[nabil1440]

Change

• golang.org/x/mod/semver compares the versions. Thus v0.1.10 is newer than v0.1.9.
• A git describe version (v0.1.1-2-gabc, -dirty) counts as its tag.
• fly cannot compare a build that is not from a release tag (dev). fly update tells this and asks before it installs the latest release.
• fly reads the release information one time, with a 60 s timeout, a User-Agent header and a status check.
• A GitHub rate limit gives a clear error. Before this change, it gave "You are already running the latest version."
• archive/tar and compress/gzip extract the binary. The code does not start the tar command.
• The new binary goes to a temporary file in the directory of the executable. Then a rename replaces the executable. Thus the rename cannot cross filesystems (EXDEV).
• If the update fails, the old binary does not change.
• The asset names and the archive layout do not change.

Tests

• Unit tests:
  • a table of version comparisons
  • GitHub API responses (httptest): 200, 403 rate limit, 500, and a response without a tag
  • asset selection
  • binary replacement, and no change to the old binary when the archive is bad
• An end-to-end test in a Linux container, as root. /tmp is on tmpfs. A local server replaces GitHub:
  • v0.1.9 updates to v0.1.10.
  • A second run shows "You are already running the latest version."
  • No temporary files stay in /usr/local/bin.
  • A user who is not root gets exit status 1.
• golangci-lint shows 0 issues on the full repository. govulncheck finds no vulnerabilities.

Closes #8