fix: stabilize systemd deployment and release updates

deploy/update.sh

@@ -19,6 +19,7 @@ RELEASE_API_URL=${UPDATE_RELEASE_API_URL:-}
 RELEASE_TOKEN=${UPDATE_RELEASE_TOKEN:-}
 CACHE_ROOT=${KAIDI_UPDATE_CACHE_ROOT:-$STATE_ROOT/cache}
 SERVICE_NAME=${KAIDI_SERVICE_NAME:-kaidi-finance.service}
+JAVA_BIN=${KAIDI_JAVA_BIN:-$APP_ROOT/runtime/java/bin/java}
 UPDATE_PATH_NAME=${KAIDI_UPDATE_PATH_NAME:-kaidi-update.path}
 PROCESS_MANAGER=${KAIDI_PROCESS_MANAGER:-systemd}
 PID_FILE=${KAIDI_PID_FILE:-/var/lib/kaidi/kaidi.pid}
@@ -276,8 +277,9 @@ verify_release_access() {
   if [ "$PROCESS_MANAGER" = baota ]; then
     runuser -u "$SERVICE_USER" -- test -x "$release_dir/ops/baota-start.sh"
   else
-    runuser -u "$SERVICE_USER" -- test -x "$APP_ROOT/runtime/java/bin/java" \
-      && runuser -u "$SERVICE_USER" -- "$APP_ROOT/runtime/java/bin/java" -version >/dev/null 2>&1
+    runuser -u "$SERVICE_USER" -- test -x "$release_dir/ops/baota-start.sh" \
+      && runuser -u "$SERVICE_USER" -- test -x "$JAVA_BIN" \
+      && runuser -u "$SERVICE_USER" -- "$JAVA_BIN" -version >/dev/null 2>&1
   fi
 }
 
@@ -1009,7 +1011,7 @@ if command -v restorecon >/dev/null 2>&1; then
 fi
 if ! verify_release_access "$RELEASE_DIR"; then
   rm -rf "$RELEASE_DIR"
-  fail "Service user cannot access the release or managed Java runtime"
+  fail "Service user cannot access the release or selected Java runtime"
 fi
 
 PREVIOUS_TARGET=$(readlink "$APP_ROOT/current" 2>/dev/null || true)