fix(updater): re-prove the retained Linux package before a privileged retry

[OrcaWin]

Found by the v1.4.167..v1.4.168-rc.1 production release scan.

The defect

The Linux package recovery card (#12183) offers three actions. Copy Install Command and Show Package both call validateTrackedArtifact() and re-hash the retained .deb/.rpm. Try Automatic Install Again — the one that actually runs a package manager as root — called quitAndInstall() with no re-verification at all.

The cached path is user-writable ($XDG_CACHE_HOME/~/.cache/orca-updater/pending/). electron-updater's DebUpdater runs ["dpkg","-i",installerPath] through runCommandWithSudoIfNeeded. So the digest proven when the recovery card rendered said nothing about the bytes a root package manager would read minutes later, after a failed escalation left the card on screen.

Scope, stated honestly

The privileged-install primitive is not new — v1.4.167 already invoked the same electron-updater path, so this is not a regression introduced by 1.4.168. What #12183 added is a long-lived retry affordance that widens the window, plus a copy-command path that did not exist before.

This change narrows the window; it does not close it. A same-UID attacker can still race between the hash and dpkg -i. Closing it properly needs an immutable handoff — installing from a held descriptor or a root-owned copy — which is a larger change and deliberately out of scope here.

The fix

Re-hash the artifact immediately before the install and ahead of any destructive quit prep, so a replaced or vanished package aborts with copy telling the user to download again, instead of being installed as root. The check runs only on the recovery retry path, where the user has already had one failure.

Also

Fixes a macOS-only failure this suite gained from the platform-conditional pre-commit copy: updater.test.ts hardcoded the non-Darwin string, so the unit suite was red on any Mac. The sibling block already had the platform guard.

Verification

New test drives a real staged package in a real temp cache through the real validator: install fails, a local process swaps the file, the retry aborts — no PTY kill, no quit, correct error status and lifecycle event. The existing retry test now also runs against a genuinely valid artifact rather than a path that never existed. src/main/updater.test.ts 109/109 on macOS; updater/window/preload suites 363 passing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a935943-f23a-498d-831e-3e1ed4720e11

📥 Commits

Reviewing files that changed from the base of the PR and between f657a51 and ef447a5.

📒 Files selected for processing (4)

• src/main/updater.test.ts
• src/main/updater.ts
• src/preload/renderer-restart-wiring.test.ts
• src/preload/renderer-restart-wiring.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/main/updater.ts

---

📝 Walkthrough

Walkthrough

Linux package installation now performs fresh retained-package digest validation before teardown and native installation. The updater blocks overlapping install requests, handles missing or changed artifacts, records diagnostics, and preserves recovery state for transient failures. Tests cover validation concurrency, staged Debian and RPM packages, digest failures, installation failures, retries, and lifecycle outcomes. The recovery card shows checking progress during automatic retries, and preload wiring relays aborted installations.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the defect, scope, fix, and verification, but it omits several required template sections and checklist details.	Add the required Screenshots, Testing, AI Review Report, Security Audit, and Notes sections with checklist status and cross-platform review details.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: revalidating retained Linux packages before privileged retry installation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[OrcaWin]

Addressed the review findings in f657a51.

#1 stale abort clobbers a newer cycle (fixed). The abort now captures an install-cycle signature before hashing and drops its status if the cycle changed — the same protection failLinuxPackageRecovery had. The artifact is still cleared, but only when it is identity-identical to the one that failed, so a download that landed during the hash is not destroyed. Test: drops an abort verdict once a newer check replaced the card (Check for Updates lands mid-hash; the available card survives and the install is still abandoned).

#2 read-failed copy and card teardown (fixed). Both messages are gone; the abort now reuses LINUX_PACKAGE_RECOVERY_MESSAGES, so read-failed reads "Orca could not read the downloaded package…" and not-regular keeps its own copy. Reasons outside RECOVERY_CLEARING_REASONS keep recovery on the status, so the card and its Copy/Show actions survive a transient I/O blip. It still fails closed — root can read a file we cannot, so chmod 000 on a swapped package would otherwise be a one-line bypass. Test: keeps the recovery card usable when the re-proof cannot read the package.

#3 primary "Restart to Update" path unprotected (fixed). The re-proof moved into performQuitAndInstall, keyed on getTrackedLinuxPackageArtifact() instead of the recovery status, so the long-window primary install is covered too. It is skipped when the retained artifact belongs to a different version than the pending install, and a synchronous artifact check keeps every non-Linux install on its exact previous timing. Tests: aborts the first install when the downloaded package was swapped, installs normally when the retained package still matches its digest.

#4 wedge on rejection (fixed). The re-proof owns a flag cleared in finally, a rejection is recorded and fails closed as read-failed, and the timer callback is back to plain void performQuitAndInstall(). The new flag also joins the quitAndInstall() guard so a second click during the hash cannot schedule a parallel install. Tests: stays installable after a re-proof that rejects outright, ignores a second install request while the digest re-proof runs. (This was live, not latent: the PR as pushed left updater-linux-package-recovery-actions.test.ts red with exactly that wedge because the module mock lacked the new export.)

#5 in-flight reuse (fixed). revalidateLinuxPackageForInstall takes { fresh: true } and never joins a hash that started before the click; a later Copy click can still join it. Tests in linux-package-update-recovery.test.ts assert the pass counts both ways.

#6 retry affordance (fixed). The retry action gained pendingLabel/isPending, matching Copy and Show.

Test fixtures: the whole Linux block now stages real packages in a real updater cache, so a path that never existed would abort every install rather than silently pass.

Verified: 115/115 updater.test.ts, 311/311 across updater/recovery/card suites, plus full src/main (only an unrelated pty-subprocess timeout under parallel load, green in isolation). tsc node clean; web clean apart from pre-existing TS6307. Every finding's test was confirmed to fail with only its source change reverted.

[coderabbitai]

🧹 Nitpick comments (1)

src/main/updater.test.ts (1)

3914-3918: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Reuse one constant for the pre-commit failure message.

The same platform-conditional literal exists at lines 1832-1835. Two copies must stay in sync with getPreCommitInstallFailureMessage in src/main/updater.ts. Move PRE_COMMIT_FAILURE_MESSAGE to module scope and use it in both places.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 48e46916-2c03-4778-9908-51e2538cd5ee

📥 Commits

Reviewing files that changed from the base of the PR and between a69ca6d and f657a51.

📒 Files selected for processing (7)

• src/main/linux-package-update-recovery.test.ts
• src/main/linux-package-update-recovery.ts
• src/main/updater-linux-package-recovery-actions.test.ts
• src/main/updater.test.ts
• src/main/updater.ts
• src/renderer/src/components/LinuxPackageInstallRecoveryCard.test.tsx
• src/renderer/src/components/LinuxPackageInstallRecoveryCard.tsx

[OrcaWin]

Round-2 finding #1 (should-fix, updater.ts:1906) — fixed in ef447a5.

Verified the claim first. Confirmed the stale-cycle branch in reportLinuxPackageRevalidationFailure returns before any sendInstallFailureStatus, and that createUpdaterQuitAbortRelay.handleStatus only calls abort() on status.state === 'error' — so that branch abandoned the install while leaving the renderer permanently restart-prepared (intentionalAppRestartInProgress stuck true → Terminal.tsx/Settings.tsx skip their dirty-buffer prompts, shutdownCheckpoint stays deduped).

Fix (4 lines of source): push the abandon from performQuitAndInstall's single return false site, so it can't depend on what the reporter decides about the status text, and relay it to the relay's existing abort():

if (getTrackedLinuxPackageArtifact() && !(await proveRetainedLinuxPackage(pendingVersion))) {
  mainWindowRef?.webContents.send('updater:quitAndInstallAborted')
  return
}

Deliberately not done: no new retry/timeout/reorder machinery, no relaxing of the cycle guard (the stale status stays withheld — the round-1 clobber fix is untouched), no new abort trigger in the relay's status handling (broadening it to non-error states would spuriously abort a legit install when a background nudge check pushes checking mid-quit). abort() is already a no-op unless the renderer armed a restart, so the push is inert on every other path.

Tests (all fail with only the source reverted, verified by patch-revert):

• drops an abort verdict once a newer check replaced the card — now also asserts the abort push (the exact case the reviewer proved emitted nothing).
• aborts the first install when the downloaded package was swapped — asserts the push, pinning the structural placement at the abandon site.
• installs normally when the retained package still matches its digest — asserts the push is absent, so a committed install can't have its restart flag cleared mid-quit.
• renderer restart wiring — covers the new channel end-to-end to relay.abort().

Verification: 236/236 across the 7 touched suites, 155/155 across adjacent updater/UpdateCard/beforeunload suites, both tsconfigs clean, oxlint + oxfmt clean, check-changed-code-quality.mjs passes (0 new findings incl. react-doctor). Original defect still fixed — the full updater.test.ts Linux block, including the swapped-package aborts, still passes.