maggesandClaude Sonnet 5
9d46547ef4
podman-verify-packages.sh/podman-update-packages.sh reported every package as "not installed" right after a genuinely successful install. Root cause: /var/log/packages is itself a symlink on Unraid (-> ../lib/pkgtools/packages), and GNU find's default -P mode doesn't descend into a symlinked starting path at all without -L — confirmed live by running the exact same find both with and without -L against a host where the packages had just installed successfully. Fixing that alone surfaced a second, previously-masked bug: "podman"'s own glob also matches podman-compose's file (a literal prefix collision), and find's unsorted output let podman-compose's record silently win podman's own check. Both fixed once via a new shared podman_find_installed_package_record() helper in podman-common.sh, rather than separately in each caller. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
130 lines
5.0 KiB
Bash
Executable File
130 lines
5.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# =============================================================================
|
|
# plugin/sbin/podman-verify-packages.sh
|
|
#
|
|
# "Pakete prüfen" — verifies the eleven packages this plugin ships are
|
|
# actually installed, at the version the plugin expects, and that the
|
|
# backed-up .txz copies (see podman-backup.sh) haven't bit-rotted on disk.
|
|
#
|
|
# Three checks per package:
|
|
# 1. Installed: Slackware records every installed package under
|
|
# /var/log/packages/<name>-<version>-<arch>-<build><tag> — its mere
|
|
# existence IS the install record (standard Slackware pkgtools
|
|
# convention, nothing custom here).
|
|
# 2. Expected version: compared against
|
|
# /usr/local/share/unraid-podman/installed-versions.env, written by
|
|
# plugin/podman.plg's postinstall step at install/update time.
|
|
# 3. Backup integrity: if a backed-up .txz exists for the installed
|
|
# version (see podman-backup.sh), its current SHA256 is re-checked
|
|
# against the .sha256 sidecar recorded at build time — catches flash
|
|
# storage corruption on the backup copy before it's needed for a
|
|
# rollback.
|
|
#
|
|
# Usage:
|
|
# podman-verify-packages.sh # human-readable report
|
|
# podman-verify-packages.sh --quiet # exit code only, minimal output
|
|
#
|
|
# Exit code: 0 if everything checks out, 1 if any package has a problem.
|
|
# =============================================================================
|
|
|
|
set -u
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=./podman-common.sh
|
|
. "$SCRIPT_DIR/podman-common.sh"
|
|
|
|
INSTALLED_VERSIONS_FILE="/usr/local/share/unraid-podman/installed-versions.env"
|
|
PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables podman-compose unraid-podman"
|
|
|
|
QUIET=0
|
|
[ "${1:-}" = "--quiet" ] && QUIET=1
|
|
|
|
report() {
|
|
[ "$QUIET" -eq 0 ] && echo "$1"
|
|
}
|
|
|
|
if [ ! -f "$INSTALLED_VERSIONS_FILE" ]; then
|
|
podman_log_error "verify: $INSTALLED_VERSIONS_FILE missing — plugin install metadata not found"
|
|
exit 1
|
|
fi
|
|
# shellcheck source=/dev/null
|
|
. "$INSTALLED_VERSIONS_FILE"
|
|
|
|
if [ -z "${PLUGIN_VERSION:-}" ]; then
|
|
podman_log_error "verify: PLUGIN_VERSION not recorded in $INSTALLED_VERSIONS_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
PROBLEMS=0
|
|
|
|
for name in $PACKAGES; do
|
|
entity_prefix=$(echo "$name" | tr '[:lower:]-' '[:upper:]_')
|
|
expected_version_var="${entity_prefix}_INSTALLED_VERSION"
|
|
expected_version="${!expected_version_var:-}"
|
|
|
|
report "== $name =="
|
|
|
|
if [ -z "$expected_version" ]; then
|
|
report " expected version: UNKNOWN (not recorded in $INSTALLED_VERSIONS_FILE)"
|
|
PROBLEMS=$((PROBLEMS + 1))
|
|
continue
|
|
fi
|
|
report " expected version: $expected_version"
|
|
|
|
# --- Check 1: installed -----------------------------------------------
|
|
# See podman-common.sh's podman_find_installed_package_record() for why
|
|
# this isn't just a plain `find ... -name "$name-*" | head -n1`.
|
|
installed_record=$(podman_find_installed_package_record "$name" $PACKAGES)
|
|
if [ -z "$installed_record" ]; then
|
|
report " installed: NO"
|
|
podman_log_error "verify: $name is not installed (no /var/log/packages/$name-* record)"
|
|
PROBLEMS=$((PROBLEMS + 1))
|
|
continue
|
|
fi
|
|
installed_basename=$(basename "$installed_record")
|
|
report " installed package: $installed_basename"
|
|
|
|
# --- Check 2: version matches expectation ------------------------------
|
|
case "$installed_basename" in
|
|
"${name}-${expected_version}-"*)
|
|
report " version match: OK"
|
|
;;
|
|
*)
|
|
report " version match: MISMATCH (installed record does not match expected $expected_version)"
|
|
podman_log_error "verify: $name installed record '$installed_basename' does not match expected version $expected_version"
|
|
PROBLEMS=$((PROBLEMS + 1))
|
|
;;
|
|
esac
|
|
|
|
# --- Check 3: backup artifact integrity, if present --------------------
|
|
# Packages of all components released together as one plugin version
|
|
# are grouped under a single PLUGIN_VERSION directory (not per-component
|
|
# version) — a rollback targets "go back to plugin release X", matching
|
|
# podman-backup.sh's restore-packages <plugin-version>.
|
|
backup_dir="$PODMAN_BACKUP_DIR/packages/$PLUGIN_VERSION"
|
|
backup_txz=$(find "$backup_dir" -maxdepth 1 -name "${name}-*.txz" 2> /dev/null | head -n1)
|
|
if [ -n "$backup_txz" ] && [ -f "$backup_txz.sha256" ]; then
|
|
if ( cd "$(dirname "$backup_txz")" && sha256sum -c "$(basename "$backup_txz").sha256" > /dev/null 2>&1 ); then
|
|
report " backup integrity: OK ($backup_txz)"
|
|
else
|
|
report " backup integrity: CORRUPT ($backup_txz)"
|
|
podman_log_error "verify: backup artifact $backup_txz failed checksum verification"
|
|
PROBLEMS=$((PROBLEMS + 1))
|
|
fi
|
|
else
|
|
report " backup integrity: no backup artifact on file (nothing to verify)"
|
|
fi
|
|
done
|
|
|
|
report ""
|
|
if [ "$PROBLEMS" -gt 0 ]; then
|
|
report "$PROBLEMS problem(s) found."
|
|
podman_notify "Podman package verification found problems" \
|
|
"$PROBLEMS issue(s) found — see $PODMAN_PLUGIN_LOG for details." \
|
|
"warning"
|
|
exit 1
|
|
fi
|
|
|
|
report "All packages verified OK."
|
|
exit 0
|