abcd update stages the verified release at the fixed name .abcd.new beside the target and opens it with O_CREATE|O_WRONLY|O_TRUNC, which follows a symlink planted at that name: the file the link points at is truncated and filled with the release bytes, and the swap then renames the symlink into the target's name, so the PATH entry becomes a link to that file. Precondition is write access to the install directory (which already lets one replace abcd), and the open was selfupdate.Apply's before the staging moved into Apply, so not a regression, but the open is owned code now.

abcd update stages the verified release at the fixed name .abcd.new beside the target and opens it with O_CREATE|O_WRONLY|O_TRUNC, which follows a symlink planted at that name: the file the link points at is truncated and filled with the release bytes, and the swap then renames the symlink into the target's name, so the PATH entry becomes a link to that file. Precondition is write access to the install directory (which already lets one replace abcd), and the open was selfupdate.Apply's before the staging moved into Apply, so not a regression, but the open is owned code now.

Grounds

• pursued: a symlink at .abcd.new leaves its victim untouched and the target a regular file holding the verified release; a victim holding the release bytes, or a symlink at the target's name after the swap, would show it wrong