Auto-update

Ferro Sentry includes a built-in self-update mechanism. The agent performs an initial update check 1 minute after startup and subsequently checks once per day on the GitHub Releases page for a newer version. If one is found, it downloads the correct binary for the current platform, replaces itself on disk, and exits cleanly so the system service manager can restart it.

Update flow

  1. Agent performs an initial check 1 minute after startup and then every 24 hours against https://api.github.com/repos/securyblack/ferro-sentry/releases/latest.
  2. Compares the remote version tag against the current binary version using semantic versioning.
  3. If a newer version exists, downloads the correct binary for the current OS and architecture.
  4. Verifies the download integrity via SHA256 checksum published in the release.
  5. Replaces the running binary on disk and calls exit(0) cleanly.
  6. systemd (Linux) or the Windows Service Manager restarts the process automatically, picking up the new binary.
The update check uses the GitHub public API and requires outbound HTTPS access to api.github.com and github.com. No other external connections are made during the update process.

Logs

Update log output
INFO ferro_sentry::updater: initial check in 1 min (current: v0.1.6)
INFO ferro_sentry::updater: new version available: v0.2.0
INFO ferro_sentry::updater: downloading ferro-sentry-linux-x86_64 v0.2.0
INFO ferro_sentry::updater: checksum verified, replacing binary
INFO ferro_sentry::updater: update complete, restarting

Disabling auto-update

If you manage updates through your own package management or deployment pipeline, you can disable the auto-updater:

toml
# Environment variable
FERROSENTRY_AUTO_UPDATE=false

# Or in config.toml
auto_update = false

Pinning a version

To install a specific version instead of the latest, pass the version tag to the install script:

bash
# Linux
FERROSENTRY_VERSION=v0.1.6 curl -fsSL https://install.ferrosentry.dev | sudo bash

# Windows
$env:FERROSENTRY_VERSION="v0.1.6"; irm https://install.ferrosentry.dev/windows | iex
Pinned versions will not auto-update. You are responsible for monitoring and applying security releases manually if auto-update is disabled or a version is pinned.