fix: place updater in same directory as update.sh

[algolucky]

Summary

Fixes #2581

While downloading and installing the updater, the commands were not specific about which directories to download and unarchive. Because of this, if update.sh was in $PATH and was executed from a different directory, the updater archive would be installed in the $PWD causing the script to not function as expected (download remaining tools), and would not error out.

This solves that by creating a temporary directory and modifying the commands around installing the updater more explicit to make sure that updater is in the same directory as update.sh.

This also adds a -verify command line flag (defaults to false). If set, update.sh will check if GPG and checksum validation is possible on linux systems, if so, the signature, public key, and checksum file will be downloaded and used to verify the updater archive.

Test Plan

Can use this test script or the one referenced in #2581

[CLAassistant]

All committers have signed the CLA.

[codecov]

Codecov Report

Merging #3983 (3563b5d) into master (aa82b9a) will increase coverage by 4.71%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #3983      +/-   ##
==========================================
+ Coverage   49.76%   54.48%   +4.71%     
==========================================
  Files         409      390      -19     
  Lines       69157    48500   -20657     
==========================================
- Hits        34419    26423    -7996     
+ Misses      31014    19858   -11156     
+ Partials     3724     2219    -1505     

Impacted Files	Coverage Δ
ledger/roundlru.go	90.56% <0.00%> (-5.67%)	⬇️
cmd/algoh/blockWatcher.go	77.77% <0.00%> (-3.18%)	⬇️
catchup/service.go	68.64% <0.00%> (-0.25%)	⬇️
network/wsNetwork.go	62.79% <0.00%> (ø)
crypto/merklearray/msgp_gen.go
data/hashable/msgp_gen.go
agreement/msgp_gen.go
data/account/msgp_gen.go
crypto/compactcert/msgp_gen.go
compactcert/msgp_gen.go
... and 23 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update aa82b9a...3563b5d. Read the comment docs.

[algobarb]

Thanks for adding the comment

[onetechnical]

I didn't run this, but it looks good on the surface. We should augment the test cases with something like:

• Run on darwin
• Run on linux, with gpg and sha256sum
• Run on linux, with gpg and without sha256sum
• Run on linux, without gpg and with sha256sum
• Run on linux without gpg and without sha256sum

[algolucky]

I've added the -verify flag, and set it to false by default. This way a user would have to explicitly acknowledge this change instead of it opening up the possibility of unattended side-effects on systems that the script is unaware of.

[onetechnical]

Thanks for the update; preserving behavior is nice. Thinking about how we want to communicate this is a good idea too.

[winder]

LGTM. I updated Sandbox to use one of the earlier drafts, I didn't realize the checksum/verify additions were coming.