update.rs

`crates/veilvoice-setup/src/update.rs`

veilvoice-setup · 581 lines · read the source here · or on GitHub

Ask, only when told to, whether a newer VeilVoice release exists.

What this is, and the claim it changes

Until this crate existed, VeilVoice's front page said "no telemetry, no update check". Half of that is unchanged and half of it is not, and the wording moved in the same commit as the code rather than afterwards:

No telemetry. Unchanged, and nothing here sends anything about you. The request is a plain GET of a public URL that anybody can open in a browser; it carries no identifier, no configuration and no counter.
**No automatic update check.** Nothing runs on a timer, at startup, or in the background. check runs because a person pressed a button in this run of the program, and it does nothing else ever.

An update checker that runs by itself is a beacon: it tells a server that this machine has VeilVoice on it, roughly how often it is used, and from which address. That is the thing being refused. A button somebody presses, once, when they want to know, is a different act with different consequences, and it is the only one on offer.

There is still no HTTP client in the dependency graph

This crate has no dependencies. It runs the transfer tool the operating system already ships, exactly as veilvoice-verify has fetched releases since it existed, and reads its output. cargo tree shows no reqwest, no hyper, no ureq; the CI job that fails the build if one appears is unchanged and still passes.

The tool is found at an absolute path, never by bare name. Resolving a program by name on Windows searches the current directory before most of PATH, so a file called curl.exe sitting beside the program would be run instead of the system one. That is finding F-13, and it does not get to happen twice.

What it will not do

It does not download a release, it does not install anything, and it does not restart the program. It reports a version string and leaves every decision to the reader. Downloading a release and checking its signature is veilvoice-verify's job, and that is a separate, deliberate act too.

An update checker that could install its own answer is an update checker that can be made to install somebody else's.

What a "newer version" is worth here

The answer comes from a public web page over TLS. That is enough to say "there is probably something newer, go and look" and it is not enough to act on: a name in a document is not a signature. Nothing in this crate verifies anything, and Report::caveat says so in the words the user sees rather than only in this comment.

In plain words

This is the "check for updates" button, and nothing else.

It runs when you press it and at no other time. There is no timer and nothing in the background, because a program that checks by itself is telling somebody else's computer that yours exists and how often you use it.

It reads a public page anybody can open, tells you the newest version number, and stops there. It does not download anything and it does not install anything.

WHAT THIS FILE CONTAINS

581 lines defining 8 functions (4 public), 4 types and 8 constants. Everything below is read out of the source, so it cannot disagree with the code.

The types it owns.

enum Verdict line 93 · How this build's version compares with the newest published one.
struct Report line 110 · What a check found.
enum Error line 134 · Why a check could not be completed.
struct Tool line 269 · Where a transfer tool was found, and how to drive it.

What happens when it runs. These are the ways in: public, and nothing else in this file calls them, so they are what an outside caller reaches first.

Report::caveat line 125 · What this answer is worth, in the words the user should see.
check line 171 · Ask whether anything newer than current has been published.
reaches fetch, find_tool, report, tag_in, parse

WHAT CALLS WHAT

The functions this file defines, and the calls between them. An edge means the callee's name appears, called, inside the caller's body. This is a syntactic reading, not a type-resolved one.

The same graph as Mermaid source

%%{init: {"theme":"base","themeVariables":{"background":"#1a1b26","primaryColor":"#1f2335","primaryTextColor":"#c0caf5","primaryBorderColor":"#7aa2f7","secondaryColor":"#16161e","tertiaryColor":"#16161e","lineColor":"#737aa2","textColor":"#c0caf5","mainBkg":"#1f2335","nodeBorder":"#7aa2f7","clusterBkg":"#16161e","clusterBorder":"#2f3549","fontFamily":"ui-monospace, SFMono-Regular, Consolas, monospace","fontSize":"14px"}}}%%
flowchart TD
    n_caveat(["Report::caveat<br/>line 125"])
    n_fmt["Error::fmt<br/>line 144"]
    n_check(["check<br/>line 171"])
    n_report["report<br/>line 182"]
    n_parse["parse<br/>line 208"]
    n_tag_in["tag_in<br/>line 243"]
    n_find_tool["find_tool<br/>line 275"]
    n_fetch["fetch<br/>line 313"]
    n_check --> n_fetch
    n_check --> n_find_tool
    n_check --> n_report
    n_check --> n_tag_in
    n_report --> n_parse
    click n_caveat href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L125" "open the source"
    click n_fmt href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L144" "open the source"
    click n_check href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L171" "open the source"
    click n_report href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L182" "open the source"
    click n_parse href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L208" "open the source"
    click n_tag_in href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L243" "open the source"
    click n_find_tool href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L275" "open the source"
    click n_fetch href "https://github.com/tilas01/veilvoice/blob/main/crates/veilvoice-setup/src/update.rs#L313" "open the source"
    classDef entry fill:#1f2335,stroke:#7aa2f7,color:#c0caf5
    class n_caveat,n_check entry
    classDef api fill:#1f2335,stroke:#7dcfff,color:#c0caf5
    class n_report,n_tag_in api
    classDef helper fill:#1f2335,stroke:#bb9af7,color:#c0caf5
    class n_fmt,n_parse,n_find_tool,n_fetch helper

This site loads no third-party script, so it cannot run Mermaid; the diagram above is the same nodes and edges drawn by the generator instead. GitHub renders the source below directly.

ITEMS

Item	Line	Documentation
`REPO` _{pub const}	72	The repository asked about.
`LATEST_URL` _{pub const}	79	The page fetched.
`RELEASES_URL` _{pub const}	82	Where releases are listed, for somebody doing this by hand.
`TIMEOUT` _{pub const}	89	How long the transfer tool is given before it is given up on.
`Verdict` _{pub enum}	93	How this build's version compares with the newest published one.
`Report` _{pub struct}	110	What a check found.
`Report::caveat` _{pub fn}	125	What this answer is worth, in the words the user should see.
`Error` _{pub enum}	134	Why a check could not be completed.
`Error::fmt` _fn	144
`VERSION` _{pub const}	165	The version this build was compiled as.
`check` _{pub fn}	171	Ask whether anything newer than current has been published.
`report` _{pub fn}	182	Compare two version strings and build the report.
`parse` _fn	208	1.2.3 or v1.2.3 as three numbers.
`tag_in` _{pub fn}	243	The tag in whatever the transfer tool printed.
`NULL_DEVICE` _const	263	This platform's bit bucket, for a reply whose body is not wanted.
`NULL_DEVICE` _const	266	This platform's bit bucket, for a reply whose body is not wanted.
`Tool` _struct	269	Where a transfer tool was found, and how to drive it.
`find_tool` _fn	275	Absolute paths only.
`fetch` _fn	313	Run the tool and hand back what it printed.
`SCOPE` _{pub const}	371	What this crate does and does not do, in one paragraph, for a front end to show beside the button.