Backlog/compliance evaluation

.github/workflows/v11-deployment-pipeline.yml

@@ -453,6 +453,7 @@ jobs:
           cd ${{ github.workspace }}/plugins/modules-config; go build -o com.utmstack.modules-config.plugin -v .
           cd ${{ github.workspace }}/plugins/crowdstrike; go build -o com.utmstack.crowdstrike.plugin -v .
           cd ${{ github.workspace }}/plugins/feeds; go build -o com.utmstack.feeds.plugin -v .
+          cd ${{ github.workspace }}/plugins/compliance-orchestrator; go build -o com.utmstack.compliance-orchestrator.plugin -v .
 
       - name: Prepare Dependencies for Event Processor Image
         run: |

agent/dependency/dependency.go

@@ -21,6 +21,29 @@ const (
 	MacosCollectorVersion = "11.2.3"
 )
 
+// getUpdaterVersion reads the desired updater version from version.json
+// (the updater_version field). Falls back to UpdaterVersion if the
+// file is missing, unreadable, or the field is empty.
+//
+// The source of truth for this value is version.json shipped by the server,
+// which the updater promotes on each successful agent update.
+func getUpdaterVersion() string {
+	var v struct {
+		UpdaterVersion string `json:"updater_version"`
+	}
+	versionPath := filepath.Join(fs.GetExecutablePath(), "version.json")
+	if !fs.Exists(versionPath) {
+		return UpdaterVersion
+	}
+	if err := fs.ReadJSON(versionPath, &v); err != nil {
+		return UpdaterVersion
+	}
+	if v.UpdaterVersion == "" {
+		return UpdaterVersion
+	}
+	return v.UpdaterVersion
+}
+
 // UpdaterFile returns the updater binary name with OS and architecture suffix.
 // Format: utmstack_updater_service_<os>_<arch>[.exe]
 // Examples:
@@ -43,6 +66,7 @@ type Dependency struct {
 	DownloadURL  func(server string) string // URL template to download from
 	DownloadName string                     // Filename to save as (if different from BinaryPath basename)
 	Critical     bool                       // If true, failure blocks agent startup
+	PreDownload  func() (cleanup func(), err error) // Called before download, returns cleanup for rollback
 	PostDownload func() error               // Run after download (e.g., unzip). Can be nil.
 	Configure    func() error               // Run on first install (can be nil)
 	Update       func() error               // Run on version change (can be nil, uses Configure)
@@ -188,13 +212,34 @@ func Reconcile(server string, skipCertValidation bool) error {
 		} else if inst.Version != dep.Version {
 			// VERSION CHANGED: Download (if needed) and update
 			utils.Logger.Info("Updating dependency: %s (%s -> %s)", dep.Name, inst.Version, dep.Version)
+
+			// Call PreDownload hook if defined
+			var cleanup func()
+			if dep.PreDownload != nil {
+				var err error
+				cleanup, err = dep.PreDownload()
+				if err != nil {
+					errMsg := fmt.Errorf("failed to run PreDownload for %s: %v", dep.Name, err)
+					utils.Logger.ErrorF("%v", errMsg)
+					if dep.Critical {
+						criticalErrors = append(criticalErrors, errMsg)
+					}
+					continue
+				}
+			}
+
 			if dep.DownloadURL != nil {
 				if err := downloadDependency(dep, server, skipCertValidation); err != nil {
 					errMsg := fmt.Errorf("failed to download dependency update %s: %v", dep.Name, err)
 					utils.Logger.ErrorF("%v", errMsg)
 					if dep.Critical {
 						criticalErrors = append(criticalErrors, errMsg)
 					}
+					// Rollback: call cleanup if PreDownload succeeded
+					if cleanup != nil {
+						utils.Logger.Info("Rolling back PreDownload changes for %s", dep.Name)
+						cleanup()
+					}
 					continue
 				}
 			}
@@ -210,6 +255,11 @@ func Reconcile(server string, skipCertValidation bool) error {
 					if dep.Critical {
 						criticalErrors = append(criticalErrors, errMsg)
 					}
+					// Rollback: call cleanup if PreDownload succeeded
+					if cleanup != nil {
+						utils.Logger.Info("Rolling back PreDownload changes for %s", dep.Name)
+						cleanup()
+					}
 					continue
 				}
 			}

agent/dependency/deps_darwin.go

@@ -10,6 +10,7 @@ import (
 	"github.com/utmstack/UTMStack/agent/config"
 	"github.com/utmstack/UTMStack/shared/exec"
 	"github.com/utmstack/UTMStack/shared/fs"
+	"github.com/utmstack/UTMStack/shared/svc"
 )
 
 const macosCollectorBinary = "utmstack-collector-mac"
@@ -20,15 +21,16 @@ func GetDependencies() []Dependency {
 
 	return []Dependency{
 		{
-			Name:       "updater",
-			Version:    UpdaterVersion,
-			BinaryPath: filepath.Join(basePath, UpdaterFile("")),
+			Name:        "updater",
+			Version:     getUpdaterVersion(),
+			BinaryPath:  filepath.Join(basePath, UpdaterFile("")),
 			DownloadURL: func(server string) string {
 				return fmt.Sprintf(config.DependUrl, server, config.DependenciesPort, UpdaterFile(""))
 			},
-			Critical:  false,
-			Configure: configureUpdater,
-			Uninstall: uninstallUpdater,
+			Critical:    false,
+			PreDownload: preDownloadUpdater,
+			Configure:   configureUpdater,
+			Uninstall:   uninstallUpdater,
 		},
 		{
 			Name:       "macos-collector",
@@ -66,3 +68,19 @@ func uninstallUpdater() error {
 	}
 	return exec.Run(updaterPath, fs.GetExecutablePath(), "uninstall")
 }
+
+func preDownloadUpdater() (func(), error) {
+	// Stop the updater service before download
+	if err := svc.Stop(config.SERVICE_UPDATER_NAME); err != nil {
+		// Service might not be running or installed yet - that's OK
+		// Return cleanup function anyway (safe to start)
+		return func() {
+			_ = svc.Start(config.SERVICE_UPDATER_NAME)
+		}, nil
+	}
+
+	// Return cleanup function that restarts the service
+	return func() {
+		_ = svc.Start(config.SERVICE_UPDATER_NAME)
+	}, nil
+}

agent/dependency/deps_linux_amd64.go

@@ -11,6 +11,7 @@ import (
 	"github.com/utmstack/UTMStack/agent/config"
 	"github.com/utmstack/UTMStack/shared/exec"
 	"github.com/utmstack/UTMStack/shared/fs"
+	"github.com/utmstack/UTMStack/shared/svc"
 )
 
 // GetDependencies returns the list of dependencies for Linux amd64.
@@ -19,15 +20,16 @@ func GetDependencies() []Dependency {
 
 	return []Dependency{
 		{
-			Name:       "updater",
-			Version:    UpdaterVersion,
-			BinaryPath: filepath.Join(basePath, UpdaterFile("")),
+			Name:        "updater",
+			Version:     getUpdaterVersion(),
+			BinaryPath:  filepath.Join(basePath, UpdaterFile("")),
 			DownloadURL: func(server string) string {
 				return fmt.Sprintf(config.DependUrl, server, config.DependenciesPort, UpdaterFile(""))
 			},
-			Critical:  false,
-			Configure: configureUpdater,
-			Uninstall: uninstallUpdater,
+			Critical:    false,
+			PreDownload: preDownloadUpdater,
+			Configure:   configureUpdater,
+			Uninstall:   uninstallUpdater,
 		},
 
 		// New beats dependency - only for uninstalling existing filebeat/winlogbeat
@@ -75,3 +77,19 @@ func uninstallUpdater() error {
 func uninstallBeats() error {
 	return collector.UninstallAll()
 }
+
+func preDownloadUpdater() (func(), error) {
+	// Stop the updater service before download
+	if err := svc.Stop(config.SERVICE_UPDATER_NAME); err != nil {
+		// Service might not be running or installed yet - that's OK
+		// Return cleanup function anyway (safe to start)
+		return func() {
+			_ = svc.Start(config.SERVICE_UPDATER_NAME)
+		}, nil
+	}
+
+	// Return cleanup function that restarts the service
+	return func() {
+		_ = svc.Start(config.SERVICE_UPDATER_NAME)
+	}, nil
+}

agent/dependency/deps_linux_arm64.go

@@ -10,6 +10,7 @@ import (
 	"github.com/utmstack/UTMStack/agent/config"
 	"github.com/utmstack/UTMStack/shared/exec"
 	"github.com/utmstack/UTMStack/shared/fs"
+	"github.com/utmstack/UTMStack/shared/svc"
 )
 
 // GetDependencies returns the list of dependencies for Linux arm64.
@@ -19,15 +20,16 @@ func GetDependencies() []Dependency {
 
 	return []Dependency{
 		{
-			Name:       "updater",
-			Version:    UpdaterVersion,
-			BinaryPath: filepath.Join(basePath, UpdaterFile("")),
+			Name:        "updater",
+			Version:     getUpdaterVersion(),
+			BinaryPath:  filepath.Join(basePath, UpdaterFile("")),
 			DownloadURL: func(server string) string {
 				return fmt.Sprintf(config.DependUrl, server, config.DependenciesPort, UpdaterFile(""))
 			},
-			Critical:  false,
-			Configure: configureUpdater,
-			Uninstall: uninstallUpdater,
+			Critical:    false,
+			PreDownload: preDownloadUpdater,
+			Configure:   configureUpdater,
+			Uninstall:   uninstallUpdater,
 		},
 
 		// Auditd dependency - auto-configures Linux audit daemon
@@ -61,3 +63,19 @@ func uninstallUpdater() error {
 	}
 	return exec.Run(updaterPath, fs.GetExecutablePath(), "uninstall")
 }
+
+func preDownloadUpdater() (func(), error) {
+	// Stop the updater service before download
+	if err := svc.Stop(config.SERVICE_UPDATER_NAME); err != nil {
+		// Service might not be running or installed yet - that's OK
+		// Return cleanup function anyway (safe to start)
+		return func() {
+			_ = svc.Start(config.SERVICE_UPDATER_NAME)
+		}, nil
+	}
+
+	// Return cleanup function that restarts the service
+	return func() {
+		_ = svc.Start(config.SERVICE_UPDATER_NAME)
+	}, nil
+}

agent/dependency/deps_windows_amd64.go

@@ -11,6 +11,7 @@ import (
 	"github.com/utmstack/UTMStack/agent/config"
 	"github.com/utmstack/UTMStack/shared/exec"
 	"github.com/utmstack/UTMStack/shared/fs"
+	"github.com/utmstack/UTMStack/shared/svc"
 )
 
 // GetDependencies returns the list of dependencies for Windows amd64.
@@ -19,15 +20,16 @@ func GetDependencies() []Dependency {
 
 	return []Dependency{
 		{
-			Name:       "updater",
-			Version:    UpdaterVersion,
-			BinaryPath: filepath.Join(basePath, UpdaterFile("")),
+			Name:        "updater",
+			Version:     getUpdaterVersion(),
+			BinaryPath:  filepath.Join(basePath, UpdaterFile("")),
 			DownloadURL: func(server string) string {
 				return fmt.Sprintf(config.DependUrl, server, config.DependenciesPort, UpdaterFile(""))
 			},
-			Critical:  false, // Agent can run without updater
-			Configure: configureUpdater,
-			Uninstall: uninstallUpdater,
+			Critical:    false, // Agent can run without updater
+			PreDownload: preDownloadUpdater,
+			Configure:   configureUpdater,
+			Uninstall:   uninstallUpdater,
 		},
 
 		// New beats dependency - only for uninstalling existing filebeat/winlogbeat
@@ -57,3 +59,19 @@ func uninstallUpdater() error {
 func uninstallBeats() error {
 	return collector.UninstallAll()
 }
+
+func preDownloadUpdater() (func(), error) {
+	// Stop the updater service before download
+	if err := svc.Stop(config.SERVICE_UPDATER_NAME); err != nil {
+		// Service might not be running or installed yet - that's OK
+		// Return cleanup function anyway (safe to start)
+		return func() {
+			_ = svc.Start(config.SERVICE_UPDATER_NAME)
+		}, nil
+	}
+
+	// Return cleanup function that restarts the service
+	return func() {
+		_ = svc.Start(config.SERVICE_UPDATER_NAME)
+	}, nil
+}

agent/dependency/deps_windows_arm64.go

@@ -10,6 +10,7 @@ import (
 	"github.com/utmstack/UTMStack/agent/config"
 	"github.com/utmstack/UTMStack/shared/exec"
 	"github.com/utmstack/UTMStack/shared/fs"
+	"github.com/utmstack/UTMStack/shared/svc"
 )
 
 // GetDependencies returns the list of dependencies for Windows arm64.
@@ -19,15 +20,16 @@ func GetDependencies() []Dependency {
 
 	return []Dependency{
 		{
-			Name:       "updater",
-			Version:    UpdaterVersion,
-			BinaryPath: filepath.Join(basePath, UpdaterFile("")),
+			Name:        "updater",
+			Version:     getUpdaterVersion(),
+			BinaryPath:  filepath.Join(basePath, UpdaterFile("")),
 			DownloadURL: func(server string) string {
 				return fmt.Sprintf(config.DependUrl, server, config.DependenciesPort, UpdaterFile(""))
 			},
-			Critical:  false,
-			Configure: configureUpdater,
-			Uninstall: uninstallUpdater,
+			Critical:    false,
+			PreDownload: preDownloadUpdater,
+			Configure:   configureUpdater,
+			Uninstall:   uninstallUpdater,
 		},
 	}
 }
@@ -44,3 +46,19 @@ func uninstallUpdater() error {
 	}
 	return exec.Run(updaterPath, fs.GetExecutablePath(), "uninstall")
 }
+
+func preDownloadUpdater() (func(), error) {
+	// Stop the updater service before download
+	if err := svc.Stop(config.SERVICE_UPDATER_NAME); err != nil {
+		// Service might not be running or installed yet - that's OK
+		// Return cleanup function anyway (safe to start)
+		return func() {
+			_ = svc.Start(config.SERVICE_UPDATER_NAME)
+		}, nil
+	}
+
+	// Return cleanup function that restarts the service
+	return func() {
+		_ = svc.Start(config.SERVICE_UPDATER_NAME)
+	}, nil
+}