Server 2.6.2: log update checks and downloads; Go 1.27.3

The update relay logs every check (car, number of releases, newest
pre-release) and every download (car, file, size, then bytes and time,
or that it was cut short); never the forge's address or token, tested.
Go 1.27.3 for the build image and toolchain: govulncheck had found
GO-2026-6809 in crypto/x509 under 1.26.9; source and binary now clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

server/releases_test.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -113,3 +115,36 @@ func TestForgeURLMustBeHTTPS(t *testing.T) {
 		t.Fatal("plain http forge accepted")
 	}
 }
+
+// The server's log says who checked for and fetched an update, and how it went — the car's
+// installation (here the shared token), the newest pre-release, the file and the bytes — and
+// never the forge's token or address.
+func TestUpdatesAreLogged(t *testing.T) {
+	var logged bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logged, nil)))
+	defer slog.SetDefault(previous)
+
+	forge := fakeForge(t)
+	defer forge.Close()
+	h := releasesAPI(t, forge)
+	if rec := do(t, h, "GET", "/v1/app/releases", testToken, ""); rec.Code != 200 {
+		t.Fatalf("%d", rec.Code)
+	}
+	if rec := do(t, h, "GET", "/v1/app/assets/7/11/NilsMG4-unstable-2.16.0.apk", testToken, ""); rec.Code != 200 {
+		t.Fatalf("%d", rec.Code)
+	}
+	out := logged.String()
+	for _, want := range []string{
+		`msg="update check" installation="shared token" releases=1 newest=car-2.16.0`,
+		`msg="update download started" installation="shared token" asset=NilsMG4-unstable-2.16.0.apk`,
+		`msg="update handed out" installation="shared token" asset=NilsMG4-unstable-2.16.0.apk sent=4`,
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("log lacks %q:\n%s", want, out)
+		}
+	}
+	if strings.Contains(out, testForgeToken) || strings.Contains(out, forge.URL) {
+		t.Fatal("the forge or its token leaked into the log")
+	}
+}