feat(update): compress agent transport with zstd #118
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/VA-116-transport-compression"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Publish a zstd-compressed transport sidecar alongside each agent binary and teach the in-band self-update path to decode a compressed payload, keeping the binary intentionally unstripped (VA-92). The agent advertises a dedicated agent-update compression capability so the server only sends compressed frames to agents that can decode them.
Protocol: add Capabilities::AGENT_UPDATE_ZSTD (0x200), distinct from the legacy gzip COMPRESSION (0x100) bit. Add UpdateCodec { Raw, Zstd } and carry it on AgentUpdate::Begin via a new KIND_BEGIN_ZSTD (2) wire byte, same tail shape as the raw Begin so the two are wire-compatible. The End-frame SHA-384 is always over the decompressed binary.
Agent: UpdateSession stages a zstd transfer's compressed frame at a distinct .update.zst sibling, then decompresses it into the .update swap path at finalize (pure-Rust ruzstd decoder, no libzstd link), hashing the decompressed output against the End hash. The raw path is unchanged. detect_capabilities advertises AGENT_UPDATE_ZSTD on every target.
Packaging: the release build produces a vervainagent-6.zst next to the raw binary and proves it is lossless in the build (zstd -d then cmp), so the existing raw .sig covers the decompressed bytes. The workflow uploads the sidecar to every channel.
Docs: release.Dockerfile no longer claims the binary is stripped; it states the binary is intentionally unstripped (VA-92) with size handled by compressing transport.
#VA-116
Publish a zstd-compressed transport sidecar alongside each agent binary and teach the in-band self-update path to decode a compressed payload, keeping the binary intentionally unstripped (VA-92). The agent advertises a dedicated agent-update compression capability so the server only sends compressed frames to agents that can decode them. Protocol: add Capabilities::AGENT_UPDATE_ZSTD (0x200), distinct from the legacy gzip COMPRESSION (0x100) bit. Add UpdateCodec { Raw, Zstd } and carry it on AgentUpdate::Begin via a new KIND_BEGIN_ZSTD (2) wire byte, same tail shape as the raw Begin so the two are wire-compatible. The End-frame SHA-384 is always over the decompressed binary. Agent: UpdateSession stages a zstd transfer's compressed frame at a distinct .update.zst sibling, then decompresses it into the .update swap path at finalize (pure-Rust ruzstd decoder, no libzstd link), hashing the decompressed output against the End hash. The raw path is unchanged. detect_capabilities advertises AGENT_UPDATE_ZSTD on every target. Packaging: the release build produces a vervainagent-6.zst next to the raw binary and proves it is lossless in the build (zstd -d then cmp), so the existing raw .sig covers the decompressed bytes. The workflow uploads the sidecar to every channel. Docs: release.Dockerfile no longer claims the binary is stripped; it states the binary is intentionally unstripped (VA-92) with size handled by compressing transport. #VA-116