Add reproducible build system, native Unraid plugin, and WebUI
- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt, and fuse-overlayfs to verified upstream source checksums; SlackBuild recipes, scripts/build-packages.sh, checksums.sh, release.sh, and update-versions.sh implement the reproducible pipeline; GitHub Actions workflows build in a Slackware container and publish releases without committing any binaries. - plugin/podman.plg installs/updates/removes all eight packages (the seven components plus the plugin's own unraid-podman scaffolding package) via upgradepkg, using the official Unraid array-event hook mechanism (event/disks_mounted, event/stopping) instead of editing /boot/config/go. rc.podman and the sbin/ helper scripts implement storage creation, config seeding/sync, preflight checks, autostart with per-container Safe-Mode, and package verify/update/rollback. - webui/plugins/podman implements the Dashboard, Containers, Pods, Images, Volumes, Networks, Logs, Terminal, Compose, and Settings panels against the approved mockup (webui/mockups/prototype.html), talking to podman system service exclusively via PodmanClient.php (libpod REST API over the Unix socket), with two documented exceptions: Terminal's one-shot exec model and Compose's use of the podman compose CLI, since libpod has no REST equivalent for either. - docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions and honest current status (syntax-checked, unit- and integration-tested against fake sockets/servers; not yet run against a real Unraid/Podman/Slackware system). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
Executable
+127
@@ -0,0 +1,127 @@
|
||||
#!/bin/bash
|
||||
# =============================================================================
|
||||
# plugin/sbin/podman-verify-packages.sh
|
||||
#
|
||||
# "Pakete prüfen" — verifies the seven packages this plugin ships are
|
||||
# actually installed, at the version the plugin expects, and that the
|
||||
# backed-up .txz copies (see podman-backup.sh) haven't bit-rotted on disk.
|
||||
#
|
||||
# Three checks per package:
|
||||
# 1. Installed: Slackware records every installed package under
|
||||
# /var/log/packages/<name>-<version>-<arch>-<build><tag> — its mere
|
||||
# existence IS the install record (standard Slackware pkgtools
|
||||
# convention, nothing custom here).
|
||||
# 2. Expected version: compared against
|
||||
# /usr/local/share/unraid-podman/installed-versions.env, written by
|
||||
# plugin/podman.plg's postinstall step at install/update time.
|
||||
# 3. Backup integrity: if a backed-up .txz exists for the installed
|
||||
# version (see podman-backup.sh), its current SHA256 is re-checked
|
||||
# against the .sha256 sidecar recorded at build time — catches flash
|
||||
# storage corruption on the backup copy before it's needed for a
|
||||
# rollback.
|
||||
#
|
||||
# Usage:
|
||||
# podman-verify-packages.sh # human-readable report
|
||||
# podman-verify-packages.sh --quiet # exit code only, minimal output
|
||||
#
|
||||
# Exit code: 0 if everything checks out, 1 if any package has a problem.
|
||||
# =============================================================================
|
||||
|
||||
set -u
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=./podman-common.sh
|
||||
. "$SCRIPT_DIR/podman-common.sh"
|
||||
|
||||
INSTALLED_VERSIONS_FILE="/usr/local/share/unraid-podman/installed-versions.env"
|
||||
PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs unraid-podman"
|
||||
|
||||
QUIET=0
|
||||
[ "${1:-}" = "--quiet" ] && QUIET=1
|
||||
|
||||
report() {
|
||||
[ "$QUIET" -eq 0 ] && echo "$1"
|
||||
}
|
||||
|
||||
if [ ! -f "$INSTALLED_VERSIONS_FILE" ]; then
|
||||
podman_log_error "verify: $INSTALLED_VERSIONS_FILE missing — plugin install metadata not found"
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck source=/dev/null
|
||||
. "$INSTALLED_VERSIONS_FILE"
|
||||
|
||||
if [ -z "${PLUGIN_VERSION:-}" ]; then
|
||||
podman_log_error "verify: PLUGIN_VERSION not recorded in $INSTALLED_VERSIONS_FILE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
PROBLEMS=0
|
||||
|
||||
for name in $PACKAGES; do
|
||||
entity_prefix=$(echo "$name" | tr '[:lower:]-' '[:upper:]_')
|
||||
expected_version_var="${entity_prefix}_INSTALLED_VERSION"
|
||||
expected_version="${!expected_version_var:-}"
|
||||
|
||||
report "== $name =="
|
||||
|
||||
if [ -z "$expected_version" ]; then
|
||||
report " expected version: UNKNOWN (not recorded in $INSTALLED_VERSIONS_FILE)"
|
||||
PROBLEMS=$((PROBLEMS + 1))
|
||||
continue
|
||||
fi
|
||||
report " expected version: $expected_version"
|
||||
|
||||
# --- Check 1: installed -----------------------------------------------
|
||||
installed_record=$(find /var/log/packages -maxdepth 1 -name "${name}-*" -print 2> /dev/null | head -n1)
|
||||
if [ -z "$installed_record" ]; then
|
||||
report " installed: NO"
|
||||
podman_log_error "verify: $name is not installed (no /var/log/packages/$name-* record)"
|
||||
PROBLEMS=$((PROBLEMS + 1))
|
||||
continue
|
||||
fi
|
||||
installed_basename=$(basename "$installed_record")
|
||||
report " installed package: $installed_basename"
|
||||
|
||||
# --- Check 2: version matches expectation ------------------------------
|
||||
case "$installed_basename" in
|
||||
"${name}-${expected_version}-"*)
|
||||
report " version match: OK"
|
||||
;;
|
||||
*)
|
||||
report " version match: MISMATCH (installed record does not match expected $expected_version)"
|
||||
podman_log_error "verify: $name installed record '$installed_basename' does not match expected version $expected_version"
|
||||
PROBLEMS=$((PROBLEMS + 1))
|
||||
;;
|
||||
esac
|
||||
|
||||
# --- Check 3: backup artifact integrity, if present --------------------
|
||||
# Packages of all 7 components released together as one plugin version
|
||||
# are grouped under a single PLUGIN_VERSION directory (not per-component
|
||||
# version) — a rollback targets "go back to plugin release X", matching
|
||||
# podman-backup.sh's restore-packages <plugin-version>.
|
||||
backup_dir="$PODMAN_BACKUP_DIR/packages/$PLUGIN_VERSION"
|
||||
backup_txz=$(find "$backup_dir" -maxdepth 1 -name "${name}-*.txz" 2> /dev/null | head -n1)
|
||||
if [ -n "$backup_txz" ] && [ -f "$backup_txz.sha256" ]; then
|
||||
if ( cd "$(dirname "$backup_txz")" && sha256sum -c "$(basename "$backup_txz").sha256" > /dev/null 2>&1 ); then
|
||||
report " backup integrity: OK ($backup_txz)"
|
||||
else
|
||||
report " backup integrity: CORRUPT ($backup_txz)"
|
||||
podman_log_error "verify: backup artifact $backup_txz failed checksum verification"
|
||||
PROBLEMS=$((PROBLEMS + 1))
|
||||
fi
|
||||
else
|
||||
report " backup integrity: no backup artifact on file (nothing to verify)"
|
||||
fi
|
||||
done
|
||||
|
||||
report ""
|
||||
if [ "$PROBLEMS" -gt 0 ]; then
|
||||
report "$PROBLEMS problem(s) found."
|
||||
podman_notify "Podman package verification found problems" \
|
||||
"$PROBLEMS issue(s) found — see $PODMAN_PLUGIN_LOG for details." \
|
||||
"warning"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
report "All packages verified OK."
|
||||
exit 0
|
||||
Reference in New Issue
Block a user