fix: use verified local packages for windows updates

[Pimpmuckl]

What

Windows self-updates still ran the web installer through:

irm https://herdr.dev/install.ps1 | iex

That process chain triggers Cortex XDR's PowerShell downloader rule. In #2751 it terminated the complete Windows Terminal causality chain and left the update incomplete.

herdr update now downloads the exact Windows package selected by the already-fetched release manifest, verifies its published SHA-256, and runs the bundled installer against that local package.

This brings Windows in line with the existing Linux and macOS update flow for release acquisition. Herdr now owns manifest selection, artifact download, and checksum verification on every platform. PowerShell receives only local paths and release metadata.

The public install.ps1 flow stays unchanged for first-time installs.

Why

Linux and macOS already let Herdr select the release, download the exact artifact, verify it, and then perform the platform-specific activation.

Windows took a separate detour. After Herdr selected the release, it handed acquisition back to a remote PowerShell script, which fetched the manifest and package again. That duplicated work and looked exactly like a PowerShell downloader to endpoint protection.

Removing that Windows-only detour simplifies updater ownership and removes the observed trigger. This is not an EDR-specific retry or exception.

The Windows-specific activation path stays where it already works. The PowerShell installer still owns ConPTY validation, the install lock, atomic activation, rollback, junction updates, retention, and cleanup. Only release acquisition moves into Herdr.

Testing

• just check
• Existing Windows installer integration with the checked-in preview package
• Local package checksum rejection and successful activation
• Existing repair, rollback, retention, and junction coverage
• Disposable process trace confirmed only curl performs network downloads and PowerShell receives local paths and metadata only

Refs #2751

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 56824e25-d2b2-4f99-b4f4-1c7f97e525d1

📥 Commits

Reviewing files that changed from the base of the PR and between d76657f and 1ab33eb.

📒 Files selected for processing (4)

• Cargo.toml
• scripts/windows_install_conpty_package_test.ps1
• src/update.rs
• website/install.ps1

---

📝 Walkthrough

Walkthrough

Windows updates now resolve package formats, download and verify packages locally, and invoke the bundled PowerShell installer with package metadata. The installer supports validated local-package arguments, while tests cover rejection and successful activation paths.

Changes

Windows local package update flow

Layer / File(s)	Summary
Windows asset format metadata src/update.rs	Windows release assets now resolve and validate zip or exe package formats from metadata or URLs.
Local package installer mode website/install.ps1, Cargo.toml	The packaged installer accepts local package path, format, identity, and SHA-256 values. It skips remote manifest and download steps in local mode.
Updater download and installation src/update.rs, scripts/windows_install_conpty_package_test.ps1	The updater downloads and verifies packages before invoking the bundled installer. Tests cover incomplete arguments, checksum failures, and successful activation.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 1ab33

The Windows update flow now uses locally downloaded and verified packages while preserving the existing activation path; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant WindowsUpdater
  participant ReleasePackage
  participant BundledInstaller
  participant herdr.exe
  WindowsUpdater->>ReleasePackage: download and verify package
  WindowsUpdater->>BundledInstaller: pass local package metadata
  BundledInstaller->>herdr.exe: install and activate executable

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: Windows updates now use verified local packages.
Description check	✅ Passed	The description directly explains the Windows update changes, rationale, implementation, and testing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ogulcancelik]

great ty!