From a23bb34e58cdb2422f08266d9ba881241209020c Mon Sep 17 00:00:00 2001
From: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
Date: Fri, 4 Jul 2025 16:15:44 +0200
Subject: [PATCH] Centralize generating baseURL

---
 lib/autoupdate/tools/helper.go  | 17 ++---------------
 lib/autoupdate/tools/updater.go |  3 +--
 lib/autoupdate/tools/utils.go   | 31 ++++++++++++++++++++++++-------
 3 files changed, 27 insertions(+), 24 deletions(-)

diff --git a/lib/autoupdate/tools/helper.go b/lib/autoupdate/tools/helper.go
index 499a7c5d377..5b6d5a22a8b 100644
--- a/lib/autoupdate/tools/helper.go
+++ b/lib/autoupdate/tools/helper.go
@@ -27,7 +27,6 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/lib/autoupdate"
 	stacksignal "github.com/gravitational/teleport/lib/utils/signal"
 )
 
@@ -35,8 +34,6 @@ import (
 var (
 	// version is the current version of the Teleport.
 	version = teleport.Version
-	// baseURL is CDN URL for downloading official Teleport packages.
-	baseURL = autoupdate.DefaultBaseURL
 )
 
 // CheckAndUpdateLocal verifies if the TELEPORT_TOOLS_VERSION environment variable
@@ -53,12 +50,7 @@ func CheckAndUpdateLocal(ctx context.Context, reExecArgs []string) error {
 		return nil
 	}
 
-	// Overrides default base URL for custom CDN for downloading updates.
-	if envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar); envBaseURL != "" {
-		baseURL = envBaseURL
-	}
-
-	updater := NewUpdater(toolsDir, version, WithBaseURL(baseURL))
+	updater := NewUpdater(toolsDir, version)
 	// At process startup, check if a version has already been downloaded to
 	// $TELEPORT_HOME/bin or if the user has set the TELEPORT_TOOLS_VERSION
 	// environment variable. If so, re-exec that version of client tools.
@@ -87,12 +79,7 @@ func CheckAndUpdateRemote(ctx context.Context, proxy string, insecure bool, reEx
 		return nil
 	}
 
-	// Overrides default base URL for custom CDN for downloading updates.
-	if envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar); envBaseURL != "" {
-		baseURL = envBaseURL
-	}
-
-	updater := NewUpdater(toolsDir, version, WithBaseURL(baseURL))
+	updater := NewUpdater(toolsDir, version)
 	toolsVersion, reExec, err := updater.CheckRemote(ctx, proxy, insecure)
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/autoupdate/tools/updater.go b/lib/autoupdate/tools/updater.go
index b236324c81d..2e923a7cb9b 100644
--- a/lib/autoupdate/tools/updater.go
+++ b/lib/autoupdate/tools/updater.go
@@ -120,7 +120,6 @@ func NewUpdater(toolsDir, localVersion string, options ...Option) *Updater {
 		toolsDir:     toolsDir,
 		localVersion: localVersion,
 		uriTemplate:  autoupdate.DefaultCDNURITemplate,
-		baseURL:      autoupdate.DefaultBaseURL,
 		client:       http.DefaultClient,
 	}
 	for _, option := range options {
@@ -266,7 +265,7 @@ func (u *Updater) UpdateWithLock(ctx context.Context, updateToolsVersion string)
 // with defined updater directory suffix.
 func (u *Updater) Update(ctx context.Context, toolsVersion string) error {
 	// Get platform specific download URLs.
-	packages, err := teleportPackageURLs(ctx, u.uriTemplate, u.baseURL, toolsVersion)
+	packages, err := teleportPackageURLs(u.uriTemplate, u.baseURL, toolsVersion)
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/autoupdate/tools/utils.go b/lib/autoupdate/tools/utils.go
index e158ef53416..a2c40087951 100644
--- a/lib/autoupdate/tools/utils.go
+++ b/lib/autoupdate/tools/utils.go
@@ -133,6 +133,22 @@ func GetReExecFromVersion(ctx context.Context) string {
 	return reExecFromVersion
 }
 
+// ResolveBaseURL calculates base URL.
+func ResolveBaseURL() (string, error) {
+	envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar)
+	if envBaseURL != "" {
+		return envBaseURL, nil
+	}
+
+	m := modules.GetModules()
+	if m.BuildType() == modules.BuildOSS {
+		slog.Warn("Client tools updates are disabled as they are licensed under AGPL. To use Community Edition builds or custom binaries, set the 'TELEPORT_CDN_BASE_URL' environment variable.")
+		return "", errNoBaseURL
+	}
+
+	return autoupdate.DefaultBaseURL, nil
+}
+
 // packageURL defines URLs to the archive and their archive sha256 hash file, and marks
 // if this package is optional, for such case download needs to be ignored if package
 // not found in CDN.
@@ -143,14 +159,15 @@ type packageURL struct {
 }
 
 // teleportPackageURLs returns URLs for the Teleport archives to download.
-func teleportPackageURLs(ctx context.Context, uriTmpl string, baseURL, version string) ([]packageURL, error) {
-	m := modules.GetModules()
-	envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar)
-	if m.BuildType() == modules.BuildOSS && envBaseURL == "" {
-		slog.WarnContext(ctx, "Client tools updates are disabled as they are licensed under AGPL. To use Community Edition builds or custom binaries, set the 'TELEPORT_CDN_BASE_URL' environment variable.")
-		return nil, errNoBaseURL
+func teleportPackageURLs(uriTmpl string, baseURL, version string) ([]packageURL, error) {
+	if baseURL == "" {
+		url, err := ResolveBaseURL()
+		if err != nil {
+			return nil, trace.Wrap(err)
+		}
+		baseURL = url
 	}
-
+	m := modules.GetModules()
 	var flags autoupdate.InstallFlags
 	if m.IsBoringBinary() {
 		flags |= autoupdate.FlagFIPS