opn

README.md

@@ -193,3 +193,15 @@ curl -f http://127.0.0.1:18766/healthz
 ## Klucz GPG
 
 `./start.sh` generuje trwały klucz GPG przy pierwszym uruchomieniu. Katalogu `gpg/` nie należy usuwać po publikacji APT/RPM.
+
+## Migracja ze starszego buildera Linux-only
+
+`last_commit` nie jest już jedynym warunkiem pominięcia kompilacji. Builder sprawdza też, czy aktualnie opublikowany release zawiera kompletne APT, RPM i OPNsense repo oraz czy `opnsense/BUILD-INFO.txt` wskazuje na ten sam commit.
+
+Jeżeli `data/state/last_commit` pochodzi ze starszej wersji narzędzia i DEB/RPM są już opublikowane, ale OPNsense repo jeszcze nie istnieje, pierwszy cykl zaloguje:
+
+```text
+commit unchanged, but unified release is incomplete; rebuilding missing artifacts for <sha>
+```
+
+i wykona build dla tego samego commita. Przy `PACKAGE_RELEASE=auto` taki build naprawczy zachowuje dotychczasowy numer wydania DEB/RPM zamiast sztucznie go zwiększać.

http/nginx.conf

@@ -35,7 +35,8 @@ http {
         add_header X-Content-Type-Options "nosniff" always;
         add_header X-Frame-Options "DENY" always;
         add_header Referrer-Policy "no-referrer" always;
-
+        add_header Cache-Control "max-age=600" always;
+        
         if ($request_method !~ ^(GET|HEAD)$) {
             return 405;
         }
@@ -73,10 +74,10 @@ http {
         index index.html;
         autoindex off;
 
-        #add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Content-Type-Options "nosniff" always;
-        #add_header X-Frame-Options "DENY" always;
+        add_header X-Frame-Options "DENY" always;
-        #add_header Referrer-Policy "no-referrer" always;
+        add_header Referrer-Policy "no-referrer" always;
-        #add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+        add_header Cache-Control "max-age=600" always;
 
         if ($request_method !~ ^(GET|HEAD)$) {
             return 405;

scripts/build-release.sh

@@ -3,6 +3,7 @@ set -Eeuo pipefail
 source /opt/rust-package-builder/scripts/lib.sh
 
 SHA=${1:?commit SHA required}
+BUILD_REASON=${2:-new-commit}
 SHORT_SHA=${SHA:0:12}
 BUILD_ID="$(date -u '+%Y%m%dT%H%M%SZ')-${SHORT_SHA}"
 WORK="$DATA_DIR/work/$BUILD_ID"
@@ -100,11 +101,24 @@ HOMEPAGE=${PACKAGE_HOMEPAGE:-${CARGO_HOMEPAGE:-${CARGO_REPOSITORY:-${CONTROL_HOM
 
 REQUESTED_PACKAGE_RELEASE=$PACKAGE_RELEASE
 if [[ "$REQUESTED_PACKAGE_RELEASE" == "auto" ]]; then
+    LAST_COMMIT=""
     LAST_VERSION=""
     LAST_PACKAGE_RELEASE=0
+    [[ -r "$DATA_DIR/state/last_commit" ]] && LAST_COMMIT=$(cat "$DATA_DIR/state/last_commit")
     [[ -r "$DATA_DIR/state/last_version" ]] && LAST_VERSION=$(cat "$DATA_DIR/state/last_version")
     [[ -r "$DATA_DIR/state/last_package_release" ]] && LAST_PACKAGE_RELEASE=$(cat "$DATA_DIR/state/last_package_release")
-    if [[ "$LAST_VERSION" == "$VERSION" && "$LAST_PACKAGE_RELEASE" =~ ^[0-9]+$ ]]; then
+
+    # Repairing an incomplete unified release for the exact same source commit
+    # must not create an artificial new DEB/RPM release number. This is the
+    # migration path from the older Linux-only builder: Linux packages already
+    # exist, while the new OPNsense artifacts still need to be produced.
+    if [[ "$BUILD_REASON" == "repair-missing-artifacts" \
+        && "$LAST_COMMIT" == "$SHA" \
+        && "$LAST_VERSION" == "$VERSION" \
+        && "$LAST_PACKAGE_RELEASE" =~ ^[1-9][0-9]*$ ]]; then
+        PACKAGE_RELEASE=$LAST_PACKAGE_RELEASE
+        log "repair build: reusing Linux package release $PACKAGE_RELEASE for unchanged commit"
+    elif [[ "$LAST_VERSION" == "$VERSION" && "$LAST_PACKAGE_RELEASE" =~ ^[0-9]+$ ]]; then
         PACKAGE_RELEASE=$((LAST_PACKAGE_RELEASE + 1))
     else
         PACKAGE_RELEASE=1
@@ -281,6 +295,7 @@ package_version=$OPNSENSE_PACKAGE_VERSION
 source_url=$SOURCE_REPO
 source_ref=$SOURCE_BRANCH
 source_commit=$SHA
+build_reason=$BUILD_REASON
 source_revision=$SOURCE_REVISION
 opnsense_series=$OPNSENSE_ABI
 freebsd_release=$FREEBSD_RELEASE
@@ -319,4 +334,4 @@ printf '%s\n' "$PACKAGE_RELEASE" | atomic_write "$DATA_DIR/state/last_package_re
 printf '%s\n' "$OPNSENSE_PACKAGE_VERSION" | atomic_write "$DATA_DIR/state/last_opnsense_package_version"
 printf '%s\n' "$BUILD_ID" | atomic_write "$DATA_DIR/state/last_release"
 
-log "build completed: version=$VERSION linux_release=$PACKAGE_RELEASE opnsense=$OPNSENSE_PACKAGE_VERSION commit=$SHA release=$BUILD_ID"
+log "build completed: reason=$BUILD_REASON version=$VERSION linux_release=$PACKAGE_RELEASE opnsense=$OPNSENSE_PACKAGE_VERSION commit=$SHA release=$BUILD_ID"

scripts/check-and-build.sh

@@ -3,6 +3,36 @@ set -Eeuo pipefail
 source /opt/rust-package-builder/scripts/lib.sh
 
 STATE_FILE="$DATA_DIR/state/last_commit"
+REPOSITORY="$DATA_DIR/repository"
+
+published_release_complete_for_commit() {
+    local sha=$1
+    local current="$REPOSITORY/current"
+    local opnsense="$current/opnsense"
+    local package_dir="$opnsense/$OPNSENSE_ABI/amd64"
+
+    [[ -d "$current" ]] || return 1
+
+    # Linux side of the atomic release.
+    [[ -f "$current/apt/dists/$REPO_DISTRIBUTION/InRelease" ]] || return 1
+    [[ -f "$current/rpm/x86_64/repodata/repomd.xml" ]] || return 1
+
+    # OPNsense side. BUILD-INFO ties the published pkg repository to the same
+    # source commit so an old Linux-only release cannot be mistaken for a
+    # complete unified release after migration.
+    [[ -f "$opnsense/meta.conf" ]] || return 1
+    [[ -f "$opnsense/packagesite.pkg" ]] || return 1
+    [[ -f "$opnsense/data.pkg" ]] || return 1
+    [[ -f "$opnsense/RustProxy.conf" ]] || return 1
+    [[ -f "$opnsense/BUILD-INFO.txt" ]] || return 1
+    [[ -f "$opnsense/os-rustproxy-latest.pkg" ]] || return 1
+    grep -Fqx "source_commit=$sha" "$opnsense/BUILD-INFO.txt" || return 1
+    grep -Fqx "opnsense_series=$OPNSENSE_ABI" "$opnsense/BUILD-INFO.txt" || return 1
+    [[ -d "$package_dir" ]] || return 1
+    find "$package_dir" -maxdepth 1 -type f -name 'os-rustproxy-*.pkg' -print -quit | grep -q . || return 1
+
+    return 0
+}
 
 log "checking repository"
 REMOTE_SHA=$(git ls-remote "$SOURCE_REPO" "refs/heads/$SOURCE_BRANCH" | awk 'NR == 1 {print $1}')
@@ -12,9 +42,15 @@ LAST_SHA=""
 [[ -r "$STATE_FILE" ]] && LAST_SHA=$(cat "$STATE_FILE")
 
 if [[ "$REMOTE_SHA" == "$LAST_SHA" ]]; then
-    log "no changes: $REMOTE_SHA"
+    if published_release_complete_for_commit "$REMOTE_SHA"; then
+        log "no changes and unified release is complete: $REMOTE_SHA"
+        exit 0
+    fi
+
+    log "commit unchanged, but unified release is incomplete; rebuilding missing artifacts for $REMOTE_SHA"
+    /opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" repair-missing-artifacts
     exit 0
 fi
 
 log "new commit detected: $REMOTE_SHA"
-/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA"
+/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" new-commit

tests/static.sh

@@ -32,6 +32,9 @@ test -f "$ROOT/opnsense/patches/0.20.0/0001-opnsense-build.patch"
 grep -q 'current.new' "$ROOT/scripts/build-release.sh"
 grep -q 'current/opnsense' "$ROOT/scripts/init-storage.sh"
 grep -q 'last_opnsense_package_version' "$ROOT/scripts/build-release.sh"
+grep -q 'published_release_complete_for_commit' "$ROOT/scripts/check-and-build.sh"
+grep -q 'repair-missing-artifacts' "$ROOT/scripts/check-and-build.sh"
+grep -q 'BUILD-INFO.txt' "$ROOT/scripts/check-and-build.sh"
 
 # Two public endpoints from one nginx container.
 grep -Fq '${REPOSITORY_URL:?REPOSITORY_URL is required}' "$ROOT/docker-compose.yml"