[taliesin-ai]

Damaged staged updates could replace a working application and discard its backup. Validate the payload before every replacement attempt, then validate the installed result while rollback is still available.

Bundle validation follows the destination type even when the staged name lacks .app. Malformed or unreadable Info.plist files are rejected; a readable plist without CFBundleExecutable retains the executable-directory fallback. macOS signature verification and backup restoration retain the original implementation's compatibility with unsigned and linker-signed builds.

Fixes #6351. Supersedes #6352 because neither maintainer account could push to its organisation-owned fork. This carries Julian Storer's implementation plus the fixes for both CodeRabbit findings, with Julian credited in the commit's Co-authored-by trailer.

Validation: go test -race ./pkg/updater passes on Linux, including the restart-ownership fix already merged as #6350. Windows amd64 and macOS arm64 cross-platform vet checks pass. Native macOS codesign and Windows execution were not rerun here.

Summary by CodeRabbit

• Bug Fixes
  • Updates now check that the staged application is valid before replacing the installed one, helping prevent incomplete or damaged updates from disrupting a working installation.
  • The installed application is checked after an update. If validation fails, the updater restores the previous version instead of discarding its backup.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The updater now validates staged payloads before replacement and validates the installed application before removing its backup. Validation failures can trigger a relaunch of the original application or restoration of the backup.

Changes

Updater swap validation

Layer / File(s)	Summary
Payload structure validation v3/pkg/updater/validate.go, v3/pkg/updater/validate_test.go, v3/pkg/updater/helper_test.go	Payload validation rejects empty or unreadable content, symlinks, and invalid .app layouts. Tests cover plist parsing and bundle structure.
Post-swap and signature validation v3/pkg/updater/validate.go, v3/pkg/updater/validate_codesign_test.go, v3/pkg/updater/validate_test.go	Installed applications receive structural and, where applicable, macOS signature checks. Tests cover linker-signed, unsigned, and tampered bundles.
Swap enforcement and recovery v3/pkg/updater/helper.go, v3/pkg/updater/helper_unix.go, v3/pkg/updater/helper_windows.go, v3/pkg/updater/helper_recovery_test.go, v3/pkg/updater/validate_test.go, v3/pkg/updater/validate_unix_test.go, v3/UNRELEASED_CHANGELOG.md	The helper checks the staged payload before replacement and the installed application before backup cleanup. Failed validation can preserve and relaunch the original or restore the backup.

Priority: Not assessed

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant runHelperSwap
  participant validatePayloadForTarget
  participant replaceTarget
  participant validateInstalled
  participant Backup
  runHelperSwap->>validatePayloadForTarget: Check staged payload after parent exits
  runHelperSwap->>replaceTarget: Replace target with staged payload
  replaceTarget->>validatePayloadForTarget: Recheck payload before replacement
  runHelperSwap->>validateInstalled: Check installed application against backup
  validateInstalled->>Backup: Read original application for signature comparison
  runHelperSwap->>Backup: Restore backup if installed validation fails

Loading

Possibly related issues

• [v3] updater: a download during a pending Restart deletes the staged payload, installing an empty app #6349: The post-wait staged-payload validation addresses the reported case where shutdown-time cleanup leaves an empty payload for the helper to install.

Possibly related PRs

• wailsapp/wails#6352: Both changes validate staged payloads during updater swaps; this PR also adds post-swap validation and backup restoration.
• wailsapp/wails#6350: That PR transfers staging ownership to the helper during restart, which relates to this PR’s validation after the parent exits.

Suggested reviewers: leaanthony

Merge Risk: Low · up to 4d35b

A stalled signing command could fail the macOS test run. Bound it before merging, or accept this limited test-workflow risk.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the bundle’s shape,
Before the old app leaves its place.
If checks find trouble in the swap,
The backup bounds back from the gap.
Then off the bunny goes to play.}

_{Comment @coderabbitai help to get the list of available commands.}