mirror of
https://github.com/hackacad/bastille.git
synced 2026-03-25 10:14:59 +01:00
Merge pull request #1316 from BastilleBSD/pkg-base-fixes
Pkg base fixes
This commit is contained in:
tschettervictor
GitHub
@@ -230,7 +230,8 @@ bootstrap_release_legacy() {
|
||||
# Verify release URL
|
||||
if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then
|
||||
ERRORS=$((ERRORS + 1))
|
||||
error_return 1 "Unable to fetch MANIFEST. See 'bootstrap urls'."
|
||||
error_notify "Unable to fetch MANIFEST. See 'bootstrap urls'."
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Validate already installed archives
|
||||
@@ -302,7 +303,7 @@ bootstrap_release_legacy() {
|
||||
|
||||
# Cleanup on error
|
||||
if [ "${ERRORS}" -ne 0 ]; then
|
||||
return "${ERRORS}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Silence motd at container login
|
||||
@@ -318,8 +319,8 @@ bootstrap_release_pkgbase() {
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
local abi="${PLATFORM_OS}:${MAJOR_VERSION}:${HW_MACHINE_ARCH}"
|
||||
local fingerprints="${bastille_releasesdir}/${RELEASE}/usr/share/keys/pkg"
|
||||
local host_fingerprintsdir="/usr/share/keys/pkg"
|
||||
local fingerprints="${bastille_releasesdir}/${RELEASE}/usr/share/keys/pkgbase-${MAJOR_VERSION}"
|
||||
local host_fingerprintsdir="/usr/share/keys/pkgbase-${MAJOR_VERSION}"
|
||||
local release_fingerprintsdir="${bastille_releasesdir}/${RELEASE}/usr/share/keys"
|
||||
if [ "${FREEBSD_BRANCH}" = "release" ]; then
|
||||
local repo_name="FreeBSD-base-release-${MINOR_VERSION}"
|
||||
@@ -328,6 +329,24 @@ bootstrap_release_pkgbase() {
|
||||
fi
|
||||
local repo_dir="${bastille_sharedir}/pkgbase"
|
||||
|
||||
# Verify trusted pkg keys
|
||||
if [ ! -f "${host_fingerprintsdir}/trusted/awskms-${MAJOR_VERSION}" ]; then
|
||||
if ! fetch -o "${host_fingerprintsdir}/trusted" https://cgit.freebsd.org/src/tree/share/keys/pkgbase-${MAJOR_VERSION}/trusted/awskms-${MAJOR_VERSION}
|
||||
then
|
||||
ERRORS=$((ERRORS + 1))
|
||||
error_notify "[ERROR]: Failed to fetch trusted pkg keys."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
if [ ! -f "${host_fingerprintsdir}/trusted/backup-signing-${MAJOR_VERSION}" ]; then
|
||||
if ! fetch -o "${host_fingerprintsdir}/trusted" https://cgit.freebsd.org/src/tree/share/keys/pkgbase-${MAJOR_VERSION}/trusted/backup-signing-${MAJOR_VERSION}
|
||||
then
|
||||
ERRORS=$((ERRORS + 1))
|
||||
error_notify "[ERROR]: Failed to fetch trusted backup pkg keys."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Validate COPYRIGHT existence
|
||||
if [ -f "${bastille_releasesdir}/${RELEASE}/COPYRIGHT" ]; then
|
||||
# Verify package sets
|
||||
@@ -338,31 +357,37 @@ bootstrap_release_pkgbase() {
|
||||
fi
|
||||
fi
|
||||
|
||||
info "\nInstalling packages..."
|
||||
|
||||
# Copy fingerprints into releasedir
|
||||
if ! mkdir -p "${release_fingerprintsdir}"; then
|
||||
ERRORS=$((ERRORS + 1))
|
||||
error_return 1 "[ERROR]: Faild to create fingerprints directory."
|
||||
error_notify "[ERROR]: Faild to create fingerprints directory."
|
||||
return 1
|
||||
fi
|
||||
if ! cp -a "${host_fingerprintsdir}" "${release_fingerprintsdir}"; then
|
||||
ERRORS=$((ERRORS + 1))
|
||||
error_return 1 "[ERROR]: Failed to copy fingerprints directory."
|
||||
error_notify "[ERROR]: Failed to copy fingerprints directory."
|
||||
return 1
|
||||
fi
|
||||
|
||||
info "\nUpdating ${repo_name} repository..."
|
||||
|
||||
# Update PkgBase repo
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \
|
||||
--repo-conf-dir="${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o VERSION_MAJOR="${MAJOR_VERSION}" \
|
||||
-o VERSION_MINOR="${MINOR_VERSION}" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
update -r "${repo_name}"; then
|
||||
|
||||
ERRORS=$((ERRORS + 1))
|
||||
error_return 1 "[ERROR]: Failed to update repository: ${repo_name}"
|
||||
error_notify "[ERROR]: Failed to update repository: ${repo_name}"
|
||||
fi
|
||||
|
||||
info "\nInstalling packages..."
|
||||
|
||||
for package in ${bastille_pkgbase_packages}; do
|
||||
|
||||
# Check if package set is already installed
|
||||
@@ -371,6 +396,8 @@ bootstrap_release_pkgbase() {
|
||||
if ! pkg --rootdir "${bastille_releasesdir}/${RELEASE}" \
|
||||
--repo-conf-dir="${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o VERSION_MAJOR="${MAJOR_VERSION}" \
|
||||
-o VERSION_MINOR="${MINOR_VERSION}" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
@@ -387,7 +414,7 @@ bootstrap_release_pkgbase() {
|
||||
|
||||
# Cleanup on error
|
||||
if [ "${ERRORS}" -ne 0 ]; then
|
||||
return "${ERRORS}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Silence motd at login
|
||||
@@ -402,12 +429,8 @@ bootstrap_release_linux() {
|
||||
# Fetch the Linux flavor
|
||||
if ! debootstrap --foreign --arch=${ARCH_BOOTSTRAP} --no-check-gpg ${RELEASE} "${bastille_releasesdir}"/${RELEASE}; then
|
||||
ERRORS=$((ERRORS + 1))
|
||||
error_return 1 "[ERROR]: Failed to fetch Linux release: ${RELEASE}"
|
||||
fi
|
||||
|
||||
# Cleanup on error
|
||||
if [ "${ERRORS}" -ne 0 ]; then
|
||||
return "${ERRORS}"
|
||||
error_notify "[ERROR]: Failed to fetch Linux release: ${RELEASE}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Set necessary settings
|
||||
@@ -695,14 +718,13 @@ esac
|
||||
|
||||
# Check for errors
|
||||
if [ "${ERRORS}" -eq 0 ]; then
|
||||
|
||||
# Check for OPTION=update
|
||||
if [ "${PKGBASE}" -eq 0 ]; then
|
||||
case "${OPTION}" in
|
||||
update)
|
||||
bastille update "${RELEASE}"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
case "${OPTION}" in
|
||||
update)
|
||||
bastille update "${RELEASE}"
|
||||
;;
|
||||
esac
|
||||
|
||||
# Success
|
||||
info "\nBootstrap successful."
|
||||
|
||||
@@ -75,13 +75,6 @@ error_continue() {
|
||||
continue
|
||||
}
|
||||
|
||||
error_return() {
|
||||
local return="${1}"
|
||||
shift 1
|
||||
error_notify "$@"
|
||||
return "${return}"
|
||||
}
|
||||
|
||||
error_exit() {
|
||||
error_notify "$@"
|
||||
echo
|
||||
|
||||
@@ -208,6 +208,8 @@ jail_update_pkgbase() {
|
||||
if ! pkg --rootdir "${jailpath}" \
|
||||
--repo-conf-dir "${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o VERSION_MAJOR="${MAJOR_VERSION}" \
|
||||
-o VERSION_MINOR="${MINOR_VERSION}" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
@@ -219,11 +221,13 @@ jail_update_pkgbase() {
|
||||
# Update jail
|
||||
if ! pkg --rootdir "${jailpath}" \
|
||||
--repo-conf-dir "${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
upgrade -r "${repo_name}"; then
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o VERSION_MAJOR="${MAJOR_VERSION}" \
|
||||
-o VERSION_MINOR="${MINOR_VERSION}" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
upgrade -r "${repo_name}"; then
|
||||
|
||||
error_exit "[ERROR]: Failed to update jail: ${TARGET}"
|
||||
fi
|
||||
@@ -246,8 +250,8 @@ release_check() {
|
||||
TARGET="${NAME_VERIFY}"
|
||||
|
||||
# Validate release existence
|
||||
if [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
|
||||
error_exit "[ERROR]: Release not found: ${RELEASE}"
|
||||
if [ ! -d "${bastille_releasesdir}/${TARGET}" ]; then
|
||||
error_exit "[ERROR]: Release not found: ${TARGET}"
|
||||
fi
|
||||
|
||||
# Verify PLATFORM_OS inside release
|
||||
|
||||
@@ -93,15 +93,6 @@ NEW_RELEASE="${2}"
|
||||
bastille_root_check
|
||||
set_target_single "${TARGET}"
|
||||
|
||||
# Check for unsupported actions
|
||||
if [ -f "/bin/midnightbsd-version" ]; then
|
||||
error_exit "[ERROR]: Not yet supported on MidnightBSD."
|
||||
fi
|
||||
|
||||
if freebsd-version | grep -qi HBSD; then
|
||||
error_exit "[ERROR]: Not yet supported on HardenedBSD."
|
||||
fi
|
||||
|
||||
thick_jail_check() {
|
||||
|
||||
# Validate jail state
|
||||
@@ -112,6 +103,50 @@ thick_jail_check() {
|
||||
error_notify "Jail is not running."
|
||||
error_exit "Use [-a|--auto] to auto-start the jail."
|
||||
fi
|
||||
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
# Set OLD_RELEASE
|
||||
OLD_RELEASE="$(${bastille_jailsdir}/${TARGET}/root/bin/freebsd-version 2>/dev/null)"
|
||||
if [ -z "${OLD_RELEASE}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
fi
|
||||
|
||||
# Set VERSION
|
||||
NEW_MINOR_VERSION=$(echo ${NEW_RELEASE} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
NEW_MAJOR_VERSION=$(echo ${NEW_RELEASE} | grep -Eo '^[0-9]+')
|
||||
|
||||
# Validate PKGBASE or non-PKGBASE
|
||||
if echo "${NEW_RELEASE}" | grep -oq "\-CURRENT"; then
|
||||
FREEBSD_BRANCH="current"
|
||||
else
|
||||
FREEBSD_BRANCH="release"
|
||||
fi
|
||||
if [ "${NEW_MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_jailsdir}/${TARGET}/root" which /usr/bin/uname > /dev/null 2>&1; then
|
||||
PKGBASE=1
|
||||
fi
|
||||
|
||||
# Check if jail is already running NEW_RELEASE
|
||||
if [ "${OLD_RELEASE}" = "${NEW_RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Jail is already running '${NEW_RELEASE}' release."
|
||||
error_exit "See 'bastille update TARGET' to update the jail."
|
||||
fi
|
||||
|
||||
elif [ "${PLATFORM_OS}" = "HardenedBSD" ]; then
|
||||
|
||||
# Set VERSION
|
||||
OLD_RELEASE="$(${bastille_jailsdir}/${TARGET}/root/bin/freebsd-version 2>/dev/null)"
|
||||
OLD_CONFIG_RELEASE="$(bastille config ${TARGET} get osrelease)"
|
||||
if [ -z "${OLD_RELEASE}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
fi
|
||||
|
||||
# Check if jail is already running NEW_RELEASE
|
||||
if [ "${OLD_CONFIG_RELEASE}" = "${NEW_RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Jail is already running '${NEW_RELEASE}' release."
|
||||
error_exit "See 'bastille update TARGET' to update the jail."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
thin_jail_check() {
|
||||
@@ -124,185 +159,269 @@ thin_jail_check() {
|
||||
error_notify "Jail is running."
|
||||
error_exit "Use [-a|--auto] to auto-stop the jail."
|
||||
fi
|
||||
|
||||
# Set VERSION
|
||||
OLD_RELEASE="$(bastille config ${TARGET} get osrelease)"
|
||||
if [ -z "${OLD_RELEASE}" ]; then
|
||||
error_exit "[ERROR]: Can't determine '${TARGET}' version."
|
||||
fi
|
||||
|
||||
# Check if jail is already running NEW_RELEASE
|
||||
if [ "${OLD_RELEASE}" = "${NEW_RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Jail is already running '${NEW_RELEASE}' release."
|
||||
error_exit "See 'bastille update RELEASE' to update the release."
|
||||
fi
|
||||
}
|
||||
|
||||
release_check() {
|
||||
|
||||
# Validate the release
|
||||
if ! echo "${NEW_RELEASE}" | grep -q "[0-9]\{2\}.[0-9]-[RELEASE,BETA,RC]"; then
|
||||
error_exit "[ERROR]: ${NEW_RELEASE} is not a valid release."
|
||||
fi
|
||||
# Validate the release name
|
||||
case "${NEW_RELEASE}" in
|
||||
[2-4].[0-9]*)
|
||||
PLATFORM_OS="MidnightBSD"
|
||||
NAME_VERIFY=$(echo "${NEW_RELEASE}")
|
||||
;;
|
||||
*-current|*-CURRENT)
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${NEW_RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-CURRENT)$' | tr '[:lower:]' '[:upper:]')
|
||||
;;
|
||||
*\.*-stable|*\.*-STABLE)
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${NEW_RELEASE}" | grep -iwE '^([1-9]+)\.[0-9](-STABLE)$' | tr '[:lower:]' '[:upper:]')
|
||||
;;
|
||||
*-release|*-RELEASE)
|
||||
PLATFORM_OS="FreeBSD"
|
||||
NAME_VERIFY=$(echo "${NEW_RELEASE}" | grep -iwE '^([0-9]+)\.[0-9](-RELEASE)$' | tr '[:lower:]' '[:upper:]')
|
||||
;;
|
||||
current|CURRENT)
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
NAME_VERIFY=$(echo "${NEW_RELEASE}" | sed 's/CURRENT/current/g')
|
||||
;;
|
||||
[1-9]*-stable|[1-9]*-STABLE)
|
||||
PLATFORM_OS="HardenedBSD"
|
||||
NAME_VERIFY=$(echo "${NEW_RELEASE}" | grep -iwE '^([1-9]+)(-stable)$' | sed 's/STABLE/stable/g')
|
||||
;;
|
||||
*)
|
||||
error_exit "[ERROR]: Invalid release: ${RELEASE}"
|
||||
;;
|
||||
esac
|
||||
|
||||
NEW_RELEASE="${NAME_VERIFY}"
|
||||
|
||||
# Exit if NEW_RELEASE doesn't exist
|
||||
if [ "${THIN_JAIL}" -eq 1 ]; then
|
||||
if [ "${JAIL_TYPE}" = "thin" ]; then
|
||||
if [ ! -d "${bastille_releasesdir}/${NEW_RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Release not found: ${NEW_RELEASE}"
|
||||
error_exit "See 'bastille bootstrap ${NEW_RELEASE} to bootstrap the release."
|
||||
error_exit "See 'bastille bootstrap'."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
jail_upgrade_pkgbase() {
|
||||
|
||||
# Only thick jails should be targetted here
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local abi="FreeBSD:${NEW_MAJOR_VERSION}:${HW_MACHINE_ARCH}"
|
||||
local fingerprints="${jailpath}/usr/share/keys/pkg"
|
||||
if [ "${FREEBSD_BRANCH}" = "release" ]; then
|
||||
local repo_name="FreeBSD-base-release-${NEW_MINOR_VERSION}"
|
||||
elif [ "${FREEBSD_BRANCH}" = "current" ]; then
|
||||
local repo_name="FreeBSD-base-latest"
|
||||
fi
|
||||
local repo_dir="${bastille_sharedir}/pkgbase"
|
||||
|
||||
info "\n[${TARGET}]:"
|
||||
|
||||
if [ "${OLD_RELEASE}" = "${NEW_RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Jail is already running '${NEW_RELEASE}'"
|
||||
error_notify "See 'bastille update TARGET' to update jail."
|
||||
fi
|
||||
|
||||
# Upgrade jail with pkgbase (thick only)
|
||||
if [ -d "${jailpath}" ]; then
|
||||
# Update repo (pkgbase)
|
||||
if ! pkg --rootdir "${jailpath}" \
|
||||
--repo-conf-dir "${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
update -r "${repo_name}"; then
|
||||
error_exit "[ERROR]: Failed to update pkg repo: ${repo_name}"
|
||||
fi
|
||||
# Update jail
|
||||
if ! pkg --rootdir "${jailpath}" \
|
||||
--repo-conf-dir "${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
upgrade -r "${repo_name}"; then
|
||||
error_exit "[ERROR]: Failed to upgrade jail: ${TARGET}"
|
||||
fi
|
||||
# Update release version (including patch level)
|
||||
NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
bastille config ${TARGET} set osrelease ${NEW_VERSION}
|
||||
else
|
||||
error_exit "[ERROR]: Jail not found: ${TARGET}"
|
||||
fi
|
||||
info "\nUpgraded ${TARGET}: ${OLD_RELEASE} -> ${NEW_RELEASE}"
|
||||
}
|
||||
|
||||
jail_upgrade() {
|
||||
|
||||
info "\n[${TARGET}]:"
|
||||
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local work_dir="${jailpath}/var/db/freebsd-update"
|
||||
local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf"
|
||||
|
||||
# Upgrade a thin jail
|
||||
if grep -qw "${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
|
||||
|
||||
# Update "osrelease" entry inside fstab
|
||||
sed -i '' "/.bastille/ s|${OLD_RELEASE}|${NEW_RELEASE}|g" "${bastille_jailsdir}/${TARGET}/fstab"
|
||||
if ! sed -i '' "/.bastille/ s|${OLD_RELEASE}|${NEW_RELEASE}|g" "${bastille_jailsdir}/${TARGET}/fstab"; then
|
||||
error_exit "[ERROR]: Failed to update fstab."
|
||||
fi
|
||||
|
||||
# Update "osrelease" inside jail.conf using 'bastille config'
|
||||
bastille config ${TARGET} set osrelease ${NEW_RELEASE}
|
||||
bastille config ${TARGET} set osrelease ${NEW_RELEASE} >/dev/null 2>/dev/null
|
||||
|
||||
# Start jail if AUTO=1
|
||||
if [ "${AUTO}" -eq 1 ]; then
|
||||
bastille start "${TARGET}"
|
||||
fi
|
||||
|
||||
info "\nUpgraded ${TARGET}: ${OLD_RELEASE} -> ${NEW_RELEASE}"
|
||||
echo "See 'bastille etcupdate TARGET' to update /etc"
|
||||
else
|
||||
# Upgrade a thick jail
|
||||
env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron \
|
||||
--currently-running "${OLD_RELEASE}" \
|
||||
-j "${TARGET}" \
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
-r "${NEW_RELEASE}" upgrade
|
||||
echo
|
||||
|
||||
# Update "osrelease" inside jail.conf using 'bastille config'
|
||||
bastille config ${TARGET} set osrelease ${NEW_RELEASE}
|
||||
warn "Please run 'bastille upgrade ${TARGET} install', restart the jail, then run 'bastille upgrade ${TARGET} install' again to finish installing updates."
|
||||
else
|
||||
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local work_dir="${jailpath}/var/db/freebsd-update"
|
||||
local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf"
|
||||
|
||||
# Upgrade a thick jail
|
||||
env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron \
|
||||
--currently-running "${OLD_RELEASE}" \
|
||||
-j "${TARGET}" \
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
-r "${NEW_RELEASE}" upgrade
|
||||
|
||||
UPGRADED_RELEASE="$(${bastille_jailsdir}/${TARGET}/root/bin/freebsd-version 2>/dev/null)"
|
||||
if [ "${OLD_RELEASE}" = "${UPGRADED_RELEASE}" ]; then
|
||||
info "\nNo upgrades available.\n"
|
||||
else
|
||||
# Update "osrelease" inside jail.conf using 'bastille config'
|
||||
bastille config ${TARGET} set osrelease ${UPGRADED_RELEASE} >/dev/null 2>/dev/null
|
||||
warn "Please run 'bastille upgrade ${TARGET} install', restart the jail, then run 'bastille upgrade ${TARGET} install' again to finish installing updates."
|
||||
echo
|
||||
fi
|
||||
|
||||
elif [ "${PLATFORM_OS}" = "HardenedBSD" ]; then
|
||||
|
||||
local jailname="${TARGET}"
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local hbsd_update_conf="${jailpath}/etc/hbsd-update.conf"
|
||||
|
||||
# Set proper vars in hbsd-update.conf
|
||||
case ${NEW_RELEASE} in
|
||||
current)
|
||||
branch="hardened/current/master"
|
||||
dnsrec="\$(uname -m).master.current.hardened.hardenedbsd.updates.hardenedbsd.org"
|
||||
;;
|
||||
*-stable)
|
||||
NEW_MAJOR_VERSION=$(echo ${NEW_RELEASE} | grep -Eo '^[0-9]+')
|
||||
branch="hardened/${MAJOR_VERSION}-stable/master"
|
||||
dnsrec="\$(uname -m).main.${MAJOR_VERSION}-stable.hardened.hardenedbsd.updates.hardenedbsd.org"
|
||||
;;
|
||||
*)
|
||||
error_exit "[ERROR]: Unknown ${PLATFORM_OS} release: ${NEW_RELEASE}"
|
||||
;;
|
||||
esac
|
||||
sysrc -f "${hbsd_update_conf}" branch="${branch}" >/dev/null 2>/dev/null
|
||||
sysrc -f "${hbsd_update_conf}" dnsrec="${dnsrec}" >/dev/null 2>/dev/null
|
||||
|
||||
hbsd-update \
|
||||
-j "${jailname}" \
|
||||
-c "${hbsd_update_conf}"
|
||||
|
||||
UPGRADED_RELEASE="$(${bastille_jailsdir}/${TARGET}/root/bin/freebsd-version 2>/dev/null)"
|
||||
if [ "${OLD_RELEASE}" = "${UPGRADED_RELEASE}" ]; then
|
||||
info "\nNo upgrades available.\n"
|
||||
else
|
||||
info "\nUpgraded ${TARGET}: ${OLD_RELEASE} -> ${UPGRADED_RELEASE}\n"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
jail_upgrade_pkgbase() {
|
||||
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local abi="FreeBSD:${NEW_MAJOR_VERSION}:${HW_MACHINE_ARCH}"
|
||||
local fingerprints="${jailpath}/usr/share/keys/pkgbase-${MAJOR_VERSION}"
|
||||
if [ "${FREEBSD_BRANCH}" = "release" ]; then
|
||||
local repo_name="FreeBSD-base-release-${NEW_MINOR_VERSION}"
|
||||
elif [ "${FREEBSD_BRANCH}" = "current" ]; then
|
||||
local repo_name="FreeBSD-base-latest"
|
||||
fi
|
||||
local repo_dir="${bastille_sharedir}/pkgbase"
|
||||
|
||||
info "\n[${TARGET}]:"
|
||||
|
||||
if [ "${OLD_RELEASE}" = "${NEW_RELEASE}" ]; then
|
||||
error_notify "[ERROR]: Jail is already running '${NEW_RELEASE}'"
|
||||
error_exit "See 'bastille update TARGET' to update jail."
|
||||
fi
|
||||
|
||||
# Upgrade jail with pkgbase (thick only)
|
||||
# Update repo (pkgbase)
|
||||
if ! pkg --rootdir "${jailpath}" \
|
||||
--repo-conf-dir "${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o VERSION_MAJOR="${NEW_MAJOR_VERSION}" \
|
||||
-o VERSION_MINOR="${NEW_MINOR_VERSION}" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
update -r "${repo_name}"; then
|
||||
|
||||
error_exit "[ERROR]: Failed to update pkg repo: ${repo_name}"
|
||||
fi
|
||||
|
||||
# Update jail
|
||||
if ! pkg --rootdir "${jailpath}" \
|
||||
--repo-conf-dir "${repo_dir}" \
|
||||
-o IGNORE_OSVERSION="yes" \
|
||||
-o VERSION_MAJOR="${NEW_MAJOR_VERSION}" \
|
||||
-o VERSION_MINOR="${NEW_MINOR_VERSION}" \
|
||||
-o ABI="${abi}" \
|
||||
-o ASSUME_ALWAYS_YES="yes" \
|
||||
-o FINGERPRINTS="${fingerprints}" \
|
||||
upgrade -r "${repo_name}"; then
|
||||
|
||||
error_exit "[ERROR]: Failed to upgrade jail: ${TARGET}"
|
||||
fi
|
||||
|
||||
# Update release version (including patch level)
|
||||
NEW_VERSION=$(/usr/sbin/jexec -l "${TARGET}" freebsd-version 2>/dev/null)
|
||||
bastille config ${TARGET} set osrelease ${NEW_VERSION} >/dev/null 2>/dev/null
|
||||
|
||||
info "\nUpgraded ${TARGET}: ${OLD_RELEASE} -> ${NEW_RELEASE}"
|
||||
else
|
||||
error_exit "[ERROR]: Not implemented for platform: ${PLATFORM_OS}"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
jail_updates_install() {
|
||||
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local work_dir="${jailpath}/var/db/freebsd-update"
|
||||
local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf"
|
||||
if [ "${PLATFORM_OS}" = "FreeBSD" ]; then
|
||||
|
||||
info "\n[${TARGET}]:"
|
||||
local jailpath="${bastille_jailsdir}/${TARGET}/root"
|
||||
local work_dir="${jailpath}/var/db/freebsd-update"
|
||||
local freebsd_update_conf="${jailpath}/etc/freebsd-update.conf"
|
||||
|
||||
# Finish installing upgrade on a thick container
|
||||
if [ -d "${jailpath}" ]; then
|
||||
info "\n[${TARGET}]:"
|
||||
|
||||
# Finish installing upgrade on a thick container
|
||||
env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron \
|
||||
-j "${TARGET}" \
|
||||
-d "${work_dir}" \
|
||||
-f "${freebsd_update_conf}" \
|
||||
install
|
||||
else
|
||||
error_exit "[ERROR]: ${TARGET} not found. See 'bastille bootstrap RELEASE'."
|
||||
error_exit "[ERROR]: Not implemented for platform: ${PLATFORM_OS}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Set needed variables
|
||||
THIN_JAIL=0
|
||||
JAIL_TYPE=""
|
||||
PKGBASE=0
|
||||
HW_MACHINE_ARCH=$(sysctl hw.machine_arch | awk '{ print $2 }')
|
||||
|
||||
# Validate jail type (thick/thin)
|
||||
if grep -qw "${bastille_jailsdir}/${TARGET}/root/.bastille" "${bastille_jailsdir}/${TARGET}/fstab"; then
|
||||
THIN_JAIL=1
|
||||
JAIL_TYPE="thin"
|
||||
fi
|
||||
|
||||
# Check what we should upgrade
|
||||
if [ "${NEW_RELEASE}" = "install" ]; then
|
||||
if [ "${THIN_JAIL}" -eq 1 ]; then
|
||||
thin_jail_check "${TARGET}"
|
||||
else
|
||||
thick_jail_check "${TARGET}"
|
||||
fi
|
||||
jail_updates_install "${TARGET}"
|
||||
else
|
||||
release_check
|
||||
if [ "${THIN_JAIL}" -eq 1 ]; then
|
||||
thin_jail_check "${TARGET}"
|
||||
else
|
||||
thick_jail_check "${TARGET}"
|
||||
fi
|
||||
OLD_RELEASE="$(${bastille_jailsdir}/${TARGET}/root/bin/freebsd-version 2>/dev/null)"
|
||||
if [ -z "${OLD_RELEASE}" ]; then
|
||||
OLD_RELEASE="$(bastille config ${TARGET} get osrelease)"
|
||||
fi
|
||||
OLD_MINOR_VERSION=$(echo ${OLD_RELEASE} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
OLD_MAJOR_VERSION=$(echo ${OLD_RELEASE} | grep -Eo '^[0-9]+')
|
||||
NEW_MINOR_VERSION=$(echo ${NEW_RELEASE} | sed -E 's/^[0-9]+\.([0-9]+)-.*$/\1/')
|
||||
NEW_MAJOR_VERSION=$(echo ${NEW_RELEASE} | grep -Eo '^[0-9]+')
|
||||
# Check if jail is already running NEW_RELEASE
|
||||
if [ "${OLD_MAJOR_VERSION}.${OLD_MINOR_VERSION}" = "${NEW_MAJOR_VERSION}.${NEW_MINOR_VERSION}" ]; then
|
||||
error_notify "[ERROR]: Jail is already running '${NEW_RELEASE}' release."
|
||||
if [ "${THIN_JAIL}" -eq 1 ]; then
|
||||
error_exit "See 'bastille update RELEASE' to update the release."
|
||||
case ${NEW_RELEASE} in
|
||||
install)
|
||||
if [ "${JAIL_TYPE}" = "thin" ]; then
|
||||
thin_jail_check "${TARGET}"
|
||||
else
|
||||
error_exit "See 'bastille update TARGET' to update the jail."
|
||||
thick_jail_check "${TARGET}"
|
||||
fi
|
||||
fi
|
||||
# Validate PKGBASE or non-PKGBASE
|
||||
if echo "${NEW_RELEASE}" | grep -oq "\-CURRENT"; then
|
||||
FREEBSD_BRANCH="current"
|
||||
else
|
||||
FREEBSD_BRANCH="release"
|
||||
fi
|
||||
if [ "${NEW_MAJOR_VERSION}" -ge 16 ] || pkg -r "${bastille_jailsdir}/${TARGET}/root" which /usr/bin/uname > /dev/null 2>&1; then
|
||||
PKGBASE=1
|
||||
fi
|
||||
# Validate THIN_JAIL+PKGBASE
|
||||
if [ "${PKGBASE}" -eq 1 ] && [ "${THIN_JAIL}" -eq 0 ]; then
|
||||
jail_upgrade_pkgbase
|
||||
else
|
||||
jail_upgrade
|
||||
fi
|
||||
fi
|
||||
jail_updates_install "${TARGET}"
|
||||
;;
|
||||
*)
|
||||
release_check
|
||||
# Unsupported platforms
|
||||
if [ "${PLATFORM_OS}" = "MidnightBSD" ] || [ -f "/bin/midnightbsd-version" ]; then
|
||||
error_exit "[ERROR]: Not yet supported on MidnightBSD."
|
||||
fi
|
||||
if [ "${JAIL_TYPE}" = "thin" ]; then
|
||||
thin_jail_check "${TARGET}"
|
||||
jail_upgrade
|
||||
else
|
||||
thick_jail_check "${TARGET}"
|
||||
if [ "${PKGBASE}" -eq 1 ]; then
|
||||
jail_upgrade_pkgbase
|
||||
else
|
||||
jail_upgrade
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
Reference in New Issue
Block a user