feat(updater): prefer CERNET PyPI source packages for releases - #10041
Open
Soulter wants to merge 1 commit into
Open
feat(updater): prefer CERNET PyPI source packages for releases#10041Soulter wants to merge 1 commit into
Soulter wants to merge 1 commit into
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
astrbot-docs | 9af89d4 | Commit Preview URL Branch Preview URL |
Sep 11 2026, 04:41 AM |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="astrbot/core/updater.py" line_range="265-337" />
<code_context>
+ "Checking the PyPI mirror for the update...",
+ 0,
+ )
+ mirror_prepared = await self._download_pypi_package(
+ target_version,
+ core_zip_path,
+ dashboard_zip_path,
+ progress_callback=dashboard_progress,
</code_context>
<issue_to_address>
**nitpick:** The PyPI source-distribution download reports every progress payload through `dashboard_progress`, so the source download is presented as WebUI progress and no Core download progress is emitted while the Core archive is being fetched and prepared.
**Triggers:** When a progress callback is supplied during a successful PyPI mirror update.
**Suggested fix:** Use a distinct Core progress callback for the source download, or emit separate progress events for the source and bundled Dashboard preparation.
</issue_to_address>Sourcery assessment
Needs a human reviewer. The updater now makes the CERNET mirror a trusted source for executable AstrBot code and bundled assets, with the mirror supplying both the archive and its SHA-256 digest. If that trust decision or package is wrong, users can persistently install incorrect or malicious code; reverting the updater would not undo files already installed.
Comment on lines
+265
to
337
| mirror_prepared = await self._download_pypi_package( | ||
| target_version, | ||
| core_zip_path, | ||
| dashboard_zip_path, | ||
| progress_callback=dashboard_progress, | ||
| ) | ||
| if mirror_prepared: | ||
| await emit_progress( | ||
| "dashboard", "done", "Bundled WebUI prepared from PyPI.", 45 | ||
| ) | ||
| await emit_progress( | ||
| "core", "done", "AstrBot source prepared from PyPI.", 90 | ||
| ) | ||
| else: | ||
| if target_version.startswith("v") and target_release is None: | ||
| releases = await self._fetch_release_info(self._release_api) | ||
| target_release = next( | ||
| ( | ||
| release | ||
| for release in releases | ||
| if release["tag_name"] == target_version | ||
| ), | ||
| None, | ||
| ) | ||
| if target_release is None: | ||
| raise RuntimeError( | ||
| f"No update package was found for version {target_version}." | ||
| ) | ||
|
|
||
| await emit_progress( | ||
| "dashboard", | ||
| "running", | ||
| "正在下载 WebUI...", | ||
| 0, | ||
| ) | ||
| await _download_package( | ||
| path=str(dashboard_zip_path), | ||
| version=target_version, | ||
| proxy=proxy, | ||
| progress_callback=dashboard_progress, | ||
| extract=False, | ||
| allow_insecure_ssl_fallback=False, | ||
| ) | ||
| await emit_progress( | ||
| "dashboard", | ||
| "done", | ||
| "WebUI 下载完成。", | ||
| 45, | ||
| ) | ||
|
|
||
| await emit_progress( | ||
| "core", | ||
| "running", | ||
| "正在下载 AstrBot 项目代码...", | ||
| 45, | ||
| ) | ||
| await self._download_core_package( | ||
| latest=False, | ||
| version=target_version, | ||
| proxy=proxy, | ||
| path=core_zip_path, | ||
| progress_callback=core_progress, | ||
| release_data=target_release, | ||
| ) | ||
| await emit_progress( | ||
| "core", | ||
| "done", | ||
| "项目代码下载完成。", | ||
| 90, | ||
| ) | ||
| await emit_progress( | ||
| "core", | ||
| "running", | ||
| "正在下载 AstrBot 项目代码...", | ||
| 45, | ||
| ) | ||
| await self._download_core_package( | ||
| latest=False, | ||
| version=target_version, | ||
| proxy=proxy, | ||
| path=core_zip_path, | ||
| progress_callback=core_progress, | ||
| release_data=target_release, | ||
| ) | ||
| await emit_progress( | ||
| "core", | ||
| "done", | ||
| "项目代码下载完成。", | ||
| 90, | ||
| ) | ||
|
|
||
| await emit_progress( | ||
| "verify", |
Contributor
There was a problem hiding this comment.
nitpick: The PyPI source-distribution download reports every progress payload through dashboard_progress, so the source download is presented as WebUI progress and no Core download progress is emitted while the Core archive is being fetched and prepared.
Triggers: When a progress callback is supplied during a successful PyPI mirror update.
Suggested fix: Use a distinct Core progress callback for the source download, or emit separate progress events for the source and bundled Dashboard preparation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release updates currently download Core and WebUI separately from hosted storage or GitHub. First check the CERNET PyPI mirror for the exact release's source distribution and use both its source tree and
astrbot/dashboard/distwhen the package is valid.Based directly on
master, independently of the workspace preview changes. Includes regression coverage for mirror success, fallback, archive validation, and update restrictions.Validation: tests were not rerun for this PR, as requested by the maintainer.
Summary by Sourcery
Prefer validated CERNET PyPI packages for release updates while retaining safe fallback and existing installation-specific update paths.
New Features:
Bug Fixes:
Enhancements:
Tests: