Repair corrupted resource updates at current version

[floze-the-genius]

Summary

• reapply the signed current index when an auto-applied, no-restart resource updater detects local artifact corruption
• clear the corruption state after the repaired resources are installed
• add a regression test for same-version artifact repair

Root cause

The updater detects checksum mismatches while loading an installed index, but a normal update check still rejects the same signed index as already current. Intelligence resources therefore cannot repair a corrupted local artifact until the server publishes a newer index, and consumers such as filter-list ingestion keep retrying the damaged file.

This keeps the existing behavior for binary updates that require a restart and user confirmation. Only automatically applied resource updates are eligible for same-version self-repair.

Fixes #2188

Validation

• go test ./service/updates ./service/intel/filterlists -count=1
• go test -race ./service/updates -run 'TestPerformUpdate(RepairsCorruptedResourcesAtSameVersion)?$' -count=1
• go vet ./service/updates
• git diff --check

Summary by CodeRabbit

• Bug Fixes
  • Automatically repairs corrupted installed resources during startup when automatic updates are enabled.
  • Repairs can proceed even when the installed and available versions are identical.
  • Clears outdated corruption notifications after a successful repair.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 86912547-6220-4ef7-9ffd-bee02de46b4d

📥 Commits

Reviewing files that changed from the base of the PR and between af0c601 and 2671a1d.

📒 Files selected for processing (2)

• service/updates/module.go
• service/updates/updates_test.go

---

📝 Walkthrough

Walkthrough

The updater now reapplies the current signed index when eligible startup corruption is detected, bypassing version checks. After cleanup, it clears corruption state and notification data. A test covers repair of corrupted resources when installed and downloaded versions match.

Changes

Corrupted resource repair

Layer / File(s)	Summary
Repair workflow and validation service/updates/module.go, service/updates/updates_test.go	updateAndUpgrade enables same-version repair for corrupted installations with automatic updates, clears corruption state after cleanup, and tests successful artifact restoration.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: repairing corrupted resource updates at the current version.
Linked Issues check	✅ Passed	The change addresses #2188 by reapplying the current index to repair corrupted filter-list artifacts and clearing stale corruption state.
Out of Scope Changes check	✅ Passed	The PR stays focused on same-version repair logic and its regression test, with no obvious unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}