fix(update): never advertise a downgrade as an update; clear every stale BTCPay pin

The app store offered "update to 2.3.9" on a node already running 2.4.2 — the
release that fixes an actively exploited 2FA bypass. Taking it would have
rolled the node back onto the vulnerable version.

Root cause: available_update_for_images compared tags for inequality only.
Same repo + different tag meant "update available", with no ordering. Every
version claim upstream of it can go stale — the signed catalog, a legacy
catalog entry, the image-versions.sh baseline pin — and any one of them
lagging turned into a backwards Update button.

Guard added: when both tags parse as dotted-numeric versions, a lower pinned
version is never offered. Tags that cannot be ordered (RELEASE.2024-11-07…,
14-vectorchord0.4.3) keep the previous behaviour rather than silently losing
updates. This makes stale data fail safe, which matters more than any single
pin being correct.

Four sources still named 2.3.9, three of them able to act on it:
- releases/app-catalog.json — a LEGACY `btcpay` entry, distinct from
  `btcpay-server`, carrying a concrete 2.3.9 image. catalog_primary_image
  treats that as authoritative, so this is what drove the button. Fixed, but
  held back from this commit: it needs re-signing.
- scripts/image-versions.sh — the baseline pin used when the catalog does not
  cover an app.
- stacks.rs — the legacy BTCPay installer, twice. The fallback install path
  would have deployed 2.3.9 outright.
- neode-ui curatedApps/marketplaceData and public/catalog.json — the store's
  displayed version, hardcoded rather than read from the catalog, which is why
  it still showed 2.3.9 after the update landed.

Audited every other installer for the same shape. The remaining literals are
the immich stack, which currently agrees with its manifests; hits in
set_config.rs and app_catalog.rs are test fixtures. To keep it that way,
scripts/check-installer-image-pins.py asserts that any installer literal
naming the same repository as an app manifest carries the same tag, and runs
blocking in CI. Verified it catches a simulated revert to 2.3.9.

Tests: 13/13 in image_versions including the exact BTCPay case, a genuine
upgrade still offered, equal versions silent, prerelease suffixes ordered on
their numbers, and opaque tags unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/check-installer-image-pins.py

@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""Fail when a hardcoded installer image tag disagrees with the app manifest.
+
+The legacy stack installers in core/archipelago/src/api/rpc/package/stacks.rs
+carry image references as string literals. Those literals are a second source of
+truth for a version, sitting behind the manifest and the signed catalog, and
+nothing keeps them in step.
+
+That is not cosmetic. BTCPay shipped 2.4.2 for an actively exploited 2FA bypass
+on 2026-08-07 while the legacy installer still named 2.3.9, so the fallback
+install path would have deployed the withdrawn release. The same shape applies
+to any app whose installer literal is left behind.
+
+The rule enforced here: if an installer literal names the same image repository
+as an app manifest, the tags must match. Repositories with no manifest are
+ignored, and so are floating tags, which carry no version claim.
+
+Usage:
+  scripts/check-installer-image-pins.py
+  scripts/check-installer-image-pins.py --show
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+
+import yaml
+
+# Files that pin images as literals on an install path. Test modules inside them
+# are stripped before scanning: fixtures deliberately name old versions.
+INSTALLER_SOURCES = [
+    "core/archipelago/src/api/rpc/package/stacks.rs",
+]
+
+FLOATING_TAGS = {"latest", "stable", "release", "main", "edge"}
+
+IMAGE_RE = re.compile(r'"([a-z0-9][a-z0-9._-]*(?:\.[a-z]+|:[0-9]+)?/[a-z0-9._/-]+:[A-Za-z0-9._-]+)"')
+
+
+def strip_test_modules(text: str) -> str:
+    """Remove #[cfg(test)] modules so fixture literals are not treated as pins."""
+    marker = "#[cfg(test)]"
+    idx = text.find(marker)
+    return text if idx == -1 else text[:idx]
+
+
+def repo_of(image: str) -> str:
+    """Image repository without registry host or tag."""
+    without_tag = image.rsplit(":", 1)[0] if ":" in image.rsplit("/", 1)[-1] else image
+    head, _, rest = without_tag.partition("/")
+    if "." in head or ":" in head or head == "localhost":
+        return rest
+    return without_tag
+
+
+def tag_of(image: str) -> str:
+    last = image.rsplit("/", 1)[-1]
+    return last.rsplit(":", 1)[1] if ":" in last else "latest"
+
+
+def manifest_images(repo_root: Path) -> dict[str, tuple[str, str]]:
+    """{image repo: (tag, manifest path)} across apps/*/manifest.yml."""
+    out: dict[str, tuple[str, str]] = {}
+    for path in sorted((repo_root / "apps").glob("*/manifest.yml")):
+        try:
+            data = yaml.safe_load(path.read_text(encoding="utf-8"))
+        except Exception:
+            continue
+        app = (data or {}).get("app")
+        if not isinstance(app, dict):
+            continue
+        image = (app.get("container") or {}).get("image")
+        if isinstance(image, str) and image:
+            out[repo_of(image)] = (tag_of(image), str(path.relative_to(repo_root)))
+    return out
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--repo", default=".")
+    parser.add_argument("--show", action="store_true")
+    args = parser.parse_args()
+
+    repo_root = Path(args.repo)
+    manifests = manifest_images(repo_root)
+    problems: list[str] = []
+    checked = 0
+
+    for rel in INSTALLER_SOURCES:
+        path = repo_root / rel
+        if not path.exists():
+            continue
+        text = strip_test_modules(path.read_text(encoding="utf-8"))
+        for line_no, line in enumerate(text.splitlines(), start=1):
+            for image in IMAGE_RE.findall(line):
+                repo = repo_of(image)
+                if repo not in manifests:
+                    continue
+                tag = tag_of(image)
+                manifest_tag, manifest_path = manifests[repo]
+                checked += 1
+                if args.show:
+                    print(f"  {rel}:{line_no}  {repo}:{tag}  (manifest {manifest_tag})")
+                if tag in FLOATING_TAGS or manifest_tag in FLOATING_TAGS:
+                    continue
+                if tag != manifest_tag:
+                    problems.append(
+                        f"{rel}:{line_no}\n"
+                        f"    installer pins {repo}:{tag}\n"
+                        f"    manifest wants {repo}:{manifest_tag}  ({manifest_path})"
+                    )
+
+    if problems:
+        print("")
+        print("Installer image pins disagree with their app manifests:")
+        for problem in problems:
+            print(f"\n  {problem}")
+        print("")
+        print("An installer literal left behind deploys the older image on the")
+        print("fallback install path — which is how a withdrawn, vulnerable")
+        print("release gets installed after it has supposedly been replaced.")
+        print("Update the literal to match the manifest.")
+        return 1
+
+    print(f"OK: {checked} installer image pin(s) agree with their app manifests.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/image-versions.sh

@@ -25,7 +25,7 @@ MEMPOOL_WEB_IMAGE="$ARCHY_REGISTRY/mempool-frontend:v3.0.1"
 MARIADB_IMAGE="$ARCHY_REGISTRY/mariadb:11.4.10"
 
 # BTCPay
-BTCPAY_IMAGE="docker.io/btcpayserver/btcpayserver:2.3.9"
+BTCPAY_IMAGE="docker.io/btcpayserver/btcpayserver:2.4.2"
 NBXPLORER_IMAGE="$ARCHY_REGISTRY/nbxplorer:2.6.0"
 POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"
 BTCPAY_POSTGRES_IMAGE="$ARCHY_REGISTRY/postgres:15.17"