fix(updates): consume verified release snapshots

Author: mcharles-square

deployment-files/docker-compose.yaml

@@ -16,6 +16,7 @@ services:
       DB_DSN: "${DB_DSN:-}"
       ENCRYPT_SERVICE_MASTER_KEY: "${ENCRYPT_SERVICE_MASTER_KEY}"
       SESSION_COOKIE_SECURE: "${SESSION_COOKIE_SECURE:-true}"
+      UPDATES_GITHUB_TOKEN: "${UPDATES_GITHUB_TOKEN:-}"
       PLUGINS_DIR: "/app/plugins"
       PLUGINS_ENABLED: "true"
       ENABLE_VIRTUAL_MINERS: "${ENABLE_VIRTUAL_MINERS:-false}"

server/cmd/fleetd/main_test.go

@@ -173,6 +173,32 @@ encrypt:
 	require.Equal(t, allowlist, config.Infrastructure.OTControlSubnets)
 }
 
+func TestFleetdUpdatesGitHubTokenEnvironment(t *testing.T) {
+	const token = "release-check-token"
+	t.Setenv("UPDATES_GITHUB_TOKEN", token)
+
+	configPath := writeFleetdConfigFile(t, `
+auth:
+  client:
+    expiration-period: "1h"
+    secret-key: "test-client-secret"
+  miner-token-expiration-period: "30m"
+encrypt:
+  service-master-key: "test-master-key"
+`)
+	config := &Config{}
+	parser, err := kong.New(
+		config,
+		kong.Name("fleetd"),
+		kong.Configuration(kongyaml.Loader, configPath),
+	)
+	require.NoError(t, err)
+
+	_, err = parser.Parse(nil)
+	require.NoError(t, err)
+	require.Equal(t, token, config.Updates.GitHubToken)
+}
+
 func TestFleetdRejectsInvalidInfrastructureOTControlSubnetsBeforeStartup(t *testing.T) {
 	config := &Config{}
 	config.Infrastructure.OTControlSubnets = "sensitive-control-subnet"

server/internal/domain/updates/service.go

@@ -162,11 +162,13 @@ func (s *Service) releaseChannel(ctx context.Context, organizationID int64) (Cha
 // when stable discovery is unavailable, but an incomplete RC view makes that
 // broader channel unavailable.
 func channelStatusAvailable(channel Channel, snap Snapshot) bool {
+	_, stableAvailable := snap.EligibleStable()
+	rc, rcAvailable := snap.EligibleRC()
 	switch channel {
 	case ChannelStable:
-		return snap.StableAvailable
+		return stableAvailable
 	case ChannelStableAndRC:
-		return snap.RCAvailable && (snap.StableAvailable || snap.LatestRC != nil)
+		return rcAvailable && (stableAvailable || rc != nil)
 	default:
 		return false
 	}
@@ -176,13 +178,10 @@ func channelStatusAvailable(channel Channel, snap Snapshot) bool {
 // stable sees the latest available stable; stable_and_rc takes the semver max
 // of that stable and the latest available RC.
 func eligibleCandidate(channel Channel, snap Snapshot) *Release {
-	var candidate *Release
-	if snap.StableAvailable {
-		candidate = snap.LatestStable
-	}
+	candidate, _ := snap.EligibleStable()
 	if channel == ChannelStableAndRC {
-		if snap.RCAvailable {
-			candidate = semverMax(candidate, snap.LatestRC)
+		if rc, available := snap.EligibleRC(); available {
+			candidate = semverMax(candidate, rc)
 		}
 	}
 	return candidate
@@ -201,6 +200,10 @@ func semverMax(a, b *Release) *Release {
 	return a
 }
 
+func isCanonicalReleaseTag(tag string) bool {
+	return isCanonicalStableTag(tag) || isCanonicalRCTag(tag)
+}
+
 // installCommand composes the copy-paste upgrade invocation from two
 // independently constrained values. The configured base must exactly match
 // the trusted Proto Fleet release path, and the GitHub-sourced tag must be