tailscale

Commit Graph

Author	SHA1	Message	Date
David Crawshaw	47ffbffa97	clientupdate: add root key (#9364 ) Signed-off-by: David Crawshaw <crawshaw@tailscale.com>	1 year ago
Andrew Lytvynov	c0ade132e6	clientupdate: restart tailscale after install on DSM6 (#9363 ) DSM6 does not automatically restart packages on install, we have to do it explicitly. Also, DSM6 has a filter for publishers in Package Center. Make the error message more helpful when update fails because of this filter not allowing our package. Fixes #9361 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	1073b56e18	ipn/ipnlocal: add logging and locking to c2n /update (#9290 ) Log some progress info to make updates more debuggable. Also, track whether an active update is already started and return an error if a concurrent update is attempted. Some planned future PRs: * add JSON output to `tailscale update` * use JSON output from `tailscale update` to provide a more detailed status of in-progress update (stage, download progress, etc) Updates #6907 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Aaron Klotz	7686ff6c46	Update clientupdate/distsign/distsign_test.go Co-authored-by: Andrew Lytvynov <awly@tailscale.com> Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
Aaron Klotz	7d60c19d7d	clientupdate/distsign: add ability to validate a binary that is already located on disk Our build system caches files locally and only updates them when something changes. Since I need to integrate some distsign stuff into the build system to validate our Windows 7 MSIs, I want to be able to check the cached copy of a package before downloading a fresh copy from pkgs. If the signature changes, then obviously the local copy is outdated and we return an error, at which point we call Download to refresh the package. Updates https://github.com/tailscale/corp/issues/14334 Signed-off-by: Aaron Klotz <aaron@tailscale.com>	1 year ago
Craig Rodrigues	8683ce78c2	client/web, clientupdate, util/linuxfw, wgengine/magicsock: Use %v verb for errors Replace %w verb with %v verb when logging errors. Use %w only for wrapping errors with fmt.Errorf() Fixes: #9213 Signed-off-by: Craig Rodrigues <rodrigc@crodrigues.org>	1 year ago
Andrew Lytvynov	4e72992900	clientupdate: add linux tarball updates (#9144 ) As a fallback to package managers, allow updating tailscale that was self-installed in some way. There are some tricky bits around updating the systemd unit (should we stick to local binary paths or to the ones in tailscaled.service?), so leaving that out for now. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Chris Palmer	ce1e02096a	ipn/ipnlocal: support most Linuxes in handleC2NUpdate (#9114 ) * ipn/ipnlocal: support most Linuxes in handleC2NUpdate Updates #6995 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	1 year ago
Andrew Lytvynov	abfe5d3879	clientupdate: detect when tailscale is installed without package manager (#9137 ) On linux users can install Tailscale via package managers or direct tarball downloads. Detect when Tailscale is not installed via a package manager so we can pick the correct update mechanism. Leave the tarball update function unimplemented for now (coming in next PR!). Updates #6995 Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	67e48d9285	clientupdate: use SPKsVersion instead of Version (#9118 ) Top-level Version in pkgs response is not always in sync with SPK versions, especially on unstable track. It's very confusing when the confirmation prompt asks you "update to 1.49.x?" and you end up updating to 1.49.y. Instead, grab the SPK-specific version field. Updates #cleanup. Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	8d2eaa1956	clientupdate: download SPK and MSI packages with distsign (#9115 ) Reimplement `downloadURLToFile` using `distsign.Download` and move all of the progress reporting logic over there. Updates #6995 Updates #755 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	18d9c92342	release/dist/cli: add verify-package-signature command (#9110 ) Helper command to verify package signatures, mainly for debugging. Also fix a copy-paste mistake in error message in distsign. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	de9ba1c621	clientupdate/distsign/roots: add temporary dev root key (#9080 ) Adding a root key that signs the current signing key on pkgs.tailscale.com. This key is here purely for development and should be replaced before 1.50 release. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	3b7ebeba2e	clientupdate: remove Arch support (#9081 ) An Arch Linux maintainer asked us to not implement "tailscale update" on Arch-based distros: https://github.com/tailscale/tailscale/issues/6995#issuecomment-1687080106 Return an error to the user if they try to run "tailscale update". Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	d45af7c66f	release/dist/cli: add sign-key and verify-key-signature commands (#9041 ) Now we have all the commands to generate the key hierarchy and verify that signing keys were signed correctly: ``` $ ./tool/go run ./cmd/dist gen-key --priv-path root-priv.pem --pub-path root-pub.pem --root wrote private key to root-priv.pem wrote public key to root-pub.pem $ ./tool/go run ./cmd/dist gen-key --priv-path signing-priv.pem --pub-path signing-pub.pem --signing wrote private key to signing-priv.pem wrote public key to signing-pub.pem $ ./tool/go run ./cmd/dist sign-key --root-priv-path root-priv.pem --sign-pub-path signing-pub.pem wrote signature to signature.bin $ ./tool/go run ./cmd/dist verify-key-signature --root-pub-path root-pub.pem --sign-pub-path signing-pub.pem --sig-path signature.bin signature ok ``` Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	f61dd12f05	clientupdate/distsign: use distinct PEM types for root/signing keys (#9045 ) To make key management less error-prone, use different PEM block types for root and signing keys. As a result, separate out most of the Go code between root/signing keys too. Updates #8760 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	7364c6beec	clientupdate/distsign: add new library for package signing/verification (#8943 ) This library is intended for use during release to sign packages which are then served from pkgs.tailscale.com. The library is also then used by clients downloading packages for `tailscale update` where OS package managers / app stores aren't used. Updates https://github.com/tailscale/tailscale/issues/8760 Updates https://github.com/tailscale/tailscale/issues/6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	86ad1ea60e	clientupdate: parse /etc/synoinfo.conf to get CPU arch (#8940 ) The hardware version in `/proc/sys/kernel/syno_hw_version` does not map exactly to versions in https://github.com/SynoCommunity/spksrc/wiki/Synology-and-SynoCommunity-Package-Architectures. It contains some slightly different version formats. Instead, `/etc/synoinfo.conf` exists and contains a `unique` line with the CPU architecture encoded. Parse that out and filter through the list of architectures that we have SPKs for. Tested on DS218 and DS413j. Updates #8927 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Chris Palmer	37c0b9be63	clientupdate: return NOTREACHED for macsys (#8898 ) * clientupdate: return NOTREACHED for macsys The work is done in Swift; this is now a documentation placeholder. Updates #6995 Signed-off-by: Chris Palmer <cpalmer@tailscale.com>	1 year ago
Andrew Lytvynov	c40d095c35	clientupdate: implement updates for Synology (#8858 ) Implement naive update for Synology packages, using latest versions from pkgs.tailscale.com. This is naive because we completely trust pkgs.tailscale.com to give us a safe package. We should switch this to some better signing mechanism later. I've only tested this on one DS218 box, so all the CPU architecture munging is purely based on docs. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago
Andrew Lytvynov	215480a022	cmd/tailscale/cli,clientupdate: extract new clientupdate package (#8827 ) Extract the self-update logic from cmd/tailscale/cli into a standalone package that could be used from tailscaled later. Updates #6995 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	1 year ago

21 Commits (85155ddaf311ea9cffbdf0de495e3794f5e89526)