fix

deploy.sh

@@ -11,18 +11,29 @@ cd "$(dirname "$0")"
 
 echo "==> build linux/amd64 (CGO off, pure-Go sqlite)"
 CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o /tmp/hakemsho-linux ./cmd/server
+LOCAL_SHA=$(shasum -a 256 /tmp/hakemsho-linux | cut -d' ' -f1)
+echo "    sha256=$LOCAL_SHA"
 
 echo "==> upload to $HOST"
 scp -i "$KEY" -o StrictHostKeyChecking=no /tmp/hakemsho-linux "$HOST:$REMOTE_DIR/hakemsho.new"
 
-echo "==> swap in + restart (zero-config; data & env untouched)"
-ssh -i "$KEY" -o StrictHostKeyChecking=no "$HOST" '
+# چک‌سام را روی سرور تأیید کن و فقط در صورتِ سالم‌بودن باینری را جابه‌جا کن.
+# این از سناریوی «انتقالِ ناقص ⇒ باینریِ خراب ⇒ SEGV» جلوگیری می‌کند.
+echo "==> verify checksum + swap in + restart (data & env untouched)"
+ssh -i "$KEY" -o StrictHostKeyChecking=no "$HOST" "
   set -e
+  REMOTE_SHA=\$(sha256sum ~/hakemsho/hakemsho.new | cut -d' ' -f1)
+  if [ \"\$REMOTE_SHA\" != \"$LOCAL_SHA\" ]; then
+    echo \"checksum mismatch (\$REMOTE_SHA != $LOCAL_SHA) — aborting, service untouched\"
+    rm -f ~/hakemsho/hakemsho.new
+    exit 1
+  fi
+  chmod +x ~/hakemsho/hakemsho.new
   mv ~/hakemsho/hakemsho.new ~/hakemsho/hakemsho
-  chmod +x ~/hakemsho/hakemsho
+  sudo systemctl reset-failed hakemsho || true
   sudo systemctl restart hakemsho
-  sleep 2
+  sleep 3
   systemctl is-active hakemsho
   curl -s -m5 http://127.0.0.1:8080/health && echo
-'
+"
 echo "==> done: https://hakem.approagency.ir/health"