From 113d49038ae2952407e5d54edb64b4e9a3828ad9 Mon Sep 17 00:00:00 2001
From: vgsml <gribanov.vladimir@gmail.com>
Date: Thu, 22 Oct 2026 23:11:02 +0200
Subject: [PATCH 1/3] spec 019: CLUSTER UPDATE EXTENSION keeps what it does not
 name

An update rewrote the item's repository (resolved again with no FROM, which its grammar did not take: moved on a node
trusting one repository, refused on one trusting several) and its comment (written empty). Now an update without FROM
keeps the item's repository (still one the node trusts), without COMMENT its comment; FROM moves it. Found by
hugr-platform spec 010's review (the console's update form).

The install test takes postgres_scanner as DuckDB publishes it for this build's version and platform (DuckDB v2.0.0 is
released): every build runs it, not only one that makes the scanner.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
---
 docs/cluster.md                        |  5 +-
 specs/019-cluster-update-keeps/spec.md | 33 ++++++++++++
 src/acl_cluster.cpp                    | 72 ++++++++++++++++++++------
 test/cpp/test_acl_cluster_install.cpp  | 55 +++++++++++++++-----
 4 files changed, 132 insertions(+), 33 deletions(-)
 create mode 100644 specs/019-cluster-update-keeps/spec.md

diff --git a/docs/cluster.md b/docs/cluster.md
index 2e9ab1b..577830b 100644
--- a/docs/cluster.md
+++ b/docs/cluster.md
@@ -27,7 +27,7 @@ placed; `manage` and `passthrough` are placed like anyone.
 
 ```sql
 CLUSTER INSTALL EXTENSION <name> VERSION '<v>' [FROM <repository>] [IN GROUP <group>] [COMMENT '<text>']
-CLUSTER UPDATE  EXTENSION <name> VERSION '<v>' [IN GROUP <group>]
+CLUSTER UPDATE  EXTENSION <name> VERSION '<v>' [FROM <repository>] [IN GROUP <group>] [COMMENT '<text>']
 CLUSTER REMOVE  EXTENSION <name> [IN GROUP <group>]
 CLUSTER ATTACH '<path>' AS <alias> (TYPE <type> [, SECRET <secret>] [, <option> [<value>]] …)
         [LINEAGE '<identity>'] [DEPENDS ON (<alias>, …)] [IN GROUP <group>] [COMMENT '<text>']
@@ -96,7 +96,8 @@ in its heartbeat; the orchestrator rolls the nodes (hugr-node spec 010, hugr-pla
   path the node's tokens travel).
   Only a GLOBAL setting may be profiled.
 - **Extensions come from a trusted repository.** `FROM` names a repository created with duckdb's
-  `CREATE EXTENSION REPOSITORY`; with exactly one, it may be left out. A path, a URL, `core` and
+  `CREATE EXTENSION REPOSITORY`; with exactly one, an install may leave it out. An update keeps what it does not name
+  (spec 019): without `FROM` the item's repository (still one the node trusts), without `COMMENT` its comment. A path, a URL, `core` and
   `community` are refused, and `VERSION` is required.
   - duckdb installs such an extension under `repositories/<repository>/` and loads it with
     `LOAD <name> FROM <repository>`.
diff --git a/specs/019-cluster-update-keeps/spec.md b/specs/019-cluster-update-keeps/spec.md
new file mode 100644
index 0000000..0f38eae
--- /dev/null
+++ b/specs/019-cluster-update-keeps/spec.md
@@ -0,0 +1,33 @@
+# Spec 019: `CLUSTER UPDATE EXTENSION` keeps what it does not name
+
+- **Status**: implemented
+- **Date**: 2026-10-22
+- **Author**: hugr lab (found by hugr-platform spec 010's review - the console's update form inherits it; the owner,
+  2026-10-22: fix it)
+
+## Problem
+
+An update rewrote two parts of the item it did not name:
+
+- **The repository** was resolved again with no `FROM`, and the grammar took none for an update. On a node trusting
+  one repository the item silently moved to it. On a node trusting several, every update was refused with "name the
+  repository with FROM" - which the statement could not do.
+- **The comment** was written empty: the upsert takes the statement's comment, and an update without `COMMENT` has
+  none.
+
+## Design
+
+- `CLUSTER UPDATE EXTENSION <name> VERSION '<v>' [FROM <repository>] [IN GROUP <group>] [COMMENT '<text>']`:
+  - without `FROM`, the item's stored repository - which must still be one this node trusts (else the refusal names
+    it and asks for `FROM`);
+  - with `FROM`, that repository, checked as an install's;
+  - without `COMMENT`, the stored comment; with it, the new one.
+- An install is unchanged: without `FROM` only on a node trusting exactly one repository.
+
+## Tests
+
+`test/cpp/test_acl_cluster_install.cpp`:
+- an update with no `FROM` keeps the item's repository and its comment;
+- with a second repository trusted, an update with no `FROM` keeps the stored one, and is not refused;
+- `FROM` an untrusted repository is refused, writing nothing;
+- `COMMENT` replaces the comment.
diff --git a/src/acl_cluster.cpp b/src/acl_cluster.cpp
index c457266..11f03d3 100644
--- a/src/acl_cluster.cpp
+++ b/src/acl_cluster.cpp
@@ -341,6 +341,14 @@ string CurrentSpec(const ReadFn &read, CatalogBackend &catalog, const string &sc
 	return row->RowCount() == 0 ? string() : row->Collection().GetValue(0, 0).ToString();
 }
 
+//! The item's stored comment ("" when it has none)
+string CurrentComment(const ReadFn &read, CatalogBackend &catalog, const string &scope, const string &kind,
+                      const string &name) {
+	auto row = read("SELECT coalesce(\"comment\", '') FROM " + catalog.Tbl("cluster_items") + " WHERE \"scope\" = " +
+	                Lit(scope) + " AND \"kind\" = " + Lit(kind) + " AND lower(\"name\") = lower(" + Lit(name) + ")");
+	return row->RowCount() == 0 ? string() : row->Collection().GetValue(0, 0).ToString();
+}
+
 string UpsertItem(CatalogBackend &catalog, const string &scope, const string &kind, const string &name,
                   const string &spec, const string &item_class, const string &comment, bool keep_pos) {
 	auto table = catalog.Tbl("cluster_items");
@@ -493,6 +501,17 @@ PolicyStore::ClusterAnswer PolicyStore::ClusterExtension(const string &verb, con
 	ClusterAnswer answer;
 	answer.item_class = v == "install" ? "hot" : "restart";
 	string repo = repository;
+	vector<string> trusted; // the node's user-provided repositories
+	auto require_trusted = [&](const string &candidate) {
+		for (auto &n : trusted) {
+			if (StringUtil::CIEquals(n, candidate)) {
+				return;
+			}
+		}
+		throw BinderException("acl cluster: \"%s\" is not a trusted repository of this node - the profile installs "
+		                      "only from a repository created with CREATE EXTENSION REPOSITORY",
+		                      candidate);
+	};
 	if (v != "remove") {
 		if (version.empty()) {
 			throw BinderException("acl cluster: an extension in the profile names its VERSION - every node installs "
@@ -503,27 +522,21 @@ PolicyStore::ClusterAnswer PolicyStore::ClusterExtension(const string &verb, con
 		auto repos = NodeQuery(*db, "SELECT repository_name FROM duckdb_extension_repositories() WHERE type = "
 		                            "'USER_PROVIDED' ORDER BY 1");
 		ResultRows rows(*repos);
-		vector<string> names;
 		for (idx_t i = 0; i < rows.Count(); i++) {
-			names.push_back(rows.GetValue(0, i).ToString());
+			trusted.push_back(rows.GetValue(0, i).ToString());
 		}
-		if (repo.empty()) {
-			if (names.size() != 1) {
+		// spec 019: an update without FROM keeps the item's repository - read with the item, below
+		if (repo.empty() && v == "install") {
+			if (trusted.size() != 1) {
 				throw BinderException("acl cluster: name the repository with FROM <name> - this node trusts %s",
-				                      names.empty()
+				                      trusted.empty()
 				                          ? string("no user-provided repository (CREATE EXTENSION REPOSITORY)")
-				                          : StringUtil::Join(names, ", "));
+				                          : StringUtil::Join(trusted, ", "));
 			}
-			repo = names[0];
-		}
-		bool known = false;
-		for (auto &n : names) {
-			known = known || StringUtil::CIEquals(n, repo);
+			repo = trusted[0];
 		}
-		if (!known) {
-			throw BinderException("acl cluster: \"%s\" is not a trusted repository of this node - the profile installs "
-			                      "only from a repository created with CREATE EXTENSION REPOSITORY",
-			                      repo);
+		if (!repo.empty()) {
+			require_trusted(repo);
 		}
 	}
 	answer.version = catalog->WriteWithReads(
@@ -553,12 +566,37 @@ PolicyStore::ClusterAnswer PolicyStore::ClusterExtension(const string &verb, con
 			    statements.push_back(DeleteItem(*catalog, scope, "extension", name));
 			    return;
 		    }
+		    // spec 019: an update keeps what it does not name - the item's repository (still one this node
+		    // trusts) and its comment
+		    auto note = comment;
+		    if (v == "update") {
+			    if (repository.empty()) {
+				    repo = JsonField(current, "repository");
+				    for (auto &n : trusted) {
+					    if (StringUtil::CIEquals(n, repo)) {
+						    repo = n;
+					    }
+				    }
+				    bool known = false;
+				    for (auto &n : trusted) {
+					    known = known || n == repo;
+				    }
+				    if (!known) {
+					    throw BinderException("acl cluster: extension \"%s\" comes from \"%s\", which this node no "
+					                          "longer trusts - name its repository with FROM",
+					                          name, repo);
+				    }
+			    }
+			    if (note.empty()) {
+				    note = CurrentComment(read, *catalog, scope, "extension", name);
+			    }
+		    }
 		    // spec 103: version and repository only - DuckDB verifies the repository's signature at every
 		    // INSTALL and LOAD, and a released version is immutable there; a hash of the signed file would
 		    // change with every key rotation and differ per channel for the same code
 		    auto spec = JsonObjectOf({{"version", version}, {"repository", repo}});
 		    statements.push_back(
-		        UpsertItem(*catalog, scope, "extension", name, spec, answer.item_class, comment, !current.empty()));
+		        UpsertItem(*catalog, scope, "extension", name, spec, answer.item_class, note, !current.empty()));
 	    },
 	    "config_version",
 	    [&](int64_t) {
@@ -1473,7 +1511,7 @@ unique_ptr<SQLStatement> ParseCluster(AdminScanner &s) {
 		for (;;) {
 			if (verb != "remove" && s.Accept("version")) {
 				version = s.Quoted("version");
-			} else if (verb == "install" && s.Accept("from")) {
+			} else if (verb != "remove" && s.Accept("from")) { // spec 019: an update may move the item
 				repository = s.NameValue("a repository name");
 			} else if (verb != "remove" && s.Accept("sha256")) {
 				// spec 103: refused, never ignored - a script that still pins a hash must not believe it does
diff --git a/test/cpp/test_acl_cluster_install.cpp b/test/cpp/test_acl_cluster_install.cpp
index 7439793..5237196 100644
--- a/test/cpp/test_acl_cluster_install.cpp
+++ b/test/cpp/test_acl_cluster_install.cpp
@@ -3,9 +3,9 @@
 // a version and a repository - the repository's signature, which DuckDB verifies at every INSTALL and
 // LOAD, is the integrity check, and a SHA256 clause is refused. The repository is a local directory in duckdb's
 // versioned layout
-// (<repo>/<name>/<version>/<revision>/<platform>/<name>.duckdb_extension.gz), holding this build's
-// own postgres_scanner - a loadable built against this exact duckdb. Skipped when the build has none
-// (a plain build: postgres_scanner comes with ACL_INTEGRATION=1).
+// (<repo>/<name>/<version>/<revision>/<platform>/<name>.duckdb_extension.gz), holding postgres_scanner as DuckDB
+// publishes it for this build's version and platform (extensions.duckdb.org - DuckDB v2.0.0 is released, spec 019):
+// every build runs the test, not only one that makes the scanner. Skipped when it cannot be fetched (offline).
 // Build + run via `GEN=ninja make test-cpp`.
 
 #include "acl_test_util.hpp"
@@ -14,7 +14,6 @@
 #include "duckdb/main/extension_helper.hpp"
 
 #include <cstdlib>
-#include <sys/stat.h>
 #include <unistd.h>
 
 using namespace duckdb;
@@ -22,7 +21,8 @@ using namespace acl_test;
 
 namespace {
 
-const char *const LOADABLE = "build/release/extension/postgres_scanner/postgres_scanner.duckdb_extension";
+//! DuckDB's own repository: what kista mirrors
+const char *const PUBLISHED = "https://extensions.duckdb.org";
 
 //! A valid RSA public key (duckdb's own repository test key): the repository needs one pinned; the
 //! loadable is unsigned, which allow_unsigned_extensions admits in this test only
@@ -50,11 +50,6 @@ bool Refused(Connection &con, const std::string &sql, const std::string &why) {
 
 int main() {
 	return RunMain("the cluster profile installs from a trusted repository (specs 093, 103)", [] {
-		struct stat info;
-		if (stat(LOADABLE, &info) != 0) {
-			std::cout << "  SKIP: no postgres_scanner loadable in this build (ACL_INTEGRATION=1 builds one)\n";
-			return;
-		}
 		char root[] = "/tmp/acl-cluster-XXXXXX";
 		if (!Check(mkdtemp(root) != nullptr, "a directory of the test's own")) {
 			return;
@@ -64,10 +59,14 @@ int main() {
 		           DuckDB::Platform();
 		Check(std::system(("mkdir -p '" + dir + "' '" + base + "/repos' '" + base + "/ext'").c_str()) == 0,
 		      "the repository's layout");
-		Check(
-		    std::system(("gzip -c '" + std::string(LOADABLE) + "' > '" + dir + "/postgres_scanner.duckdb_extension.gz'")
-		                    .c_str()) == 0,
-		    "the extension in it");
+		auto url = std::string(PUBLISHED) + "/" + ExtensionHelper::GetVersionDirectoryName() + "/" +
+		           DuckDB::Platform() + "/postgres_scanner.duckdb_extension.gz";
+		if (std::system(
+		        ("curl -fsSL --max-time 120 -o '" + dir + "/postgres_scanner.duckdb_extension.gz' '" + url + "'")
+		            .c_str()) != 0) {
+			std::cout << "  SKIP: " << url << " could not be fetched\n";
+			return;
+		}
 
 		DBConfig config;
 		config.SetOptionByName("allow_extension_repositories", Value("allowed"));
@@ -109,6 +108,34 @@ int main() {
 			        "spec 103");
 		});
 
+		Scenario("an update keeps the repository and the comment it does not name (spec 019)", [&] {
+			One(con, "ACL ADMIN CLUSTER UPDATE EXTENSION postgres_scanner VERSION 'v9.9.9' COMMENT 'the lake''s'");
+			Check(One(con, "SELECT comment FROM acl_cluster_items() WHERE name = 'postgres_scanner'") == "the lake's",
+			      "COMMENT sets the comment");
+			// a second trusted repository: an update naming none keeps the item's, never refused for the choice
+			Exec(con, "CREATE EXTENSION REPOSITORY other WITH PREFIX '" + base + "/repo' USING PUBLIC KEY '" +
+			              PUBLIC_KEY + "'");
+			auto answer = One(con, "ACL ADMIN CLUSTER UPDATE EXTENSION postgres_scanner VERSION 'v9.9.10'");
+			Check(answer.find("'class': restart") != std::string::npos, "an update with two repositories: " + answer);
+			auto spec = One(con, "SELECT spec FROM acl_cluster_items() WHERE name = 'postgres_scanner'");
+			Check(spec.find("\"repository\": \"trusted\"") != std::string::npos &&
+			          spec.find("\"version\": \"v9.9.10\"") != std::string::npos,
+			      "the item's repository kept, its version moved: " + spec);
+			Check(One(con, "SELECT comment FROM acl_cluster_items() WHERE name = 'postgres_scanner'") == "the lake's",
+			      "and its comment kept");
+			Refused(con, "ACL ADMIN CLUSTER UPDATE EXTENSION postgres_scanner VERSION 'v9.9.11' FROM nowhere",
+			        "not a trusted repository");
+			Check(One(con, "SELECT spec FROM acl_cluster_items() WHERE name = 'postgres_scanner'") == spec,
+			      "a refused update writes nothing");
+			One(con, "ACL ADMIN CLUSTER UPDATE EXTENSION postgres_scanner VERSION 'v9.9.10' FROM other");
+			Check(One(con, "SELECT spec FROM acl_cluster_items() WHERE name = 'postgres_scanner'")
+			              .find("\"repository\": \"other\"") != std::string::npos,
+			      "FROM moves the item to another trusted repository");
+			// an install still names its repository when the node trusts several
+			Refused(con, "ACL ADMIN CLUSTER INSTALL EXTENSION mysql_scanner VERSION 'v1'",
+			        "name the repository with FROM");
+		});
+
 		Scenario("an update or a removal is restart class: described, not applied live", [&] {
 			auto answer = One(con, "ACL ADMIN CLUSTER UPDATE EXTENSION postgres_scanner VERSION 'v9.9.10'");
 			Check(answer.find("'class': restart") != std::string::npos &&

From f4bb765480f5405836729b7a4819d3cd4d4ede46 Mon Sep 17 00:00:00 2001
From: vgsml <gribanov.vladimir@gmail.com>
Date: Thu, 22 Oct 2026 23:11:36 +0200
Subject: [PATCH 2/3] spec 019: the stored repository's check, plainer

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
---
 src/acl_cluster.cpp | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/src/acl_cluster.cpp b/src/acl_cluster.cpp
index 11f03d3..96c6ee5 100644
--- a/src/acl_cluster.cpp
+++ b/src/acl_cluster.cpp
@@ -572,14 +572,9 @@ PolicyStore::ClusterAnswer PolicyStore::ClusterExtension(const string &verb, con
 		    if (v == "update") {
 			    if (repository.empty()) {
 				    repo = JsonField(current, "repository");
-				    for (auto &n : trusted) {
-					    if (StringUtil::CIEquals(n, repo)) {
-						    repo = n;
-					    }
-				    }
 				    bool known = false;
 				    for (auto &n : trusted) {
-					    known = known || n == repo;
+					    known = known || StringUtil::CIEquals(n, repo);
 				    }
 				    if (!known) {
 					    throw BinderException("acl cluster: extension \"%s\" comes from \"%s\", which this node no "

From 957be826dca6d5ba512ba5b3acd051be29053b8e Mon Sep 17 00:00:00 2001
From: vgsml <gribanov.vladimir@gmail.com>
Date: Thu, 22 Oct 2026 23:23:20 +0200
Subject: [PATCH 3/3] spec 019: the bootstrap e2e takes kista's pinned release,
 not its main

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LdLs2iBQygBKtsApdH9Sxi
---
 specs/019-cluster-update-keeps/spec.md | 7 +++++++
 test/e2e/bootstrap/run.sh              | 5 ++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/specs/019-cluster-update-keeps/spec.md b/specs/019-cluster-update-keeps/spec.md
index 0f38eae..9ef0042 100644
--- a/specs/019-cluster-update-keeps/spec.md
+++ b/specs/019-cluster-update-keeps/spec.md
@@ -31,3 +31,10 @@ An update rewrote two parts of the item it did not name:
 - with a second repository trusted, an update with no `FROM` keeps the stored one, and is not refused;
 - `FROM` an untrusted repository is refused, writing nothing;
 - `COMMENT` replaces the comment.
+
+## Also
+
+The bootstrap e2e cloned kista's main, which moved (its spec 0030: a version names its core extensions) and failed
+this PR's CI from outside. It now takes the kista release the platform's umbrella chart pins (`KISTA_REF`, v0.1.4), as
+the platform's demo pins its node. `scripts/publish_to_kista.sh` follows kista's new rule when the chart moves to a
+release with it.
diff --git a/test/e2e/bootstrap/run.sh b/test/e2e/bootstrap/run.sh
index 2610eab..0c51f66 100755
--- a/test/e2e/bootstrap/run.sh
+++ b/test/e2e/bootstrap/run.sh
@@ -188,7 +188,10 @@ docker exec "$PG_CONTAINER" pg_isready -U postgres >/dev/null 2>&1 || fail "Post
 if [ -n "${REPOSITORY_DIR:-}" ]; then
 	kista_src="$(cd "$REPOSITORY_DIR" && pwd)"
 else
-	git clone -q --depth 1 https://github.com/hugr-lab/duckdb-extension-repository "$TMP/kista-src" || fail "no kista"
+	# the release the platform's umbrella chart pins (hugr-platform charts/hugr), never main: kista's main moves
+	# (its spec 0030 asks a version's core extensions) and would break this test from outside
+	git clone -q --depth 1 --branch "${KISTA_REF:-v0.1.4}" https://github.com/hugr-lab/duckdb-extension-repository \
+		"$TMP/kista-src" 2>/dev/null || fail "no kista at ${KISTA_REF:-v0.1.4}"
 	kista_src="$TMP/kista-src"
 fi
 (cd "$kista_src" && GOWORK=off CGO_ENABLED=0 go build -o "$TMP/bin/kista" ./cmd/kista) || fail "kista did not build"