mirror of
https://github.com/stornic56/debianito-post-install.git
synced 2026-10-31 13:08:06 +00:00
Integrity fixes: atomic writes, rc checks, curl
- Verified the repository backup rc in migrate.sh. `_persistent_backup_repos()` now aborts before any destructive step when the tar archive is missing or corrupt, removing the invalid backup itself. - Verified the restore rc in migrate.sh. `_restore_backup()` now reports failure instead of printing a green "Backup restored" message, and its caller distinguishes a restored backup from a failed restore. - Made the upgrade phases fail honestly. `apt upgrade` and `apt full-upgrade` now abort with `apt --fix-broken install` + `dpkg --configure -a` instructions instead of reporting "completed successfully" over a partially-upgraded system. - Made repository source writes atomic. Both writers tee into a `.tmp` file and move into place, and the `/etc/apt/sources.list` removal now happens after the write. - Corrected the SID warning text in migrate.sh to reflect that security fixes arrive via package uploads rather than a nonexistent sid-security suite. - Added exit-path cleanup traps for the temp `.deb` files: `trap 'rm -f "$deb_path"' RETURN` in `heroic.sh`and `tools.sh`. - Tightened Heroic download handling: the API fetch uses `curl -fsS --connect-timeout 10 --max-time 30`, the download uses `curl -fsSL --max-time 300`, and the `.deb` is validated with both `dpkg-deb --info` and `dpkg-deb --contents`; `sudo apt install` is guarded with `if !` before the temporary file is deleted. - Tightened the OpenRGB install path: the Codeberg API fetch uses `curl -fsS --connect-timeout 10 --max-time 30` and the download `curl -fsSL --max-time 300`, with the same dual `dpkg-deb` integrity check as the Heroic fallback. - Guarded the OpenRGB post-install side effects: the script now aborts after removing the failed `.deb` if `sudo apt install` returns non-zero, so `modprobe i2c-dev`, `/etc/modules`, the `i2c` group membership, `udevadm`, and the `setcap` step no longer run when the package is absent.
This commit is contained in:
stornic56
+68
-16
@@ -13,7 +13,13 @@ _persistent_backup_repos() {
|
||||
[ -f /etc/apt/sources.list ] && files+=("/etc/apt/sources.list")
|
||||
[ -d /etc/apt/sources.list.d ] && files+=("/etc/apt/sources.list.d")
|
||||
[ ${#files[@]} -eq 0 ] && return 1
|
||||
sudo tar czf "$_MIGRATE_BACKUP" "${files[@]}" 2>/dev/null
|
||||
# The rollback promise depends on this archive:
|
||||
# a failed backup must abort before anything is
|
||||
# deleted or rewritten.
|
||||
if ! sudo tar czf "$_MIGRATE_BACKUP" "${files[@]}" 2>/dev/null; then
|
||||
rm -f "$_MIGRATE_BACKUP"
|
||||
return 1
|
||||
fi
|
||||
echo "Backup: $_MIGRATE_BACKUP"
|
||||
}
|
||||
|
||||
@@ -23,7 +29,13 @@ _restore_backup() {
|
||||
return 1
|
||||
fi
|
||||
echo -e "${YELLOW}Restoring repository backup...${NC}"
|
||||
sudo tar xzf "$_MIGRATE_BACKUP" -C / 2>/dev/null
|
||||
if ! sudo tar xzf "$_MIGRATE_BACKUP" -C / 2>/dev/null; then
|
||||
_msg_red "Restore Failed" \
|
||||
"Extraction of $_MIGRATE_BACKUP failed.\n\
|
||||
/etc/apt sources may be missing or inconsistent.\n\n\
|
||||
Restore manually:\n sudo tar xzf $_MIGRATE_BACKUP -C /" 12 70
|
||||
return 1
|
||||
fi
|
||||
echo -e "${GREEN}Backup restored from $_MIGRATE_BACKUP${NC}"
|
||||
}
|
||||
|
||||
@@ -64,7 +76,14 @@ _write_deb822_branch() {
|
||||
fi
|
||||
|
||||
sudo mkdir -p /etc/apt/sources.list.d
|
||||
echo -e "$main_content" | sudo tee "$main_file" >/dev/null
|
||||
# Stage to a temp file and move atomically: an
|
||||
# interrupted write never leaves a partial sources.
|
||||
if ! echo -e "$main_content" | sudo tee "${main_file}.tmp" >/dev/null; then
|
||||
return 1
|
||||
fi
|
||||
if ! sudo mv "${main_file}.tmp" "$main_file"; then
|
||||
return 1
|
||||
fi
|
||||
echo "Wrote $main_file"
|
||||
}
|
||||
|
||||
@@ -80,7 +99,14 @@ _write_classic_branch() {
|
||||
main_content+="deb https://security.debian.org/debian-security ${target}-security main contrib non-free non-free-firmware\n"
|
||||
fi
|
||||
|
||||
echo -e "$main_content" | sudo tee "$main_file" >/dev/null
|
||||
# Stage to a temp file and move atomically: an
|
||||
# interrupted write never leaves a partial sources.
|
||||
if ! echo -e "$main_content" | sudo tee "${main_file}.tmp" >/dev/null; then
|
||||
return 1
|
||||
fi
|
||||
if ! sudo mv "${main_file}.tmp" "$main_file"; then
|
||||
return 1
|
||||
fi
|
||||
echo "Wrote $main_file"
|
||||
}
|
||||
|
||||
@@ -93,7 +119,8 @@ Risks include:\n\
|
||||
• NVIDIA / DKMS drivers may break\n\
|
||||
• System may fail to boot after reboot\n\
|
||||
• Some packages may be removed or replaced\n\
|
||||
• SID (unstable) receives NO security updates\n\n\
|
||||
• SID (unstable) has no release cycle; security\n\
|
||||
fixes arrive via package uploads, not DSAs\n\n\
|
||||
A full persistent backup will be saved to /var/backups/\n\
|
||||
so you can restore if things go wrong." 16 70
|
||||
|
||||
@@ -154,16 +181,20 @@ so you can restore if things go wrong." 16 70
|
||||
[ -f /etc/apt/sources.list.d/debian-backports.sources ] && sudo rm -f /etc/apt/sources.list.d/debian-backports.sources
|
||||
[ -f /etc/apt/sources.list.d/debian-backports.list ] && sudo rm -f /etc/apt/sources.list.d/debian-backports.list
|
||||
|
||||
# 4c. Remove any old classic source files to avoid conflicts
|
||||
[ -f /etc/apt/sources.list ] && sudo rm -f /etc/apt/sources.list
|
||||
|
||||
# 4d. Write new sources
|
||||
# 4c. Write new sources
|
||||
if ! _write_branch_sources "$target"; then
|
||||
echo -e "${RED}[-]${NC} Failed to write new sources. Restoring backup..."
|
||||
_restore_backup || true
|
||||
return 1
|
||||
fi
|
||||
|
||||
# 4d. Remove the old classic file AFTER the new
|
||||
# sources are live: an interrupt between steps
|
||||
# leaves both files (recoverable), not none.
|
||||
# Only needed on the deb822 path; the classic
|
||||
# writer replaced sources.list atomically.
|
||||
[ "$DEBIAN_VERSION" = "13" ] && [ -f /etc/apt/sources.list ] && sudo rm -f /etc/apt/sources.list
|
||||
|
||||
# 4e. SID guardrails: install bug alerts before upgrade
|
||||
if [ "$target" = "sid" ]; then
|
||||
echo -e "${YELLOW}Installing apt-listbugs and apt-listchanges (SID guardrails)...${NC}"
|
||||
@@ -175,19 +206,40 @@ so you can restore if things go wrong." 16 70
|
||||
echo -e "${YELLOW}Running apt update...${NC}"
|
||||
if ! sudo apt update; then
|
||||
echo -e "${RED}apt update failed. Restoring backup...${NC}"
|
||||
_restore_backup
|
||||
_msg_red "Migration Failed" \
|
||||
"apt update failed. Backup has been restored from:\n\
|
||||
if _restore_backup; then
|
||||
_msg_red "Migration Failed" \
|
||||
"apt update failed. Backup has been restored from:\n\
|
||||
$_MIGRATE_BACKUP\n\n\
|
||||
Your system should be back to its previous state.\n\
|
||||
Run 'sudo apt update' manually to verify." 12 70
|
||||
return
|
||||
else
|
||||
_msg_red "Migration Failed" \
|
||||
"apt update failed AND the backup could not be\n\
|
||||
restored from $_MIGRATE_BACKUP.\n\n\
|
||||
Restore it manually:\n sudo tar xzf $_MIGRATE_BACKUP -C /\n\
|
||||
then run: sudo apt update" 12 70
|
||||
fi
|
||||
return 1
|
||||
fi
|
||||
|
||||
# 4g. Full upgrade
|
||||
_run_cmd "Upgrade" "sudo apt upgrade -y" "Upgrading packages..."
|
||||
_run_cmd "Full-Upgrade" "sudo apt full-upgrade -y" "Running full-upgrade..."
|
||||
_run_cmd "Autoremove" "sudo apt autoremove -y" "Removing obsolete packages..."
|
||||
# A failed upgrade leaves packages half-installed.
|
||||
# Restoring only the sources would be worse (stable
|
||||
# sources + testing packages), so stop with an
|
||||
# honest report and manual-recovery instructions.
|
||||
if ! _run_cmd "Upgrade" "sudo apt upgrade -y" "Upgrading packages..."; then
|
||||
_msg_red "Migration Incomplete" \
|
||||
"Package upgrade failed. The system is partially\n\
|
||||
upgraded to ${target}. Do NOT reboot yet.\n\n\
|
||||
Repair with:\n sudo apt --fix-broken install\n sudo dpkg --configure -a\n\n\
|
||||
To roll back the branch manually, restore:\n sudo tar xzf $_MIGRATE_BACKUP -C /" 14 70
|
||||
return 1
|
||||
fi
|
||||
if ! _run_cmd "Full-Upgrade" "sudo apt full-upgrade -y" "Running full-upgrade..."; then
|
||||
_msg_red "Migration Incomplete" "full-upgrade failed. Repair with:\n sudo apt --fix-broken install\nBackup: $_MIGRATE_BACKUP" 10 70
|
||||
return 1
|
||||
fi
|
||||
_run_cmd "Autoremove" "sudo apt autoremove -y" "Removing obsolete packages..." || true
|
||||
|
||||
# 4h. Re-run detection to reflect new branch
|
||||
echo -e "${YELLOW}Re-running system detection for new branch...${NC}"
|
||||
|
||||
@@ -5,12 +5,13 @@
|
||||
# Any active (non-commented) source of any format, in any file?
|
||||
# Returns: 0 if at least one active source exists, 1 otherwise
|
||||
has_active_deb_sources() {
|
||||
local apt_dir="${APT_DIR:-/etc/apt}"
|
||||
local f
|
||||
for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list; do
|
||||
for f in "$apt_dir/sources.list" "$apt_dir/sources.list.d/"*.list; do
|
||||
[ -f "$f" ] || continue
|
||||
grep -qE '^[^#]*\bdeb\b' "$f" 2>/dev/null && return 0
|
||||
done
|
||||
for f in /etc/apt/sources.list.d/*.sources; do
|
||||
for f in "$apt_dir/sources.list.d/"*.sources; do
|
||||
[ -f "$f" ] || continue
|
||||
grep -qE '^Types:.*\bdeb\b' "$f" 2>/dev/null && \
|
||||
grep -qE '^URIs:' "$f" 2>/dev/null && return 0
|
||||
@@ -22,10 +23,11 @@ has_active_deb_sources() {
|
||||
# DEB822 is only valid on Debian 13 (Trixie); Debian 11/12 are classic-only.
|
||||
# Returns: "deb822", "classic", or "none"
|
||||
detect_repo_format() {
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f /etc/apt/sources.list.d/debian.sources ] && \
|
||||
grep -qE '^Types:.*\bdeb\b' /etc/apt/sources.list.d/debian.sources 2>/dev/null; then
|
||||
local apt_dir="${APT_DIR:-/etc/apt}"
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f "$apt_dir/sources.list.d/debian.sources" ] && \
|
||||
grep -qE '^Types:.*\bdeb\b' "$apt_dir/sources.list.d/debian.sources" 2>/dev/null; then
|
||||
echo "deb822"
|
||||
elif [ -f /etc/apt/sources.list ] && grep -qE '^[^#]*\bdeb\b' /etc/apt/sources.list 2>/dev/null; then
|
||||
elif [ -f "$apt_dir/sources.list" ] && grep -qE '^[^#]*\bdeb\b' "$apt_dir/sources.list" 2>/dev/null; then
|
||||
echo "classic"
|
||||
else
|
||||
echo "none"
|
||||
@@ -35,17 +37,18 @@ detect_repo_format() {
|
||||
# Detect the components currently active in the main repo file
|
||||
# Returns: components list (e.g. "main contrib non-free non-free-firmware")
|
||||
detect_active_components() {
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f /etc/apt/sources.list.d/debian.sources ]; then
|
||||
local apt_dir="${APT_DIR:-/etc/apt}"
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f "$apt_dir/sources.list.d/debian.sources" ]; then
|
||||
local comps
|
||||
comps=$(grep "^Components:" /etc/apt/sources.list.d/debian.sources 2>/dev/null | head -1 | cut -d: -f2- | sed 's/^[[:space:]]*//')
|
||||
comps=$(grep "^Components:" "$apt_dir/sources.list.d/debian.sources" 2>/dev/null | head -1 | cut -d: -f2- | sed 's/^[[:space:]]*//')
|
||||
if [ -n "$comps" ]; then
|
||||
echo "$comps"
|
||||
return
|
||||
fi
|
||||
fi
|
||||
if [ -f /etc/apt/sources.list ]; then
|
||||
if [ -f "$apt_dir/sources.list" ]; then
|
||||
local comps
|
||||
comps=$(grep "^[^#]*deb .* main" /etc/apt/sources.list 2>/dev/null | head -1 | sed 's/.*main\s*//')
|
||||
comps=$(grep "^[^#]*deb .* main" "$apt_dir/sources.list" 2>/dev/null | head -1 | sed 's/.*main\s*//')
|
||||
if [ -n "$comps" ]; then
|
||||
echo "main $comps"
|
||||
return
|
||||
@@ -61,17 +64,18 @@ detect_active_components() {
|
||||
# Check whether backports are currently enabled (any format, any file)
|
||||
# Returns: 0 if enabled, 1 otherwise
|
||||
detect_backports_status() {
|
||||
local apt_dir="${APT_DIR:-/etc/apt}"
|
||||
local codename="$1"
|
||||
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f /etc/apt/sources.list.d/debian.sources ]; then
|
||||
grep -qE "^Suites:.*${codename}-backports" /etc/apt/sources.list.d/debian.sources 2>/dev/null && return 0
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f "$apt_dir/sources.list.d/debian.sources" ]; then
|
||||
grep -qE "^Suites:.*${codename}-backports" "$apt_dir/sources.list.d/debian.sources" 2>/dev/null && return 0
|
||||
fi
|
||||
if [ -f /etc/apt/sources.list ]; then
|
||||
grep -qE "^[^#]*${codename}-backports" /etc/apt/sources.list 2>/dev/null && return 0
|
||||
if [ -f "$apt_dir/sources.list" ]; then
|
||||
grep -qE "^[^#]*${codename}-backports" "$apt_dir/sources.list" 2>/dev/null && return 0
|
||||
fi
|
||||
if [ -d /etc/apt/sources.list.d ]; then
|
||||
grep -qrE "^Suites:.*${codename}-backports" /etc/apt/sources.list.d/*.sources 2>/dev/null && return 0
|
||||
grep -qrE "^[^#]*${codename}-backports" /etc/apt/sources.list.d/*.list 2>/dev/null && return 0
|
||||
if [ -d "$apt_dir/sources.list.d" ]; then
|
||||
grep -qrE "^Suites:.*${codename}-backports" "$apt_dir/sources.list.d/"*.sources 2>/dev/null && return 0
|
||||
grep -qrE "^[^#]*${codename}-backports" "$apt_dir/sources.list.d/"*.list 2>/dev/null && return 0
|
||||
fi
|
||||
|
||||
return 1
|
||||
@@ -84,24 +88,25 @@ detect_backports_status() {
|
||||
# "embedded-classic" (inside sources.list),
|
||||
# "none"
|
||||
detect_backports_location() {
|
||||
local apt_dir="${APT_DIR:-/etc/apt}"
|
||||
local codename="$1"
|
||||
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f /etc/apt/sources.list.d/debian-backports.sources ] && \
|
||||
grep -qE "^Suites:.*${codename}-backports" /etc/apt/sources.list.d/debian-backports.sources 2>/dev/null; then
|
||||
if [ "$DEBIAN_VERSION" = "13" ] && [ -f "$apt_dir/sources.list.d/debian-backports.sources" ] && \
|
||||
grep -qE "^Suites:.*${codename}-backports" "$apt_dir/sources.list.d/debian-backports.sources" 2>/dev/null; then
|
||||
echo "standalone-deb822"
|
||||
elif [ -f /etc/apt/sources.list.d/debian-backports.list ] && \
|
||||
grep -qE "^[^#]*${codename}-backports" /etc/apt/sources.list.d/debian-backports.list 2>/dev/null; then
|
||||
elif [ -f "$apt_dir/sources.list.d/debian-backports.list" ] && \
|
||||
grep -qE "^[^#]*${codename}-backports" "$apt_dir/sources.list.d/debian-backports.list" 2>/dev/null; then
|
||||
echo "standalone-classic"
|
||||
elif [ "$DEBIAN_VERSION" = "13" ] && [ -f /etc/apt/sources.list.d/debian.sources ] && \
|
||||
grep -qE "^Suites:.*${codename}-backports" /etc/apt/sources.list.d/debian.sources 2>/dev/null; then
|
||||
elif [ "$DEBIAN_VERSION" = "13" ] && [ -f "$apt_dir/sources.list.d/debian.sources" ] && \
|
||||
grep -qE "^Suites:.*${codename}-backports" "$apt_dir/sources.list.d/debian.sources" 2>/dev/null; then
|
||||
echo "embedded-deb822"
|
||||
elif [ -f /etc/apt/sources.list ] && \
|
||||
grep -qE "^[^#]*${codename}-backports" /etc/apt/sources.list 2>/dev/null; then
|
||||
elif [ -f "$apt_dir/sources.list" ] && \
|
||||
grep -qE "^[^#]*${codename}-backports" "$apt_dir/sources.list" 2>/dev/null; then
|
||||
echo "embedded-classic"
|
||||
elif [ -d /etc/apt/sources.list.d ]; then
|
||||
if grep -qrE "^Suites:.*${codename}-backports" /etc/apt/sources.list.d/*.sources 2>/dev/null; then
|
||||
elif [ -d "$apt_dir/sources.list.d" ]; then
|
||||
if grep -qrE "^Suites:.*${codename}-backports" "$apt_dir/sources.list.d/"*.sources 2>/dev/null; then
|
||||
echo "embedded-deb822"
|
||||
elif grep -qrE "^[^#]*${codename}-backports" /etc/apt/sources.list.d/*.list 2>/dev/null; then
|
||||
elif grep -qrE "^[^#]*${codename}-backports" "$apt_dir/sources.list.d/"*.list 2>/dev/null; then
|
||||
echo "embedded-classic"
|
||||
else
|
||||
echo "none"
|
||||
|
||||
Reference in New Issue
Block a user