Self-Updater

Supported versions are in the security policy: https://github.com/VectoDE/Self-Updater/blob/main/.github/SECURITY.md#supported-versions . Upgrading from self-updater 1.x-3.x is described in the README, and self-updater migrate converts old configuration files: https://github.com/VectoDE/Self-Updater/blob/main/README.md#upgrading-from-self-updater-1x-to-3x

https://github.com/VectoDE/Self-Updater/issues

Reporters are credited in the advisory and the changelog: https://github.com/VectoDE/Self-Updater/blob/main/.github/SECURITY.md#what-happens-next

https://github.com/VectoDE/Self-Updater/blob/main/.github/SECURITY.md#what-happens-next

Documented in https://github.com/VectoDE/Self-Updater/blob/main/.github/CONTRIBUTING.md#coding-standards

CI enforces TypeScript strict mode, typescript-eslint strictTypeChecked and stylisticTypeChecked, sonarjs and Prettier with zero warnings allowed.

No native code is compiled.

The library build emits source maps next to the bundles, and the CLI bundle is not minified, so debugging information is kept.

No make-style build; npm scripts call tsdown directly.

Builds use the committed package-lock.json with npm ci, exact development dependency versions and the Node version from .nvmrc; the container build pins base images by digest and the Compose modules through go.sum. Release builds run in GitHub Actions from the release commit.

npm install --global @vectode/self-updater, or the container image ghcr.io/vectode/self-updater for linux/amd64 and linux/arm64. https://github.com/VectoDE/Self-Updater/blob/main/README.md#install

Installed through npm or as a container image; no install script or file layout of its own.

git clone, npm ci, npm test. https://github.com/VectoDE/Self-Updater/blob/main/.github/CONTRIBUTING.md#setup

Dependabot version and security updates cover npm, GitHub Actions, the Docker base images and the Go module of the Compose build. OSV-Scanner checks package-lock.json and docker/compose/go.mod daily and on every pull request, CI scans the built container image with OSV-Scanner and govulncheck, and npm audit and GitHub dependency review run on every pull request.

Reused components are npm packages, Docker base images and Go modules, all updated through Dependabot and the lockfiles.

Uses current Node.js 22+ APIs (node:crypto, node:http, fetch) and current Git commands; no deprecated interfaces.

CI builds the package, runs the built CLI (init, validate, update --dry-run), installs the packed tarball in a fresh project, loads the configuration entry on Deno and Bun, and builds the container image and checks that it runs as a non-root user with git and docker compose. https://github.com/VectoDE/Self-Updater/actions/workflows/ci.yml

The bug fixes of the last six months came with tests: the log redaction fix (99d486c) added regression tests, and the fixes to the container build are checked by the "Container image" CI job, which builds the image and runs git and docker compose in it.

About 98 % statement coverage, enforced by thresholds in vitest.config.ts.

The contributing guide requires tests for new behaviour and a test that fails without the fix for every bug fix, and the pull request template asks for it. https://github.com/VectoDE/Self-Updater/blob/main/.github/CONTRIBUTING.md#making-a-change

https://github.com/VectoDE/Self-Updater/blob/main/.github/CONTRIBUTING.md#making-a-change

Maximal strictness, zero warnings allowed.

Secure design principles are applied as described in https://github.com/VectoDE/Self-Updater/blob/main/docs/ASSURANCE.md#secure-design-principles

By default nothing depends on weak algorithms: the only algorithm the software uses itself is HMAC-SHA256. Commit and tag signature checks (off by default) are done by Git and cover Git object ids, whose hash algorithm (SHA-1 with collision detection or SHA-256) is a property of the deployed repository.

The software implements no algorithms. The webhook algorithm is fixed by GitHub's protocol (X-Hub-Signature-256) and lives in one function in src/webhook.ts; signature algorithms are those of Git, OpenSSH and GnuPG and follow their configuration.

The access token, webhook secret and notification URLs are referenced in the configuration as ${NAME} and read from the environment or a separate .env file, so they are kept apart from the configuration and can be changed without rebuilding. They never reach logs, .git/config or the state file.

Outgoing connections support HTTPS (provider API, Git, notifications) and SSH (Git). Plain http:// or git:// is only used when the operator configures such a URL. The webhook receiver speaks plain HTTP, is off by default and listens on 127.0.0.1 by default; it is meant to sit behind a reverse proxy that terminates TLS, as the README describes, and every delivery is authenticated with HMAC-SHA256 or the GitLab token.

TLS is provided by Node.js and Git (libcurl), which use TLS 1.2 or later by default; the software does not change the TLS versions.

Node.js and Git verify TLS certificates by default, and the software never turns verification off (no rejectUnauthorized, NODE_TLS_REJECT_UNAUTHORIZED or http.sslVerify settings anywhere in the code).

The access token is only sent over connections whose certificate Node.js or Git has verified during the TLS handshake, before any HTTP header is sent. Git gets it as an http.<origin>.extraHeader scoped to the repository origin, so it goes nowhere else.

From 4.0.0 on, the release workflow publishes npm versions with signed SLSA provenance (Trusted Publishing), GitHub releases with the tarball, its signed build attestation (.intoto.jsonl) and a CycloneDX SBOM, and the container image ghcr.io/vectode/self-updater with a signed build attestation. Verification is documented in https://github.com/VectoDE/Self-Updater/blob/main/.github/SECURITY.md#verifying-a-release . The old package self-updater (3.0.0 and older) was published by hand without provenance.

From v4.0.0 on, the release workflow signs every release commit and version tag with an SSH key kept only in the GitHub environment "release", which only main can use; the workflow verifies the tag before pushing it, and GitHub shows it as verified. Public key in .github/allowed_signers; verification in https://github.com/VectoDE/Self-Updater/blob/main/.github/SECURITY.md#verifying-a-release . The older tags v1.0.0, v1.0.1 and 1.0.2 are unsigned historical tags.

The configuration is validated completely before anything runs (src/config/schema.ts), with strict patterns for branch, remote and service names and URL checks. Webhook deliveries are limited to 1 MB and authenticated before parsing, provider API answers are accepted only if they are a commit id, and refs reach Git only after -- or as full refspecs.

No runtime dependencies; Git and built-in restarts run without a shell; the webhook receiver is off by default, listens on 127.0.0.1 by default and refuses to start without a secret; the systemd example runs as an unprivileged user with systemd sandboxing, and the container image runs as the non-root node user. CI and release runners use step-security/harden-runner, actions and base images are pinned by SHA or digest, and tokens are least privilege.

Threat model, trust boundaries, secure design principles and countered weaknesses: https://github.com/VectoDE/Self-Updater/blob/main/docs/ASSURANCE.md

CodeQL with the security-extended query suite.

Written in a memory-safe language.