Updates

Settings → Updates shows when a new release is out; Update installs it. Over SSH:

sudo /opt/hakobu/hakobu update

Apps keep running; the panel is down for the minute it restarts. If the new version doesn't come up, the previous one is put back by itself, and Roll back in the same place (or sudo /opt/hakobu/hakobu rollback) goes back to it later. A rollback past an update that changed the panel's database also puts back the copy of the database made just before it (what changed in the panel since is lost; the newer database is kept beside it).

A panel installed before v0.24.0 can't update to it or later: their databases have nothing in common. It refuses to start, and the update puts the old version back by itself. Install anew.

Signed releases

Releases are signed with an Ed25519 key that never leaves the release workflow: hakobu and install.sh install a release only if its signature over hakobu <version> and its checksums is by that key, so neither a tampered download nor an older release under a newer name gets in.

The panel can't update itself: it runs as hakobu, which can't write its own program, and only asks; a root service (hakobu-update.path, hakobu-rollback.path) then installs the latest signed release or puts back the one from before the last update, whatever the request said. Installing any other version takes sudo /opt/hakobu/hakobu update --to vX.Y.Z.