fix(update): never advertise a downgrade as an update; clear every stale BTCPay pin

The app store offered "update to 2.3.9" on a node already running 2.4.2 — the
release that fixes an actively exploited 2FA bypass. Taking it would have
rolled the node back onto the vulnerable version.

Root cause: available_update_for_images compared tags for inequality only.
Same repo + different tag meant "update available", with no ordering. Every
version claim upstream of it can go stale — the signed catalog, a legacy
catalog entry, the image-versions.sh baseline pin — and any one of them
lagging turned into a backwards Update button.

Guard added: when both tags parse as dotted-numeric versions, a lower pinned
version is never offered. Tags that cannot be ordered (RELEASE.2024-11-07…,
14-vectorchord0.4.3) keep the previous behaviour rather than silently losing
updates. This makes stale data fail safe, which matters more than any single
pin being correct.

Four sources still named 2.3.9, three of them able to act on it:
- releases/app-catalog.json — a LEGACY `btcpay` entry, distinct from
  `btcpay-server`, carrying a concrete 2.3.9 image. catalog_primary_image
  treats that as authoritative, so this is what drove the button. Fixed, but
  held back from this commit: it needs re-signing.
- scripts/image-versions.sh — the baseline pin used when the catalog does not
  cover an app.
- stacks.rs — the legacy BTCPay installer, twice. The fallback install path
  would have deployed 2.3.9 outright.
- neode-ui curatedApps/marketplaceData and public/catalog.json — the store's
  displayed version, hardcoded rather than read from the catalog, which is why
  it still showed 2.3.9 after the update landed.

Audited every other installer for the same shape. The remaining literals are
the immich stack, which currently agrees with its manifests; hits in
set_config.rs and app_catalog.rs are test fixtures. To keep it that way,
scripts/check-installer-image-pins.py asserts that any installer literal
naming the same repository as an app manifest carries the same tag, and runs
blocking in CI. Verified it catches a simulated revert to 2.3.9.

Tests: 13/13 in image_versions including the exact BTCPay case, a genuine
upgrade still offered, equal versions silent, prerelease suffixes ordered on
their numbers, and opaque tags unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/package/stacks.rs

@@ -1076,7 +1076,7 @@ impl RpcHandler {
         let images = [
             &format!("{}/postgres:15.17", REGISTRY),
             &format!("{}/nbxplorer:2.6.0", REGISTRY),
-            "docker.io/btcpayserver/btcpayserver:2.3.9",
+            "docker.io/btcpayserver/btcpayserver:2.4.2",
         ];
         self.set_install_phase("btcpay-server", InstallPhase::PullingImage)
             .await;
@@ -1233,7 +1233,7 @@ impl RpcHandler {
                     "BTCPAY_POSTGRES=User ID=btcpay;Password={};Host=archy-btcpay-db;Port=5432;Database=btcpay;Include Error Detail=true",
                     db_pass
                 ),
-                "docker.io/btcpayserver/btcpayserver:2.3.9",
+                "docker.io/btcpayserver/btcpayserver:2.4.2",
             ])
             .output()
             .await

core/archipelago/src/container/image_versions.rs

@@ -230,9 +230,54 @@ pub fn available_update_for_images(pinned: &str, running_image: &str) -> Option<
         return None;
     }
 
+    // Never advertise a LOWER version as an update.
+    //
+    // Everything upstream of here is a version claim that can go stale: the
+    // signed catalog, a legacy catalog entry with no manifest, the
+    // image-versions.sh baseline pin. When one lags behind what a node is
+    // actually running, a bare `pinned != running` check turns that staleness
+    // into an "Update" button that rolls the node BACKWARDS — and a rollback
+    // to a version withdrawn for a vulnerability is precisely the case where
+    // that must not happen. Observed with BTCPay: 2.4.2 installed, a stale
+    // 2.3.9 pin, and the UI offering "update" to the exploited release.
+    //
+    // Only suppress when both tags parse as comparable version numbers, so
+    // apps with opaque tags (RELEASE.2024-11-07T00-52-20Z, 14-vectorchord0.4.3)
+    // keep the previous behaviour rather than silently losing updates.
+    if let (Some(p), Some(r)) = (
+        parse_version_parts(&pinned_version),
+        parse_version_parts(&running_version),
+    ) {
+        if p < r {
+            return None;
+        }
+    }
+
     Some(pinned_version)
 }
 
+/// Numeric components of a version tag, for ordering comparisons only.
+///
+/// Accepts a leading `v` and a trailing pre-release suffix (`v0.18.4-beta`),
+/// comparing on the dotted numbers alone. Returns None when the tag is not a
+/// recognisable dotted-numeric version, which the caller treats as "cannot
+/// order these" rather than as equality.
+fn parse_version_parts(tag: &str) -> Option<Vec<u64>> {
+    let core = tag.strip_prefix('v').unwrap_or(tag);
+    // Drop a pre-release/build suffix: 0.18.4-beta -> 0.18.4
+    let core = core.split(['-', '+', '_']).next().unwrap_or(core);
+    if core.is_empty() {
+        return None;
+    }
+    let parts: Vec<&str> = core.split('.').collect();
+    let mut out = Vec::with_capacity(parts.len());
+    for part in parts {
+        // Any non-numeric component makes the whole tag unorderable.
+        out.push(part.parse::<u64>().ok()?);
+    }
+    Some(out)
+}
+
 /// Extract version tag from a full image reference.
 /// e.g. "source.archipelago-foundation.org/lfg2025/lnd:v0.18.4-beta" → "v0.18.4-beta"
 /// Returns "latest" if no tag or tag is empty.
@@ -417,4 +462,63 @@ NOT_AN_IMAGE="something"
         );
         assert_eq!(image_var_for_app("unknown-app"), None);
     }
+
+    /// The BTCPay case that prompted the guard: 2.4.2 shipped for an actively
+    /// exploited 2FA bypass, a stale 2.3.9 pin left in a legacy catalog entry,
+    /// and the UI offering the withdrawn release as an "update".
+    #[test]
+    fn never_advertises_a_downgrade_as_an_update() {
+        let stale = "docker.io/btcpayserver/btcpayserver:2.3.9";
+        let running = "docker.io/btcpayserver/btcpayserver:2.4.2";
+        assert_eq!(available_update_for_images(stale, running), None);
+    }
+
+    #[test]
+    fn still_advertises_a_genuine_upgrade() {
+        let pinned = "docker.io/btcpayserver/btcpayserver:2.4.2";
+        let running = "docker.io/btcpayserver/btcpayserver:2.3.9";
+        assert_eq!(
+            available_update_for_images(pinned, running),
+            Some("2.4.2".to_string())
+        );
+    }
+
+    #[test]
+    fn equal_versions_offer_nothing() {
+        let same = "docker.io/btcpayserver/btcpayserver:2.4.2";
+        assert_eq!(available_update_for_images(same, same), None);
+    }
+
+    #[test]
+    fn prerelease_suffixes_compare_on_their_numbers() {
+        let older = "example.test/lfg2025/lnd:v0.18.3-beta";
+        let newer = "example.test/lfg2025/lnd:v0.18.4-beta";
+        assert_eq!(available_update_for_images(older, newer), None);
+        assert_eq!(
+            available_update_for_images(newer, older),
+            Some("v0.18.4-beta".to_string())
+        );
+    }
+
+    /// Opaque tags stay on the old behaviour: we cannot order them, so a
+    /// difference is still reported rather than silently swallowed.
+    #[test]
+    fn unorderable_tags_keep_previous_behaviour() {
+        let a = "example.test/lfg2025/minio:RELEASE.2024-11-07T00-52-20Z";
+        let b = "example.test/lfg2025/minio:RELEASE.2024-10-01T00-00-00Z";
+        assert_eq!(
+            available_update_for_images(a, b),
+            Some("RELEASE.2024-11-07T00-52-20Z".to_string())
+        );
+    }
+
+    #[test]
+    fn parse_version_parts_rejects_non_numeric() {
+        assert_eq!(parse_version_parts("2.4.2"), Some(vec![2, 4, 2]));
+        assert_eq!(parse_version_parts("v0.18.4-beta"), Some(vec![0, 18, 4]));
+        assert_eq!(parse_version_parts("28.4"), Some(vec![28, 4]));
+        assert_eq!(parse_version_parts("RELEASE.2024-11-07T00-52-20Z"), None);
+        assert_eq!(parse_version_parts("14-vectorchord0.4.3"), Some(vec![14]));
+        assert_eq!(parse_version_parts("latest"), None);
+    }
 }