mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
ArjenandJohnathan Corgan
0f1fd18c25
Add OpenWrt .apk packaging for OpenWrt 25+, where apk-tools is the mandatory package manager. The existing .ipk continues to cover OpenWrt 24.x and earlier. Built SDK-free like the .ipk: it reuses the cargo-zigbuild cross-compile and the shared installed-filesystem payload under openwrt-ipk/files, and assembles the ADB container with the official `apk mkpkg` applet from apk-tools 3.0.5 built from source, so no OpenWrt SDK image is needed. The package-openwrt workflow is refactored so a single compile-binaries job cross-compiles and strips each arch once; both the .ipk and .apk packagers consume the binaries via a new --bin-dir flag instead of each recompiling. A build-apk job (aarch64, x86_64) builds apk-tools, packages, and structurally verifies the .apk with `apk adbdump`. Releases now publish .apk artifacts and checksums alongside .ipk; the release download is scoped to fips_* so the shared raw-binary artifacts are not swept into the published release. apk-version.sh maps a release tag or commit height to an apk-tools-valid version, covered by a case-table test. Packages are unsigned, installed with `apk add --allow-untrusted`, matching the .ipk posture. Also fix the OpenWrt control socket: the init script now pre-creates /run/fips before starting the daemon, the procd equivalent of the systemd unit's RuntimeDirectory=fips. Without it, on a fresh boot the daemon resolves its control socket to /tmp (since /run/fips does not yet exist), while fips-gateway later creates /run/fips for its own gateway.sock, leaving fipsctl/fipstop resolving a /run/fips/control.sock the daemon never bound.
39 lines
1.2 KiB
Bash
39 lines
1.2 KiB
Bash
#!/bin/sh /etc/rc.common
|
|
# FIPS mesh daemon — procd init script for OpenWrt
|
|
|
|
USE_PROCD=1
|
|
START=95
|
|
STOP=10
|
|
|
|
PROG=/usr/bin/fips
|
|
CONFIG=/etc/fips/fips.yaml
|
|
|
|
start_service() {
|
|
# Ensure TUN module is loaded before starting the daemon.
|
|
modprobe tun 2>/dev/null || true
|
|
|
|
# Pre-create the control-socket runtime directory so the daemon binds the
|
|
# canonical /run/fips/control.sock instead of falling back to /tmp. This is
|
|
# the procd equivalent of the systemd unit's RuntimeDirectory=fips (and the
|
|
# fips.tmpfiles "d /run/fips 0750 root fips" entry); OpenWrt was the only
|
|
# platform missing it. Without it, fips-gateway — which creates /run/fips
|
|
# for its own gateway.sock — makes fipsctl/fipstop resolve a control socket
|
|
# under /run/fips that the daemon actually bound under /tmp.
|
|
mkdir -p /run/fips
|
|
chmod 0750 /run/fips
|
|
chgrp fips /run/fips 2>/dev/null || true
|
|
|
|
procd_open_instance
|
|
procd_set_param command "$PROG" --config "$CONFIG"
|
|
# Respawn: restart after 5 s, give up after 5 consecutive failures within
|
|
# a 3600 s window, then reset the failure counter and try again.
|
|
procd_set_param respawn 3600 5 5
|
|
procd_set_param stdout 1
|
|
procd_set_param stderr 1
|
|
procd_close_instance
|
|
}
|
|
|
|
reload_service() {
|
|
restart
|
|
}
|