Zero-downtime auto-updates in a Rust security agent

Ferro Sentry ships security updates silently. No package manager, no SSH session, no restart window to schedule. Once a new release is tagged on GitHub, every running agent picks it up within 24 hours. Here is how it works.

The constraints

A security agent has a critical update requirement:

1. Download the new binary without interrupting active threat monitoring
2. Replace itself atomically — a partially-written binary would break host security
3. Hand off cleanly so systemd / Windows SCM restarts it with the new version
4. Never brick a remote server if a download fails

How Ferro Sentry solves it

The updater runs as an asynchronous background Tokio task that wakes up daily.

startup
  └─ 1 min → check GitHub Releases API
              ├─ no new version → sleep 24 h → repeat
              └─ new version found
                  ├─ download binary for current platform/arch
                  ├─ verify SHA256 checksum
                  ├─ atomic rename (replace in place)
                  └─ std::process::exit(0)

The key step is the atomic rename. On Linux, rename(2) is guaranteed atomic on the same filesystem. On Windows, the agent uses MoveFileExW with MOVEFILE_REPLACE_EXISTING.