diff --git a/README.md b/README.md index 2252692..747bee2 100644 --- a/README.md +++ b/README.md @@ -52,21 +52,21 @@ Gitea 响应中可能错误指向内网地址的 `browser_download_url`。 PostgreSQL 18。PostgreSQL 兼容开发已冻结，不属于本次 Preview.12 发布范围。 执行命令的机器需预装 `bash`、`sudo`、`curl`、`mktemp` 和 `sha256sum`，并能访问目标 Gitea；`jq` 和 Java -由安装器补齐，数据库服务和数据库客户端均不会被安装。默认首次安装向导直接使用 JDBC 连接浏览器中填写的 +由安装器补齐；Java 17 优先使用服务器已有运行时，没有合适版本时才从官方 Azul 下载。数据库服务和数据库客户端均不会被安装。默认首次安装向导直接使用 JDBC 连接浏览器中填写的 外部数据库，不需要服务器安装 MySQL CLI。应用固定安装到 `/opt/kaidi`、`/var/lib/kaidi`、 `/var/lib/kaidi-update` 和 `/etc/kaidi`。安装器不安装、不启动也不修改 Nginx、Caddy、宝塔或其他反向代理。 ### 直接 curl 安装 ```bash -curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.12/install.sh | sudo bash +curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh | sudo bash ``` 这条命令会提示填写 Java 应用端口，直接回车使用 `18080`；随后安装最新签名 Release，并默认进入 `/setup` 安装向导。Java 默认只监听 `127.0.0.1:所选端口`，前端页面、API 和健康检查均由同一端口提供。无人值守安装可直接指定： ```bash -curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.12/install.sh \ +curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh \ | sudo env KAIDI_APP_PORT=19090 bash ``` @@ -74,8 +74,8 @@ curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-previe 时才设置 `KAIDI_SERVER_ADDRESS=0.0.0.0`，通常应保持默认回环绑定并由本机反向代理访问。需要在执行前独立校验安装脚本时使用： ```bash -curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.12/install.sh -o /tmp/kaidi-install.sh -printf '%s %s\n' ccc648cf63b9f495fd94ffb6ddd9374b1dd26e4acbc1ef63c1e3482e55b4ea65 /tmp/kaidi-install.sh | sha256sum -c - +curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh -o /tmp/kaidi-install.sh +printf '%s %s\n' 95a5887809edaf1e4ed6201224c4d2d122388c0289a83e2c960a0641d9671664 /tmp/kaidi-install.sh | sha256sum -c - sudo bash /tmp/kaidi-install.sh rm -f /tmp/kaidi-install.sh ``` @@ -86,7 +86,7 @@ rm -f /tmp/kaidi-install.sh 包装器会在 `sudo` 前校验 `deploy/install.sh` 的固定 SHA-256，再按同一公钥信任链安装最新签名 Release。 ```bash -git clone --branch v1.0.0-preview.12 --depth 1 https://git.awaioi.com/ERP-Team/kaidi.git kaidi-preview +git clone --branch v1.0.0-preview.13 --depth 1 https://git.awaioi.com/ERP-Team/kaidi.git kaidi-preview cd kaidi-preview ./deploy/install-from-git.sh ``` @@ -98,7 +98,7 @@ cd kaidi-preview - 仅在 Linux + systemd 环境执行；首版 32 位支持基线为带 systemd 的 Debian/Ubuntu x86 32 位 Linux。 - 不安装或创建数据库；在 `/setup` 中连接运维人员预先准备的外部 MySQL 8.4.x。 -- 识别 `x86_64`、`aarch64`、`armv7` 或 32 位 `i386/i486/i586/i686`，校验 SHA-256 后安装对应的 Azul Java 17 JRE。 +- 识别 `x86_64`、`aarch64`、`armv7` 或 32 位 `i386/i486/i586/i686`；已有 Java 17 直接复用，否则校验 SHA-256 后下载对应的官方 Azul Java 17 JRE。 - 使用安装器内置的 SHA-256 指纹校验 Release 公钥，再用该公钥验证发布清单 RSA 签名。 - 首次安装默认启用 `/setup` 向导，不在命令行保存数据库密码；向导只接受 MySQL 8.4.x，并在提交前验证 DDL/DML 权限。 - 安装签名 Release 到 `/opt/kaidi/releases/`，以 `/opt/kaidi/current` 原子切换当前版本。 @@ -141,7 +141,7 @@ sudo cat /root/kaidi-first-login.txt 32 位服务端镜像，因此 32 位主机需要预先连接一台 MySQL 8.4 数据库，之后仍然只执行一个安装命令： ```bash -curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.12/install.sh | sudo bash +curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh | sudo bash ``` 无论主机架构如何，安装器都不会安装 MySQL、数据库客户端或创建数据库容器。在打开向导前，需要预先创建 `kaidi_finance`，并授予安装账号该库的 @@ -161,7 +161,7 @@ GRANT ALL PRIVILEGES ON kaidi_finance.* TO 'kaidi'@'KAIDI_SERVER_IP'; 管理员数据和运维人员新增的环境变量： ```bash -curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.12/install.sh \ +curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh \ | sudo env KAIDI_REINSTALL=true KAIDI_SETUP_WIZARD=false bash ``` @@ -171,7 +171,7 @@ curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-previe 如果安装器已完成但向导尚未提交，可执行下面的命令重新生成一次性安装码；该恢复路径只接受仍处于向导模式且未锁定的安装，正式模式不会被覆盖。 ```bash -curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.12/install.sh \ +curl -fsSL https://git.awaioi.com/ERP-Team/kaidi/releases/download/v1.0.0-preview.13/install.sh \ | sudo env KAIDI_REINSTALL=true bash ``` @@ -207,8 +207,8 @@ act_runner 提供 `ubuntu-24.04` 标签，并在 tag 发布时执行后端、前 Preview 属性由 SemVer 版本名表达。之后推送 tag 即会构建、测试、签名并发布： ```bash -git tag v1.0.0-preview.12 -git push origin v1.0.0-preview.12 +git tag v1.0.0-preview.13 +git push origin v1.0.0-preview.13 ``` 在线更新使用独立的 TDesign 页面：隔离的系统管理员进入“系统治理 → 系统更新”。权限与配置页只管理用户、角色、数据范围、表单模板和参数版本，不配置系统名称或域名。 @@ -260,7 +260,7 @@ cat /var/lib/kaidi-update/status.json ```bash KAIDI_RELEASE_SIGNING_KEY=/secure/release-signing-private.pem \ KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256=807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9 \ - ./scripts/package-release.sh 1.0.0-preview.12 + ./scripts/package-release.sh 1.0.0-preview.13 KAIDI_TRUSTED_RELEASE_PUBLIC_KEY_SHA256=807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9 \ ./scripts/verify-release.sh dist/release ``` diff --git a/deploy/install-from-git.sh b/deploy/install-from-git.sh index 3877855..2361092 100755 --- a/deploy/install-from-git.sh +++ b/deploy/install-from-git.sh @@ -5,7 +5,7 @@ umask 077 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd) INSTALLER="$ROOT/deploy/install.sh" -INSTALLER_SHA256=${KAIDI_INSTALLER_SHA256:-ccc648cf63b9f495fd94ffb6ddd9374b1dd26e4acbc1ef63c1e3482e55b4ea65} +INSTALLER_SHA256=${KAIDI_INSTALLER_SHA256:-95a5887809edaf1e4ed6201224c4d2d122388c0289a83e2c960a0641d9671664} RELEASE_API_URL=${KAIDI_RELEASE_API_URL:-https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest} PUBLIC_KEY_SHA256=${KAIDI_RELEASE_PUBLIC_KEY_SHA256:-807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9} TOKEN_FILE=${KAIDI_RELEASE_TOKEN_FILE:-} diff --git a/deploy/install.sh b/deploy/install.sh index f2879a7..ca6611f 100755 --- a/deploy/install.sh +++ b/deploy/install.sh @@ -89,13 +89,17 @@ download() { local url=$1 output=$2 case "$url" in https://*) - curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \ - --tlsv1.2 "$url" -o "$output" + if ! curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \ + --tlsv1.2 --connect-timeout 15 --max-time 600 "$url" -o "$output"; then + die "Download failed: $url" + fi ;; *) [ "${KAIDI_ALLOW_INSECURE_UPDATE:-false}" = "true" ] || die "Release URLs must use HTTPS" - curl --fail --silent --show-error --location --proto '=http,https' \ - --proto-redir '=http,https' "$url" -o "$output" + if ! curl --fail --silent --show-error --location --proto '=http,https' \ + --proto-redir '=http,https' --connect-timeout 15 --max-time 600 "$url" -o "$output"; then + die "Download failed: $url" + fi ;; esac } @@ -175,8 +179,40 @@ azul_arch() { esac } +system_java_home() { + local java_bin resolved_java java_major home + if [ -n "${KAIDI_JAVA_HOME:-}" ]; then + home=${KAIDI_JAVA_HOME%/} + java_bin="$home/bin/java" + else + java_bin=$(command -v java 2>/dev/null || true) + fi + [ -x "$java_bin" ] || return 1 + java_major=$( + "$java_bin" -version 2>&1 \ + | sed -n 's/.*version "\([0-9][0-9]*\).*/\1/p' \ + | head -n 1 + ) + [[ "$java_major" =~ ^[0-9]+$ ]] && [ "$java_major" -ge 17 ] || return 1 + resolved_java=$(readlink -f "$java_bin" 2>/dev/null || printf '%s' "$java_bin") + case "$resolved_java" in + */bin/java) home=${resolved_java%/bin/java} ;; + *) return 1 ;; + esac + [ -x "$home/bin/java" ] || return 1 + printf '%s\n' "$home" +} + prepare_java() { - local api java_metadata package_metadata package_uuid java_url java_sha256 actual_sha256 + local api java_metadata package_metadata package_uuid java_url java_sha256 actual_sha256 system_home + if system_home=$(system_java_home); then + JAVA_STAGED_DIR="$WORK_DIR/java.next" + ln -s "$system_home" "$JAVA_STAGED_DIR" + log "Using existing Java 17 runtime at $system_home" + "$JAVA_STAGED_DIR/bin/java" -version + return + fi + log "No local Java 17 runtime found; downloading the official Azul Java 17 runtime" api="https://api.azul.com/metadata/v1/zulu/packages/?java_version=17&os=linux&arch=$(azul_arch)&archive_type=tar.gz&java_package_type=jre&release_status=ga&availability_types=CA&latest=true" java_metadata="$WORK_DIR/zulu-metadata.json" download "$api" "$java_metadata" diff --git a/scripts/package-release.sh b/scripts/package-release.sh index 623b921..c1cd552 100755 --- a/scripts/package-release.sh +++ b/scripts/package-release.sh @@ -99,7 +99,7 @@ cp "$ROOT/deploy/systemd/kaidi-update.path" "$STAGE/ops/kaidi-update.path" chmod 0755 "$STAGE/ops/update.sh" ARTIFACT="kaidi-finance-$VERSION.tar.gz" -COPYFILE_DISABLE=1 tar -czf "$OUTPUT_DIR/$ARTIFACT" -C "$STAGE" . +COPYFILE_DISABLE=1 tar --format=ustar -czf "$OUTPUT_DIR/$ARTIFACT" -C "$STAGE" . SHA256=$(sha256_file "$OUTPUT_DIR/$ARTIFACT") cp "$ROOT/backend/target/backend-sbom.json" "$OUTPUT_DIR/backend-sbom.cdx.json" (cd "$ROOT/frontend" && npm sbom --omit=dev --package-lock-only \ diff --git a/scripts/test-install-fixture.sh b/scripts/test-install-fixture.sh index 7cbe1d1..be68e42 100755 --- a/scripts/test-install-fixture.sh +++ b/scripts/test-install-fixture.sh @@ -23,6 +23,7 @@ fail() { sed -n '/^is_semver()/,/^}/p' "$ROOT/deploy/install.sh" sed -n '/^write_env_file_preserving_unknown()/,/^}/p' "$ROOT/deploy/install.sh" sed -n '/^azul_arch()/,/^}/p' "$ROOT/deploy/install.sh" + sed -n '/^system_java_home()/,/^}/p' "$ROOT/deploy/install.sh" sed -n '/^sha256_file()/,/^}/p' "$ROOT/deploy/install.sh" sed -n '/^prepare_java()/,/^}/p' "$ROOT/deploy/install.sh" sed -n '/^download_release_url()/,/^}/p' "$ROOT/deploy/install.sh" @@ -157,8 +158,15 @@ download() { esac } ARCH_FIXTURE=i686 +export KAIDI_JAVA_HOME="$WORK/missing-java-home" prepare_java >/dev/null 2>&1 [ -x "$JAVA_STAGED_DIR/bin/java" ] || fail 'verified i686 Java runtime was not staged' +rm -rf "$JAVA_STAGED_DIR" +export KAIDI_JAVA_HOME="$WORK/fake-jre" +prepare_java >/dev/null 2>&1 +[ -L "$JAVA_STAGED_DIR" ] || fail 'existing Java 17 runtime was not reused' +[ "$(readlink -f "$JAVA_STAGED_DIR")" = "$(readlink -f "$WORK/fake-jre")" ] \ + || fail 'installer linked an unexpected local Java runtime' export RELEASE_API_URL=https://gitea.fixture.invalid/api/v1/repos/ERP-Team/kaidi/releases/latest RELEASE_TOKEN=fixture-read-only-token @@ -225,6 +233,8 @@ grep -Fq 'download "$api" "$java_metadata"' "$ROOT/deploy/install.sh" \ # shellcheck disable=SC2016 # Match literal installer source. grep -Fq 'java_sha256=$(jq -er' "$ROOT/deploy/install.sh" \ || fail 'installer no longer obtains the Java runtime SHA-256' +grep -Fq 'Using existing Java 17 runtime' "$ROOT/deploy/install.sh" \ + || fail 'installer no longer reuses a local Java 17 runtime' # shellcheck disable=SC2016 # Match literal installer source. grep -Fq '[ "$actual_sha256" = "$java_sha256" ]' "$ROOT/deploy/install.sh" \ || fail 'installer no longer verifies the Java runtime SHA-256'