Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

fix: pin installed version instead of clearing on install

Browse source 
After successful install (confirm_dependencies or capability receipt),
pin the installed version as selected_version instead of clearing it.
This prevents subsequent scans from silently advancing to a newer
unapproved version. The pin is the enforcement mechanism.
This commit is contained in:
Fimeg 2026-06-08 16:07:33 -04:00
commit b0e2a77528
1 changed files with 18 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

22
server/internal/api/handlers/updates.go
View file

@ -1414,9 +1414,16 @@ func (h *UpdateHandler) ReportLog(c *gin.Context) {
} else {
log.Printf("[INFO] [server] [updates] confirm_dependencies_status_updated package=%s type=%s status=%s",
packageName, packageType, models.StatusInstalled)
// Clear any pinned version so subsequent scans pick up the latest available
// Pin the installed version so subsequent scans don't
// silently advance to a newer unapproved version.
if upd, lookupErr := h.updateQueries.GetUpdateByPackage(agentID, packageType, packageName); lookupErr == nil {
_ = h.updateQueries.ClearTargetVersion(upd.ID)
installedVersion := upd.AvailableVersion
if upd.SelectedVersion != nil && *upd.SelectedVersion != "" {
installedVersion = *upd.SelectedVersion
}
if installedVersion != "" {
_ = h.updateQueries.SetTargetVersion(upd.ID, installedVersion)
}
}
}
}
@ -3009,9 +3016,16 @@ func (h *UpdateHandler) ReportCapabilityResult(c *gin.Context) {
} else {
log.Printf("[INFO] [server] [capability] receipt_status_updated token_id=%s update_id=%s status=%s",
tokenID, updateID, status)
// Clear any pinned version on successful install
// Pin the installed version so subsequent scans don't
// silently advance to a newer unapproved version.
if status == models.StatusInstalled {
_ = h.updateQueries.ClearTargetVersion(updateID)
installedVersion := update.AvailableVersion
if update.SelectedVersion != nil && *update.SelectedVersion != "" {
installedVersion = *update.SelectedVersion
}
if installedVersion != "" {
_ = h.updateQueries.SetTargetVersion(updateID, installedVersion)
}
}
}
}