ollama source for Momentry Core verification

app/updater/updater.go

@@ -0,0 +1,403 @@
+//go:build windows || darwin
+
+package updater
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"mime"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/ollama/ollama/app/store"
+	"github.com/ollama/ollama/app/version"
+	"github.com/ollama/ollama/auth"
+)
+
+var (
+	UpdateCheckURLBase      = "https://ollama.com/api/update"
+	UpdateDownloaded        = false
+	UpdateCheckInterval     = 60 * 60 * time.Second
+	UpdateCheckInitialDelay = 3 * time.Second // 30 * time.Second
+
+	UpdateStageDir    string
+	UpgradeLogFile    string
+	UpgradeMarkerFile string
+	Installer         string
+	UserAgentOS       string
+
+	VerifyDownload func() error
+)
+
+// TODO - maybe move up to the API package?
+type UpdateResponse struct {
+	UpdateURL     string `json:"url"`
+	UpdateVersion string `json:"version"`
+}
+
+func (u *Updater) checkForUpdate(ctx context.Context) (bool, UpdateResponse) {
+	var updateResp UpdateResponse
+
+	requestURL, err := url.Parse(UpdateCheckURLBase)
+	if err != nil {
+		return false, updateResp
+	}
+
+	query := requestURL.Query()
+	query.Add("os", runtime.GOOS)
+	query.Add("arch", runtime.GOARCH)
+	currentVersion := version.Version
+	query.Add("version", currentVersion)
+	query.Add("ts", strconv.FormatInt(time.Now().Unix(), 10))
+
+	// The original macOS app used to use the device ID
+	// to check for updates so include it if present
+	if runtime.GOOS == "darwin" {
+		if id, err := u.Store.ID(); err == nil && id != "" {
+			query.Add("id", id)
+		}
+	}
+
+	var signature string
+
+	nonce, err := auth.NewNonce(rand.Reader, 16)
+	if err != nil {
+		// Don't sign if we haven't yet generated a key pair for the server
+		slog.Debug("unable to generate nonce for update check request", "error", err)
+	} else {
+		query.Add("nonce", nonce)
+		requestURL.RawQuery = query.Encode()
+
+		data := []byte(fmt.Sprintf("%s,%s", http.MethodGet, requestURL.RequestURI()))
+		signature, err = auth.Sign(ctx, data)
+		if err != nil {
+			slog.Debug("unable to generate signature for update check request", "error", err)
+		}
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL.String(), nil)
+	if err != nil {
+		slog.Warn(fmt.Sprintf("failed to check for update: %s", err))
+		return false, updateResp
+	}
+	if signature != "" {
+		req.Header.Set("Authorization", signature)
+	}
+	ua := fmt.Sprintf("ollama/%s %s Go/%s %s", version.Version, runtime.GOARCH, runtime.Version(), UserAgentOS)
+	req.Header.Set("User-Agent", ua)
+
+	slog.Debug("checking for available update", "requestURL", requestURL, "User-Agent", ua)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		slog.Warn(fmt.Sprintf("failed to check for update: %s", err))
+		return false, updateResp
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusNoContent {
+		slog.Debug("check update response 204 (current version is up to date)")
+		return false, updateResp
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		slog.Warn(fmt.Sprintf("failed to read body response: %s", err))
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		slog.Info(fmt.Sprintf("check update error %d - %.96s", resp.StatusCode, string(body)))
+		return false, updateResp
+	}
+	err = json.Unmarshal(body, &updateResp)
+	if err != nil {
+		slog.Warn(fmt.Sprintf("malformed response checking for update: %s", err))
+		return false, updateResp
+	}
+	// Extract the version string from the URL in the github release artifact path
+	updateResp.UpdateVersion = path.Base(path.Dir(updateResp.UpdateURL))
+
+	slog.Info("New update available at " + updateResp.UpdateURL)
+	return true, updateResp
+}
+
+func (u *Updater) DownloadNewRelease(ctx context.Context, updateResp UpdateResponse) error {
+	// Create a cancellable context for this download
+	downloadCtx, cancel := context.WithCancel(ctx)
+	u.cancelDownloadLock.Lock()
+	u.cancelDownload = cancel
+	u.cancelDownloadLock.Unlock()
+	defer func() {
+		u.cancelDownloadLock.Lock()
+		u.cancelDownload = nil
+		u.cancelDownloadLock.Unlock()
+		cancel()
+	}()
+
+	// Do a head first to check etag info
+	req, err := http.NewRequestWithContext(downloadCtx, http.MethodHead, updateResp.UpdateURL, nil)
+	if err != nil {
+		return err
+	}
+
+	// In case of slow downloads, continue the update check in the background
+	bgctx, bgcancel := context.WithCancel(downloadCtx)
+	defer bgcancel()
+	go func() {
+		for {
+			select {
+			case <-bgctx.Done():
+				return
+			case <-time.After(UpdateCheckInterval):
+				u.checkForUpdate(bgctx)
+			}
+		}
+	}()
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("error checking update: %w", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected status attempting to download update %d", resp.StatusCode)
+	}
+	filename := Installer
+	_, params, err := mime.ParseMediaType(resp.Header.Get("content-disposition"))
+	if err == nil && params["filename"] != "" {
+		filename = params["filename"]
+	}
+
+	stageFilename, err := updateStagePath(UpdateStageDir, resp.Header.Get("etag"), filename)
+	if err != nil {
+		return err
+	}
+
+	// Check to see if we already have it downloaded
+	_, err = os.Stat(stageFilename)
+	if err == nil {
+		slog.Info("update already downloaded", "bundle", stageFilename)
+		UpdateDownloaded = true
+		return nil
+	}
+
+	cleanupOldDownloads(UpdateStageDir)
+
+	req.Method = http.MethodGet
+	resp, err = http.DefaultClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("error checking update: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected status attempting to download update %d", resp.StatusCode)
+	}
+
+	stageFilename, err = updateStagePath(UpdateStageDir, resp.Header.Get("etag"), filename)
+	if err != nil {
+		return err
+	}
+
+	_, err = os.Stat(filepath.Dir(stageFilename))
+	if errors.Is(err, os.ErrNotExist) {
+		if err := os.MkdirAll(filepath.Dir(stageFilename), 0o755); err != nil {
+			return fmt.Errorf("create ollama dir %s: %v", filepath.Dir(stageFilename), err)
+		}
+	}
+
+	payload, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("failed to read body response: %w", err)
+	}
+	fp, err := os.OpenFile(stageFilename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
+	if err != nil {
+		return fmt.Errorf("write payload %s: %w", stageFilename, err)
+	}
+	if n, err := fp.Write(payload); err != nil || n != len(payload) {
+		_ = fp.Close()
+		return fmt.Errorf("write payload %s: %d vs %d -- %w", stageFilename, n, len(payload), err)
+	}
+	if err := fp.Close(); err != nil {
+		return fmt.Errorf("close payload %s: %w", stageFilename, err)
+	}
+	slog.Info("new update downloaded " + stageFilename)
+
+	if err := VerifyDownload(); err != nil {
+		_ = os.Remove(stageFilename)
+		return fmt.Errorf("%s - %s", resp.Request.URL.String(), err)
+	}
+	UpdateDownloaded = true
+	return nil
+}
+
+func updateStagePath(stageDir, etag, filename string) (string, error) {
+	filename, err := safeUpdateFilename(filename)
+	if err != nil {
+		return "", err
+	}
+
+	stageDir, err = filepath.Abs(stageDir)
+	if err != nil {
+		return "", fmt.Errorf("resolve update stage dir: %w", err)
+	}
+
+	stageFilename := filepath.Join(stageDir, updateStageETagDir(etag), filename)
+	if err := ensurePathInDir(stageDir, stageFilename); err != nil {
+		return "", err
+	}
+
+	return stageFilename, nil
+}
+
+func safeUpdateFilename(filename string) (string, error) {
+	filename = strings.TrimSpace(filename)
+	if filename == "" {
+		return "", errors.New("missing update filename")
+	}
+	if filename == "." || filename == ".." ||
+		filepath.IsAbs(filename) || path.IsAbs(filename) ||
+		strings.ContainsAny(filename, `/\:`) ||
+		filepath.Base(filename) != filename || path.Base(filename) != filename {
+		return "", fmt.Errorf("unsafe update filename %q", filename)
+	}
+	return filename, nil
+}
+
+func updateStageETagDir(etag string) string {
+	etag = strings.Trim(strings.TrimSpace(etag), "\"")
+	if etag == "" {
+		slog.Debug("no etag detected, falling back to filename based dedup")
+		return "_"
+	}
+
+	sum := sha256.Sum256([]byte(etag))
+	return hex.EncodeToString(sum[:])
+}
+
+func ensurePathInDir(dir, name string) error {
+	rel, err := filepath.Rel(dir, name)
+	if err != nil {
+		return fmt.Errorf("resolve update staging path: %w", err)
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
+		return fmt.Errorf("update staging path escapes stage dir: %s", name)
+	}
+	return nil
+}
+
+func cleanupOldDownloads(stageDir string) {
+	files, err := os.ReadDir(stageDir)
+	if err != nil && errors.Is(err, os.ErrNotExist) {
+		// Expected behavior on first run
+		return
+	} else if err != nil {
+		slog.Warn(fmt.Sprintf("failed to list stage dir: %s", err))
+		return
+	}
+	for _, file := range files {
+		fullname := filepath.Join(stageDir, file.Name())
+		slog.Debug("cleaning up old download: " + fullname)
+		err = os.RemoveAll(fullname)
+		if err != nil {
+			slog.Warn(fmt.Sprintf("failed to cleanup stale update download %s", err))
+		}
+	}
+}
+
+type Updater struct {
+	Store              *store.Store
+	cancelDownload     context.CancelFunc
+	cancelDownloadLock sync.Mutex
+	checkNow           chan struct{}
+}
+
+// CancelOngoingDownload cancels any currently running download
+func (u *Updater) CancelOngoingDownload() {
+	u.cancelDownloadLock.Lock()
+	defer u.cancelDownloadLock.Unlock()
+	if u.cancelDownload != nil {
+		slog.Info("cancelling ongoing update download")
+		u.cancelDownload()
+		u.cancelDownload = nil
+	}
+}
+
+// TriggerImmediateCheck signals the background checker to check for updates immediately
+func (u *Updater) TriggerImmediateCheck() {
+	if u.checkNow != nil {
+		select {
+		case u.checkNow <- struct{}{}:
+		default:
+			// Check already pending, no need to queue another
+		}
+	}
+}
+
+func (u *Updater) StartBackgroundUpdaterChecker(ctx context.Context, cb func(string) error) {
+	u.checkNow = make(chan struct{}, 1)
+	u.checkNow <- struct{}{} // Trigger first check after initial delay
+	go func() {
+		// Don't blast an update message immediately after startup
+		time.Sleep(UpdateCheckInitialDelay)
+		slog.Info("beginning update checker", "interval", UpdateCheckInterval)
+		ticker := time.NewTicker(UpdateCheckInterval)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-ctx.Done():
+				slog.Debug("stopping background update checker")
+				return
+			case <-u.checkNow:
+				// Immediate check triggered
+			case <-ticker.C:
+				// Regular interval check
+			}
+
+			// Always check for updates
+			available, resp := u.checkForUpdate(ctx)
+			if !available {
+				continue
+			}
+
+			// Update is available - check if auto-update is enabled for downloading
+			settings, err := u.Store.Settings()
+			if err != nil {
+				slog.Error("failed to load settings", "error", err)
+				continue
+			}
+
+			if !settings.AutoUpdateEnabled {
+				// Auto-update disabled - don't download, just log
+				slog.Debug("update available but auto-update disabled", "version", resp.UpdateVersion)
+				continue
+			}
+
+			// Auto-update is enabled - download
+			err = u.DownloadNewRelease(ctx, resp)
+			if err != nil {
+				slog.Error("failed to download new release", "error", err)
+				continue
+			}
+
+			// Download successful - show tray notification
+			err = cb(resp.UpdateVersion)
+			if err != nil {
+				slog.Warn("failed to register update available with tray", "error", err)
+			}
+		}
+	}()
+}

app/updater/updater_darwin.go

@@ -0,0 +1,494 @@
+package updater
+
+// #cgo CFLAGS: -x objective-c
+// #cgo LDFLAGS: -framework Webkit -framework Cocoa -framework LocalAuthentication -framework ServiceManagement
+// #include "updater_darwin.h"
+// typedef const char cchar_t;
+import "C"
+
+import (
+	"archive/zip"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+const updateArchiveRoot = "Ollama.app"
+
+type bundleEntryScope int
+
+const (
+	bundleEntryRelative bundleEntryScope = iota
+	bundleEntryWithArchiveRoot
+)
+
+var (
+	appBackupDir   string
+	SystemWidePath = "/Applications/Ollama.app"
+)
+
+var BundlePath = func() string {
+	if bundle := alreadyMoved(); bundle != "" {
+		return bundle
+	}
+
+	exe, err := os.Executable()
+	if err != nil {
+		return ""
+	}
+
+	// We also install this binary in Contents/Frameworks/Squirrel.framework/Versions/A/Squirrel
+	if filepath.Base(exe) == "Squirrel" &&
+		filepath.Base(filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(exe)))))) == "Contents" {
+		return filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(filepath.Dir(exe))))))
+	}
+
+	// Make sure we're in a proper macOS app bundle structure (Contents/MacOS)
+	if filepath.Base(filepath.Dir(exe)) != "MacOS" ||
+		filepath.Base(filepath.Dir(filepath.Dir(exe))) != "Contents" {
+		return ""
+	}
+
+	return filepath.Dir(filepath.Dir(filepath.Dir(exe)))
+}()
+
+func init() {
+	VerifyDownload = verifyDownload
+	Installer = "Ollama-darwin.zip"
+	home, err := os.UserHomeDir()
+	if err != nil {
+		panic(err)
+	}
+
+	var uts unix.Utsname
+	if err := unix.Uname(&uts); err == nil {
+		sysname := unix.ByteSliceToString(uts.Sysname[:])
+		release := unix.ByteSliceToString(uts.Release[:])
+		UserAgentOS = fmt.Sprintf("%s/%s", sysname, release)
+	} else {
+		slog.Warn("unable to determine OS version", "error", err)
+		UserAgentOS = "Darwin"
+	}
+
+	// TODO handle failure modes here, and developer mode better...
+
+	// Executable = Ollama.app/Contents/MacOS/Ollama
+
+	UpgradeLogFile = filepath.Join(home, ".ollama", "logs", "upgrade.log")
+
+	cacheDir, err := os.UserCacheDir()
+	if err != nil {
+		slog.Warn("unable to determine user cache dir, falling back to tmpdir", "error", err)
+		cacheDir = os.TempDir()
+	}
+	appDataDir := filepath.Join(cacheDir, "ollama")
+	UpgradeMarkerFile = filepath.Join(appDataDir, "upgraded")
+	appBackupDir = filepath.Join(appDataDir, "backup")
+	UpdateStageDir = filepath.Join(appDataDir, "updates")
+}
+
+func DoUpgrade(interactive bool) error {
+	// TODO use UpgradeLogFile to record the upgrade details from->to version, etc.
+
+	bundle := getStagedUpdate()
+	if bundle == "" {
+		return fmt.Errorf("failed to lookup downloads")
+	}
+
+	slog.Info("starting upgrade", "app", BundlePath, "update", bundle, "pid", os.Getpid(), "log", UpgradeLogFile)
+
+	// TODO - in the future, consider shutting down the backend server now to give it
+	// time to drain connections and stop allowing new connections while we perform the
+	// actual upgrade to reduce the overall time to complete
+	contentsName := filepath.Join(BundlePath, "Contents")
+	appBackup := filepath.Join(appBackupDir, "Ollama.app")
+	contentsOldName := filepath.Join(appBackup, "Contents")
+
+	// Verify old doesn't exist yet
+	if _, err := os.Stat(contentsOldName); err == nil {
+		slog.Error("prior upgrade failed", "backup", contentsOldName)
+		return fmt.Errorf("prior upgrade failed - please upgrade manually by installing the bundle")
+	}
+	if err := os.MkdirAll(appBackupDir, 0o755); err != nil {
+		return fmt.Errorf("unable to create backup dir %s: %w", appBackupDir, err)
+	}
+
+	// Verify bundle loads before starting staging process
+	r, err := zip.OpenReader(bundle)
+	if err != nil {
+		return fmt.Errorf("unable to open upgrade bundle %s: %w", bundle, err)
+	}
+	defer r.Close()
+
+	slog.Debug("temporarily staging old version", "staging", appBackup)
+	if err := os.Rename(BundlePath, appBackup); err != nil {
+		if !interactive {
+			// We don't want to prompt for permission if we're attempting to upgrade at startup
+			return fmt.Errorf("unable to upgrade in non-interactive mode with permission problems: %w", err)
+		}
+		// TODO actually inspect the error and look for permission problems before trying chown
+		slog.Warn("unable to backup old version due to permission problems, changing ownership", "error", err)
+		u, err := user.Current()
+		if err != nil {
+			return err
+		}
+		if !chownWithAuthorization(u.Username) {
+			return fmt.Errorf("unable to change permissions to complete upgrade")
+		}
+		if err := os.Rename(BundlePath, appBackup); err != nil {
+			return fmt.Errorf("unable to perform upgrade - failed to stage old version: %w", err)
+		}
+	}
+
+	// Get ready to try to unwind a partial upgade failure during unzip
+	// If something goes wrong, we attempt to put the old version back.
+	anyFailures := false
+	defer func() {
+		if anyFailures {
+			slog.Warn("upgrade failures detected, attempting to revert")
+			if err := os.RemoveAll(BundlePath); err != nil {
+				slog.Warn("failed to remove partial upgrade", "path", BundlePath, "error", err)
+				// At this point, we're basically hosed and the user will need to re-install
+				return
+			}
+			if err := os.Rename(appBackup, BundlePath); err != nil {
+				slog.Error("failed to revert to prior version", "path", contentsName, "error", err)
+			}
+		}
+	}()
+
+	// Bundle contents Ollama.app/Contents/...
+	links := []*zip.File{}
+	for _, f := range r.File {
+		s := strings.SplitN(f.Name, "/", 2)
+		if len(s) < 2 || s[1] == "" {
+			slog.Debug("skipping", "file", f.Name)
+			continue
+		}
+		name := s[1]
+		if strings.HasSuffix(name, "/") {
+			d, err := bundleEntryPath(BundlePath, name, bundleEntryRelative)
+			if err != nil {
+				anyFailures = true
+				return err
+			}
+			err = os.MkdirAll(d, 0o755)
+			if err != nil {
+				anyFailures = true
+				return fmt.Errorf("failed to mkdir %s: %w", d, err)
+			}
+			continue
+		}
+		if f.Mode()&os.ModeSymlink != 0 {
+			// Defer links to the end
+			links = append(links, f)
+			continue
+		}
+
+		destName, err := bundleEntryPath(BundlePath, name, bundleEntryRelative)
+		if err != nil {
+			anyFailures = true
+			return err
+		}
+		if err := extractBundleFile(f, destName, name); err != nil {
+			anyFailures = true
+			return err
+		}
+	}
+	for _, f := range links {
+		s := strings.SplitN(f.Name, "/", 2) // Strip off Ollama.app/
+		if len(s) < 2 || s[1] == "" {
+			slog.Debug("skipping link", "file", f.Name)
+			continue
+		}
+		name := s[1]
+		src, err := f.Open()
+		if err != nil {
+			anyFailures = true
+			return err
+		}
+		buf, err := io.ReadAll(src)
+		if err != nil {
+			anyFailures = true
+			return err
+		}
+		link := string(buf)
+		if link == "" {
+			anyFailures = true
+			return fmt.Errorf("bundle contains empty symlink %s", f.Name)
+		}
+		if filepath.IsAbs(link) {
+			anyFailures = true
+			return fmt.Errorf("bundle contains absolute symlink %s -> %s", f.Name, link)
+		}
+		if !validBundleLinkTarget(name, link, bundleEntryRelative) {
+			anyFailures = true
+			return fmt.Errorf("bundle contains invalid symlink %s -> %s", f.Name, link)
+		}
+		destName, err := bundleEntryPath(BundlePath, name, bundleEntryRelative)
+		if err != nil {
+			anyFailures = true
+			return err
+		}
+		if err = os.Symlink(link, destName); err != nil {
+			anyFailures = true
+			return err
+		}
+	}
+
+	f, err := os.OpenFile(UpgradeMarkerFile, os.O_RDONLY|os.O_CREATE, 0o666)
+	if err != nil {
+		slog.Warn("unable to create marker file", "file", UpgradeMarkerFile, "error", err)
+	}
+	f.Close()
+	// Make sure to remove the staged download now that we succeeded so we don't inadvertently try again.
+	cleanupOldDownloads(UpdateStageDir)
+
+	return nil
+}
+
+func DoPostUpgradeCleanup() error {
+	slog.Debug("post upgrade cleanup", "backup", appBackupDir)
+	err := os.RemoveAll(appBackupDir)
+	if err != nil {
+		return err
+	}
+	slog.Debug("post upgrade cleanup", "old", UpgradeMarkerFile)
+	return os.Remove(UpgradeMarkerFile)
+}
+
+func verifyDownload() error {
+	bundle := getStagedUpdate()
+	if bundle == "" {
+		return fmt.Errorf("failed to lookup downloads")
+	}
+	slog.Debug("verifying update", "bundle", bundle)
+
+	// Extract zip file into a temporary location so we can run the cert verification routines
+	dir, err := os.MkdirTemp("", "ollama_update_verify")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(dir)
+	r, err := zip.OpenReader(bundle)
+	if err != nil {
+		return fmt.Errorf("unable to open upgrade bundle %s: %w", bundle, err)
+	}
+	defer r.Close()
+	links := []*zip.File{}
+	for _, f := range r.File {
+		if strings.HasSuffix(f.Name, "/") {
+			d, err := bundleEntryPath(dir, f.Name, bundleEntryWithArchiveRoot)
+			if err != nil {
+				return err
+			}
+			err = os.MkdirAll(d, 0o755)
+			if err != nil {
+				return fmt.Errorf("failed to mkdir %s: %w", d, err)
+			}
+			continue
+		}
+		if f.Mode()&os.ModeSymlink != 0 {
+			// Defer links to the end
+			links = append(links, f)
+			continue
+		}
+		destName, err := bundleEntryPath(dir, f.Name, bundleEntryWithArchiveRoot)
+		if err != nil {
+			return err
+		}
+		if err := extractBundleFile(f, destName, f.Name); err != nil {
+			return err
+		}
+	}
+	for _, f := range links {
+		src, err := f.Open()
+		if err != nil {
+			return err
+		}
+		buf, err := io.ReadAll(src)
+		if err != nil {
+			return err
+		}
+		link := string(buf)
+		if link == "" {
+			return fmt.Errorf("bundle contains empty symlink %s", f.Name)
+		}
+		if filepath.IsAbs(link) {
+			return fmt.Errorf("bundle contains absolute symlink %s -> %s", f.Name, link)
+		}
+		if !validBundleLinkTarget(f.Name, link, bundleEntryWithArchiveRoot) {
+			return fmt.Errorf("bundle contains invalid symlink %s -> %s", f.Name, link)
+		}
+		destName, err := bundleEntryPath(dir, f.Name, bundleEntryWithArchiveRoot)
+		if err != nil {
+			return err
+		}
+		if err = os.Symlink(link, destName); err != nil {
+			return err
+		}
+	}
+
+	if err := verifyExtractedBundle(filepath.Join(dir, "Ollama.app")); err != nil {
+		return fmt.Errorf("signature verification failed: %s", err)
+	}
+	return nil
+}
+
+func bundleEntryPath(root, name string, scope bundleEntryScope) (string, error) {
+	cleanName := filepath.Clean(filepath.FromSlash(name))
+	if !filepath.IsLocal(cleanName) {
+		return "", fmt.Errorf("bundle contains invalid path: %s", name)
+	}
+	if scope == bundleEntryWithArchiveRoot && cleanName != updateArchiveRoot &&
+		!strings.HasPrefix(cleanName, updateArchiveRoot+string(os.PathSeparator)) {
+		return "", fmt.Errorf("bundle contains invalid path: %s", name)
+	}
+	return filepath.Join(root, cleanName), nil
+}
+
+func extractBundleFile(f *zip.File, destName, name string) error {
+	src, err := f.Open()
+	if err != nil {
+		return fmt.Errorf("failed to open bundle file %s: %w", name, err)
+	}
+	defer src.Close()
+
+	d := filepath.Dir(destName)
+	if _, err := os.Stat(d); err != nil {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			return fmt.Errorf("failed to mkdir %s: %w", d, err)
+		}
+	}
+
+	destFile, err := os.OpenFile(destName, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
+	if err != nil {
+		return fmt.Errorf("failed to open output file %s: %w", destName, err)
+	}
+	defer destFile.Close()
+
+	if _, err := io.Copy(destFile, src); err != nil {
+		return fmt.Errorf("failed to open extract file %s: %w", destName, err)
+	}
+	return nil
+}
+
+func validBundleLinkTarget(name, link string, scope bundleEntryScope) bool {
+	cleanTarget := filepath.Clean(filepath.Join(filepath.Dir(filepath.FromSlash(name)), filepath.FromSlash(link)))
+	if !filepath.IsLocal(cleanTarget) {
+		return false
+	}
+	return scope == bundleEntryRelative || cleanTarget == updateArchiveRoot ||
+		strings.HasPrefix(cleanTarget, updateArchiveRoot+string(os.PathSeparator))
+}
+
+// If we detect an upgrade bundle, attempt to upgrade at startup
+func DoUpgradeAtStartup() error {
+	bundle := getStagedUpdate()
+	if bundle == "" {
+		return fmt.Errorf("failed to lookup downloads")
+	}
+
+	if BundlePath == "" {
+		return fmt.Errorf("unable to upgrade at startup, app in development mode")
+	}
+
+	// [Re]verify before proceeding
+	if err := VerifyDownload(); err != nil {
+		_ = os.Remove(bundle)
+		slog.Warn("verification failure", "bundle", bundle, "error", err)
+		return nil
+	}
+	slog.Info("performing update at startup", "bundle", bundle)
+	return DoUpgrade(false)
+}
+
+func getStagedUpdate() string {
+	files, err := filepath.Glob(filepath.Join(UpdateStageDir, "*", "*.zip"))
+	if err != nil {
+		slog.Debug("failed to lookup downloads", "error", err)
+		return ""
+	}
+	if len(files) == 0 {
+		return ""
+	} else if len(files) > 1 {
+		// Shouldn't happen
+		slog.Warn("multiple update downloads found, using first one", "bundles", files)
+	}
+	return files[0]
+}
+
+func IsUpdatePending() bool {
+	return getStagedUpdate() != ""
+}
+
+func chownWithAuthorization(user string) bool {
+	u := C.CString(user)
+	defer C.free(unsafe.Pointer(u))
+	return (bool)(C.chownWithAuthorization(u))
+}
+
+func verifyExtractedBundle(path string) error {
+	p := C.CString(path)
+	defer C.free(unsafe.Pointer(p))
+	resp := C.verifyExtractedBundle(p)
+	if resp == nil {
+		return nil
+	}
+
+	return errors.New(C.GoString(resp))
+}
+
+//export goLogInfo
+func goLogInfo(msg *C.cchar_t) {
+	slog.Info(C.GoString(msg))
+}
+
+//export goLogDebug
+func goLogDebug(msg *C.cchar_t) {
+	slog.Debug(C.GoString(msg))
+}
+
+func alreadyMoved() string {
+	// Respect users intent if they chose "keep" vs. "replace" when dragging to Applications
+	installedAppPaths, err := filepath.Glob(filepath.Join(
+		strings.TrimSuffix(SystemWidePath, filepath.Ext(SystemWidePath))+"*"+filepath.Ext(SystemWidePath),
+		"Contents", "MacOS", "Ollama"))
+	if err != nil {
+		slog.Warn("failed to lookup installed app paths", "error", err)
+		return ""
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		slog.Warn("failed to resolve executable", "error", err)
+		return ""
+	}
+	self, err := os.Stat(exe)
+	if err != nil {
+		slog.Warn("failed to stat running executable", "path", exe, "error", err)
+		return ""
+	}
+	selfSys := self.Sys().(*syscall.Stat_t)
+	for _, installedAppPath := range installedAppPaths {
+		app, err := os.Stat(installedAppPath)
+		if err != nil {
+			slog.Debug("failed to stat installed app path", "path", installedAppPath, "error", err)
+			continue
+		}
+		appSys := app.Sys().(*syscall.Stat_t)
+
+		if appSys.Ino == selfSys.Ino {
+			return filepath.Dir(filepath.Dir(filepath.Dir(installedAppPath)))
+		}
+	}
+	return ""
+}

app/updater/updater_darwin.h

@@ -0,0 +1,16 @@
+#import <Cocoa/Cocoa.h>
+
+// TODO make these macros so we can extract line numbers from the native code
+void appLogInfo(NSString *msg);
+void appLogDebug(NSString *msg);
+void goLogInfo(const char *msg); 
+void goLogDebug(const char *msg); 
+
+
+AuthorizationRef getAuthorization(NSString *authorizationPrompt,
+                                  NSString *right);
+
+AuthorizationRef getAppInstallAuthorization();
+
+const char* verifyExtractedBundle(char *path);
+bool chownWithAuthorization(const char *user);

app/updater/updater_darwin.m

@@ -0,0 +1,182 @@
+#import "updater_darwin.h"
+#import <AppKit/AppKit.h>
+#import <Cocoa/Cocoa.h>
+#import <CoreServices/CoreServices.h>
+#import <Security/Security.h>
+#import <ServiceManagement/ServiceManagement.h>
+
+void appLogInfo(NSString *msg) {
+    NSLog(@"%@", msg);
+    goLogInfo([msg UTF8String]);
+}
+
+void appLogDebug(NSString *msg) {
+    NSLog(@"%@", msg);
+    goLogDebug([msg UTF8String]);
+}
+
+NSString *SystemWidePath = @"/Applications/Ollama.app";
+
+// TODO - how to detect if the user has admin access?
+// Possible APIs to explore:
+// - SFAuthorization
+// - CSIdentityQueryCreateForCurrentUser + CSIdentityQueryCreateForName(NULL,
+// CFSTR("admin"), kCSIdentityQueryStringEquals, kCSIdentityClassGroup,
+// CSGetDefaultIdentityAuthority());
+
+// Caller must call AuthorizationFree(authRef, kAuthorizationFlagDestroyRights)
+// once finished
+// TODO consider a struct response type to capture user cancel scenario from
+// other error/failure scenarios
+AuthorizationRef getAuthorization(NSString *authorizationPrompt,
+                                  NSString *right) {
+    appLogInfo([NSString stringWithFormat:@"XXX in getAuthorization"]);
+    AuthorizationRef authRef = NULL;
+    OSStatus err = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment,
+                                          kAuthorizationFlagDefaults, &authRef);
+    if (err != errAuthorizationSuccess) {
+        appLogInfo([NSString
+            stringWithFormat:
+                @"Failed to create authorization reference. Status = %d",
+                err]);
+        return NULL;
+    }
+    NSString *bundleIdentifier = [[NSBundle mainBundle] bundleIdentifier];
+    NSString *rightNameString =
+        [NSString stringWithFormat:@"%@.%@", bundleIdentifier, right];
+    const char *rightName = [rightNameString UTF8String];
+    appLogInfo([NSString stringWithFormat:@"XXX requesting right %@", rightNameString]);
+
+    OSStatus getRightResult = AuthorizationRightGet(rightName, NULL);
+    if (getRightResult == errAuthorizationDenied) {
+        // Create or update the right if it doesn't exist
+        if (AuthorizationRightSet(
+                authRef, rightName,
+                (__bridge CFTypeRef _Nonnull)(
+                    @(kAuthorizationRuleAuthenticateAsAdmin)),
+                (__bridge CFStringRef _Nullable)(authorizationPrompt), NULL,
+                NULL) != errAuthorizationSuccess) {
+            appLogInfo([NSString
+                stringWithFormat:
+                    @"Failed to set right for moving to /Applications"]);
+            AuthorizationFree(authRef, kAuthorizationFlagDestroyRights);
+            return NULL;
+        }
+    }
+    AuthorizationItem rightItem = {
+        .name = rightName, .valueLength = 0, .value = NULL, .flags = 0};
+    AuthorizationRights rights = {.count = 1, .items = &rightItem};
+    AuthorizationFlags flags =
+        (AuthorizationFlags)(kAuthorizationFlagExtendRights |
+                             kAuthorizationFlagInteractionAllowed);
+
+    err = AuthorizationCopyRights(authRef, &rights, NULL, flags, NULL);
+    if (err != errAuthorizationSuccess) {
+        if (err == errAuthorizationCanceled) {
+            appLogInfo([NSString
+                stringWithFormat:@"User cancelled authorization. Status = %d",
+                                 err]);
+            // TODO bubble up user cancel/reject so we can keep track
+
+        } else {
+            appLogInfo([NSString
+                stringWithFormat:@"failed to grant authorization. Status = %d",
+                                 err]);
+        }
+        AuthorizationFree(authRef, kAuthorizationFlagDestroyRights);
+        return NULL;
+    }
+    return authRef;
+}
+
+AuthorizationRef getAppInstallAuthorization() {
+    return getAuthorization(
+        @"Ollama needs additional permission to move or update itself as a "
+         "system-wide Application",
+        @"systemApplication");
+}
+
+bool chownWithAuthorization(const char *user) {
+    AuthorizationRef authRef = getAppInstallAuthorization();
+    if (authRef == NULL) {
+        return NO;
+    }
+    const char *chownTool = "/usr/sbin/chown";
+    const char *chownArgs[] = {"-R", user, [SystemWidePath UTF8String], NULL};
+
+    FILE *pipe = NULL;
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
+    OSStatus err = AuthorizationExecuteWithPrivileges(
+        authRef, chownTool, kAuthorizationFlagDefaults,
+        (char *const *)chownArgs, &pipe);
+#pragma clang diagnostic pop
+
+    if (err != errAuthorizationSuccess) {
+        appLogInfo([NSString
+            stringWithFormat:@"Failed to update ownership of %@  Status = %d",
+                             SystemWidePath, err]);
+        AuthorizationFree(authRef, kAuthorizationFlagDestroyRights);
+        return NO;
+    }
+
+    // wait for the command to finish
+    while (pipe && !feof(pipe)) {
+        fgetc(pipe);
+    }
+    if (pipe) {
+        fclose(pipe);
+    }
+    appLogDebug([NSString stringWithFormat:@"XXX finished chown"]);
+    AuthorizationFree(authRef, kAuthorizationFlagDestroyRights);
+    return true;
+}
+
+// nil if bundle is good, error string otherwise
+const char *verifyExtractedBundle(char *path) {
+    NSString *p = [NSString stringWithFormat:@"%s", path];
+
+    appLogDebug([NSString stringWithFormat:@"verifyExtractedBundle: %@", p]);
+    SecStaticCodeRef staticCode = NULL;
+
+    OSStatus result = SecStaticCodeCreateWithPath(
+        CFURLCreateFromFileSystemRepresentation(
+            (__bridge CFAllocatorRef)(kCFAllocatorSystemDefault),
+            (const UInt8 *)path, strlen(path), kCFStringEncodingMacRoman),
+        kSecCSDefaultFlags, &staticCode);
+
+    if (result != noErr) {
+        NSString *failureReason =
+            CFBridgingRelease(SecCopyErrorMessageString(result, NULL));
+        appLogDebug([NSString
+            stringWithFormat:@"Failed to get static code for bundle: %@",
+                             failureReason]);
+        if (staticCode != NULL)
+            CFRelease(staticCode);
+        return [[NSString
+            stringWithFormat:@"Failed to get static code for bundle:  %@",
+                             failureReason] UTF8String];
+    }
+
+    CFErrorRef validityError = NULL;
+    result = SecStaticCodeCheckValidityWithErrors(
+        staticCode, kSecCSCheckAllArchitectures, NULL, &validityError);
+
+    if (result != noErr) {
+        NSString *failureReason =
+            CFBridgingRelease(SecCopyErrorMessageString(result, NULL));
+        appLogDebug([NSString
+            stringWithFormat:@"Signatures did not verify on bundle: %@",
+                             failureReason]);
+
+        // TODO - consider extracting additional details from validityError
+
+        if (validityError != NULL)
+            CFRelease(validityError);
+        return [[NSString
+            stringWithFormat:@"Signatures did not verify on bundle: %@",
+                             failureReason] UTF8String];
+    }
+    appLogDebug([NSString stringWithFormat:@"bundle passed verification"]);
+    return NULL;
+}

app/updater/updater_live_test.go

@@ -0,0 +1,127 @@
+//go:build (windows || darwin) && updater_live
+
+package updater
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/ollama/ollama/app/store"
+	"github.com/ollama/ollama/app/version"
+)
+
+// TestLiveAppUpdate exercises the production update endpoint and downloads the
+// current OS update artifact. It is intentionally excluded from normal test
+// runs because it depends on ollama.com and downloads a release artifact.
+//
+// Run with:
+//
+//	go test -tags updater_live -run TestLiveAppUpdate ./app/updater
+func TestLiveAppUpdate(t *testing.T) {
+	const spoofedVersion = "0.20.0"
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	oldUpdateStageDir := UpdateStageDir
+	oldUpdateDownloaded := UpdateDownloaded
+	oldVerifyDownload := VerifyDownload
+	oldVersion := version.Version
+	defer func() {
+		UpdateStageDir = oldUpdateStageDir
+		UpdateDownloaded = oldUpdateDownloaded
+		VerifyDownload = oldVerifyDownload
+		version.Version = oldVersion
+	}()
+
+	version.Version = spoofedVersion
+
+	expectedFilename := ""
+	switch runtime.GOOS {
+	case "windows":
+		t.Setenv("LOCALAPPDATA", t.TempDir())
+		expectedFilename = "OllamaSetup.exe"
+	case "darwin":
+		expectedFilename = "Ollama-darwin.zip"
+	default:
+		t.Fatalf("unsupported updater live test OS %q", runtime.GOOS)
+	}
+
+	UpdateStageDir = filepath.Join(t.TempDir(), "updates")
+	UpdateDownloaded = false
+	verifyCalled := false
+	VerifyDownload = func() error {
+		verifyCalled = true
+		return verifyDownload()
+	}
+
+	updater := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "db.sqlite")}}
+	defer updater.Store.Close()
+
+	available, updateResp := updater.checkForUpdate(ctx)
+	if !available {
+		t.Fatalf("expected production update check to offer an update for spoofed version %s", spoofedVersion)
+	}
+	if updateResp.UpdateURL == "" {
+		t.Fatal("production update response did not include a download URL")
+	}
+	t.Logf("production update version=%q url=%q", updateResp.UpdateVersion, updateResp.UpdateURL)
+
+	if err := updater.DownloadNewRelease(ctx, updateResp); err != nil {
+		t.Fatalf("download production update: %v", err)
+	}
+
+	staged := getStagedUpdate()
+	if staged == "" {
+		t.Fatal("production update was not staged")
+	}
+	t.Logf("staged production update at %s", staged)
+
+	assertPathInsideDir(t, UpdateStageDir, staged)
+	if filepath.Base(staged) != expectedFilename {
+		t.Fatalf("expected staged %s update filename to be %q, got %q", runtime.GOOS, expectedFilename, filepath.Base(staged))
+	}
+	expectedExt := filepath.Ext(expectedFilename)
+	if filepath.Ext(staged) != expectedExt {
+		t.Fatalf("expected staged %s update to be a %s artifact, got %s", runtime.GOOS, expectedExt, staged)
+	}
+
+	info, err := os.Stat(staged)
+	if err != nil {
+		t.Fatalf("stat staged update: %v", err)
+	}
+	if info.Size() == 0 {
+		t.Fatal("staged production update is empty")
+	}
+
+	if !verifyCalled {
+		t.Fatal("DownloadNewRelease did not call VerifyDownload")
+	}
+	t.Logf("production updater download path verified staged %s update", runtime.GOOS)
+}
+
+func assertPathInsideDir(t *testing.T, dir, name string) {
+	t.Helper()
+
+	dir, err := filepath.Abs(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	name, err = filepath.Abs(name)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rel, err := filepath.Rel(dir, name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
+		t.Fatalf("staged update escaped update stage dir: %s", name)
+	}
+}

app/updater/updater_test.go

@@ -0,0 +1,642 @@
+//go:build windows || darwin
+
+package updater
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/ollama/ollama/app/store"
+)
+
+func TestUpdateStagePathRejectsUnsafeFilename(t *testing.T) {
+	stageDir := t.TempDir()
+	for _, tt := range []struct {
+		name     string
+		filename string
+	}{
+		{"empty", ""},
+		{"dot", "."},
+		{"dotdot", ".."},
+		{"posix_parent", "../OllamaSetup.exe"},
+		{"windows_parent", `..\OllamaSetup.exe`},
+		{"posix_absolute_tmp", "/tmp/OllamaSetup.exe"},
+		{"darwin_absolute_app", "/Applications/Ollama.app"},
+		{"darwin_bundle_path", "Ollama.app/Contents/MacOS/Ollama"},
+		{"darwin_user_download", "~/Downloads/Ollama-darwin.zip"},
+		{"windows_absolute", `C:\Users\Public\OllamaSetup.exe`},
+		{"colon", "Ollama:Setup.exe"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			if _, err := updateStagePath(stageDir, "etag", tt.filename); err == nil {
+				t.Fatal("expected unsafe filename to be rejected")
+			}
+		})
+	}
+}
+
+func TestUpdateStagePathHashesETag(t *testing.T) {
+	stageDir := t.TempDir()
+	stageFilename, err := updateStagePath(stageDir, `../escaped`, "OllamaSetup.exe")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rel, err := filepath.Rel(stageDir, stageFilename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
+		t.Fatalf("stage filename escaped stage dir: %s", stageFilename)
+	}
+	etagDir := filepath.Base(filepath.Dir(stageFilename))
+	if etagDir == ".." || etagDir == "escaped" || strings.ContainsAny(etagDir, `/\`) {
+		t.Fatalf("stage filename used raw etag path component: %s", stageFilename)
+	}
+}
+
+func TestIsNewReleaseAvailable(t *testing.T) {
+	slog.SetLogLoggerLevel(slog.LevelDebug)
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/update.json" {
+			w.Write([]byte(
+				fmt.Sprintf(`{"version": "9.9.9", "url": "%s"}`,
+					server.URL+"/9.9.9/"+Installer)))
+			// TODO - wire up the redirects to mimic real behavior
+		} else {
+			slog.Debug("unexpected request", "url", r.URL)
+		}
+	}))
+	defer server.Close()
+	slog.Debug("server", "url", server.URL)
+
+	updater := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "test.db")}}
+	defer updater.Store.Close() // Ensure database is closed
+	UpdateCheckURLBase = server.URL + "/update.json"
+	updatePresent, resp := updater.checkForUpdate(t.Context())
+	if !updatePresent {
+		t.Fatal("expected update to be available")
+	}
+	if resp.UpdateVersion != "9.9.9" {
+		t.Fatal("unexpected response", "url", resp.UpdateURL, "version", resp.UpdateVersion)
+	}
+}
+
+func TestDownloadNewReleaseRejectsUnsafeHeaderFilename(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	oldInstaller := Installer
+	oldVerifyDownload := VerifyDownload
+	oldUpdateDownloaded := UpdateDownloaded
+	defer func() {
+		Installer = oldInstaller
+		VerifyDownload = oldVerifyDownload
+		UpdateDownloaded = oldUpdateDownloaded
+	}()
+	Installer = "OllamaSetup.exe"
+	UpdateDownloaded = false
+	VerifyDownload = func() error {
+		t.Fatal("verification should not run for rejected downloads")
+		return nil
+	}
+
+	var getAttempted atomic.Bool
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodHead {
+			w.Header().Set("ETag", `"safe"`)
+			w.Header().Set("Content-Disposition", `attachment; filename="../OllamaSetup.exe"`)
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		getAttempted.Store(true)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	updater := &Updater{}
+	err := updater.DownloadNewRelease(t.Context(), UpdateResponse{UpdateURL: server.URL + "/download"})
+	if err == nil || !strings.Contains(err.Error(), "unsafe update filename") {
+		t.Fatalf("expected unsafe filename error, got %v", err)
+	}
+	if getAttempted.Load() {
+		t.Fatal("download should not continue after unsafe filename")
+	}
+	if _, err := os.Stat(filepath.Join(filepath.Dir(UpdateStageDir), "OllamaSetup.exe")); err == nil {
+		t.Fatal("download escaped update stage dir")
+	}
+}
+
+func TestDownloadNewReleaseDoesNotUseRawETagAsPathComponent(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	oldInstaller := Installer
+	oldVerifyDownload := VerifyDownload
+	oldUpdateDownloaded := UpdateDownloaded
+	defer func() {
+		Installer = oldInstaller
+		VerifyDownload = oldVerifyDownload
+		UpdateDownloaded = oldUpdateDownloaded
+	}()
+	Installer = "OllamaSetup.exe"
+	UpdateDownloaded = false
+	VerifyDownload = func() error {
+		return nil
+	}
+
+	payload := []byte("payload")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("ETag", `"../escaped"`)
+		w.WriteHeader(http.StatusOK)
+		if r.Method == http.MethodGet {
+			_, _ = w.Write(payload)
+		}
+	}))
+	defer server.Close()
+
+	updater := &Updater{}
+	if err := updater.DownloadNewRelease(t.Context(), UpdateResponse{UpdateURL: server.URL + "/download"}); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := os.Stat(filepath.Join(filepath.Dir(UpdateStageDir), "escaped", Installer)); err == nil {
+		t.Fatal("download escaped update stage dir via etag")
+	}
+
+	entries, err := os.ReadDir(UpdateStageDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 1 {
+		t.Fatalf("expected one staged update dir, got %d", len(entries))
+	}
+	stageFilename := filepath.Join(UpdateStageDir, entries[0].Name(), Installer)
+	got, err := os.ReadFile(stageFilename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(payload) {
+		t.Fatalf("unexpected staged payload %q", got)
+	}
+}
+
+func TestBackgroundCheckerSkipsAlreadyStagedETagDownload(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	oldInstaller := Installer
+	oldVerifyDownload := VerifyDownload
+	oldUpdateDownloaded := UpdateDownloaded
+	oldUpdateCheckInitialDelay := UpdateCheckInitialDelay
+	oldUpdateCheckInterval := UpdateCheckInterval
+	oldUpdateCheckURLBase := UpdateCheckURLBase
+	defer func() {
+		Installer = oldInstaller
+		VerifyDownload = oldVerifyDownload
+		UpdateDownloaded = oldUpdateDownloaded
+		UpdateCheckInitialDelay = oldUpdateCheckInitialDelay
+		UpdateCheckInterval = oldUpdateCheckInterval
+		UpdateCheckURLBase = oldUpdateCheckURLBase
+	}()
+	Installer = "OllamaSetup.exe"
+	UpdateDownloaded = false
+	UpdateCheckInitialDelay = time.Millisecond
+	UpdateCheckInterval = 5 * time.Millisecond
+
+	var verifyCount atomic.Int32
+	VerifyDownload = func() error {
+		verifyCount.Add(1)
+		return nil
+	}
+
+	headETag := `"old-update"`
+	getETag := `"download-response-etag"`
+	payload := []byte("payload")
+	var headCount atomic.Int32
+	var getCount atomic.Int32
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/update.json":
+			w.Write([]byte(
+				fmt.Sprintf(`{"version": "9.9.9", "url": "%s"}`,
+					server.URL+"/9.9.9/"+Installer)))
+		case "/9.9.9/" + Installer:
+			w.Header().Set("Content-Disposition", `attachment; filename="OllamaSetup.exe"`)
+			switch r.Method {
+			case http.MethodHead:
+				etag := headETag
+				if getCount.Load() > 0 {
+					etag = getETag
+				}
+				w.Header().Set("ETag", etag)
+				headCount.Add(1)
+				w.WriteHeader(http.StatusOK)
+			case http.MethodGet:
+				w.Header().Set("ETag", getETag)
+				getCount.Add(1)
+				w.WriteHeader(http.StatusOK)
+				_, _ = w.Write(payload)
+			default:
+				t.Errorf("unexpected request method %s", r.Method)
+				w.WriteHeader(http.StatusMethodNotAllowed)
+			}
+		default:
+			t.Errorf("unexpected request path %s", r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+	UpdateCheckURLBase = server.URL + "/update.json"
+
+	updater := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "test.db")}}
+	defer updater.Store.Close()
+	settings, err := updater.Store.Settings()
+	if err != nil {
+		t.Fatal(err)
+	}
+	settings.AutoUpdateEnabled = true
+	if err := updater.Store.SetSettings(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+
+	callbacks := make(chan string, 4)
+	updater.StartBackgroundUpdaterChecker(ctx, func(ver string) error {
+		callbacks <- ver
+		return nil
+	})
+
+	for range 2 {
+		select {
+		case <-callbacks:
+		case <-time.After(5 * time.Second):
+			t.Fatal("timed out waiting for repeated update checks")
+		}
+	}
+	cancel()
+
+	stageFilename, err := updateStagePath(UpdateStageDir, getETag, Installer)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := os.ReadFile(stageFilename)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(payload) {
+		t.Fatalf("unexpected staged payload %q", got)
+	}
+
+	if headCount.Load() < 2 {
+		t.Fatalf("HEAD count = %d, want at least 2", headCount.Load())
+	}
+	if getCount.Load() != 1 {
+		t.Fatalf("GET count = %d, want 1", getCount.Load())
+	}
+	if verifyCount.Load() != 1 {
+		t.Fatalf("verification count = %d, want 1", verifyCount.Load())
+	}
+	if !UpdateDownloaded {
+		t.Fatal("UpdateDownloaded should stay true for already staged update")
+	}
+}
+
+func TestBackgoundChecker(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	haveUpdate := false
+	verified := false
+	done := make(chan int)
+	cb := func(ver string) error {
+		haveUpdate = true
+		done <- 0
+		return nil
+	}
+	stallTimer := time.NewTimer(5 * time.Second)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	UpdateCheckInitialDelay = 5 * time.Millisecond
+	UpdateCheckInterval = 5 * time.Millisecond
+	VerifyDownload = func() error {
+		verified = true
+		return nil
+	}
+
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/update.json" {
+			w.Write([]byte(
+				fmt.Sprintf(`{"version": "9.9.9", "url": "%s"}`,
+					server.URL+"/9.9.9/"+Installer)))
+			// TODO - wire up the redirects to mimic real behavior
+		} else if r.URL.Path == "/9.9.9/"+Installer {
+			buf := &bytes.Buffer{}
+			zw := zip.NewWriter(buf)
+			zw.Close()
+			io.Copy(w, buf)
+		} else {
+			slog.Debug("unexpected request", "url", r.URL)
+		}
+	}))
+	defer server.Close()
+	UpdateCheckURLBase = server.URL + "/update.json"
+
+	updater := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "test.db")}}
+	defer updater.Store.Close()
+
+	settings, err := updater.Store.Settings()
+	if err != nil {
+		t.Fatal(err)
+	}
+	settings.AutoUpdateEnabled = true
+	if err := updater.Store.SetSettings(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	updater.StartBackgroundUpdaterChecker(ctx, cb)
+	select {
+	case <-stallTimer.C:
+		t.Fatal("stalled")
+	case <-done:
+		if !haveUpdate {
+			t.Fatal("no update received")
+		}
+		if !verified {
+			t.Fatal("unverified")
+		}
+	}
+}
+
+func TestAutoUpdateDisabledSkipsDownload(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	var downloadAttempted atomic.Bool
+	done := make(chan struct{})
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	UpdateCheckInitialDelay = 5 * time.Millisecond
+	UpdateCheckInterval = 5 * time.Millisecond
+	VerifyDownload = func() error {
+		return nil
+	}
+
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/update.json" {
+			w.Write([]byte(
+				fmt.Sprintf(`{"version": "9.9.9", "url": "%s"}`,
+					server.URL+"/9.9.9/"+Installer)))
+		} else if r.URL.Path == "/9.9.9/"+Installer {
+			downloadAttempted.Store(true)
+			buf := &bytes.Buffer{}
+			zw := zip.NewWriter(buf)
+			zw.Close()
+			io.Copy(w, buf)
+		}
+	}))
+	defer server.Close()
+	UpdateCheckURLBase = server.URL + "/update.json"
+
+	updater := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "test.db")}}
+	defer updater.Store.Close()
+
+	// Ensure auto-update is disabled
+	settings, err := updater.Store.Settings()
+	if err != nil {
+		t.Fatal(err)
+	}
+	settings.AutoUpdateEnabled = false
+	if err := updater.Store.SetSettings(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	cb := func(ver string) error {
+		t.Fatal("callback should not be called when auto-update is disabled")
+		return nil
+	}
+
+	updater.StartBackgroundUpdaterChecker(ctx, cb)
+
+	// Wait enough time for multiple check cycles
+	time.Sleep(50 * time.Millisecond)
+	close(done)
+
+	if downloadAttempted.Load() {
+		t.Fatal("download should not be attempted when auto-update is disabled")
+	}
+}
+
+func TestAutoUpdateReenabledDownloadsUpdate(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	var downloadAttempted atomic.Bool
+	callbackCalled := make(chan struct{}, 1)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	UpdateCheckInitialDelay = 5 * time.Millisecond
+	UpdateCheckInterval = 5 * time.Millisecond
+	VerifyDownload = func() error {
+		return nil
+	}
+
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/update.json" {
+			w.Write([]byte(
+				fmt.Sprintf(`{"version": "9.9.9", "url": "%s"}`,
+					server.URL+"/9.9.9/"+Installer)))
+		} else if r.URL.Path == "/9.9.9/"+Installer {
+			downloadAttempted.Store(true)
+			buf := &bytes.Buffer{}
+			zw := zip.NewWriter(buf)
+			zw.Close()
+			io.Copy(w, buf)
+		}
+	}))
+	defer server.Close()
+	UpdateCheckURLBase = server.URL + "/update.json"
+
+	upd := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "test.db")}}
+	defer upd.Store.Close()
+
+	// Start with auto-update disabled
+	settings, err := upd.Store.Settings()
+	if err != nil {
+		t.Fatal(err)
+	}
+	settings.AutoUpdateEnabled = false
+	if err := upd.Store.SetSettings(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	cb := func(ver string) error {
+		select {
+		case callbackCalled <- struct{}{}:
+		default:
+		}
+		return nil
+	}
+
+	upd.StartBackgroundUpdaterChecker(ctx, cb)
+
+	// Wait for a few cycles with auto-update disabled - no download should happen
+	time.Sleep(50 * time.Millisecond)
+	if downloadAttempted.Load() {
+		t.Fatal("download should not happen while auto-update is disabled")
+	}
+
+	// Re-enable auto-update
+	settings.AutoUpdateEnabled = true
+	if err := upd.Store.SetSettings(settings); err != nil {
+		t.Fatal(err)
+	}
+
+	// Wait for the checker to pick it up and download
+	select {
+	case <-callbackCalled:
+		// Success: download happened and callback was called after re-enabling
+		if !downloadAttempted.Load() {
+			t.Fatal("expected download to be attempted after re-enabling")
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("expected download and callback after re-enabling auto-update")
+	}
+}
+
+func TestCancelOngoingDownload(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	downloadStarted := make(chan struct{})
+	downloadCancelled := make(chan struct{})
+
+	ctx := t.Context()
+	VerifyDownload = func() error {
+		return nil
+	}
+
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/update.json" {
+			w.Write([]byte(
+				fmt.Sprintf(`{"version": "9.9.9", "url": "%s"}`,
+					server.URL+"/9.9.9/"+Installer)))
+		} else if r.URL.Path == "/9.9.9/"+Installer {
+			if r.Method == http.MethodHead {
+				w.Header().Set("Content-Length", "1000000")
+				w.WriteHeader(http.StatusOK)
+				return
+			}
+			// Signal that download has started
+			close(downloadStarted)
+			// Wait for cancellation or timeout
+			select {
+			case <-r.Context().Done():
+				close(downloadCancelled)
+				return
+			case <-time.After(5 * time.Second):
+				t.Error("download was not cancelled in time")
+			}
+		}
+	}))
+	defer server.Close()
+	UpdateCheckURLBase = server.URL + "/update.json"
+
+	updater := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "test.db")}}
+	defer updater.Store.Close()
+
+	_, resp := updater.checkForUpdate(ctx)
+
+	// Start download in goroutine
+	go func() {
+		_ = updater.DownloadNewRelease(ctx, resp)
+	}()
+
+	// Wait for download to start
+	select {
+	case <-downloadStarted:
+	case <-time.After(2 * time.Second):
+		t.Fatal("download did not start in time")
+	}
+
+	// Cancel the download
+	updater.CancelOngoingDownload()
+
+	// Verify cancellation was received
+	select {
+	case <-downloadCancelled:
+		// Success
+	case <-time.After(2 * time.Second):
+		t.Fatal("download cancellation was not received by server")
+	}
+}
+
+func TestTriggerImmediateCheck(t *testing.T) {
+	UpdateStageDir = t.TempDir()
+	checkCount := atomic.Int32{}
+	checkDone := make(chan struct{}, 10)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	// Set a very long interval so only TriggerImmediateCheck causes checks
+	UpdateCheckInitialDelay = 1 * time.Millisecond
+	UpdateCheckInterval = 1 * time.Hour
+	VerifyDownload = func() error {
+		return nil
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/update.json" {
+			checkCount.Add(1)
+			select {
+			case checkDone <- struct{}{}:
+			default:
+			}
+			// Return no update available
+			w.WriteHeader(http.StatusNoContent)
+		}
+	}))
+	defer server.Close()
+	UpdateCheckURLBase = server.URL + "/update.json"
+
+	updater := &Updater{Store: &store.Store{DBPath: filepath.Join(t.TempDir(), "test.db")}}
+	defer updater.Store.Close()
+
+	cb := func(ver string) error {
+		return nil
+	}
+
+	updater.StartBackgroundUpdaterChecker(ctx, cb)
+
+	// Wait for the initial check that fires after the initial delay
+	select {
+	case <-checkDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("initial check did not happen")
+	}
+
+	initialCount := checkCount.Load()
+
+	// Trigger immediate check
+	updater.TriggerImmediateCheck()
+
+	// Wait for the triggered check
+	select {
+	case <-checkDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("triggered check did not happen")
+	}
+
+	finalCount := checkCount.Load()
+	if finalCount <= initialCount {
+		t.Fatalf("TriggerImmediateCheck did not cause additional check: initial=%d, final=%d", initialCount, finalCount)
+	}
+}

app/updater/updater_windows.go

@@ -0,0 +1,413 @@
+package updater
+
+import (
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var runningInstaller string
+
+var (
+	crypt32              = windows.NewLazySystemDLL("crypt32.dll")
+	procCryptMsgGetParam = crypt32.NewProc("CryptMsgGetParam")
+	procCryptMsgClose    = crypt32.NewProc("CryptMsgClose")
+)
+
+const cmsgSignerInfoParam = 6
+
+type cmsgSignerInfo struct {
+	Version                 uint32
+	Issuer                  windows.CertNameBlob
+	SerialNumber            windows.CryptIntegerBlob
+	HashAlgorithm           windows.CryptAlgorithmIdentifier
+	HashEncryptionAlgorithm windows.CryptAlgorithmIdentifier
+	EncryptedHash           windows.CryptDataBlob
+	AuthAttrs               cryptAttributes
+	UnauthAttrs             cryptAttributes
+}
+
+type cryptAttributes struct {
+	Count      uint32
+	Attributes unsafe.Pointer
+}
+
+type OSVERSIONINFOEXW struct {
+	dwOSVersionInfoSize uint32
+	dwMajorVersion      uint32
+	dwMinorVersion      uint32
+	dwBuildNumber       uint32
+	dwPlatformId        uint32
+	szCSDVersion        [128]uint16
+	wServicePackMajor   uint16
+	wServicePackMinor   uint16
+	wSuiteMask          uint16
+	wProductType        uint8
+	wReserved           uint8
+}
+
+func init() {
+	VerifyDownload = verifyDownload
+	Installer = "Ollama-darwin.zip"
+	localAppData := os.Getenv("LOCALAPPDATA")
+	appDataDir := filepath.Join(localAppData, "Ollama")
+
+	// Use a distinct update staging directory from the old desktop app
+	// to avoid double upgrades on the transition
+	UpdateStageDir = filepath.Join(appDataDir, "updates_v2")
+
+	UpgradeLogFile = filepath.Join(appDataDir, "upgrade.log")
+	Installer = "OllamaSetup.exe"
+	runningInstaller = filepath.Join(appDataDir, Installer)
+	UpgradeMarkerFile = filepath.Join(appDataDir, "upgraded")
+
+	loadOSVersion()
+}
+
+func loadOSVersion() {
+	UserAgentOS = "Windows"
+	verInfo := OSVERSIONINFOEXW{}
+	verInfo.dwOSVersionInfoSize = (uint32)(unsafe.Sizeof(verInfo))
+	ntdll, err := windows.LoadDLL("ntdll.dll")
+	if err != nil {
+		slog.Warn("unable to find ntdll", "error", err)
+		return
+	}
+	defer ntdll.Release()
+	pRtlGetVersion, err := ntdll.FindProc("RtlGetVersion")
+	if err != nil {
+		slog.Warn("unable to locate RtlGetVersion", "error", err)
+		return
+	}
+	status, _, err := pRtlGetVersion.Call(uintptr(unsafe.Pointer(&verInfo)))
+	if status < 0x80000000 { // Success or Informational
+		// Note: Windows 11 reports 10.0.22000 or newer
+		UserAgentOS = fmt.Sprintf("Windows/%d.%d.%d", verInfo.dwMajorVersion, verInfo.dwMinorVersion, verInfo.dwBuildNumber)
+	} else {
+		slog.Warn("unable to get OS version", "error", err)
+	}
+}
+
+func getStagedUpdate() string {
+	// When transitioning from old to new app, cleanup the update from the old staging dir
+	// This can eventually be removed once enough time has passed since the transition
+	cleanupOldDownloads(filepath.Join(os.Getenv("LOCALAPPDATA"), "Ollama", "updates"))
+
+	files, err := filepath.Glob(filepath.Join(UpdateStageDir, "*", "*.exe"))
+	if err != nil {
+		slog.Debug("failed to lookup downloads", "error", err)
+		return ""
+	}
+	if len(files) == 0 {
+		return ""
+	} else if len(files) > 1 {
+		// Shouldn't happen
+		slog.Warn("multiple update downloads found, using first one", "bundles", files)
+	}
+	return files[0]
+}
+
+func DoUpgrade(interactive bool) error {
+	bundle := getStagedUpdate()
+	if bundle == "" {
+		return fmt.Errorf("failed to lookup downloads")
+	}
+
+	if err := VerifyDownload(); err != nil {
+		_ = os.Remove(bundle)
+		slog.Warn("verification failure", "bundle", bundle, "error", err)
+		return fmt.Errorf("staged update verification failed: %w", err)
+	}
+
+	// We move the installer to ensure we don't race with multiple apps starting in quick succession
+	if err := os.Rename(bundle, runningInstaller); err != nil {
+		return fmt.Errorf("unable to rename %s -> %s : %w", bundle, runningInstaller, err)
+	}
+
+	slog.Info("upgrade log file " + UpgradeLogFile)
+
+	// make the upgrade show progress, but non interactive
+	installArgs := []string{
+		"/CLOSEAPPLICATIONS",                    // Quit the tray app if it's still running
+		"/LOG=" + filepath.Base(UpgradeLogFile), // Only relative seems reliable, so set pwd
+		"/FORCECLOSEAPPLICATIONS",               // Force close the tray app - might be needed
+		"/SP",                                   // Skip the "This will install... Do you wish to continue" prompt
+		"/NOCANCEL",                             // Disable the ability to cancel upgrade mid-flight to avoid partially installed upgrades
+		"/SILENT",
+	}
+
+	if !interactive {
+		// Add flags to make it totally silent without GUI
+		installArgs = append(installArgs, "/VERYSILENT", "/SUPPRESSMSGBOXES")
+	}
+
+	slog.Info("starting upgrade", "installer", runningInstaller, "args", installArgs)
+	os.Chdir(filepath.Dir(UpgradeLogFile)) //nolint:errcheck
+	cmd := exec.Command(runningInstaller, installArgs...)
+
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("unable to start ollama app %w", err)
+	}
+
+	if cmd.Process != nil {
+		err := cmd.Process.Release()
+		if err != nil {
+			slog.Error(fmt.Sprintf("failed to release server process: %s", err))
+		}
+	} else {
+		// TODO - some details about why it didn't start, or is this a pedantic error case?
+		return errors.New("installer process did not start")
+	}
+
+	// If the install fails to upgrade the system, and leaves a functional
+	// app, this marker file will cause us to remove the staged upgrade
+	// bundle, which will prevent trying again until we download again.
+	// If this becomes looping a problem, we may need to look for failures
+	// in the upgrade log in DoPostUpgradeCleanup and then not download
+	// the same version again.
+	f, err := os.OpenFile(UpgradeMarkerFile, os.O_RDONLY|os.O_CREATE, 0o666)
+	if err != nil {
+		slog.Warn("unable to create marker file", "file", UpgradeMarkerFile, "error", err)
+	}
+	f.Close()
+
+	// TODO should we linger for a moment and check to make sure it's actually running by checking the pid?
+
+	slog.Info("Installer started in background, exiting")
+
+	os.Exit(0)
+	// Not reached
+	return nil
+}
+
+func DoPostUpgradeCleanup() error {
+	cleanupOldDownloads(UpdateStageDir)
+	err := os.Remove(UpgradeMarkerFile)
+	if err != nil {
+		slog.Warn("unable to clean up marker file", "marker", UpgradeMarkerFile, "error", err)
+	}
+	err = os.Remove(runningInstaller)
+	if err != nil {
+		slog.Debug("failed to remove running installer on first attempt, backgrounding...", "installer", runningInstaller, "error", err)
+		go func() {
+			for range 10 {
+				time.Sleep(5 * time.Second)
+				if err := os.Remove(runningInstaller); err == nil {
+					slog.Debug("installer cleaned up")
+					return
+				}
+				slog.Debug("failed to remove running installer on background attempt", "installer", runningInstaller, "error", err)
+			}
+		}()
+	}
+	return nil
+}
+
+func verifyDownload() error {
+	bundle := getStagedUpdate()
+	if bundle == "" {
+		return fmt.Errorf("failed to lookup downloads")
+	}
+	slog.Debug("verifying update", "bundle", bundle)
+
+	if err := verifyWindowsInstallerSignature(bundle); err != nil {
+		return fmt.Errorf("signature verification failed: %w", err)
+	}
+	return nil
+}
+
+func verifyWindowsInstallerSignature(filename string) error {
+	filename16, err := windows.UTF16PtrFromString(filename)
+	if err != nil {
+		return err
+	}
+
+	data := &windows.WinTrustData{
+		Size:             uint32(unsafe.Sizeof(windows.WinTrustData{})),
+		UIChoice:         windows.WTD_UI_NONE,
+		RevocationChecks: windows.WTD_REVOKE_WHOLECHAIN,
+		UnionChoice:      windows.WTD_CHOICE_FILE,
+		StateAction:      windows.WTD_STATEACTION_VERIFY,
+		UIContext:        windows.WTD_UICONTEXT_INSTALL,
+		FileOrCatalogOrBlobOrSgnrOrCert: unsafe.Pointer(&windows.WinTrustFileInfo{
+			Size:     uint32(unsafe.Sizeof(windows.WinTrustFileInfo{})),
+			FilePath: filename16,
+		}),
+	}
+
+	verifyErr := windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, data)
+	data.StateAction = windows.WTD_STATEACTION_CLOSE
+	closeErr := windows.WinVerifyTrustEx(windows.InvalidHWND, &windows.WINTRUST_ACTION_GENERIC_VERIFY_V2, data)
+	if verifyErr != nil {
+		return verifyErr
+	}
+	if closeErr != nil {
+		return fmt.Errorf("close WinVerifyTrust state: %w", closeErr)
+	}
+
+	subject, err := windowsInstallerSignerSubject(filename)
+	if err != nil {
+		return err
+	}
+	slog.Debug("verified update signature", "subject", subject)
+	return nil
+}
+
+func windowsInstallerSignerSubject(filename string) (string, error) {
+	filename16, err := windows.UTF16PtrFromString(filename)
+	if err != nil {
+		return "", err
+	}
+
+	var certStore windows.Handle
+	var msg windows.Handle
+	if err := windows.CryptQueryObject(
+		windows.CERT_QUERY_OBJECT_FILE,
+		unsafe.Pointer(filename16),
+		windows.CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED,
+		windows.CERT_QUERY_FORMAT_FLAG_BINARY,
+		0,
+		nil,
+		nil,
+		nil,
+		&certStore,
+		&msg,
+		nil,
+	); err != nil {
+		return "", err
+	}
+	defer windows.CertCloseStore(certStore, 0) //nolint:errcheck
+	defer cryptMsgClose(msg)                   //nolint:errcheck
+
+	var signerInfoSize uint32
+	if err := cryptMsgGetParam(msg, cmsgSignerInfoParam, 0, nil, &signerInfoSize); err != nil {
+		return "", err
+	}
+	if signerInfoSize == 0 {
+		return "", fmt.Errorf("missing signer info")
+	}
+
+	signerInfoBuf := make([]byte, signerInfoSize)
+	if err := cryptMsgGetParam(msg, cmsgSignerInfoParam, 0, unsafe.Pointer(&signerInfoBuf[0]), &signerInfoSize); err != nil {
+		return "", err
+	}
+	signerInfo := (*cmsgSignerInfo)(unsafe.Pointer(&signerInfoBuf[0]))
+	certInfo := windows.CertInfo{
+		Issuer:       signerInfo.Issuer,
+		SerialNumber: signerInfo.SerialNumber,
+	}
+
+	cert, err := windows.CertFindCertificateInStore(
+		certStore,
+		windows.X509_ASN_ENCODING|windows.PKCS_7_ASN_ENCODING,
+		0,
+		windows.CERT_FIND_SUBJECT_CERT,
+		unsafe.Pointer(&certInfo),
+		nil,
+	)
+	if err != nil {
+		return "", err
+	}
+	defer windows.CertFreeCertificateContext(cert) //nolint:errcheck
+
+	parsed, err := x509.ParseCertificate(unsafe.Slice(cert.EncodedCert, cert.Length))
+	if err != nil {
+		return "", err
+	}
+
+	for _, org := range parsed.Subject.Organization {
+		if org == "Ollama Inc." {
+			return parsed.Subject.String(), nil
+		}
+	}
+	return "", fmt.Errorf("unexpected signer: %s", parsed.Subject.String())
+}
+
+func cryptMsgGetParam(msg windows.Handle, paramType, index uint32, data unsafe.Pointer, size *uint32) error {
+	r1, _, e1 := procCryptMsgGetParam.Call(
+		uintptr(msg),
+		uintptr(paramType),
+		uintptr(index),
+		uintptr(data),
+		uintptr(unsafe.Pointer(size)),
+	)
+	if r1 == 0 {
+		if e1 != syscall.Errno(0) {
+			return e1
+		}
+		return syscall.EINVAL
+	}
+	return nil
+}
+
+func cryptMsgClose(msg windows.Handle) error {
+	r1, _, e1 := procCryptMsgClose.Call(uintptr(msg))
+	if r1 == 0 {
+		if e1 != syscall.Errno(0) {
+			return e1
+		}
+		return syscall.EINVAL
+	}
+	return nil
+}
+
+func IsUpdatePending() bool {
+	return getStagedUpdate() != ""
+}
+
+func DoUpgradeAtStartup() error {
+	return DoUpgrade(false)
+}
+
+func isInstallerRunning() bool {
+	return len(IsProcRunning(Installer)) > 0
+}
+
+func IsProcRunning(procName string) []uint32 {
+	pids := make([]uint32, 2048)
+	var ret uint32
+	if err := windows.EnumProcesses(pids, &ret); err != nil || ret == 0 {
+		slog.Debug("failed to check for running installers", "error", err)
+		return nil
+	}
+	pids = pids[:ret]
+	matches := []uint32{}
+	for _, pid := range pids {
+		if pid == 0 {
+			continue
+		}
+		hProcess, err := windows.OpenProcess(windows.PROCESS_QUERY_INFORMATION|windows.PROCESS_VM_READ, false, pid)
+		if err != nil {
+			continue
+		}
+		defer windows.CloseHandle(hProcess)
+		var module windows.Handle
+		var cbNeeded uint32
+		cb := (uint32)(unsafe.Sizeof(module))
+		if err := windows.EnumProcessModules(hProcess, &module, cb, &cbNeeded); err != nil {
+			continue
+		}
+		var sz uint32 = 1024 * 8
+		moduleName := make([]uint16, sz)
+		cb = uint32(len(moduleName)) * (uint32)(unsafe.Sizeof(uint16(0)))
+		if err := windows.GetModuleBaseName(hProcess, module, &moduleName[0], cb); err != nil && err != syscall.ERROR_INSUFFICIENT_BUFFER {
+			continue
+		}
+		exeFile := path.Base(strings.ToLower(syscall.UTF16ToString(moduleName)))
+		if strings.EqualFold(exeFile, procName) {
+			matches = append(matches, pid)
+		}
+	}
+	return matches
+}

app/updater/updater_windows_test.go

@@ -0,0 +1,88 @@
+//go:build windows
+
+package updater
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestVerifyDownloadRejectsUnsignedWindowsInstaller(t *testing.T) {
+	oldUpdateStageDir := UpdateStageDir
+	defer func() {
+		UpdateStageDir = oldUpdateStageDir
+	}()
+
+	t.Setenv("LOCALAPPDATA", t.TempDir())
+	UpdateStageDir = t.TempDir()
+	bundle := filepath.Join(UpdateStageDir, "etag", "OllamaSetup.exe")
+	if err := os.MkdirAll(filepath.Dir(bundle), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(bundle, []byte("not a signed installer"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	err := verifyDownload()
+	if err == nil || !strings.Contains(err.Error(), "signature verification failed") {
+		t.Fatalf("expected signature verification failure, got %v", err)
+	}
+}
+
+func TestDoUpgradeAtStartupRejectsUnsignedWindowsInstaller(t *testing.T) {
+	oldUpdateStageDir := UpdateStageDir
+	oldRunningInstaller := runningInstaller
+	oldUpgradeLogFile := UpgradeLogFile
+	oldUpgradeMarkerFile := UpgradeMarkerFile
+	oldVerifyDownload := VerifyDownload
+	defer func() {
+		UpdateStageDir = oldUpdateStageDir
+		runningInstaller = oldRunningInstaller
+		UpgradeLogFile = oldUpgradeLogFile
+		UpgradeMarkerFile = oldUpgradeMarkerFile
+		VerifyDownload = oldVerifyDownload
+	}()
+
+	t.Setenv("LOCALAPPDATA", t.TempDir())
+	UpdateStageDir = t.TempDir()
+	runDir := t.TempDir()
+	runningInstaller = filepath.Join(runDir, "OllamaSetup.exe")
+	UpgradeLogFile = filepath.Join(runDir, "upgrade.log")
+	UpgradeMarkerFile = filepath.Join(runDir, "upgraded")
+	VerifyDownload = verifyDownload
+
+	bundle := filepath.Join(UpdateStageDir, "etag", "OllamaSetup.exe")
+	if err := os.MkdirAll(filepath.Dir(bundle), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(bundle, []byte("not a signed installer"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	err := DoUpgradeAtStartup()
+	if err == nil || !strings.Contains(err.Error(), "signature verification failed") {
+		t.Fatalf("expected signature verification failure, got %v", err)
+	}
+	if _, err := os.Stat(runningInstaller); !os.IsNotExist(err) {
+		t.Fatalf("unsigned installer was moved before verification failed: %v", err)
+	}
+	if _, err := os.Stat(bundle); !os.IsNotExist(err) {
+		t.Fatalf("unsigned staged installer was not removed after verification failure: %v", err)
+	}
+}
+
+func TestIsInstallerRunning(t *testing.T) {
+	oldInstaller := Installer
+	defer func() {
+		Installer = oldInstaller
+	}()
+
+	slog.SetLogLoggerLevel(slog.LevelDebug)
+	Installer = "go.exe"
+	if !isInstallerRunning() {
+		t.Fatal("not running")
+	}
+}