maggesandClaude Sonnet 5
5b47b4cc0a
- Package #9-11: catatonit (pod infra init), nftables (netavark firewall backend), docker-compose (external compose provider for `podman compose`) — all vendored prebuilt binaries, versions.env pinned, propagated through build-packages.sh/release.sh/podman.plg/verify+update-packages.sh. - Fix WebUI: every POST action was silently failing (empty response body) because Unraid's own CSRF protection was never satisfied — app.js now sends the page's csrf_token as X-CSRF-Token. - Fix WebUI: PodmanClient::pullImage() assumed a single JSON response, but /images/pull actually streams newline-delimited JSON — every successful pull was throwing "Expected a JSON object/array response". - Fix WebUI: compose.php's up/down status detection had the same single-JSON-vs-NDJSON bug for `podman compose ps`, plus stderr was corrupting the parse. - Add cache-busting (?v=<mtime>) to Podman.page's script/style tags so a redeployed JS/CSS fix isn't served stale from browser cache. - Add a reusable modal dialog (app.js openFormModal) replacing prompt()/alert() for New Volume/Network/Pull Image. - Add host-path (bind-mount) support when creating a named volume. - Add Create Container (image, name, network mode incl. custom networks, ports, volumes, env, restart policy, privileged, start-after-create), auto-pulling the image on first use since /containers/create doesn't. All fixes verified live against a real podman system service and, where reachable, via the actual WebUI over the real socket — not just unit-level. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
184 lines
7.4 KiB
Bash
Executable File
184 lines
7.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# =============================================================================
|
|
# scripts/lib/slackbuild-common.sh
|
|
#
|
|
# Shared helper functions sourced by every packages/*/*.SlackBuild script.
|
|
# Centralizing this logic means each individual SlackBuild only has to
|
|
# describe *how to compile* its component — fetching, checksum verification,
|
|
# and final .txz packaging are implemented once, here, and used the same way
|
|
# by all ten packages (unraid-podman's own SlackBuild has no upstream
|
|
# source to fetch, so it doesn't need this). This is what keeps the build
|
|
# scripts consistent and short instead of each reinventing (and potentially
|
|
# forgetting) checksum verification or Slackware package metadata.
|
|
#
|
|
# Every SlackBuild is expected to:
|
|
# 1. `. "$(dirname "$0")/../../scripts/lib/slackbuild-common.sh"`
|
|
# 2. `. "$(dirname "$0")/../../versions.env"`
|
|
# 3. Call sb_init, sb_fetch_and_verify, do its own compile steps into
|
|
# $PKG, then call sb_make_package.
|
|
#
|
|
# Not meant to be run directly.
|
|
# =============================================================================
|
|
|
|
set -eu
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# sb_init <pkg-name>
|
|
#
|
|
# Sets up the standard SlackBuild working directories and exports the
|
|
# variables every subsequent helper (and the calling SlackBuild) relies on:
|
|
# CWD - directory the SlackBuild itself lives in (packages/<name>/)
|
|
# TMP - scratch/build directory (source is extracted and compiled here)
|
|
# PKG - staging directory that becomes the .txz payload
|
|
# OUTPUT - where the finished .txz + checksum files are written
|
|
# All three of TMP/PKG/OUTPUT are safe to delete/recreate; nothing outside
|
|
# of them is ever touched, and nothing under them is ever committed to git
|
|
# (see .gitignore: packages/**/src, packages/**/pkg, packages/**/work).
|
|
# -----------------------------------------------------------------------------
|
|
sb_init() {
|
|
local pkg_name="$1"
|
|
|
|
PRGNAM="$pkg_name"
|
|
CWD="$(cd "$(dirname "${BASH_SOURCE[1]}")" && pwd)"
|
|
TMP="${TMP:-$CWD/work}"
|
|
PKG="${PKG:-$TMP/package-$PRGNAM}"
|
|
OUTPUT="${OUTPUT:-$CWD/../../dist}"
|
|
|
|
export PRGNAM CWD TMP PKG OUTPUT
|
|
|
|
rm -rf "$TMP"
|
|
mkdir -p "$TMP" "$PKG" "$OUTPUT"
|
|
|
|
echo "==> [$PRGNAM] TMP=$TMP"
|
|
echo "==> [$PRGNAM] PKG=$PKG"
|
|
echo "==> [$PRGNAM] OUTPUT=$OUTPUT"
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# sb_fetch_and_verify <url> <expected-sha256> <dest-filename>
|
|
#
|
|
# Downloads a source tarball into $TMP and verifies it against the SHA256
|
|
# pinned in versions.env before anything is extracted or built. Aborts the
|
|
# build loudly on any mismatch — a checksum mismatch means either
|
|
# versions.env is stale (a legitimate new upstream release) or the source is
|
|
# not what it claims to be; either way, an unreviewed build must not proceed.
|
|
# -----------------------------------------------------------------------------
|
|
sb_fetch_and_verify() {
|
|
local url="$1"
|
|
local expected_sha256="$2"
|
|
local dest_name="$3"
|
|
local dest_path="$TMP/$dest_name"
|
|
|
|
# All progress/diagnostic output here must go to stderr, not stdout:
|
|
# callers capture this function's return value via `tarball=$(sb_fetch_and_verify ...)`,
|
|
# and command substitution captures everything written to stdout — a
|
|
# stray stdout echo above the final `echo "$dest_path"` would get
|
|
# concatenated into that captured value instead of just printing to the
|
|
# log.
|
|
echo "==> [$PRGNAM] Fetching $url" >&2
|
|
curl -fL --retry 3 --retry-delay 2 -o "$dest_path" "$url"
|
|
|
|
local actual_sha256
|
|
actual_sha256=$(sha256sum "$dest_path" | awk '{print $1}')
|
|
|
|
if [ "$actual_sha256" != "$expected_sha256" ]; then
|
|
echo "!! [$PRGNAM] SHA256 MISMATCH for $dest_name" >&2
|
|
echo "!! expected: $expected_sha256" >&2
|
|
echo "!! actual: $actual_sha256" >&2
|
|
echo "!! Refusing to build against unverified source. If upstream" >&2
|
|
echo "!! genuinely released a new version, update versions.env via" >&2
|
|
echo "!! scripts/update-versions.sh instead of editing the hash by hand." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> [$PRGNAM] SHA256 verified ($actual_sha256)" >&2
|
|
echo "$dest_path"
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# sb_extract <tarball-path> [strip-components]
|
|
#
|
|
# Extracts a verified tarball into $TMP/src, normalizing away the
|
|
# "<repo>-<version>/" wrapper directory GitHub/cgit archives always contain,
|
|
# so every SlackBuild can `cd "$TMP/src"` regardless of upstream's archive
|
|
# layout.
|
|
# -----------------------------------------------------------------------------
|
|
sb_extract() {
|
|
local tarball="$1"
|
|
local strip="${2:-1}"
|
|
|
|
mkdir -p "$TMP/src"
|
|
tar -xf "$tarball" -C "$TMP/src" --strip-components="$strip"
|
|
echo "$TMP/src"
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# sb_install_docs <license-file> [readme-file]
|
|
#
|
|
# Installs upstream's license (and optionally README) into the standard
|
|
# Slackware package documentation location, plus this project's own build
|
|
# metadata, so `installpkg` output and /usr/doc/<pkg>-<version>/ are
|
|
# populated per Slackware convention.
|
|
# -----------------------------------------------------------------------------
|
|
sb_install_docs() {
|
|
local license_file="$1"
|
|
local readme_file="${2:-}"
|
|
local docdir="$PKG/usr/doc/$PRGNAM-$VERSION"
|
|
|
|
mkdir -p "$docdir"
|
|
[ -f "$license_file" ] && cp "$license_file" "$docdir/"
|
|
[ -n "$readme_file" ] && [ -f "$readme_file" ] && cp "$readme_file" "$docdir/"
|
|
|
|
{
|
|
echo "Built by unraid-podman from upstream source."
|
|
echo "Package: $PRGNAM $VERSION"
|
|
echo "Built: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
} > "$docdir/unraid-podman.build-info"
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# sb_make_package
|
|
#
|
|
# Finalizes the Slackware package: installs slack-desc + doinst.sh (if
|
|
# present) into $PKG/install/, strips binaries, sets root:root ownership,
|
|
# runs makepkg to produce the .txz, then writes SHA256 + MD5 sidecar files
|
|
# next to it.
|
|
#
|
|
# - SHA256 is used by scripts/build-packages.sh / CI to verify build
|
|
# artifacts between jobs.
|
|
# - MD5 is additionally generated because Unraid's .plg <FILE> mechanism
|
|
# verifies downloads via MD5 by convention (see
|
|
# docs/ARCHITECTURE.md section 3.2) — scripts/release.sh reads the .md5
|
|
# file to populate plugin/podman.plg's entities.
|
|
#
|
|
# Produces: $OUTPUT/<name>-<version>-<arch>-<build><tag>.txz (+ .sha256, .md5)
|
|
# -----------------------------------------------------------------------------
|
|
sb_make_package() {
|
|
local version="$1"
|
|
local arch="$2"
|
|
local build="$3"
|
|
local tag="$4"
|
|
|
|
mkdir -p "$PKG/install"
|
|
if [ -f "$CWD/slack-desc" ]; then
|
|
cp "$CWD/slack-desc" "$PKG/install/slack-desc"
|
|
else
|
|
echo "!! [$PRGNAM] missing packages/$PRGNAM/slack-desc" >&2
|
|
exit 1
|
|
fi
|
|
[ -f "$CWD/doinst.sh" ] && cp "$CWD/doinst.sh" "$PKG/install/doinst.sh"
|
|
|
|
# Strip debug symbols where possible to keep package size down; ignore
|
|
# failures (e.g. static/stripped-already binaries, non-ELF files).
|
|
find "$PKG" -type f \( -perm -u+x -o -name '*.so*' \) -exec sh -c \
|
|
'file "$1" | grep -q ELF && strip --strip-unneeded "$1" 2>/dev/null || true' _ {} \;
|
|
|
|
local pkg_file="$PRGNAM-$version-$arch-$build$tag.txz"
|
|
( cd "$PKG" && makepkg --linkadd y --chown y "$OUTPUT/$pkg_file" )
|
|
|
|
( cd "$OUTPUT" && sha256sum "$pkg_file" > "$pkg_file.sha256" )
|
|
( cd "$OUTPUT" && md5sum "$pkg_file" > "$pkg_file.md5" )
|
|
|
|
echo "==> [$PRGNAM] built $OUTPUT/$pkg_file"
|
|
}
|