Updating the agent

The agent updates itself the way it patches the rest of the host: through a signed job your organization approved. Nothing on our side can push a new agent to a host by itself.

Proposing an update

The portal shows each host’s agent version against the current stable build. For a host that is behind:

• on the host’s page, Propose updating to …;
• on the hosts list, select hosts and choose Update agent… for many at once.

That opens a proposal like any other. Once it is approved, each host gets a self_update job for exactly that version.

Automatic updates

Settings → Agent updates → Keep agents on the stable channel automatically. When stable moves, an update is opened for every host behind it and approved on the authority of the admin or owner who turned the setting on. Before signing each update, the service checks that person still administers the organization. It is off unless you turn it on.

What the agent does with the job

A host only takes a self_update job if its agent.toml permits the self_update kind (the default does). Take it out to keep a host’s agent updated only the way it was installed.

How it updates depends on how it was installed:

• The package (from the one-liner or the repository): apt or dnf installs the version the job names from the host’s own configured repository, which they check against the repository’s signing key. A host gets updates only from the channel it is configured for: a host on stable refuses an update to a beta build, and says so. Agents from 0.2 report how they were installed and which channel they follow; the host page shows it, and an update to another channel skips those hosts with the reason instead of proposing a job they would refuse.
• The static binaries in /usr/local/bin: the agent downloads the channel’s manifest from pkg.updawg.net/bin/<channel>.json, checks its signature against the release key built into the agent, and installs the binaries it names only if their SHA-256 matches.

Either way, the new agent has five minutes to check in. If it doesn’t, the previous version is put back and restarted, and the job is reported as failed with the reason. Whichever agent is running at the end reports the result.

The release key is the same key that signs the repository, and its public half is compiled into the agent. It isn’t configurable and it is never fetched.