{"record":{"id":"7d164214aef6c35c","repo":"zeroclaw-labs/zeroclaw","slug":"downloaded-binary-version-check-failed","errorCode":null,"errorMessage":"downloaded binary --version check failed","messagePattern":"downloaded binary --version check failed","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/commands/update.rs","lineNumber":721,"sourceCode":"        bail!(\n            \"downloaded binary too small ({} bytes), likely corrupt\",\n            meta.len()\n        );\n    }\n\n    // Check binary architecture before attempting execution so we can give\n    // a clear diagnostic instead of the opaque \"Exec format error (os error 8)\".\n    check_binary_arch(path).await?;\n\n    // Quick check: try running --version\n    let output = tokio::process::Command::new(path)\n        .arg(\"--version\")\n        .output()\n        .await\n        .context(\"cannot execute downloaded binary\")?;\n\n    if !output.status.success() {\n        bail!(\"downloaded binary --version check failed\");\n    }\n\n    let stdout = String::from_utf8_lossy(&output.stdout);\n    if !stdout.contains(\"zeroclaw\") {\n        bail!(\"downloaded binary does not appear to be zeroclaw\");\n    }\n\n    Ok(())\n}\n\nasync fn check_binary_arch(path: &Path) -> Result<()> {\n    use tokio::io::AsyncReadExt;\n\n    // Read only the header — enough to cover a PE file's DOS stub and reach the\n    // COFF machine field pointed to by `e_lfanew` (well under 4 KiB in practice)\n    // — instead of pulling the whole multi-megabyte binary into memory.\n    let mut header = Vec::new();\n    tokio::fs::File::open(path)","sourceCodeStart":703,"sourceCodeEnd":739,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/commands/update.rs#L703-L739","documentation":"As part of validate_binary, the updater executes the freshly downloaded binary with --version. The process spawned successfully (unlike the 'cannot execute downloaded binary' context error) but exited with a non-zero status. This usually means the binary runs but crashes on startup because the host cannot satisfy its runtime dependencies.","triggerScenarios":"`zeroclaw update` on a host where the downloaded binary starts then fails: glibc older than the release was built against, missing shared libraries, CPU without required instruction sets, or a sandbox restricting the child process.","commonSituations":"Old Debian/Ubuntu or RHEL base images with old glibc (binary built on a newer toolchain); missing libssl/libgcc at runtime; hardened sandboxes (seccomp/AppArmor) killing the child; gnu asset used on a host that needs the musl asset.","solutions":["Run the downloaded binary directly with --version from a shell to read the real stderr (e.g. '/lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.xx not found').","Check your glibc version with `ldd --version`; if it is older than the release requires, use a musl/static asset if the release provides one.","Install missing runtime libraries the error names.","Report the platform combination (OS, arch, glibc) against the release so packaging can cover it."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"# pre-flight: can this host run the release binary at all?\ncurl -fsSL <asset-url> -o /tmp/zeroclaw-test && chmod +x /tmp/zeroclaw-test\n/tmp/zeroclaw-test --version >/dev/null || echo 'host cannot run this build' >&2","typeGuard":null,"tryCatchPattern":"match run_update().await {\n    Err(e) if e.to_string().contains(\"--version check failed\") => {\n        // run the staged binary manually to capture stderr; typically a\n        // glibc/library problem: switch asset (musl) or update the host\n    }\n    other => other,\n}","preventionTips":["Pin update flows on minimal base images to musl/static builds when available.","Check `ldd --version` against the release's documented minimum glibc before updating.","Run a manual `--version` pre-flight of the downloaded asset on new host classes."],"tags":["update","binary-validation","glibc","runtime-dependencies"],"backgroundTag":"glibc-version-mismatch","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}