mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
d1b8a725ac
OpenWrt scans every package Makefile with DUMP=1 before it builds anything, and that scan does not read the target config, so ARCH is empty there. The unsupported-architecture error therefore fired on every scan, the package's metadata came out empty, and make package/fips/compile in the SDK built nothing at all. The error now applies only outside the scan. The SDK feed Makefile also declared no postinst, prerm or conffiles, so a package built from it ran only OpenWrt's generated scripts. Their default_postinst enables every init script a package ships on a fresh install and starts every one on each install and upgrade, so such a package enabled and started fips-gateway on a fresh install, started a gateway the operator had disabled on every upgrade, and under opkg replaced an edited fips.yaml. The Makefile now reads its postinst and prerm bodies from scripts/, the same files build-ipk.sh and build-apk.sh install, and lists fips.yaml as a conffile. Because the generated postinst runs the package's body before the enable-and-start loop under opkg and after it under apk, a new preinst, used only by the Makefile, leaves a one-time hold in /var/run unless the gateway is enabled, and the gateway's start_service, finding the hold, removes it, disables the service and starts nothing. Under apk, where an upgrade runs no script of the old package, the preinst also stops the services and leaves the upgrade marker, as the old prerm does under opkg. The marker stays in /tmp, because the prerm of an installed 0.5.2 package writes it there. The prerm recognises an upgrade from PKG_UPGRADE as well as from its first argument, since OpenWrt's default_prerm passes the script path first, and the postinst clears the hold before re-enabling the gateway after an upgrade from a package whose prerm disabled it. An image build runs package scripts on the build host with IPKG_INSTROOT naming the image root, so the preinst, postinst and prerm now do nothing when it is set, rather than enabling and starting services on the host and writing into its /tmp. The README tells image builders to pass DISABLED_SERVICES=fips-gateway to keep the gateway off, and drops the caveat that SDK builds lack the scripts. Built in the openwrt/sdk 24.10.8 (ipk) and 25.12.5 (apk) images and installed, upgraded and removed with the real opkg and apk in the matching rootfs images: a fresh install leaves the gateway disabled and stopped, an upgrade keeps it disabled or enabled as it was, and an edited fips.yaml survives. A new scenario runs the same flows under ash in local and GitHub CI and checks the scripts touch nothing on a build host, and package-test.sh checks the Makefile names the scripts and the conffile.
67 lines
2.6 KiB
Bash
Executable File
67 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# Maintainer script run after the FIPS package is unpacked.
|
|
#
|
|
# Installed as the .ipk CONTROL/postinst and registered as the .apk
|
|
# post-install script, and as the .apk post-upgrade script with PKG_UPGRADE=1
|
|
# exported ahead of this body, so one body serves both packagers.
|
|
#
|
|
# The fips daemon is enabled and started on every install. The gateway is not:
|
|
# the package ships that service disabled, and the README and the deployment
|
|
# tutorial tell the operator to enable it deliberately.
|
|
#
|
|
# Upgrades are the awkward case, because opkg runs the OLD package's prerm
|
|
# before any script from the new one:
|
|
#
|
|
# marker present the old package was one of these, its prerm left
|
|
# enablement alone, and the gateway only needs starting
|
|
# again if it was enabled;
|
|
# no marker the old package's prerm disabled the gateway on its way
|
|
# out, so its former state is unrecoverable; the gateway is
|
|
# re-enabled, which also re-enables one an operator had
|
|
# disabled by hand.
|
|
#
|
|
# Under apk, a fresh install runs this as post-install and the gateway stays
|
|
# off. An upgrade runs it as post-upgrade, after the .apk pre-upgrade script
|
|
# (the prerm body) has stopped the services and left the marker.
|
|
#
|
|
# A package built from the SDK feed Makefile runs this body from OpenWrt's
|
|
# generated postinst, beside a generic loop that enables and starts every init
|
|
# script; the preinst there leaves a hold that keeps the gateway out of that
|
|
# loop. When this body decides the gateway is to be enabled, it removes the
|
|
# hold first. See scripts/preinst.
|
|
#
|
|
# The upgrade marker stays in /tmp: an installed 0.5.2 package's prerm writes
|
|
# it there, and this script must find it to leave a disabled gateway disabled.
|
|
|
|
# An image build (OpenWrt's image builder or buildroot) runs this on the build
|
|
# host with IPKG_INSTROOT naming the image's root. Nothing here may touch the
|
|
# host, so it does nothing there; see the README for the gateway in images.
|
|
|
|
[ -n "${IPKG_INSTROOT:-}" ] && exit 0
|
|
|
|
UPGRADE_MARKER=/tmp/fips-prerm-upgrade
|
|
INSTALL_HOLD=/var/run/fips-gateway-install-hold
|
|
|
|
# Run first-boot UCI setup (the script deletes itself when done).
|
|
if [ -x /etc/uci-defaults/90-fips-setup ]; then
|
|
/etc/uci-defaults/90-fips-setup && rm -f /etc/uci-defaults/90-fips-setup
|
|
fi
|
|
|
|
/etc/init.d/fips enable
|
|
/etc/init.d/fips start
|
|
|
|
if [ "${PKG_UPGRADE:-0}" = "1" ]; then
|
|
if [ -e "$UPGRADE_MARKER" ]; then
|
|
rm -f "$UPGRADE_MARKER"
|
|
else
|
|
rm -f "$INSTALL_HOLD"
|
|
/etc/init.d/fips-gateway enable
|
|
fi
|
|
|
|
if /etc/init.d/fips-gateway enabled 2>/dev/null; then
|
|
/etc/init.d/fips-gateway start
|
|
fi
|
|
fi
|
|
|
|
exit 0
|