145 lines
4.9 KiB
Bash
Executable File
145 lines
4.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
BUILDER_ROOT=${BUILDER_ROOT:-/opt/rust-package-builder}
|
|
source "$BUILDER_ROOT/scripts/lib.sh"
|
|
|
|
SOURCE_DIR=${1:?source path required}
|
|
BINARY=${2:?FreeBSD binary required}
|
|
PACKAGE_FILE=${3:?output package file required}
|
|
PACKAGE_VERSION=${4:?OPNsense package version required}
|
|
|
|
PLUGIN_ROOT="$BUILDER_ROOT/opnsense/plugin"
|
|
FREEBSD_ABI=${FREEBSD_ABI:-FreeBSD:15:amd64}
|
|
FREEBSD_ARCH=${FREEBSD_ARCH:-freebsd:15:x86:64}
|
|
|
|
for tool in python3 sha256sum tar zstd file; do
|
|
require_cmd "$tool"
|
|
done
|
|
|
|
[[ -f "$SOURCE_DIR/Cargo.toml" ]] || fatal "missing Cargo.toml in $SOURCE_DIR"
|
|
[[ -f "$BINARY" ]] || fatal "missing cross-built binary: $BINARY"
|
|
[[ -d "$PLUGIN_ROOT/src" ]] || fatal "missing embedded OPNsense plugin source: $PLUGIN_ROOT/src"
|
|
|
|
binary_desc=$(file -b "$BINARY")
|
|
[[ "$binary_desc" == *FreeBSD* ]] || fatal "refusing to package a non-FreeBSD binary: $binary_desc"
|
|
|
|
WORK=$(mktemp -d "${PACKAGE_FILE}.work.XXXXXX")
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
STAGE="$WORK/stage"
|
|
META="$WORK/meta"
|
|
ARCHIVE="$WORK/os-rustproxy.tar"
|
|
PAYLOAD_LIST="$WORK/payload.list"
|
|
mkdir -p "$STAGE/usr/local" "$META" "$(dirname "$PACKAGE_FILE")"
|
|
|
|
cp -a "$PLUGIN_ROOT/src/." "$STAGE/usr/local/"
|
|
mkdir -p "$STAGE/usr/local/sbin"
|
|
install -m 0555 "$BINARY" "$STAGE/usr/local/sbin/rust-proxy"
|
|
|
|
chmod 0555 "$STAGE/usr/local/etc/rc.d/rustproxy"
|
|
chmod 0555 "$STAGE/usr/local/etc/rc.syshook.d/start/50-rustproxy.start"
|
|
chmod 0555 "$STAGE/usr/local/opnsense/scripts/rustproxy/service.sh"
|
|
|
|
POST_INSTALL_FILE="$PLUGIN_ROOT/+POST_INSTALL.pre"
|
|
PRE_DEINSTALL_FILE="$PLUGIN_ROOT/+PRE_DEINSTALL.pre"
|
|
|
|
python3 - "$STAGE" "$META" "$PACKAGE_VERSION" "$FREEBSD_ABI" "$FREEBSD_ARCH" \
|
|
"$POST_INSTALL_FILE" "$PRE_DEINSTALL_FILE" <<'PY'
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
stage = Path(sys.argv[1])
|
|
meta_dir = Path(sys.argv[2])
|
|
version = sys.argv[3]
|
|
abi = sys.argv[4]
|
|
arch = sys.argv[5]
|
|
post_install = Path(sys.argv[6]).read_text(encoding="utf-8")
|
|
pre_deinstall = Path(sys.argv[7]).read_text(encoding="utf-8")
|
|
|
|
files = {}
|
|
flatsize = 0
|
|
for p in sorted(stage.rglob("*")):
|
|
if p.is_symlink():
|
|
files["/" + p.relative_to(stage).as_posix()] = "-"
|
|
elif p.is_file():
|
|
files["/" + p.relative_to(stage).as_posix()] = hashlib.sha256(p.read_bytes()).hexdigest()
|
|
flatsize += p.stat().st_size
|
|
|
|
common = {
|
|
"name": "os-rustproxy",
|
|
"version": version,
|
|
"origin": "opnsense/os-rustproxy",
|
|
"comment": "RustProxy reverse proxy service",
|
|
"desc": "RustProxy packaged as an OPNsense plugin with configurable HTTP, HTTPS/TLS and administration listeners.",
|
|
"maintainer": "local@localhost",
|
|
"www": "https://git.linuxiarz.pl/gru/RustProxy",
|
|
"prefix": "/usr/local",
|
|
"abi": abi,
|
|
"arch": arch,
|
|
"flatsize": flatsize,
|
|
"licenselogic": "single",
|
|
"licenses": ["UNKNOWN"],
|
|
"categories": ["www"],
|
|
"deps": {},
|
|
"options": {},
|
|
}
|
|
manifest = dict(common)
|
|
manifest["files"] = files
|
|
manifest["scripts"] = {
|
|
"post-install": post_install,
|
|
"pre-deinstall": pre_deinstall,
|
|
}
|
|
|
|
(meta_dir / "+COMPACT_MANIFEST").write_text(
|
|
json.dumps(common, separators=(",", ":"), ensure_ascii=False) + "\n",
|
|
encoding="utf-8",
|
|
)
|
|
(meta_dir / "+MANIFEST").write_text(
|
|
json.dumps(manifest, separators=(",", ":"), ensure_ascii=False) + "\n",
|
|
encoding="utf-8",
|
|
)
|
|
PY
|
|
|
|
(
|
|
cd "$STAGE"
|
|
find . \( -type f -o -type l \) -print | LC_ALL=C sort | sed 's#^\./##' > "$PAYLOAD_LIST"
|
|
)
|
|
[[ -s "$PAYLOAD_LIST" ]] || fatal "OPNsense package payload is empty"
|
|
|
|
tar --format=ustar --owner=0 --group=0 --numeric-owner \
|
|
-cf "$ARCHIVE" -C "$META" +COMPACT_MANIFEST +MANIFEST
|
|
tar -P --format=ustar --owner=0 --group=0 --numeric-owner --no-recursion \
|
|
--transform='s,^,/,S' \
|
|
-rf "$ARCHIVE" -C "$STAGE" -T "$PAYLOAD_LIST"
|
|
|
|
python3 - "$ARCHIVE" "$META/+MANIFEST" <<'PY'
|
|
import json
|
|
from pathlib import Path
|
|
import sys
|
|
import tarfile
|
|
|
|
archive = Path(sys.argv[1])
|
|
manifest = json.loads(Path(sys.argv[2]).read_text(encoding="utf-8"))
|
|
expected = set(manifest.get("files", {}))
|
|
with tarfile.open(archive, "r:") as tf:
|
|
members = tf.getmembers()
|
|
if [m.name for m in members[:2]] != ["+COMPACT_MANIFEST", "+MANIFEST"]:
|
|
raise SystemExit("package metadata must be the first two tar members")
|
|
payload = members[2:]
|
|
if any(m.isdir() for m in payload):
|
|
raise SystemExit("directory entries are not allowed in OPNsense package payload")
|
|
actual = {m.name for m in payload if m.isfile() or m.issym() or m.islnk()}
|
|
relative = sorted(name for name in actual if not name.startswith("/"))
|
|
if relative:
|
|
raise SystemExit(f"payload contains non-absolute paths: {relative[:5]}")
|
|
missing = sorted(expected - actual)
|
|
extra = sorted(actual - expected)
|
|
if missing or extra:
|
|
raise SystemExit(f"package payload does not match +MANIFEST; missing={missing[:5]} extra={extra[:5]}")
|
|
PY
|
|
|
|
zstd -q -f -19 -T0 "$ARCHIVE" -o "$PACKAGE_FILE"
|
|
zstd -dc "$PACKAGE_FILE" | tar -tf - >/dev/null
|
|
log "created OPNsense package: $PACKAGE_FILE"
|