From e2398a4379a68d2b178a9dc6fc7c455bfbfe5a0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mateusz=20Gruszczy=C5=84ski?= Date: Wed, 7 Oct 2026 09:43:58 +0200 Subject: [PATCH] opn --- README.md | 12 ++++++++++++ http/nginx.conf | 11 ++++++----- scripts/build-release.sh | 19 ++++++++++++++++-- scripts/check-and-build.sh | 40 ++++++++++++++++++++++++++++++++++++-- tests/static.sh | 3 +++ 5 files changed, 76 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index ead1b12..9efe297 100644 --- a/README.md +++ b/README.md @@ -193,3 +193,15 @@ curl -f http://127.0.0.1:18766/healthz ## Klucz GPG `./start.sh` generuje trwały klucz GPG przy pierwszym uruchomieniu. Katalogu `gpg/` nie należy usuwać po publikacji APT/RPM. + +## Migracja ze starszego buildera Linux-only + +`last_commit` nie jest już jedynym warunkiem pominięcia kompilacji. Builder sprawdza też, czy aktualnie opublikowany release zawiera kompletne APT, RPM i OPNsense repo oraz czy `opnsense/BUILD-INFO.txt` wskazuje na ten sam commit. + +Jeżeli `data/state/last_commit` pochodzi ze starszej wersji narzędzia i DEB/RPM są już opublikowane, ale OPNsense repo jeszcze nie istnieje, pierwszy cykl zaloguje: + +```text +commit unchanged, but unified release is incomplete; rebuilding missing artifacts for +``` + +i wykona build dla tego samego commita. Przy `PACKAGE_RELEASE=auto` taki build naprawczy zachowuje dotychczasowy numer wydania DEB/RPM zamiast sztucznie go zwiększać. diff --git a/http/nginx.conf b/http/nginx.conf index c03f5b8..e190752 100644 --- a/http/nginx.conf +++ b/http/nginx.conf @@ -35,7 +35,8 @@ http { add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header Referrer-Policy "no-referrer" always; - + add_header Cache-Control "max-age=600" always; + if ($request_method !~ ^(GET|HEAD)$) { return 405; } @@ -73,10 +74,10 @@ http { index index.html; autoindex off; - #add_header X-Content-Type-Options "nosniff" always; - #add_header X-Frame-Options "DENY" always; - #add_header Referrer-Policy "no-referrer" always; - #add_header Cache-Control "no-cache, no-store, must-revalidate" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "DENY" always; + add_header Referrer-Policy "no-referrer" always; + add_header Cache-Control "max-age=600" always; if ($request_method !~ ^(GET|HEAD)$) { return 405; diff --git a/scripts/build-release.sh b/scripts/build-release.sh index f11f5dd..10b6add 100755 --- a/scripts/build-release.sh +++ b/scripts/build-release.sh @@ -3,6 +3,7 @@ set -Eeuo pipefail source /opt/rust-package-builder/scripts/lib.sh SHA=${1:?commit SHA required} +BUILD_REASON=${2:-new-commit} SHORT_SHA=${SHA:0:12} BUILD_ID="$(date -u '+%Y%m%dT%H%M%SZ')-${SHORT_SHA}" WORK="$DATA_DIR/work/$BUILD_ID" @@ -100,11 +101,24 @@ HOMEPAGE=${PACKAGE_HOMEPAGE:-${CARGO_HOMEPAGE:-${CARGO_REPOSITORY:-${CONTROL_HOM REQUESTED_PACKAGE_RELEASE=$PACKAGE_RELEASE if [[ "$REQUESTED_PACKAGE_RELEASE" == "auto" ]]; then + LAST_COMMIT="" LAST_VERSION="" LAST_PACKAGE_RELEASE=0 + [[ -r "$DATA_DIR/state/last_commit" ]] && LAST_COMMIT=$(cat "$DATA_DIR/state/last_commit") [[ -r "$DATA_DIR/state/last_version" ]] && LAST_VERSION=$(cat "$DATA_DIR/state/last_version") [[ -r "$DATA_DIR/state/last_package_release" ]] && LAST_PACKAGE_RELEASE=$(cat "$DATA_DIR/state/last_package_release") - if [[ "$LAST_VERSION" == "$VERSION" && "$LAST_PACKAGE_RELEASE" =~ ^[0-9]+$ ]]; then + + # Repairing an incomplete unified release for the exact same source commit + # must not create an artificial new DEB/RPM release number. This is the + # migration path from the older Linux-only builder: Linux packages already + # exist, while the new OPNsense artifacts still need to be produced. + if [[ "$BUILD_REASON" == "repair-missing-artifacts" \ + && "$LAST_COMMIT" == "$SHA" \ + && "$LAST_VERSION" == "$VERSION" \ + && "$LAST_PACKAGE_RELEASE" =~ ^[1-9][0-9]*$ ]]; then + PACKAGE_RELEASE=$LAST_PACKAGE_RELEASE + log "repair build: reusing Linux package release $PACKAGE_RELEASE for unchanged commit" + elif [[ "$LAST_VERSION" == "$VERSION" && "$LAST_PACKAGE_RELEASE" =~ ^[0-9]+$ ]]; then PACKAGE_RELEASE=$((LAST_PACKAGE_RELEASE + 1)) else PACKAGE_RELEASE=1 @@ -281,6 +295,7 @@ package_version=$OPNSENSE_PACKAGE_VERSION source_url=$SOURCE_REPO source_ref=$SOURCE_BRANCH source_commit=$SHA +build_reason=$BUILD_REASON source_revision=$SOURCE_REVISION opnsense_series=$OPNSENSE_ABI freebsd_release=$FREEBSD_RELEASE @@ -319,4 +334,4 @@ printf '%s\n' "$PACKAGE_RELEASE" | atomic_write "$DATA_DIR/state/last_package_re printf '%s\n' "$OPNSENSE_PACKAGE_VERSION" | atomic_write "$DATA_DIR/state/last_opnsense_package_version" printf '%s\n' "$BUILD_ID" | atomic_write "$DATA_DIR/state/last_release" -log "build completed: version=$VERSION linux_release=$PACKAGE_RELEASE opnsense=$OPNSENSE_PACKAGE_VERSION commit=$SHA release=$BUILD_ID" +log "build completed: reason=$BUILD_REASON version=$VERSION linux_release=$PACKAGE_RELEASE opnsense=$OPNSENSE_PACKAGE_VERSION commit=$SHA release=$BUILD_ID" diff --git a/scripts/check-and-build.sh b/scripts/check-and-build.sh index d21f0fc..4f7e367 100755 --- a/scripts/check-and-build.sh +++ b/scripts/check-and-build.sh @@ -3,6 +3,36 @@ set -Eeuo pipefail source /opt/rust-package-builder/scripts/lib.sh STATE_FILE="$DATA_DIR/state/last_commit" +REPOSITORY="$DATA_DIR/repository" + +published_release_complete_for_commit() { + local sha=$1 + local current="$REPOSITORY/current" + local opnsense="$current/opnsense" + local package_dir="$opnsense/$OPNSENSE_ABI/amd64" + + [[ -d "$current" ]] || return 1 + + # Linux side of the atomic release. + [[ -f "$current/apt/dists/$REPO_DISTRIBUTION/InRelease" ]] || return 1 + [[ -f "$current/rpm/x86_64/repodata/repomd.xml" ]] || return 1 + + # OPNsense side. BUILD-INFO ties the published pkg repository to the same + # source commit so an old Linux-only release cannot be mistaken for a + # complete unified release after migration. + [[ -f "$opnsense/meta.conf" ]] || return 1 + [[ -f "$opnsense/packagesite.pkg" ]] || return 1 + [[ -f "$opnsense/data.pkg" ]] || return 1 + [[ -f "$opnsense/RustProxy.conf" ]] || return 1 + [[ -f "$opnsense/BUILD-INFO.txt" ]] || return 1 + [[ -f "$opnsense/os-rustproxy-latest.pkg" ]] || return 1 + grep -Fqx "source_commit=$sha" "$opnsense/BUILD-INFO.txt" || return 1 + grep -Fqx "opnsense_series=$OPNSENSE_ABI" "$opnsense/BUILD-INFO.txt" || return 1 + [[ -d "$package_dir" ]] || return 1 + find "$package_dir" -maxdepth 1 -type f -name 'os-rustproxy-*.pkg' -print -quit | grep -q . || return 1 + + return 0 +} log "checking repository" REMOTE_SHA=$(git ls-remote "$SOURCE_REPO" "refs/heads/$SOURCE_BRANCH" | awk 'NR == 1 {print $1}') @@ -12,9 +42,15 @@ LAST_SHA="" [[ -r "$STATE_FILE" ]] && LAST_SHA=$(cat "$STATE_FILE") if [[ "$REMOTE_SHA" == "$LAST_SHA" ]]; then - log "no changes: $REMOTE_SHA" + if published_release_complete_for_commit "$REMOTE_SHA"; then + log "no changes and unified release is complete: $REMOTE_SHA" + exit 0 + fi + + log "commit unchanged, but unified release is incomplete; rebuilding missing artifacts for $REMOTE_SHA" + /opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" repair-missing-artifacts exit 0 fi log "new commit detected: $REMOTE_SHA" -/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" +/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" new-commit diff --git a/tests/static.sh b/tests/static.sh index 66b240f..dc7aabb 100755 --- a/tests/static.sh +++ b/tests/static.sh @@ -32,6 +32,9 @@ test -f "$ROOT/opnsense/patches/0.20.0/0001-opnsense-build.patch" grep -q 'current.new' "$ROOT/scripts/build-release.sh" grep -q 'current/opnsense' "$ROOT/scripts/init-storage.sh" grep -q 'last_opnsense_package_version' "$ROOT/scripts/build-release.sh" +grep -q 'published_release_complete_for_commit' "$ROOT/scripts/check-and-build.sh" +grep -q 'repair-missing-artifacts' "$ROOT/scripts/check-and-build.sh" +grep -q 'BUILD-INFO.txt' "$ROOT/scripts/check-and-build.sh" # Two public endpoints from one nginx container. grep -Fq '${REPOSITORY_URL:?REPOSITORY_URL is required}' "$ROOT/docker-compose.yml"