang.org/x/mod v0.35.0
12	golang.org/x/sys v0.26.0	13		golang.org/x/sys v0.26.0
13	golang.org/x/term v0.25.0	14		golang.org/x/term v0.25.0
14	)	15		)

M go.sum +2 -0 generated file: collapsed

load diff

M packages/agent/update.go +21 -30


@@ -4,10 +4,10 @@ import (
4	4		"context"
5	5		"encoding/json"
6	6		"fmt"
	7	+	"golang.org/x/mod/semver"
7	8		"net/http"
8	9		"os"
9	10		"path/filepath"
10		-	"strconv"
11	11		"strings"
12	12		"sync"
13	13		"time"

@@ -121,40 +121,31 @@ func buildInfo(current, latest, url string) UpdateInfo {
121	121		return info
122	122		}
123	123
124		-	// versionLess returns a < b for dotted semver-ish tags like "0.0.4".
125		-	// Non-numeric components compare as zero, which is fine for zot's
126		-	// x.y.z-only scheme.
	124	+	// versionLess reports whether a is an older semantic version than b.
	125	+	// Invalid versions return false so update checks never offer a downgrade.
127	126		func versionLess(a, b string) bool {
128		-	as := splitVersion(a)
129		-	bs := splitVersion(b)
130		-	for i := 0; i < 3; i++ {
131		-	av, bv := 0, 0
132		-	if i < len(as) {
133		-	av = as[i]
134		-	}
135		-	if i < len(bs) {
136		-	bv = bs[i]
137		-	}
138		-	if av != bv {
139		-	return av < bv
140		-	}
141		-	}
142		-	return false
	127	+	comparison, err := compareVersions(a, b)
	128	+	return err == nil && comparison < 0
143	129		}
144	130
145		-	func splitVersion(s string) []int {
146		-	s = strings.TrimPrefix(s, "v")
147		-	// Strip build-metadata suffix like "(abc1234, 2026-04-18)".
148		-	if i := strings.IndexAny(s, " ("); i > 0 {
149		-	s = s[:i]
	131	+	func compareVersions(a, b string) (int, error) {
	132	+	a = normalizedVersion(a)
	133	+	b = normalizedVersion(b)
	134	+	if !semver.IsValid(a) {
	135	+	return 0, fmt.Errorf("invalid semantic version %q", strings.TrimPrefix(a, "v"))
150	136		}
151		-	parts := strings.Split(s, ".")
152		-	out := make([]int, 0, len(parts))
153		-	for _, p := range parts {
154		-	n, _ := strconv.Atoi(p)
155		-	out = append(out, n)
	137	+	if !semver.IsValid(b) {
	138	+	return 0, fmt.Errorf("invalid semantic version %q", strings.TrimPrefix(b, "v"))
	139	+	}
	140	+	return semver.Compare(a, b), nil
	141	+	}
	142	+
	143	+	func normalizedVersion(v string) string {
	144	+	v = versionOnly(v)
	145	+	if !strings.HasPrefix(v, "v") {
	146	+	v = "v" + v
156	147		}
157		-	return out
	148	+	return v
158	149		}
159	150
160	151		// fetchLatestRelease queries the GitHub API for the latest published

 	"context"
 	"encoding/json"
 	"fmt"
+	"golang.org/x/mod/semver"
 	"net/http"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
 	return info
 }
-// versionLess returns a < b for dotted semver-ish tags like "0.0.4".
+// versionLess reports whether a is an older semantic version than b.
-// Non-numeric components compare as zero, which is fine for zot's
+// Invalid versions return false so update checks never offer a downgrade.
-// x.y.z-only scheme.
 func versionLess(a, b string) bool {
-	as := splitVersion(a)
+	comparison, err := compareVersions(a, b)
-	bs := splitVersion(b)
+	return err == nil && comparison < 0
-	for i := 0; i < 3; i++ {
-		av, bv := 0, 0
-		if i < len(as) {
-			av = as[i]
-		}
-		if i < len(bs) {
-			bv = bs[i]
-		}
-		if av != bv {
-			return av < bv
-		}
-	}
-	return false
 }
-func splitVersion(s string) []int {
+func compareVersions(a, b string) (int, error) {
-	s = strings.TrimPrefix(s, "v")
+	a = normalizedVersion(a)
-	// Strip build-metadata suffix like "(abc1234, 2026-04-18)".
+	b = normalizedVersion(b)
-	if i := strings.IndexAny(s, " ("); i > 0 {
+	if !semver.IsValid(a) {
-		s = s[:i]
+		return 0, fmt.Errorf("invalid semantic version %q", strings.TrimPrefix(a, "v"))
 	}
-	parts := strings.Split(s, ".")
+	if !semver.IsValid(b) {
-	out := make([]int, 0, len(parts))
+		return 0, fmt.Errorf("invalid semantic version %q", strings.TrimPrefix(b, "v"))
-	for _, p := range parts {
+	}
-		n, _ := strconv.Atoi(p)
+	return semver.Compare(a, b), nil
-		out = append(out, n)
+}
+func normalizedVersion(v string) string {
+	v = versionOnly(v)
+	if !strings.HasPrefix(v, "v") {
+		v = "v" + v
 	}
-	return out
+	return v
 }
 // fetchLatestRelease queries the GitHub API for the latest published

A packages/agent/update_test.go +35 -0

@@ -0,0 +1,35 @@
	1	+	package agent
	2	+
	3	+	import "testing"
	4	+
	5	+	func TestVersionLess(t *testing.T) {
	6	+	pseudo := "0.3.35-0.20260809165004-9e3c28d4b65"
	7	+	cases := []struct {
	8	+	name string
	9	+	a, b string
	10	+	want bool
	11	+	}{
	12	+	{name: "older release", a: "0.3.33", b: "0.3.34", want: true},
	13	+	{name: "newer release", a: "0.3.35", b: "0.3.34", want: false},
	14	+	{name: "pseudo after prior release", a: pseudo, b: "0.3.34", want: false},
	15	+	{name: "pseudo before final release", a: pseudo, b: "0.3.35", want: true},
	16	+	{name: "prior release before pseudo", a: "0.3.34", b: pseudo, want: true},
	17	+	{name: "decorated build", a: "0.3.33 (abc1234, 2026-08-09)", b: "0.3.34", want: true},
	18	+	{name: "invalid current", a: "not-a-version", b: "0.3.34", want: false},
	19	+	}
	20	+	for _, tc := range cases {
	21	+	t.Run(tc.name, func(t *testing.T) {
	22	+	if got := versionLess(tc.a, tc.b); got != tc.want {
	23	+	t.Fatalf("versionLess(%q, %q) = %v, want %v", tc.a, tc.b, got, tc.want)
	24	+	}
	25	+	})
	26	+	}
	27	+	}
	28	+
	29	+	func TestBuildInfoDoesNotOfferPseudoVersionDowngrade(t *testing.T) {
	30	+	current := "0.3.35-0.20260809165004-9e3c28d4b65"
	31	+	info := buildInfo(current, "v0.3.34", "https://example.com/release")
	32	+	if info.Available {
	33	+	t.Fatalf("buildInfo(%q, %q) offered a downgrade", current, info.Latest)
	34	+	}
	35	+	}

@@ -0,0 +1,35 @@
	1	+	package agent
	2	+
	3	+	import "testing"
	4	+
	5	+	func TestVersionLess(t *testing.T) {
	6	+	pseudo := "0.3.35-0.20260809165004-9e3c28d4b65"
	7	+	cases := []struct {
	8	+	name string
	9	+	a, b string
	10	+	want bool
	11	+	}{
	12	+	{name: "older release", a: "0.3.33", b: "0.3.34", want: true},
	13	+	{name: "newer release", a: "0.3.35", b: "0.3.34", want: false},
	14	+	{name: "pseudo after prior release", a: pseudo, b: "0.3.34", want: false},
	15	+	{name: "pseudo before final release", a: pseudo, b: "0.3.35", want: true},
	16	+	{name: "prior release before pseudo", a: "0.3.34", b: pseudo, want: true},
	17	+	{name: "decorated build", a: "0.3.33 (abc1234, 2026-08-09)", b: "0.3.34", want: true},
	18	+	{name: "invalid current", a: "not-a-version", b: "0.3.34", want: false},
	19	+	}
	20	+	for _, tc := range cases {
	21	+	t.Run(tc.name, func(t *testing.T) {
	22	+	if got := versionLess(tc.a, tc.b); got != tc.want {
	23	+	t.Fatalf("versionLess(%q, %q) = %v, want %v", tc.a, tc.b, got, tc.want)
	24	+	}
	25	+	})
	26	+	}
	27	+	}
	28	+
	29	+	func TestBuildInfoDoesNotOfferPseudoVersionDowngrade(t *testing.T) {
	30	+	current := "0.3.35-0.20260809165004-9e3c28d4b65"
	31	+	info := buildInfo(current, "v0.3.34", "https://example.com/release")
	32	+	if info.Available {
	33	+	t.Fatalf("buildInfo(%q, %q) offered a downgrade", current, info.Latest)
	34	+	}
	35	+	}

M packages/agent/zotfile.go +5 -1


@@ -752,7 +752,11 @@ func checkZotfileRequirements(zf zotfileLoaded, version string) error {
752	752		if versionOnly(version) == "0.0.0" {
753	753		return fmt.Errorf("agent requires zot %s or newer; unversioned development builds cannot satisfy min_zot", min)
754	754		}
755		-	if versionLess(version, min) {
	755	+	comparison, err := compareVersions(version, min)
	756	+	if err != nil {
	757	+	return fmt.Errorf("validate min_zot requirement: %w", err)
	758	+	}
	759	+	if comparison < 0 {
756	760		return fmt.Errorf("agent requires zot %s or newer; running %s", min, versionOnly(version))
757	761		}
758	762		}

 		if versionOnly(version) == "0.0.0" {
 			return fmt.Errorf("agent requires zot %s or newer; unversioned development builds cannot satisfy min_zot", min)
 		}
-		if versionLess(version, min) {
+		comparison, err := compareVersions(version, min)
+		if err != nil {
+			return fmt.Errorf("validate min_zot requirement: %w", err)
+		}
+		if comparison < 0 {
 			return fmt.Errorf("agent requires zot %s or newer; running %s", min, versionOnly(version))
 		}
 	}

M packages/agent/zotfile_test.go +8 -0


@@ -223,6 +223,14 @@ func TestCheckZotfileMinVersion(t *testing.T) {
223	223		if err := checkZotfileRequirements(zf, "0.3.0"); err != nil {
224	224		t.Fatalf("minimum version rejected: %v", err)
225	225		}
	226	+	if err := checkZotfileRequirements(zf, "not-a-version"); err == nil {
	227	+	t.Fatal("invalid zot version accepted")
	228	+	}
	229	+
	230	+	zf.Manifest.Runtime.MinZot = "not-a-version"
	231	+	if err := checkZotfileRequirements(zf, "0.3.0"); err == nil {
	232	+	t.Fatal("invalid min_zot requirement accepted")
	233	+	}
226	234		}
227	235
228	236		func TestApplyZotfileModelRequirementsRejectsUnsupportedFields(t *testing.T) {


@@ -223,6 +223,14 @@ func TestCheckZotfileMinVersion(t *testing.T) {
223	if err := checkZotfileRequirements(zf, "0.3.0"); err != nil {	223		if err := checkZotfileRequirements(zf, "0.3.0"); err != nil {
224	t.Fatalf("minimum version rejected: %v", err)	224		t.Fatalf("minimum version rejected: %v", err)
225	}	225		}
		226	+	if err := checkZotfileRequirements(zf, "not-a-version"); err == nil {
		227	+	t.Fatal("invalid zot version accepted")
		228	+	}
		229	+
		230	+	zf.Manifest.Runtime.MinZot = "not-a-version"
		231	+	if err := checkZotfileRequirements(zf, "0.3.0"); err == nil {
		232	+	t.Fatal("invalid min_zot requirement accepted")
		233	+	}
226	}	234		}
227		235
228	func TestApplyZotfileModelRequirementsRejectsUnsupportedFields(t *testing.T) {	236		func TestApplyZotfileModelRequirementsRejectsUnsupportedFields(t *testing.T) {