release: unify upgrade and release pipeline

deploy/upgrade-agent.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e
+set -euo pipefail
 
 # VPS-Commander Agent 一键安全升级脚本
 # Repo: https://github.com/kyaring/vps-commander
@@ -7,28 +7,19 @@ set -e
 REPO="kyaring/vps-commander"
 INSTALL_DIR="/opt/vps-commander"
 GITHUB_URL="https://github.com"
+API_URL="https://api.github.com"
 
-# 颜色输出
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m'
-
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; NC='\033[0m'
 info() { echo -e "${BLUE}[INFO]${NC} $*"; }
 success() { echo -e "${GREEN}[SUCCESS]${NC} $*"; }
 warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
 
-# 检查 root 权限
 [[ $EUID -ne 0 ]] && error "必须使用 root 权限运行此脚本"
+[ -f "${INSTALL_DIR}/vps-commander-agent" ] || error "未检测到已安装的 Agent (${INSTALL_DIR}/vps-commander-agent)，请先使用 install.sh 完整安装。"
+command -v curl >/dev/null 2>&1 || error "系统缺少 curl"
+command -v sha256sum >/dev/null 2>&1 || error "系统缺少 sha256sum，无法安全校验 Release"
 
-# 检查是否安装过 agent
-if [ ! -f "${INSTALL_DIR}/vps-commander-agent" ]; then
-    error "未检测到已安装的 Agent (${INSTALL_DIR}/vps-commander-agent)，请先使用 install.sh 完整安装。"
-fi
-
-# 架构检测
 ARCH=$(uname -m)
 case "$ARCH" in
     x86_64|amd64) TARGET_ARCH="amd64" ;;
@@ -36,45 +27,48 @@ case "$ARCH" in
     *) error "暂不支持的系统架构: $ARCH" ;;
 esac
 
-info "正在获取最新 Release 版本信息..."
-LATEST_TAG=$(curl -fsSL -k "https://api.github.com/repos/${REPO}/releases/latest" 2>/dev/null | grep '"tag_name":' | head -n1 | sed -E 's/.*"([^"]+)".*/\1/')
-if [ -z "$LATEST_TAG" ]; then
-    warn "无法通过 GitHub API 自动获取 Tag，回退至 v1.1.5"
-    LATEST_TAG="v1.1.5"
-fi
+info "正在获取最新正式 Release 版本信息..."
+LATEST_TAG=$(curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 30 \
+    "${API_URL}/repos/${REPO}/releases/latest" |
+    sed -n 's/^[[:space:]]*"tag_name": "\\([^"]*\\)".*/\\1/p' | head -n1)
+[ -n "$LATEST_TAG" ] || error "无法从 GitHub 获取最新正式 Release，已停止升级；不会回退到旧版本"
 info "目标升级版本: ${LATEST_TAG} (${TARGET_ARCH})"
 
 BIN_NAME="vps-commander-agent-linux-${TARGET_ARCH}"
 DOWNLOAD_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/${BIN_NAME}"
-TMP_BIN="${INSTALL_DIR}/vps-commander-agent.tmp"
+CHECKSUM_URL="${GITHUB_URL}/${REPO}/releases/download/${LATEST_TAG}/checksums.txt"
+TMP_BIN=$(mktemp "${INSTALL_DIR}/vps-commander-agent.tmp.XXXXXX") || error "无法创建临时文件"
+TMP_SUM=$(mktemp "${INSTALL_DIR}/vps-commander-checksums.tmp.XXXXXX") || { rm -f "$TMP_BIN"; error "无法创建校验文件"; }
 BAK_BIN="${INSTALL_DIR}/vps-commander-agent.bak"
+cleanup() { rm -f "$TMP_BIN" "$TMP_SUM"; }
+trap cleanup EXIT
 
 info "正在下载新版本二进制文件..."
-curl -fsSL -k -o "${TMP_BIN}" "${DOWNLOAD_URL}" || error "下载失败，请检查网络或 Release 是否存在"
+curl -fL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 600 -o "$TMP_BIN" "$DOWNLOAD_URL" || error "下载失败: ${DOWNLOAD_URL}"
+[ -s "$TMP_BIN" ] || error "下载结果为空"
 
-# 完整性校验：文件大小不能小于 1MB
-FILE_SIZE=$(stat -c%s "${TMP_BIN}" 2>/dev/null || stat -f%z "${TMP_BIN}" 2>/dev/null || echo 0)
-if [ "$FILE_SIZE" -lt 1000000 ]; then
-    rm -f "${TMP_BIN}"
-    error "下载的文件不完整或损坏 (大小: ${FILE_SIZE} 字节)，已终止升级"
-fi
-
-chmod +x "${TMP_BIN}"
+info "正在校验 SHA256..."
+curl -fsSL --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 60 -o "$TMP_SUM" "$CHECKSUM_URL" || error "无法获取 Release 校验文件"
+EXPECTED=$(awk -v f="$BIN_NAME" '$2 == f {print $1; exit}' "$TMP_SUM")
+[ -n "$EXPECTED" ] || error "Release 校验文件中缺少 ${BIN_NAME}"
+ACTUAL=$(sha256sum "$TMP_BIN" | awk '{print $1}')
+[ "$ACTUAL" = "$EXPECTED" ] || error "SHA256 校验失败: ${BIN_NAME}"
+info "SHA256 校验通过: ${ACTUAL}"
 
+chmod +x "$TMP_BIN"
 info "备份旧版本并原子替换..."
-cp -f "${INSTALL_DIR}/vps-commander-agent" "${BAK_BIN}" 2>/dev/null || true
-mv -f "${TMP_BIN}" "${INSTALL_DIR}/vps-commander-agent"
+cp -f "${INSTALL_DIR}/vps-commander-agent" "$BAK_BIN" 2>/dev/null || true
+mv -f "$TMP_BIN" "${INSTALL_DIR}/vps-commander-agent"
 
 info "重启 vps-commander-agent 服务..."
 systemctl restart vps-commander-agent
 sleep 2
-
 if systemctl is-active --quiet vps-commander-agent; then
-    success "Agent 成功平滑升级至 ${LATEST_TAG} 并已恢复运行！"
-    rm -f "${BAK_BIN}"
+    success "Agent 成功升级至 ${LATEST_TAG}，SHA256 已验证并恢复运行。"
+    rm -f "$BAK_BIN"
 else
     warn "服务启动异常，正在自动回滚原版本..."
-    mv -f "${BAK_BIN}" "${INSTALL_DIR}/vps-commander-agent"
+    mv -f "$BAK_BIN" "${INSTALL_DIR}/vps-commander-agent"
     systemctl restart vps-commander-agent
     error "升级失败，已安全回滚至上一版本，请查看日志: journalctl -u vps-commander-agent -n 20"
 fi