fix: stabilize software updates

internal/updateagent/controller.go

@@ -69,7 +69,6 @@ func (c *Controller) updateHandler(w http.ResponseWriter, r *http.Request) {
 	request.Version = strings.TrimSpace(request.Version)
 	request.CurrentVersion = strings.TrimSpace(request.CurrentVersion)
 	request.RegistryUsername = strings.TrimSpace(request.RegistryUsername)
-	request.RegistryToken = strings.TrimSpace(request.RegistryToken)
 	if !updateprotocol.ValidVersion(request.Version) || !updateprotocol.ValidVersion(request.CurrentVersion) || request.RegistryUsername == "" || len(request.RegistryUsername) > 128 || len(request.RegistryToken) < 8 || len(request.RegistryToken) > 1024 {
 		http.Error(w, "invalid update request", http.StatusBadRequest)
 		return
@@ -99,12 +98,12 @@ func (c *Controller) run(request updateprotocol.Request) {
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
 	defer cancel()
 	err := c.runner.Update(ctx, request, c.setPhase)
-	registryToken := request.RegistryToken
+	registryCredential := request.RegistryToken
 	request.RegistryToken = ""
 	if err != nil {
 		message := publicAgentError(err)
 		c.setPhase(updateprotocol.PhaseFailed, message)
-		c.logger.Error("software update failed", "version", request.Version, "error", redactSecret(err, registryToken))
+		c.logger.Error("software update failed", "version", request.Version, "error", redactSecret(err, registryCredential))
 		return
 	}
 	c.setPhase(updateprotocol.PhaseComplete, "Update erfolgreich installiert")

internal/updateagent/controller_test.go

@@ -67,7 +67,7 @@ func TestControllerValidatesRequestsAndRunsOnlyOneUpdate(t *testing.T) {
 		t.Fatalf("request without current version accepted: status=%d", missingCurrent.Code)
 	}
 
-	const secret = "registry-token-must-not-leak"
+	const secret = " registry-password-must-not-be-trimmed "
 	body := []byte(`{"version":"v2.0.0","current_version":"v1.4.0","registry_username":"user","registry_token":"` + secret + `"}`)
 	accepted := httptest.NewRecorder()
 	handler.ServeHTTP(accepted, httptest.NewRequest(http.MethodPost, "/v1/update", bytes.NewReader(body)))

internal/updateagent/docker.go

@@ -304,8 +304,8 @@ func (c *dockerClient) findTarget(ctx context.Context, label string) (containerS
 	return running[0], nil
 }
 
-func (c *dockerClient) pullImage(ctx context.Context, repository, tag, username, token string) error {
-	authJSON, _ := json.Marshal(map[string]string{"username": username, "password": token, "serveraddress": strings.Split(repository, "/")[0]})
+func (c *dockerClient) pullImage(ctx context.Context, repository, tag, username, credential string) error {
+	authJSON, _ := json.Marshal(map[string]string{"username": username, "password": credential, "serveraddress": strings.Split(repository, "/")[0]})
 	headers := http.Header{"X-Registry-Auth": {base64.URLEncoding.EncodeToString(authJSON)}}
 	query := url.Values{"fromImage": {repository}, "tag": {tag}}
 	response, err := c.request(ctx, http.MethodPost, "/images/create?"+query.Encode(), nil, headers, true)