mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
d1b8a725ac
OpenWrt scans every package Makefile with DUMP=1 before it builds anything, and that scan does not read the target config, so ARCH is empty there. The unsupported-architecture error therefore fired on every scan, the package's metadata came out empty, and make package/fips/compile in the SDK built nothing at all. The error now applies only outside the scan. The SDK feed Makefile also declared no postinst, prerm or conffiles, so a package built from it ran only OpenWrt's generated scripts. Their default_postinst enables every init script a package ships on a fresh install and starts every one on each install and upgrade, so such a package enabled and started fips-gateway on a fresh install, started a gateway the operator had disabled on every upgrade, and under opkg replaced an edited fips.yaml. The Makefile now reads its postinst and prerm bodies from scripts/, the same files build-ipk.sh and build-apk.sh install, and lists fips.yaml as a conffile. Because the generated postinst runs the package's body before the enable-and-start loop under opkg and after it under apk, a new preinst, used only by the Makefile, leaves a one-time hold in /var/run unless the gateway is enabled, and the gateway's start_service, finding the hold, removes it, disables the service and starts nothing. Under apk, where an upgrade runs no script of the old package, the preinst also stops the services and leaves the upgrade marker, as the old prerm does under opkg. The marker stays in /tmp, because the prerm of an installed 0.5.2 package writes it there. The prerm recognises an upgrade from PKG_UPGRADE as well as from its first argument, since OpenWrt's default_prerm passes the script path first, and the postinst clears the hold before re-enabling the gateway after an upgrade from a package whose prerm disabled it. An image build runs package scripts on the build host with IPKG_INSTROOT naming the image root, so the preinst, postinst and prerm now do nothing when it is set, rather than enabling and starting services on the host and writing into its /tmp. The README tells image builders to pass DISABLED_SERVICES=fips-gateway to keep the gateway off, and drops the caveat that SDK builds lack the scripts. Built in the openwrt/sdk 24.10.8 (ipk) and 25.12.5 (apk) images and installed, upgraded and removed with the real opkg and apk in the matching rootfs images: a fresh install leaves the gateway disabled and stopped, an upgrade keeps it disabled or enabled as it was, and an edited fips.yaml survives. A new scenario runs the same flows under ash in local and GitHub CI and checks the scripts touch nothing on a build host, and package-test.sh checks the Makefile names the scripts and the conffile.
44 lines
2.0 KiB
Bash
Executable File
44 lines
2.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# Maintainer script run before the FIPS package's files are unpacked.
|
|
#
|
|
# Used only by the OpenWrt SDK feed Makefile, as the package's preinst under
|
|
# opkg and its pre-install and pre-upgrade scripts under apk. build-ipk.sh and
|
|
# build-apk.sh ship a postinst of their own and do not need it.
|
|
#
|
|
# A package built in the SDK gets OpenWrt's generated postinst, whose
|
|
# default_postinst enables every init script the package installs on a fresh
|
|
# install and starts every one on every install and upgrade. The package's own
|
|
# postinst body runs before that loop under opkg and after it under apk, so the
|
|
# body cannot keep the gateway off by itself. Instead, unless the gateway is
|
|
# enabled now, this leaves a hold that init.d/fips-gateway honours once: its
|
|
# start_service removes the hold, disables the service and starts nothing. A
|
|
# fresh install therefore leaves the gateway disabled and stopped, and an
|
|
# upgrade does not start a gateway the operator disabled.
|
|
#
|
|
# An apk upgrade runs no script of the outgoing package, so nothing else stops
|
|
# the services or tells the postinst body that enablement survived the upgrade.
|
|
# This does what the outgoing package's prerm does on an opkg upgrade.
|
|
|
|
# An image build (OpenWrt's image builder or buildroot) runs this on the build
|
|
# host with IPKG_INSTROOT naming the image's root. Nothing here may touch the
|
|
# host, so it does nothing there; see the README for the gateway in images.
|
|
|
|
[ -n "${IPKG_INSTROOT:-}" ] && exit 0
|
|
|
|
INSTALL_HOLD=/var/run/fips-gateway-install-hold
|
|
UPGRADE_MARKER=/tmp/fips-prerm-upgrade
|
|
|
|
# opkg passes "install" or "upgrade <old-version>"; apk passes versions only.
|
|
if [ "${PKG_UPGRADE:-0}" = "1" ] && [ "${1:-}" != "upgrade" ]; then
|
|
: > "$UPGRADE_MARKER" 2>/dev/null || true
|
|
/etc/init.d/fips-gateway stop 2>/dev/null || true
|
|
/etc/init.d/fips stop 2>/dev/null || true
|
|
fi
|
|
|
|
if ! /etc/init.d/fips-gateway enabled 2>/dev/null; then
|
|
mkdir -p "${INSTALL_HOLD%/*}" 2>/dev/null
|
|
: > "$INSTALL_HOLD" 2>/dev/null || true
|
|
fi
|
|
|
|
exit 0
|