fix: recover stalled update requests

deploy/systemd/kaidi-update.service

@@ -18,5 +18,5 @@ IOSchedulingPriority=6
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=full
-ReadWritePaths=/opt/kaidi /www/wwwroot/kaidi /var/lib/kaidi /var/lib/kaidi-update /var/log/kaidi /etc/systemd/system
+ReadWritePaths=/opt/kaidi -/www/wwwroot/kaidi /var/lib/kaidi /var/lib/kaidi-update /var/log/kaidi /etc/systemd/system
 UMask=0077

deploy/update.sh

@@ -62,6 +62,9 @@ case "$RUNTIME_ENV_FILE" in
 esac
 
 bootstrap_die() {
+  if [ -f "$PROCESSING_FILE" ] && [ ! -L "$PROCESSING_FILE" ]; then
+    fail "$1"
+  fi
   printf '%s\n' "$1" >&2
   exit 1
 }
@@ -174,6 +177,15 @@ prepare_update_layout() {
     || bootstrap_die "Private update directories could not be prepared"
 }
 
+prepare_queue_layout() {
+  if [ -d "$PROCESSING_DIR" ] && [ ! -L "$PROCESSING_DIR" ] \
+    && [ -d "$FAILED_REQUEST_ROOT" ] && [ ! -L "$FAILED_REQUEST_ROOT" ]; then
+    return 0
+  fi
+  install -d -o root -g root -m 0700 "$PROCESSING_DIR" "$FAILED_REQUEST_ROOT" \
+    || bootstrap_die "Private update queue directories could not be prepared"
+}
+
 secure_release_tree() {
   release_dir=$1
   chown -R root:"$SERVICE_GROUP" "$release_dir" || return 1
@@ -197,9 +209,6 @@ verify_release_access() {
   fi
 }
 
-prepare_update_layout
-load_runtime_database_env
-
 # shellcheck disable=SC2329 # Invoked by the EXIT trap below.
 cleanup() {
   rc=$?
@@ -616,6 +625,7 @@ validate_release_operations() {
     "$WORK_DIR/extracted/ops/kaidi-update.path" >/dev/null || return 1
 }
 
+prepare_queue_layout
 exec 9>"$LOCK_FILE"
 flock -n 9 || exit 0
 recover_interrupted_transaction
@@ -650,6 +660,8 @@ TARGET_VERSION=$REQUESTED_VERSION
 REQUEST_ACTION=$(jq -er '(.action // "INSTALL") | strings | ascii_upcase
   | select(. == "DOWNLOAD" or . == "INSTALL")' "$PROCESSING_FILE") \
   || fail "Update request action is invalid"
+prepare_update_layout
+load_runtime_database_env
 [ -z "$RELEASE_TOKEN" ] || { [ "${#RELEASE_TOKEN}" -le 512 ] \
   && ! printf '%s' "$RELEASE_TOKEN" | grep -q '[[:cntrl:]]'; } \
   || fail "UPDATE_RELEASE_TOKEN is invalid"