feat(fpagent): pin releases, report upgrades, restart the service

The installer gains --tag to install a specific release (gateway route
/fpagent/releases/tags/:tag), derives the git hash from the asset name,
and hands it to the bundle installer as VERSION so upgrades are reported
and the installed version is recorded. Service restart on upgrade lives
in the bundle installer, which owns the systemd unit.

tools/public/fpagent/install.sh

@@ -27,8 +27,12 @@ usage() {
 	cat <<EOF
 Usage: curl -fsSL ${BASE}/install.sh | bash -s -- [installer options]
 
-Downloads the latest fpagent release, verifies it, and runs its installer.
-Options are forwarded to that installer:
+Downloads the fpagent release, verifies it, and runs its installer.
+
+Options:
+  --tag TAG               release tag to install (default: latest)
+
+Options below are forwarded to the bundled installer:
   --check                 preflight and report only; change nothing
   --offline               never touch the network; fail if dependencies are missing
   --enable-service        install and enable a systemd service (starts at boot)
@@ -42,13 +46,26 @@ Environment:
 EOF
 }
 
-for arg in "$@"; do
-	case "$arg" in
+RELEASE_TAG="latest"
+FORWARD=()
+while [ $# -gt 0 ]; do
+	case "$1" in
 		-h | --help)
 			usage
 			exit 0
 			;;
+		--tag)
+			RELEASE_TAG="${2:?--tag needs a release tag}"
+			shift
+			;;
+		--tag=*)
+			RELEASE_TAG="${1#--tag=}"
+			;;
+		*)
+			FORWARD+=("$1")
+			;;
 	esac
+	shift
 done
 
 for cmd in curl tar sha256sum python3 find; do
@@ -68,11 +85,17 @@ find "$tmpbase" -maxdepth 1 -mindepth 1 -type d -uid "$(id -u)" \
 # online bundle (whose installer apt-get's the dependency).
 codename="$(sed -n 's/^VERSION_CODENAME=//p' /etc/os-release 2>/dev/null | tr -d '"')"
 
-say "Fetching the latest Fingerprint Agent release..."
-meta="$(curl -fsSL "${BASE}/releases/latest")" || die "could not fetch the release list from ${BASE}"
+if [ "$RELEASE_TAG" = "latest" ]; then
+	meta_url="${BASE}/releases/latest"
+else
+	meta_url="${BASE}/releases/tags/${RELEASE_TAG}"
+fi
+
+say "Fetching the Fingerprint Agent release (${RELEASE_TAG})..."
+meta="$(curl -fsSL "$meta_url")" || die "could not fetch the release list from ${BASE}"
 
 readout="$(python3 -c '
-import json, sys
+import json, re, sys
 codename = sys.argv[1]
 release = json.loads(sys.argv[2])
 assets = [a["name"] for a in release.get("assets", [])]
@@ -83,15 +106,19 @@ def pick(suffix):
 name = pick("-ubuntu-" + codename + "-x86_64.tar.gz") if codename else ""
 if not name:
     name = pick("-linux-x86_64.tar.gz")
-print(release.get("tag", "") + "\t" + name)
+# The git hash is baked into the asset name (bundle.sh --version) and into
+# the binary itself; it is the version we record and later compare against.
+m = re.match(r"^fpagent-(.+)-(?:linux-x86_64|ubuntu-[a-z0-9]+-x86_64)\.tar\.gz$", name)
+version = m.group(1) if m else ""
+print(release.get("tag", "") + "\t" + name + "\t" + version)
 ' "$codename" "$meta")" || die "could not parse the release metadata"
 
-tag="${readout%%$'\t'*}"
-asset="${readout#*$'\t'}"
-[ -n "$tag" ] && [ -n "$asset" ] || die "no compatible bundle in the latest release (x86_64 required)"
+IFS=$'\t' read -r tag asset version <<<"$readout"
+[ -n "$tag" ] && [ -n "$asset" ] || die "no compatible bundle in release ${RELEASE_TAG} (x86_64 required)"
 
 say "  release ${tag}"
 say "  bundle  ${asset}"
+[ -n "$version" ] && say "  version ${version}"
 
 tmp="$(mktemp -d "$tmpbase/fpagent-install.XXXXXXXX")"
 trap 'rm -rf "$tmp"' EXIT
@@ -106,5 +133,10 @@ get "${BASE}/releases/download/${tag}/${asset}.sha256" "${tmp}/${asset}.sha256"
 tar xzf "${tmp}/${asset}" -C "$tmp" || die "could not extract ${asset}"
 [ -x "${tmp}/install.sh" ] || die "the bundle does not contain install.sh"
 
+# Hand the version to the bundle installer so it can record it and report an
+# upgrade. Bundles built by bundle.sh already carry VERSION; this also covers
+# older bundles and other packagers, using the hash from the asset name.
+[ -n "$version" ] && printf '%s\n' "$version" >"${tmp}/VERSION"
+
 say "Running the installer (pass --enable-service to start at boot)..."
-"${tmp}/install.sh" "$@"
+"${tmp}/install.sh" "${FORWARD[@]}"