A Windows runner updates itself 494a1b9a8ac2

- **A Windows runner updates itself (#83, #85):** `flow runner update` on Windows checks a PE build, renames `flow.exe` to `flow.prev.exe` and `flow.new.exe` into its place with `MoveFileExW` (retrying while a virus scanner holds a new file; a running program cannot rename its own file, so a copy of it, `flow __rename`, does), tells the running runner through an `update.request` file in its home (no SIGUSR1 there), and the runner leaves and exits 75 so a Task Scheduler task set to restart on failure starts the new build, which proves itself by reaching the hub. Tried in the Windows VM: install, leave, exit 75, restart, proven. A rollback runs the restored build and ends with it. Spec §11.5.3.

does; set it to restart on failure, as a runner that leaves for a new build

exits 75 (`flow runner update`, spec §11.5.3). What a Windows runner does

not do yet: report load and kernel, or drain when Windows stops it

(oxygenflow#83).

# A Windows runner's free disk and renaming a running flow.exe (oxygenflow#83);

# already in the tree through wasmtime.

    /// Rename a program that cannot rename its own file (Windows; #83)

    #[command(name = "__rename", hide = true)]

    Rename { from: PathBuf, to: PathBuf },

        Cmd::Rename { from, to } => {

            flow::portable::rename(&from, &to).with_context(|| format!("renaming {} to {}", from.display(), to.display()))?;

            Ok(())

        }

                // Windows has no exec: run the restored build and end with it.

                {

                    let status = std::process::Command::new(&p.exe)

                        .args(std::env::args_os().skip(1))

                        .status()

                        .with_context(|| format!("starting flow {} again after the rollback", p.from))?;

                    std::process::exit(status.code().unwrap_or(1));

                }

/// Rename `from` to `to`, which must not exist. On Windows through

/// `MoveFileExW`, which renames a program that is running, trying again

/// while another program (a virus scanner) holds the file.

pub fn rename(from: &Path, to: &Path) -> io::Result<()> {

    #[cfg(windows)]

    {

        use std::os::windows::ffi::OsStrExt;

        let wide = |p: &Path| p.as_os_str().encode_wide().chain(Some(0)).collect::<Vec<u16>>();

        let (f, t) = (wide(from), wide(to));

        // A virus scanner holds a new program for a while after it is

        // written (a sharing violation, 32, or access denied, 5): try again

        // for half a minute.

        let mut tries = 0;

        loop {

            // SAFETY: both are NUL-terminated wide paths.

            if unsafe { windows_sys::Win32::Storage::FileSystem::MoveFileExW(f.as_ptr(), t.as_ptr(), 0) } != 0 {

                return Ok(());

            }

            let e = io::Error::last_os_error();

            tries += 1;

            if tries >= 30 || !matches!(e.raw_os_error(), Some(32) | Some(5)) {

                return Err(e);

            }

            std::thread::sleep(std::time::Duration::from_secs(1));

        }

    }

    #[cfg(not(windows))]

    {

        std::fs::rename(from, to)

    }

}

    // Left for a new build: on Windows, end as a failure, so a Task

    // Scheduler task set to restart on failure starts it (systemd's

    // Restart=always starts it after a clean exit).

    if cfg!(windows) && served.is_ok() && LEFT_FOR_UPDATE.load(std::sync::atomic::Ordering::SeqCst) {

        eprintln!("flow runner: left for the new build; exiting 75 so it is started");

        std::process::exit(75);

    }

/// Set once the runner leaves for a new build.

static LEFT_FOR_UPDATE: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);

            if UPDATE.swap(false, std::sync::atomic::Ordering::SeqCst) || crate::update::requested(&home.root) {

                LEFT_FOR_UPDATE.store(true, std::sync::atomic::Ordering::SeqCst);

/// In the runner's home: a new build is in place, leave for it. How a

/// runner is told on Windows, which has no SIGUSR1.

const REQUEST: &str = "update.request";

/// `exe`'s sibling named `stem`, with `exe`'s extension (`flow.prev.exe`

/// beside `flow.exe` on Windows, `flow.prev` beside `flow` elsewhere).

pub fn beside(exe: &Path, stem: &str) -> PathBuf {

    match exe.extension() {

        Some(e) => exe.with_file_name(format!("{stem}.{}", e.to_string_lossy())),

        None => exe.with_file_name(stem),

    }

}

/// The PE machine number of this build's architecture (Windows).

fn pe_machine_here() -> Option<u16> {

    Some(match std::env::consts::ARCH {

        "x86_64" => 0x8664,

        "aarch64" => 0xAA64,

        _ => return None,

    })

}

/// Refuse a file that is not a PE executable for this machine (Windows).

pub fn check_pe(bytes: &[u8]) -> Result<()> {

    if bytes.len() < 0x40 || &bytes[..2] != b"MZ" {

        bail!("not a Windows executable");

    }

    let at = u32::from_le_bytes([bytes[0x3c], bytes[0x3d], bytes[0x3e], bytes[0x3f]]) as usize;

    if bytes.len() < at + 6 || &bytes[at..at + 4] != b"PE\0\0" {

        bail!("not a Windows executable (no PE header in its first {} bytes)", bytes.len());

    }

    let machine = u16::from_le_bytes([bytes[at + 4], bytes[at + 5]]);

    match pe_machine_here() {

        Some(m) if m == machine => Ok(()),

        Some(_) => bail!("a build for another machine (PE machine {machine:#x}); this runner is {}", std::env::consts::ARCH),

        None => bail!("updates are not supported on {}", std::env::consts::ARCH),

    }

}

    let mut head = vec![0u8; 4096];

    if cfg!(windows) {

        check_pe(&head[..n])?;

    } else {

        check_target(&head[..n])?;

    }

}

/// Whether `p` is the program running now.

fn is_self(p: &Path) -> bool {

    let canon = |p: &Path| std::fs::canonicalize(p).ok();

    std::env::current_exe().ok().and_then(|me| canon(&me)).is_some_and(|me| Some(me) == canon(p))

}

/// Rename program `from` to `to`. On Windows a running program cannot

/// rename its own file (other programs can), so a copy of it, run as

/// `flow __rename`, does it then.

fn rename_exe(from: &Path, to: &Path) -> Result<()> {

    if cfg!(windows) && is_self(from) {

        let helper = beside(from, "flow.rename");

        std::fs::copy(from, &helper).with_context(|| format!("copying {} to rename it", from.display()))?;

        let out = std::process::Command::new(&helper).arg("__rename").arg(from).arg(to).output();

        let _ = std::fs::remove_file(&helper);

        let out = out.with_context(|| format!("starting {}", helper.display()))?;

        if !out.status.success() {

            bail!("{}", String::from_utf8_lossy(&out.stderr).trim());

        }

        return Ok(());

    }

    Ok(crate::portable::rename(from, to)?)

/// On Windows, where a running program cannot be replaced but can be

/// renamed, `exe` is renamed aside and `staged` into its place.

    let prev = beside(exe, PREV);

    if cfg!(windows) {

        let _ = std::fs::remove_file(&prev);

        rename_exe(exe, &prev).with_context(|| format!("keeping {} as {}", exe.display(), prev.display()))?;

        if let Err(e) = crate::portable::rename(staged, exe) {

            let _ = crate::portable::rename(&prev, exe);

            return Err(e).with_context(|| format!("putting {} in place of {}", staged.display(), exe.display()));

        }

        return Ok(());

    }

    let prev = beside(exe, PREV);

    }

    if cfg!(windows) {

        // The failed build may be the one running: rename it aside first.

        let failed = beside(exe, "flow.failed");

        let _ = std::fs::remove_file(&failed);

        rename_exe(exe, &failed).with_context(|| format!("moving {} aside", exe.display()))?;

        return crate::portable::rename(&prev, exe).with_context(|| format!("putting {} back", prev.display()));

    let staged = beside(exe, NEW);

    }

    if let Err(e) = swap(exe, &staged) {

        let _ = std::fs::remove_file(&staged);

        return Err(e);

    let told = running(&home.root).filter(|pid| cfg!(not(unix)) || tell(*pid));

/// On Windows: a request in the runner's home, which its loop reads.

/// Whether the runner has been asked, by file, to leave for a new build

/// (and forget the asking).

pub fn requested(home: &Path) -> bool {

    std::fs::remove_file(home.join(REQUEST)).is_ok()

}

#[cfg(unix)]

}

/// On Windows: a runner of this home has a pid file, and is asked by a

/// request file it reads (a stale one is cleared when a runner starts).

#[cfg(not(unix))]

fn running(home: &Path) -> Option<u32> {

    let pid: u32 = std::fs::read_to_string(home.join(PID)).ok()?.trim().parse().ok()?;

    std::fs::write(home.join(REQUEST), pid.to_string()).ok()?;

    Some(pid)

#[cfg_attr(not(unix), allow(dead_code))]

    let _ = std::fs::remove_file(home.join(REQUEST));

        eprintln!("flow runner: flow {} proven (it reached the hub); flow {} stays as {}", p.to, p.from, beside(&p.exe, PREV).display());

    }

    #[test]

    fn a_windows_build_is_checked_as_pe_and_named_beside_with_its_extension() {

        let mut pe = vec![0u8; 0x100];

        pe[..2].copy_from_slice(b"MZ");

        pe[0x3c..0x40].copy_from_slice(&0x80u32.to_le_bytes());

        pe[0x80..0x84].copy_from_slice(b"PE\0\0");

        pe[0x84..0x86].copy_from_slice(&0x8664u16.to_le_bytes());

        if std::env::consts::ARCH == "x86_64" {

            check_pe(&pe).unwrap();

        }

        pe[0x84..0x86].copy_from_slice(&0x01c4u16.to_le_bytes());

        assert!(check_pe(&pe).is_err(), "another machine");

        assert!(check_pe(b"\x7fELF and more bytes than enough for a header, really, quite a few more")

            .unwrap_err()

            .to_string()

            .contains("not a Windows"));

        assert_eq!(beside(Path::new("C:/flow/flow.exe"), PREV), Path::new("C:/flow/flow.prev.exe"));

        assert_eq!(beside(Path::new("/usr/local/bin/flow"), NEW), Path::new("/usr/local/bin/flow.new"));

    }

    #[test]

    fn a_request_file_asks_once() {

        let dir = tempfile::tempdir().unwrap();

        assert!(!requested(dir.path()));

        std::fs::write(dir.path().join(REQUEST), "1").unwrap();

        assert!(requested(dir.path()) && !requested(dir.path()), "read once");

        std::fs::write(dir.path().join(REQUEST), "1").unwrap();

        note_runner(dir.path());

        assert!(!requested(dir.path()), "a starting runner clears a stale request");

6. **On Windows** (oxygenflow#83) the same steps run with Windows' means:

   the build is checked as a PE executable for this machine; `flow.exe`

   is renamed to `flow.prev.exe` and `flow.new.exe` into its place (a

   running program can be renamed but not replaced, and cannot rename

   its own file, so a copy of it, `flow __rename`, does that); the runner

   is told by an `update.request` file in its home, which it reads in its

   loop, there being no SIGUSR1; and having left, it exits 75, so a Task

   Scheduler task set to restart on failure starts the new build. A

   rollback runs the restored build in its place and ends with it.