# Nexus installer/update chain audit — hardening v1

**Dato:** 2026-06-05  
**Branch:** `integration/platform-sprint-before-phase1`  
**Target:** Build 89 / `0.1.0-installer1`

| Komponent | Fil/path | Risiko | Fix nødvendig | Status |
|-----------|----------|--------|---------------|--------|
| Manifest fetch | `UpdateService.CheckForUpdatesAsync` | Ugyldig JSON, BOM, HTTP fejl | Ja | **FIXET** — strip BOM, danske fejl, channel unavailable |
| SHA256 validering | `UpdateService.DownloadUpdateAsync` | Korrupt/tampered ZIP | Ja | **FIXET** — hash før staging |
| Process stop preflight | `NexusUpdateProcessStopper` | e_sqlite3 låst af kørende Identity | Ja | **FIXET** — kun Nexus under InstallRoot + PID-fil |
| Fil-lås preflight | `NexusUpdateFileLockChecker` | Expand/copy fejler silently | Ja | **FIXET** — exclusive open på dll/exe |
| Unrelated dotnet kill | `apply-pending-update.ps1` STOP | Dræber forkerte processer | Ja | **FIXET** — path-prefix match, ingen global dotnet |
| Hang i Preparing | `UpdateService` + job store | UI fast i "forbereder" | Ja | **FIXET** — 3 min timeout, Stale recovery |
| Hang i Applying | `NexusPlatformUpdateJobStore` | Script dør uden cleanup | Ja | **FIXET** — 10 min timeout, stale → Failed/Stale |
| Queue stuck | `NexusInstallQueue` | Parallel jobs | Ja | **FIXET** — 5 min job timeout |
| Data overskrives | `identity/` publish | SQLite i binary mappe | Ja | **FIXET** — `data/nexus-identity.db` |
| Versioneret staging | `apply-pending-update.ps1` | In-place zip extract | Ja | **FIXET** — `versions\{build}\` → copy |
| Rollback ved fejl | `apply-pending-update.ps1` | Brækket install efter partial copy | Ja | **FIXET** — `versions\_previous` backup/restore |
| Shell lukker ikke | `UpdateInfoViewModel.InstallAsync` | safe-poc holder filer låst | Ja | **FIXET** — Shutdown ved Scheduled |
| Persisted job | `%LocalAppData%\NinjaNexus\update\pending-job.json` | Restart mid-update | Ja | **FIXET** — job store + recovery |
| UI retry/cancel/clear | `UpdateInfoWindow` + ViewModel | Bruger fastlåst | Ja | **FIXET** — Prøv igen, Annuller, Ryd fastlåst |
| Danske fejltekster | UpdateService, ViewModel, lock checker | Uklar UX | Ja | **FIXET** |
| POC apply script | `scripts/nexus-laptop-poc/apply-pending-update.ps1` | Mangler i install | Nej (POC) | **OK** — kopieres med pakke |
| Build/publish | `build-package.ps1`, `build-installer.ps1` | Forkert manifest | Ja | **FIXET** — build 89 notes |
| CDN upload | `publish-coolify.ps1`, `tools/publish-nexus-update.ps1` | SHA mismatch remote | Nej | **OK** — remote verify |
| NexusSetup.exe | `source/nexus-installer/` | Første install | Nej (scope) | **OK** — embedded payload |
| Code signing | manifest `signature` | MITM | Fremtid | **PENDING** — SHA256 only i POC |
| Atomisk junction swap | `current` → `versions\{build}` | Langsom disk race | Fremtid | **DOKUMENTERET** — copy-based i v1 |
| Nexus Agent proces | Embedded i Shell | N/A separat exe | Nej | **OK** — stop via NexusShell only |
| Admin/UAC | Installer | Elevation | Nej (POC) | **OK** — user-writable POC path |
| Antivirus | ZIP extract | Slow lock | Delvis | **MITIGERET** — retry/backoff i apply script |

## Flow (efter hardening)

```
Check manifest → Download → SHA256 → Ready
  → Preparing (stop Nexus, lock check, 3 min timeout)
  → Applying (apply-pending-update.ps1, 10 min timeout)
  → versions\{build} extract → backup _previous → copy shell/identity
  → verify → restart → Completed | Failed+rollback
```
