new_version

2026-10-19 11:09:13 +02:00
1 parent 910bb563f0
commit a946c38194
@@ -2,19 +2,20 @@
 set -Eeuo pipefail
 SRC=${1:?usage: check-rustproxy-source.sh /path/to/RustProxy}

-for f in \
-    Cargo.toml \
-    debian/rustproxy.service \
-    debian/rustproxy.environment \
-    debian/rustproxy.logrotate \
-    debian/rustproxy.tmpfiles \
-    debian/rustproxy.postinst \
-    grafana/rustproxy-overview.json; do
+for f in Cargo.toml grafana/rustproxy-overview.json src/main/bootstrap.rs; do
    [[ -f "$SRC/$f" ]] || { echo "missing: $f" >&2; exit 1; }
 done
-
 grep -q '^name = "rust-proxy"' "$SRC/Cargo.toml"
-grep -q '^ExecStart=/usr/bin/rust-proxy serve' "$SRC/debian/rustproxy.service"
-grep -q '^RUST_PROXY_DATA_DIR=/var/lib/rustproxy' "$SRC/debian/rustproxy.environment"
+grep -q 'RUST_PROXY_CONFIG' "$SRC/src/main/bootstrap.rs"
+grep -q 'Reload,' "$SRC/src/main/bootstrap.rs"

-echo 'RustProxy packaging layout: OK'
+# Old RustProxy releases shipped full Debian metadata. The 0.34.x source
+# archive no longer does; the builder's own nFPM fallback is authoritative.
+if [[ -f "$SRC/debian/rustproxy.service" ]]; then
+    grep -q 'ExecStart=' "$SRC/debian/rustproxy.service"
+else
+    [[ -f "$SRC/deploy/rustproxy.service" ]] || { echo 'no reference systemd unit found' >&2; exit 1; }
+    grep -q '^ExecReload=' "$SRC/deploy/rustproxy.service"
+fi
+
+echo 'RustProxy source supports --config and soft reload: OK'
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+WORK=$(mktemp -d)
+SLEEP_PID=""
+cleanup() {
+    [[ -z "$SLEEP_PID" ]] || kill "$SLEEP_PID" 2>/dev/null || true
+    rm -rf "$WORK"
+}
+trap cleanup EXIT
+
+for tool in file zstd tar python3; do
+    command -v "$tool" >/dev/null 2>&1 || { echo "SKIP FreeBSD native packaging: missing $tool"; exit 0; }
+done
+mkdir -p "$WORK/source" "$WORK/repo/FreeBSD:15:amd64" "$WORK/run"
+printf '[package]\nname = "rust-proxy"\nversion = "0.34.1"\n' > "$WORK/source/Cargo.toml"
+python3 - "$WORK/bin" <<'PY'
+from pathlib import Path
+import struct,sys
+p=Path(sys.argv[1]); p.write_bytes(b'\x7fELF\x02\x01\x01\x09'+bytes(8)+struct.pack('<HHIQQQIHHHHHH',2,62,1,0,0,0,0,64,56,0,64,0,0));p.chmod(0o755)
+PY
+export BUILDER_ROOT="$ROOT" FREEBSD_ABI=FreeBSD:15:amd64 FREEBSD_ARCH=freebsd:15:x86:64
+"$ROOT/scripts/package-freebsd.sh" "$WORK/source" "$WORK/bin" "$WORK/rustproxy-0.34.1_2.pkg" 0.34.1_2
+zstd -dc "$WORK/rustproxy-0.34.1_2.pkg" | tar -xOf - +MANIFEST > "$WORK/manifest.json"
+python3 - "$WORK/manifest.json" <<'PY'
+import json,sys
+m=json.load(open(sys.argv[1])); names=set(m['files'])
+assert m['name']=='rustproxy'
+assert m['origin']=='www/rustproxy'
+assert m['version']=='0.34.1_2'
+assert m['abi']=='FreeBSD:15:amd64'
+assert '/usr/local/sbin/rust-proxy' in names
+assert '/usr/local/etc/rc.d/rustproxy' in names
+assert '/usr/local/etc/newsyslog.conf.d/rustproxy.conf' in names
+assert len(names)==3
+assert not any('/opnsense/' in n or 'syshook' in n for n in names)
+assert 'post-install' in m['scripts'] and 'pre-deinstall' in m['scripts']
+PY
+
+# Test the actual rc.d reload command without a running FreeBSD machine.
+cat > "$WORK/rc.subr" <<'SH'
+load_rc_config() { :; }
+checkyesno() { eval 'v=${'"$1"'-NO}'; [ "$v" = YES ]; }
+run_rc_command() { case "$1" in reload) "$reload_cmd" ;; *) return 1 ;; esac; }
+SH
+cat > "$WORK/su" <<'SH'
+#!/bin/sh
+printf '%s\n' "$*" > "$TEST_ARGS"
+SH
+chmod +x "$WORK/su"
+python3 - "$ROOT/packaging/freebsd/rustproxy.rc" "$WORK/rc" "$WORK" <<'PY'
+from pathlib import Path
+import sys
+src=Path(sys.argv[1]).read_text();w=Path(sys.argv[3]);
+src=src.replace('. /etc/rc.subr', f'. "{w}/rc.subr"')
+src=src.replace('/usr/bin/su -m', f'"{w}/su" -m')
+Path(sys.argv[2]).write_text(src)
+PY
+sleep 120 & SLEEP_PID=$!
+printf '%s\n' "$SLEEP_PID" > "$WORK/run/rustproxy.pid"
+export TEST_ARGS="$WORK/cli-args" rustproxy_run_dir="$WORK/run"
+export rustproxy_config=/usr/local/etc/rustproxy/config.json rustproxy_enable=YES
+sh "$WORK/rc" reload
+rg_args=$(cat "$TEST_ARGS")
+[[ "$rg_args" == *'--data-dir /var/db/rustproxy'* ]]
+[[ "$rg_args" == *'--config /usr/local/etc/rustproxy/config.json'* ]]
+[[ "$rg_args" == *'--admin-listen 127.0.0.1:9090 reload'* ]]
+export rustproxy_config='/usr/local/etc/rustproxy/config.json;touch /tmp/bad'
+if sh "$WORK/rc" reload >/dev/null 2>&1; then
+    echo 'unsafe config path was accepted' >&2; exit 1
+fi
+unset rustproxy_config
+
+# Catalog generation: mock FreeBSD bsdtar on Linux using zstd + tar.
+mkdir -p "$WORK/mockbin"
+cat > "$WORK/mockbin/bsdtar" <<'SH'
+#!/bin/sh
+case "$1" in
+    -xOf) zstd -dc "$2" | tar -xOf - "$3" ;;
+    *) exit 2 ;;
+esac
+SH
+chmod +x "$WORK/mockbin/bsdtar"
+cp "$WORK/rustproxy-0.34.1_2.pkg" "$WORK/repo/FreeBSD:15:amd64/"
+cp "$WORK/rustproxy-0.34.1_2.pkg" "$WORK/repo/rustproxy-latest.pkg"
+PATH="$WORK/mockbin:$PATH" python3 "$ROOT/scripts/generate-opnsense-repo.py" "$WORK/repo" --retention 10
+python3 - "$WORK/repo/packagesite.pkg" <<'PY'
+import json,tarfile,sys
+with tarfile.open(sys.argv[1]) as archive:
+    content=archive.extractfile('packagesite.yaml').read().decode().splitlines()
+assert len(content)==1,content
+pkg=json.loads(content[0]);assert pkg['name']=='rustproxy'
+assert pkg['path']=='FreeBSD:15:amd64/rustproxy-0.34.1_2.pkg',pkg['path']
+PY
+
+echo 'FreeBSD native package, rc.d reload and repository catalog: OK'
@@ -62,6 +62,9 @@ export MAINTAINER=test@example.invalid HOMEPAGE=https://example.invalid
 export GPG_PRIVATE_KEY_FILE=/nonexistent/test.gpg
 "$ROOT/scripts/prepare-package.sh" "$WORK/source" "$WORK/linux" "$WORK/bin"
 cmp "$ROOT/packaging/rustproxy.logrotate" "$WORK/linux/payload/etc/logrotate.d/rustproxy"
+UNIT="$WORK/linux/payload/usr/lib/systemd/system/rustproxy.service"
+grep -Fq 'ExecReload=/usr/bin/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 127.0.0.1:9090 reload' "$UNIT"
+grep -Fq 'ReadWritePaths=-/etc/rustproxy' "$UNIT"
 for metadata in nfpm-deb.yaml nfpm-rpm.yaml; do
    grep -Fq '/etc/logrotate.d/rustproxy' "$WORK/linux/$metadata"
    grep -Fq 'config|noreplace' "$WORK/linux/$metadata"
@@ -39,7 +39,9 @@ PY
 # Isolate the rc.d argument composition without running FreeBSD-only commands.
 cat > "$WORK/rc.subr" <<'EOF'
 load_rc_config() { :; }
-run_rc_command() { printf '%s\n' "$command_args"; }
+run_rc_command() {
+    if [ "$1" = reload ]; then "$reload_cmd"; else printf '%s\n' "$command_args"; fi
+}
 EOF
 python3 - "$RC" "$WORK/rc-test" "$WORK" <<'PY'
 from pathlib import Path
@@ -67,6 +69,26 @@ assert_interval 604800
 printf 'enabled="1"\n' > "$WORK/opnsense.conf"
 args=$(sh "$WORK/rc-test" start)
 [[ "$args" == *'--update-check-interval-secs 3600 serve'* ]] || exit 1
+# Exercise the rc.d soft reload itself with a live mock child and CLI.
+mkdir -p "$WORK/bin"
+cat > "$WORK/bin/mock-cli" <<'EOF'
+#!/bin/sh
+printf '%s\n' "$*" > "$TEST_CLI_ARGS"
+EOF
+chmod +x "$WORK/bin/mock-cli"
+printf 'enabled="1"\nrustproxy_config_path="/usr/local/etc/rustproxy/config.json"\n' > "$WORK/opnsense.conf"
+echo "$$" > "$WORK/rustproxy.pid"
+export TEST_CLI_ARGS="$WORK/cli-args"
+rustproxy_run_dir="$WORK" rustproxy_command="$WORK/bin/mock-cli" sh "$WORK/rc-test" reload
+args=$(cat "$TEST_CLI_ARGS")
+[[ "$args" == *'--data-dir /var/db/rustproxy'* ]]
+[[ "$args" == *'--config /usr/local/etc/rustproxy/config.json'* ]]
+[[ "$args" == *'--admin-listen 127.0.0.1:9090 reload'* ]]
+printf 'enabled="1"\nrustproxy_config_path="/usr/local/etc/rustproxy/config.json;touch /tmp/bad"\n' > "$WORK/opnsense.conf"
+if rustproxy_run_dir="$WORK" rustproxy_command="$WORK/bin/mock-cli" sh "$WORK/rc-test" reload >/dev/null 2>&1; then
+    echo 'Unsafe OPNsense config path was accepted' >&2; exit 1
+fi
+
 for invalid in 0 59 604801 nope '1;touch /tmp/pwn'; do
    printf 'enabled="1"\nrustproxy_update_check_interval_secs="%s"\n' "$invalid" > "$WORK/opnsense.conf"
    if sh "$WORK/rc-test" start >/dev/null 2>&1; then
@@ -90,6 +112,7 @@ case "$1" in
    status) [ -f "$TEST_PID" ] ;;
    onestart) printf 'start\n' >> "$TEST_LOG"; touch "$TEST_PID" ;;
    onestop) printf 'stop\n' >> "$TEST_LOG"; rm -f "$TEST_PID" ;;
+    reload) printf 'reload\n' >> "$TEST_LOG" ;;
    *) exit 1 ;;
 esac
 EOF
@@ -114,6 +137,9 @@ ENABLED=1 "$WORK/hook-test"
 [[ $(grep -cx start "$TEST_LOG") == 1 ]] || { echo 'Boot did not start service' >&2; exit 1; }
 ENABLED=1 "$WORK/hook-test"
 [[ $(grep -cx start "$TEST_LOG") == 1 ]] || { echo 'Duplicate supervisor start' >&2; exit 1; }
+ENABLED=1 "$WORK/service-test" reload
+[[ $(grep -cx reload "$TEST_LOG") == 1 ]] || { echo 'Soft reload not passed through' >&2; exit 1; }
+[[ $(grep -cx stop "$TEST_LOG" || true) == 0 ]] || { echo 'Soft reload restarted service' >&2; exit 1; }
 rm -f "$TEST_PID"
 ENABLED=0 "$WORK/hook-test"
 [[ $(grep -cx start "$TEST_LOG") == 1 ]] || { echo 'Disabled service started' >&2; exit 1; }
@@ -122,4 +148,4 @@ if FAIL_RENDER=1 ENABLED=1 "$WORK/hook-test" >/dev/null 2>&1; then
 fi
 [[ $(grep -cx start "$TEST_LOG") == 1 ]] || { echo 'Started despite failed template rendering' >&2; exit 1; }

-echo 'OPNsense boot / update interval checks: OK'
+echo 'OPNsense boot / update interval / soft reload checks: OK'
@@ -16,6 +16,13 @@ grep -q '/opt/freebsd-sysroot' "$ROOT/Dockerfile"
 # Coordinator uses one checkout but independent branches.
 grep -q 'build-linux-release.sh' "$ROOT/scripts/build-release.sh"
 grep -q 'build-opnsense-release.sh' "$ROOT/scripts/build-release.sh"
+grep -q 'build-freebsd-release.sh' "$ROOT/scripts/build-release.sh"
+grep -q 'package-freebsd.sh' "$ROOT/scripts/build-freebsd-release.sh"
+grep -q 'FREEBSD_NATIVE_PACKAGING_REVISION=1' "$ROOT/scripts/lib.sh"
+grep -Fq 'FREEBSD_NATIVE_ENABLED: "${FREEBSD_NATIVE_ENABLED:-0}"' "$ROOT/docker-compose.yml"
+grep -Fq 'location /freebsd/' "$ROOT/http/nginx.conf"
+grep -Fq 'FREEBSD_NATIVE_ENABLED=0' "$ROOT/.env.example"
+grep -Fq 'ExecReload=/usr/bin/' "$ROOT/scripts/prepare-package.sh"
 grep -q 'OPNsense branch will still run' "$ROOT/scripts/build-release.sh"

 # Linux tests gate Linux packaging only.
@@ -36,7 +43,7 @@ grep -q 'last_opnsense_commit' "$ROOT/scripts/build-opnsense-release.sh"
 test -f "$ROOT/opnsense/plugin/src/etc/rc.d/rustproxy"
 test -x "$ROOT/opnsense/plugin/src/etc/rc.syshook.d/start/50-rustproxy.start"
 ! test -e "$ROOT/opnsense/plugin/src/etc/rc.syshook.d/10-rustproxy.start"
-grep -q 'OPNSENSE_PACKAGING_REVISION=3' "$ROOT/scripts/lib.sh"
+grep -q 'OPNSENSE_PACKAGING_REVISION=4' "$ROOT/scripts/lib.sh"
 test -f "$ROOT/opnsense/patches/0.20.0/0001-opnsense-build.patch"

 # Per-branch state/retry logic.