mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
d1b8a725ac
OpenWrt scans every package Makefile with DUMP=1 before it builds anything, and that scan does not read the target config, so ARCH is empty there. The unsupported-architecture error therefore fired on every scan, the package's metadata came out empty, and make package/fips/compile in the SDK built nothing at all. The error now applies only outside the scan. The SDK feed Makefile also declared no postinst, prerm or conffiles, so a package built from it ran only OpenWrt's generated scripts. Their default_postinst enables every init script a package ships on a fresh install and starts every one on each install and upgrade, so such a package enabled and started fips-gateway on a fresh install, started a gateway the operator had disabled on every upgrade, and under opkg replaced an edited fips.yaml. The Makefile now reads its postinst and prerm bodies from scripts/, the same files build-ipk.sh and build-apk.sh install, and lists fips.yaml as a conffile. Because the generated postinst runs the package's body before the enable-and-start loop under opkg and after it under apk, a new preinst, used only by the Makefile, leaves a one-time hold in /var/run unless the gateway is enabled, and the gateway's start_service, finding the hold, removes it, disables the service and starts nothing. Under apk, where an upgrade runs no script of the old package, the preinst also stops the services and leaves the upgrade marker, as the old prerm does under opkg. The marker stays in /tmp, because the prerm of an installed 0.5.2 package writes it there. The prerm recognises an upgrade from PKG_UPGRADE as well as from its first argument, since OpenWrt's default_prerm passes the script path first, and the postinst clears the hold before re-enabling the gateway after an upgrade from a package whose prerm disabled it. An image build runs package scripts on the build host with IPKG_INSTROOT naming the image root, so the preinst, postinst and prerm now do nothing when it is set, rather than enabling and starting services on the host and writing into its /tmp. The README tells image builders to pass DISABLED_SERVICES=fips-gateway to keep the gateway off, and drops the caveat that SDK builds lack the scripts. Built in the openwrt/sdk 24.10.8 (ipk) and 25.12.5 (apk) images and installed, upgraded and removed with the real opkg and apk in the matching rootfs images: a fresh install leaves the gateway disabled and stopped, an upgrade keeps it disabled or enabled as it was, and an edited fips.yaml survives. A new scenario runs the same flows under ash in local and GitHub CI and checks the scripts touch nothing on a build host, and package-test.sh checks the Makefile names the scripts and the conffile.
39 lines
1.7 KiB
Bash
Executable File
39 lines
1.7 KiB
Bash
Executable File
#!/bin/sh
|
|
# Maintainer script run before the FIPS package is removed or replaced.
|
|
#
|
|
# Installed as the .ipk CONTROL/prerm and registered as the .apk pre-deinstall
|
|
# script, and as the .apk pre-upgrade script with its arguments rewritten to
|
|
# "upgrade <new-version>", so one body serves both packagers.
|
|
#
|
|
# opkg calls this with "upgrade <new-version>" when the package is being
|
|
# replaced. Disabling the services there would erase the operator's choice,
|
|
# because nothing records it anywhere else, so an upgrade only stops them and
|
|
# leaves a marker telling the incoming postinst that enablement survived.
|
|
# A real removal stops and disables both, as before.
|
|
#
|
|
# A package built from the SDK feed Makefile runs this body from OpenWrt's
|
|
# generated prerm, which passes the script's own path first, so "upgrade" is
|
|
# then the second argument. opkg exports PKG_UPGRADE=1 for an upgrade either
|
|
# way, and apk runs this only on a removal.
|
|
|
|
# An image build (OpenWrt's image builder or buildroot) runs this on the build
|
|
# host with IPKG_INSTROOT naming the image's root. Nothing here may touch the
|
|
# host, so it does nothing there; see the README for the gateway in images.
|
|
|
|
[ -n "${IPKG_INSTROOT:-}" ] && exit 0
|
|
|
|
UPGRADE_MARKER=/tmp/fips-prerm-upgrade
|
|
|
|
if [ "${1:-}" = "upgrade" ] || [ "${PKG_UPGRADE:-0}" = "1" ]; then
|
|
: > "$UPGRADE_MARKER" 2>/dev/null || true
|
|
/etc/init.d/fips-gateway stop 2>/dev/null || true
|
|
/etc/init.d/fips stop 2>/dev/null || true
|
|
exit 0
|
|
fi
|
|
|
|
/etc/init.d/fips-gateway stop 2>/dev/null || true
|
|
/etc/init.d/fips-gateway disable 2>/dev/null || true
|
|
/etc/init.d/fips stop 2>/dev/null || true
|
|
/etc/init.d/fips disable 2>/dev/null || true
|
|
exit 0
|