feat: establish secure update foundation

internal/buildinfo/version.go

@@ -1,5 +1,21 @@
 package buildinfo
 
+const (
+	// UpdateProtocolVersion is returned by the privileged update agent. Version
+	// 2 requires the running version so the agent can verify it independently.
+	UpdateProtocolVersion = 2
+
+	// The contracts below are deliberately stable across normal releases. A
+	// breaking container or database change must use a new contract and cannot
+	// be installed through the unattended update path.
+	RuntimeContractVersion  = 2
+	DatabaseContractVersion = 1
+	CurrentSchemaVersion    = 11
+	MinimumUpdateVersion    = "v1.4.0"
+	MinimumAgentVersion     = "v1.4.0"
+	MinimumAgentProtocol    = 2
+)
+
 // Version is replaced through -ldflags for release images. The source fallback
 // keeps local builds and tests honest about the currently checked-out release.
-var Version = "v1.3.0"
+var Version = "v1.4.0"

internal/buildinfo/version_test.go

@@ -0,0 +1,50 @@
+package buildinfo
+
+import (
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func TestDockerfileMetadataMatchesRuntimeContracts(t *testing.T) {
+	t.Parallel()
+	content, err := os.ReadFile("../../Dockerfile")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dockerfile := string(content)
+	wanted := []string{
+		"ARG VERSION=" + Version,
+		"ARG MINIMUM_UPDATE_VERSION=" + MinimumUpdateVersion,
+		"ARG MINIMUM_AGENT_PROTOCOL=" + strconv.Itoa(MinimumAgentProtocol),
+		"ARG RUNTIME_CONTRACT_VERSION=" + strconv.Itoa(RuntimeContractVersion),
+		"ARG DATABASE_CONTRACT_VERSION=" + strconv.Itoa(DatabaseContractVersion),
+		"ARG SCHEMA_VERSION=" + strconv.Itoa(CurrentSchemaVersion),
+	}
+	for _, line := range wanted {
+		if !strings.Contains(dockerfile, line+"\n") {
+			t.Errorf("Dockerfile is missing %q", line)
+		}
+	}
+	versionLinkerFlag := "-X github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/buildinfo.Version=${VERSION}"
+	if count := strings.Count(dockerfile, versionLinkerFlag); count != 1 {
+		t.Fatalf("release version must be linked into the control binary, found %d flags", count)
+	}
+	if !strings.Contains(dockerfile, "ln -s domain-control /usr/local/bin/update-agent") {
+		t.Fatal("Dockerfile is missing the v1.3 Compose compatibility symlink")
+	}
+	for path, marker := range map[string]string{
+		"../../compose.yml": "domain-control-webinterface-prod:" + Version,
+		"../../README.md":   "domain-control-webinterface-prod:" + Version,
+		"../../UPDATE.md":   "Compose-Version ist `" + Version + "`",
+	} {
+		data, readErr := os.ReadFile(path)
+		if readErr != nil {
+			t.Fatal(readErr)
+		}
+		if !strings.Contains(string(data), marker) {
+			t.Errorf("%s is not synchronized with %s", path, Version)
+		}
+	}
+}