stornic56/debianito-post-install
1
0
Fork 0
mirror of https://github.com/stornic56/debianito-post-install.git synced 2026-10-31 13:08:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Integrity fixes: atomic writes, rc checks, curl

Browse Source 
- Verified the repository backup rc in migrate.sh. `_persistent_backup_repos()` now aborts before any destructive step when the tar archive is missing or corrupt, removing the invalid backup itself.
- Verified the restore rc in migrate.sh. `_restore_backup()` now reports failure instead of printing a green "Backup restored" message, and its caller distinguishes a restored backup from a failed restore.
- Made the upgrade phases fail honestly. `apt upgrade` and `apt full-upgrade` now abort with `apt --fix-broken install` + `dpkg --configure -a` instructions instead of reporting "completed successfully" over a partially-upgraded system.
- Made repository source writes atomic. Both writers tee into a `.tmp` file and move into place, and the `/etc/apt/sources.list` removal now happens after the write.
- Corrected the SID warning text in migrate.sh to reflect that security fixes arrive via package uploads rather than a nonexistent sid-security suite.
- Added exit-path cleanup traps for the temp `.deb` files: `trap 'rm -f "$deb_path"' RETURN` in `heroic.sh`and `tools.sh`.
- Tightened Heroic download handling: the API fetch uses `curl -fsS --connect-timeout 10 --max-time 30`, the download uses `curl -fsSL --max-time 300`, and the `.deb` is validated with both `dpkg-deb --info` and `dpkg-deb --contents`; `sudo apt install` is guarded with `if !` before the temporary file is deleted.
- Tightened the OpenRGB install path: the Codeberg API fetch uses `curl -fsS --connect-timeout 10 --max-time 30` and the download `curl -fsSL --max-time 300`, with the same dual `dpkg-deb` integrity check as the Heroic fallback.
- Guarded the OpenRGB post-install side effects: the script now aborts after removing the failed `.deb` if `sudo apt install` returns non-zero, so `modprobe i2c-dev`, `/etc/modules`, the `i2c` group membership, `udevadm`, and the `setcap` step no longer run when the package is absent.
This commit is contained in:
stornic56
2026-10-04 23:39:40 -05:00
committed by GitHub
parent 9828ea439c
commit 9a96dff6ea
22 changed files with 975 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/repos/migrate.sh
+68 -16
View File
@@ -13,7 +13,13 @@ _persistent_backup_repos() {
[ -f /etc/apt/sources.list ] && files+=("/etc/apt/sources.list")
[ -d /etc/apt/sources.list.d ] && files+=("/etc/apt/sources.list.d")
[ ${#files[@]} -eq 0 ] && return 1
sudo tar czf "$_MIGRATE_BACKUP" "${files[@]}" 2>/dev/null
# The rollback promise depends on this archive:
# a failed backup must abort before anything is
# deleted or rewritten.
if ! sudo tar czf "$_MIGRATE_BACKUP" "${files[@]}" 2>/dev/null; then
rm -f "$_MIGRATE_BACKUP"
return 1
fi
echo "Backup: $_MIGRATE_BACKUP"
}
@@ -23,7 +29,13 @@ _restore_backup() {
return 1
fi
echo -e "${YELLOW}Restoring repository backup...${NC}"
sudo tar xzf "$_MIGRATE_BACKUP" -C / 2>/dev/null
if ! sudo tar xzf "$_MIGRATE_BACKUP" -C / 2>/dev/null; then
_msg_red "Restore Failed" \
"Extraction of $_MIGRATE_BACKUP failed.\n\
/etc/apt sources may be missing or inconsistent.\n\n\
Restore manually:\n sudo tar xzf $_MIGRATE_BACKUP -C /" 12 70
return 1
fi
echo -e "${GREEN}Backup restored from $_MIGRATE_BACKUP${NC}"
}
@@ -64,7 +76,14 @@ _write_deb822_branch() {
fi
sudo mkdir -p /etc/apt/sources.list.d
echo -e "$main_content" | sudo tee "$main_file" >/dev/null
# Stage to a temp file and move atomically: an
# interrupted write never leaves a partial sources.
if ! echo -e "$main_content" | sudo tee "${main_file}.tmp" >/dev/null; then
return 1
fi
if ! sudo mv "${main_file}.tmp" "$main_file"; then
return 1
fi
echo "Wrote $main_file"
}
@@ -80,7 +99,14 @@ _write_classic_branch() {
main_content+="deb https://security.debian.org/debian-security ${target}-security main contrib non-free non-free-firmware\n"
fi
echo -e "$main_content" | sudo tee "$main_file" >/dev/null
# Stage to a temp file and move atomically: an
# interrupted write never leaves a partial sources.
if ! echo -e "$main_content" | sudo tee "${main_file}.tmp" >/dev/null; then
return 1
fi
if ! sudo mv "${main_file}.tmp" "$main_file"; then
return 1
fi
echo "Wrote $main_file"
}
@@ -93,7 +119,8 @@ Risks include:\n\
• NVIDIA / DKMS drivers may break\n\
• System may fail to boot after reboot\n\
• Some packages may be removed or replaced\n\
• SID (unstable) receives NO security updates\n\n\
• SID (unstable) has no release cycle; security\n\
fixes arrive via package uploads, not DSAs\n\n\
A full persistent backup will be saved to /var/backups/\n\
so you can restore if things go wrong." 16 70
@@ -154,16 +181,20 @@ so you can restore if things go wrong." 16 70
[ -f /etc/apt/sources.list.d/debian-backports.sources ] && sudo rm -f /etc/apt/sources.list.d/debian-backports.sources
[ -f /etc/apt/sources.list.d/debian-backports.list ] && sudo rm -f /etc/apt/sources.list.d/debian-backports.list
# 4c. Remove any old classic source files to avoid conflicts
[ -f /etc/apt/sources.list ] && sudo rm -f /etc/apt/sources.list
# 4d. Write new sources
# 4c. Write new sources
if ! _write_branch_sources "$target"; then
echo -e "${RED}[-]${NC} Failed to write new sources. Restoring backup..."
_restore_backup || true
return 1
fi
# 4d. Remove the old classic file AFTER the new
# sources are live: an interrupt between steps
# leaves both files (recoverable), not none.
# Only needed on the deb822 path; the classic
# writer replaced sources.list atomically.
[ "$DEBIAN_VERSION" = "13" ] && [ -f /etc/apt/sources.list ] && sudo rm -f /etc/apt/sources.list
# 4e. SID guardrails: install bug alerts before upgrade
if [ "$target" = "sid" ]; then
echo -e "${YELLOW}Installing apt-listbugs and apt-listchanges (SID guardrails)...${NC}"
@@ -175,19 +206,40 @@ so you can restore if things go wrong." 16 70
echo -e "${YELLOW}Running apt update...${NC}"
if ! sudo apt update; then
echo -e "${RED}apt update failed. Restoring backup...${NC}"
_restore_backup
_msg_red "Migration Failed" \
"apt update failed. Backup has been restored from:\n\
if _restore_backup; then
_msg_red "Migration Failed" \
"apt update failed. Backup has been restored from:\n\
$_MIGRATE_BACKUP\n\n\
Your system should be back to its previous state.\n\
Run 'sudo apt update' manually to verify." 12 70
return
else
_msg_red "Migration Failed" \
"apt update failed AND the backup could not be\n\
restored from $_MIGRATE_BACKUP.\n\n\
Restore it manually:\n sudo tar xzf $_MIGRATE_BACKUP -C /\n\
then run: sudo apt update" 12 70
fi
return 1
fi
# 4g. Full upgrade
_run_cmd "Upgrade" "sudo apt upgrade -y" "Upgrading packages..."
_run_cmd "Full-Upgrade" "sudo apt full-upgrade -y" "Running full-upgrade..."
_run_cmd "Autoremove" "sudo apt autoremove -y" "Removing obsolete packages..."
# A failed upgrade leaves packages half-installed.
# Restoring only the sources would be worse (stable
# sources + testing packages), so stop with an
# honest report and manual-recovery instructions.
if ! _run_cmd "Upgrade" "sudo apt upgrade -y" "Upgrading packages..."; then
_msg_red "Migration Incomplete" \
"Package upgrade failed. The system is partially\n\
upgraded to ${target}. Do NOT reboot yet.\n\n\
Repair with:\n sudo apt --fix-broken install\n sudo dpkg --configure -a\n\n\
To roll back the branch manually, restore:\n sudo tar xzf $_MIGRATE_BACKUP -C /" 14 70
return 1
fi
if ! _run_cmd "Full-Upgrade" "sudo apt full-upgrade -y" "Running full-upgrade..."; then
_msg_red "Migration Incomplete" "full-upgrade failed. Repair with:\n sudo apt --fix-broken install\nBackup: $_MIGRATE_BACKUP" 10 70
return 1
fi
_run_cmd "Autoremove" "sudo apt autoremove -y" "Removing obsolete packages..." || true
# 4h. Re-run detection to reflect new branch
echo -e "${YELLOW}Re-running system detection for new branch...${NC}"