881 lines
41 KiB
Bash
Executable File
881 lines
41 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -Eeuo pipefail
|
||
|
||
# TallyNote native installer. Dry-run by default; pass --apply to mutate the host.
|
||
PATH=/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin
|
||
export PATH
|
||
umask 077
|
||
|
||
PREFIX=${TALLYNOTE_PREFIX:-/opt/tallynote}
|
||
DATA_DIR=${TALLYNOTE_DATA_DIR:-/var/lib/tallynote}
|
||
CONFIG_DIR=${TALLYNOTE_CONFIG_DIR:-/etc/tallynote}
|
||
REPOSITORY_URL=${TALLYNOTE_REPOSITORY_URL:-https://git.awaioi.com/awaioi/TallyNote}
|
||
RELEASE_API_URL=${TALLYNOTE_RELEASE_API_URL:-https://git.awaioi.com/api/v1/repos/awaioi/TallyNote/releases/latest}
|
||
RELEASE_BASE_URL=${TALLYNOTE_RELEASE_BASE_URL:-}
|
||
VERSION=${TALLYNOTE_VERSION:-latest}
|
||
RELEASE_FILE=${TALLYNOTE_RELEASE_FILE:-}
|
||
SHA256_URL=${TALLYNOTE_SHA256_URL:-}
|
||
SIGNATURE_URL=${TALLYNOTE_SIGNATURE_URL:-}
|
||
SIGNING_KEY=${TALLYNOTE_SIGNING_KEY:-}
|
||
SIGNATURE_FORMAT=${TALLYNOTE_SIGNATURE_FORMAT:-ed25519}
|
||
SHA256_FILE=${TALLYNOTE_SHA256_FILE:-}
|
||
UPDATE_PUBLIC_KEY_FILE=${TALLYNOTE_UPDATE_PUBLIC_KEY_FILE:-}
|
||
APPLY=0
|
||
KEEP_RELEASES=${TALLYNOTE_KEEP_RELEASES:-3}
|
||
REQUIRE_SIGNATURE=${TALLYNOTE_INSTALL_REQUIRE_SIGNATURE:-true}
|
||
ALLOW_DOWNGRADE=${TALLYNOTE_ALLOW_DOWNGRADE:-false}
|
||
ALLOW_UNSIGNED=0
|
||
MAX_RELEASE_MB=${TALLYNOTE_MAX_RELEASE_MB:-512}
|
||
MAX_EXTRACT_MB=${TALLYNOTE_MAX_EXTRACT_MB:-2048}
|
||
MAX_ARCHIVE_ENTRIES=${TALLYNOTE_MAX_ARCHIVE_ENTRIES:-100000}
|
||
CONNECT_TIMEOUT=${TALLYNOTE_INSTALL_CONNECT_TIMEOUT_SECONDS:-15}
|
||
MAX_TIME=${TALLYNOTE_INSTALL_MAX_TIME_SECONDS:-300}
|
||
RELEASE_ALLOWED_HOSTS=${TALLYNOTE_RELEASE_ALLOWED_HOSTS:-}
|
||
OPENSSL_BIN=${TALLYNOTE_OPENSSL_BIN:-openssl}
|
||
UNAME_BIN=${TALLYNOTE_UNAME_BIN:-uname}
|
||
|
||
INSTALL_SWITCHED=0
|
||
INSTALL_COMMITTED=0
|
||
INSTALL_PREVIOUS_TARGET=''
|
||
INSTALL_NEW_RELEASE=''
|
||
INSTALL_WORK_DIR=''
|
||
INSTALL_BACKUP_DIR=''
|
||
INSTALL_WAS_ACTIVE=0
|
||
INSTALL_PATH_WAS_ACTIVE=0
|
||
INSTALL_UPDATE_WAS_ACTIVE=0
|
||
DATA_DIR_TEMP_ROOT=0
|
||
DATA_DIR_ORIGINAL_OWNER=''
|
||
|
||
REPOSITORY_URL=${REPOSITORY_URL%/}
|
||
RELEASE_API_URL=${RELEASE_API_URL%/}
|
||
|
||
usage() {
|
||
cat <<'EOF'
|
||
Usage: install.sh [--apply] [--version VERSION] [--release-base-url HTTPS_URL]
|
||
[--release-file FILE] [--sha256-url HTTPS_URL|--sha256-file FILE]
|
||
[--signature-url HTTPS_URL] [--signing-key PUBLIC_KEY_FILE]
|
||
[--signature-format ed25519|gpg]
|
||
[--update-public-key-file FILE]
|
||
[--keep-releases N] [--allow-downgrade] [--allow-unsigned] [--dry-run]
|
||
|
||
The default is --dry-run. Network downloads and filesystem changes happen only
|
||
with --apply. Production installs require a detached signature (Ed25519 over
|
||
SHA256SUMS by default; legacy GPG archive signatures are opt-in); --allow-unsigned
|
||
is for isolated development hosts only.
|
||
EOF
|
||
}
|
||
die() { printf 'tallynote installer: %s\n' "$*" >&2; exit 1; }
|
||
log() { printf 'tallynote installer: %s\n' "$*"; }
|
||
|
||
[[ "$REQUIRE_SIGNATURE" == true || "$REQUIRE_SIGNATURE" == false ]] || die 'TALLYNOTE_INSTALL_REQUIRE_SIGNATURE 必须是 true 或 false'
|
||
[[ "$ALLOW_DOWNGRADE" == true || "$ALLOW_DOWNGRADE" == false ]] || die 'TALLYNOTE_ALLOW_DOWNGRADE 必须是 true 或 false'
|
||
[[ "$SIGNATURE_FORMAT" == ed25519 || "$SIGNATURE_FORMAT" == gpg ]] || die '签名格式必须是 ed25519 或 gpg'
|
||
[[ "$MAX_RELEASE_MB" =~ ^[1-9][0-9]*$ && "$MAX_EXTRACT_MB" =~ ^[1-9][0-9]*$ && "$MAX_ARCHIVE_ENTRIES" =~ ^[1-9][0-9]*$ ]] || die '安装资源限制必须是正整数'
|
||
[[ "$CONNECT_TIMEOUT" =~ ^[1-9][0-9]*$ && "$MAX_TIME" =~ ^[1-9][0-9]*$ ]] || die '安装超时配置必须是正整数'
|
||
|
||
version_sort_desc() {
|
||
if sort -V </dev/null >/dev/null 2>&1; then
|
||
sort -V -r
|
||
return
|
||
fi
|
||
# BSD sort (macOS) and minimal BusyBox builds may lack -V. The installer
|
||
# targets Linux, but keeping a numeric fallback makes dry-runs deterministic
|
||
# and avoids deleting a newer 1.10 release before an older 1.9 release.
|
||
awk -F'[.-]' '{ printf "%020d.%020d.%020d.%s\t%s\n", $1, $2, $3, ($4 == "" ? "~" : $4), $0 }' \
|
||
| sort -r | cut -f2-
|
||
}
|
||
|
||
while (($#)); do
|
||
case "$1" in
|
||
--apply) APPLY=1 ;;
|
||
--dry-run) APPLY=0 ;;
|
||
--version) VERSION=${2:?missing value for --version}; shift ;;
|
||
--release-base-url) RELEASE_BASE_URL=${2:?missing value for --release-base-url}; shift ;;
|
||
--release-file) RELEASE_FILE=${2:?missing value for --release-file}; shift ;;
|
||
--sha256-url) SHA256_URL=${2:?missing value for --sha256-url}; shift ;;
|
||
--sha256-file) SHA256_FILE=${2:?missing value for --sha256-file}; shift ;;
|
||
--signature-url) SIGNATURE_URL=${2:?missing value for --signature-url}; shift ;;
|
||
--signing-key) SIGNING_KEY=${2:?missing value for --signing-key}; shift ;;
|
||
--signature-format) SIGNATURE_FORMAT=${2:?missing value for --signature-format}; shift ;;
|
||
--update-public-key-file) UPDATE_PUBLIC_KEY_FILE=${2:?missing value for --update-public-key-file}; shift ;;
|
||
--keep-releases) KEEP_RELEASES=${2:?missing value for --keep-releases}; shift ;;
|
||
--allow-downgrade) ALLOW_DOWNGRADE=true ;;
|
||
--allow-unsigned) ALLOW_UNSIGNED=1; REQUIRE_SIGNATURE=false ;;
|
||
-h|--help) usage; exit 0 ;;
|
||
*) die "unknown option: $1" ;;
|
||
esac
|
||
shift
|
||
done
|
||
|
||
detect_platform() {
|
||
local machine libc os
|
||
os=$("$UNAME_BIN" -s)
|
||
if [[ "$os" != Linux ]]; then
|
||
(( APPLY )) && die "仅支持 Linux 安装（当前系统：$os）；可用 --dry-run 预览"
|
||
log "dry-run: 当前系统为 ${os}，--apply 仅允许 Linux"
|
||
fi
|
||
machine=$("$UNAME_BIN" -m)
|
||
case "$machine" in
|
||
x86_64|amd64) TALLYNOTE_ARCH=x64 ;;
|
||
aarch64|arm64) TALLYNOTE_ARCH=arm64 ;;
|
||
armv7l|armv7|armhf) TALLYNOTE_ARCH=armv7; log 'ARMv7 is experimental; continue only if a matching release exists.' ;;
|
||
i?86|x86) die '32-bit x86 (ia32) is unsupported' ;;
|
||
*) die "unsupported CPU architecture: $machine" ;;
|
||
esac
|
||
libc=glibc
|
||
if command -v ldd >/dev/null 2>&1 && ldd --version 2>&1 | grep -qi musl; then libc=musl; fi
|
||
TALLYNOTE_LIBC=$libc
|
||
export TALLYNOTE_ARCH TALLYNOTE_LIBC
|
||
}
|
||
|
||
require_https() {
|
||
local value=$1
|
||
case "$value" in https://*) ;; *) die "release endpoints must use HTTPS: $value" ;; esac
|
||
[[ "$value" != *[[:cntrl:]]* && "$value" != *[[:space:]]* ]] || die 'release endpoint contains control characters'
|
||
[[ "$value" != *'@'* ]] || die 'release endpoints must not contain credentials'
|
||
}
|
||
|
||
url_host() {
|
||
local authority host
|
||
require_https "$1"
|
||
authority=${1#https://}
|
||
authority=${authority%%/*}
|
||
[[ -n "$authority" && "$authority" != *'@'* ]] || die 'release endpoint host is invalid'
|
||
if [[ "$authority" == \[*\]* ]]; then
|
||
host=${authority#\[}
|
||
host=${host%%\]*}
|
||
else
|
||
host=${authority%%:*}
|
||
fi
|
||
[[ "$host" =~ ^[A-Za-z0-9.-]+$ || "$host" =~ ^[0-9A-Fa-f:]+$ ]] || die 'release endpoint host is invalid'
|
||
if [[ "$authority" != \[*\]* && "$authority" == *:* ]]; then
|
||
local port=${authority##*:}
|
||
[[ "$port" =~ ^[0-9]{1,5}$ && "$port" -ge 1 && "$port" -le 65535 ]] || die 'release endpoint port is invalid'
|
||
fi
|
||
printf '%s' "$host" | tr '[:upper:]' '[:lower:]'
|
||
}
|
||
|
||
validate_allowed_hosts() {
|
||
local candidate
|
||
[[ -z "$RELEASE_ALLOWED_HOSTS" ]] && return 0
|
||
IFS=',' read -r -a _allowed_parts <<< "$RELEASE_ALLOWED_HOSTS"
|
||
((${#_allowed_parts[@]} > 0)) || die 'release host allowlist is invalid'
|
||
for candidate in "${_allowed_parts[@]}"; do
|
||
[[ "$candidate" =~ ^[A-Za-z0-9.-]+$ || "$candidate" =~ ^[0-9A-Fa-f:]+$ ]] || die 'release host allowlist contains an invalid host'
|
||
done
|
||
}
|
||
|
||
append_allowed_host() {
|
||
local host=$1 candidate
|
||
[[ -n "$host" ]] || return 0
|
||
if [[ -n "$RELEASE_ALLOWED_HOSTS" ]]; then
|
||
_allowed_parts=()
|
||
IFS=',' read -r -a _allowed_parts <<< "$RELEASE_ALLOWED_HOSTS"
|
||
for candidate in "${_allowed_parts[@]}"; do
|
||
[[ "$(printf '%s' "$candidate" | tr '[:upper:]' '[:lower:]')" == "$host" ]] && return 0
|
||
done
|
||
fi
|
||
RELEASE_ALLOWED_HOSTS=${RELEASE_ALLOWED_HOSTS:+$RELEASE_ALLOWED_HOSTS,}$host
|
||
}
|
||
|
||
assert_allowed_url() {
|
||
local url=$1 host candidate
|
||
host=$(url_host "$url")
|
||
[[ -n "$RELEASE_ALLOWED_HOSTS" ]] || die 'release host allowlist is empty'
|
||
_allowed_parts=()
|
||
IFS=',' read -r -a _allowed_parts <<< "$RELEASE_ALLOWED_HOSTS"
|
||
for candidate in "${_allowed_parts[@]}"; do
|
||
candidate=$(printf '%s' "$candidate" | tr '[:upper:]' '[:lower:]' | sed 's/[[:space:]]//g')
|
||
[[ -n "$candidate" && "$candidate" == "$host" ]] && return 0
|
||
done
|
||
die "release URL redirected to an untrusted host: $host"
|
||
}
|
||
|
||
download() {
|
||
local url=$1 out=$2 max_bytes=${3:-$((MAX_RELEASE_MB * 1024 * 1024))}
|
||
local current="$url" headers status location actual origin scheme authority
|
||
require_https "$url"
|
||
assert_allowed_url "$url"
|
||
[[ ! -L "$out" && ! -e "$out" ]] || die "download destination already exists: $out"
|
||
for _redirect in 0 1 2 3; do
|
||
headers="${out}.headers-${RANDOM}-$$"
|
||
status=$(curl --proto '=https' --tlsv1.2 --fail --silent --show-error --max-redirs 0 \
|
||
--connect-timeout "$CONNECT_TIMEOUT" --max-time "$MAX_TIME" --max-filesize "$max_bytes" \
|
||
--retry 2 --retry-connrefused --output "$out" --dump-header "$headers" \
|
||
--write-out '%{http_code}' "$current" 2>/dev/null) || status=000
|
||
if [[ "$status" =~ ^2[0-9][0-9]$ ]]; then
|
||
rm -f -- "$headers"
|
||
break
|
||
fi
|
||
if [[ "$status" =~ ^3[0-9][0-9]$ ]]; then
|
||
location=$(awk 'BEGIN{IGNORECASE=1} /^Location:/ {sub(/^[^:]*:[[:space:]]*/, ""); gsub(/[\r\n]/, ""); value=$0} END{print value}' "$headers")
|
||
rm -f -- "$headers"
|
||
[[ -n "$location" ]] || { rm -f -- "$out"; die 'release URL redirect is missing Location'; }
|
||
case "$location" in
|
||
https://*) current="$location" ;;
|
||
/*)
|
||
scheme=${current%%://*}
|
||
authority=${current#*://}; authority=${authority%%/*}
|
||
origin="${scheme}://${authority}"
|
||
current="${origin}${location}"
|
||
;;
|
||
*) current="${current%/*}/$location" ;;
|
||
esac
|
||
require_https "$current"
|
||
assert_allowed_url "$current"
|
||
continue
|
||
fi
|
||
rm -f -- "$headers" "$out"
|
||
die "无法下载 release 文件"
|
||
done
|
||
[[ "$status" =~ ^2[0-9][0-9]$ ]] || { rm -f -- "$out"; die 'release URL 重定向次数超过限制'; }
|
||
actual=$(wc -c < "$out" | tr -d '[:space:]')
|
||
[[ "$actual" =~ ^[0-9]+$ && "$actual" -le "$max_bytes" ]] || { rm -f -- "$out"; die '下载文件超过大小限制'; }
|
||
chmod 600 "$out"
|
||
}
|
||
|
||
resolve_latest_version() {
|
||
local payload tag metadata_file
|
||
require_https "$RELEASE_API_URL"
|
||
assert_allowed_url "$RELEASE_API_URL"
|
||
metadata_file=$(mktemp)
|
||
rm -f -- "$metadata_file"
|
||
download "$RELEASE_API_URL" "$metadata_file" $((2 * 1024 * 1024))
|
||
payload=$(cat "$metadata_file")
|
||
rm -f -- "$metadata_file"
|
||
if command -v jq >/dev/null 2>&1; then
|
||
tag=$(printf '%s' "$payload" | jq -r '.tag_name // .tagName // empty' 2>/dev/null || true)
|
||
elif command -v python3 >/dev/null 2>&1; then
|
||
tag=$(printf '%s' "$payload" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d.get("tag_name") or d.get("tagName") or "")' 2>/dev/null || true)
|
||
else
|
||
tag=$(printf '%s' "$payload" | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
|
||
fi
|
||
validate_semver "$tag" || die 'release API 未返回有效版本号'
|
||
VERSION=${tag#v}
|
||
}
|
||
|
||
release_urls() {
|
||
local version_tag="v${VERSION#v}"
|
||
if [[ -z "$RELEASE_BASE_URL" ]]; then
|
||
RELEASE_BASE_URL="${REPOSITORY_URL}/releases/download/${version_tag}"
|
||
elif [[ "$RELEASE_BASE_URL" == *"{version}"* ]]; then
|
||
RELEASE_BASE_URL=${RELEASE_BASE_URL//\{version\}/$version_tag}
|
||
fi
|
||
RELEASE_BASE_URL=${RELEASE_BASE_URL%/}
|
||
require_https "$RELEASE_BASE_URL"
|
||
append_allowed_host "$(url_host "$RELEASE_BASE_URL")"
|
||
}
|
||
|
||
verify_archive() {
|
||
local archive=$1 checksum=$2 signature=$3 key=$4 expected archive_name
|
||
[[ -s "$archive" ]] || die 'release archive is empty'
|
||
[[ -n "$checksum" ]] || die 'SHA-256 checksum is required (use --sha256-url)'
|
||
archive_name=$(basename -- "$archive")
|
||
expected=$(awk -v name="$archive_name" 'NF >= 2 { candidate=$2; sub(/^\*/, "", candidate); if (candidate == name || candidate == "./" name) { print $1; exit } }' "$checksum")
|
||
[[ -n "$expected" ]] || die "checksum file has no entry for $archive_name"
|
||
[[ "$expected" =~ ^[A-Fa-f0-9]{64}$ ]] || die 'checksum file does not contain a SHA-256 digest'
|
||
printf '%s %s\n' "$expected" "$archive" | sha256sum -c - >/dev/null || die 'SHA-256 verification failed'
|
||
if [[ "$REQUIRE_SIGNATURE" == true ]]; then
|
||
[[ -n "$signature" && -s "$signature" ]] || die '发布包缺少 SHA256SUMS.sig；生产安装必须使用签名'
|
||
[[ -n "$key" && -f "$key" && ! -L "$key" ]] || die '生产安装必须提供签名公钥（--signing-key FILE）'
|
||
[[ "$(stat_uid "$key")" == 0 ]] || die '更新公钥必须由 root 拥有'
|
||
[[ "$(wc -c < "$key" | tr -d '[:space:]')" -le 16384 ]] || die '更新公钥文件过大'
|
||
local key_bits
|
||
key_bits=$(stat_mode_bits "$key")
|
||
(( (key_bits & 18) == 0 )) || die '更新公钥不能被组或其他用户写入'
|
||
if [[ "$SIGNATURE_FORMAT" == gpg ]]; then
|
||
command -v gpg >/dev/null 2>&1 || die 'gpg is required for --signature-format gpg'
|
||
local gpg_home
|
||
gpg_home=$(mktemp -d)
|
||
if ! (
|
||
set -Eeuo pipefail
|
||
trap 'rm -rf -- "$gpg_home"' EXIT
|
||
chmod 700 "$gpg_home"
|
||
gpg --batch --homedir "$gpg_home" --import "$key" >/dev/null 2>&1
|
||
gpg --batch --homedir "$gpg_home" --no-auto-key-retrieve --verify "$signature" "$archive" >/dev/null 2>&1
|
||
); then
|
||
rm -rf -- "$gpg_home"
|
||
die 'release GPG signature verification failed'
|
||
fi
|
||
rm -rf -- "$gpg_home"
|
||
else
|
||
"$OPENSSL_BIN" pkey -pubin -in "$key" -noout >/dev/null 2>&1 || die '更新公钥不是有效的 Ed25519 公钥'
|
||
if ! "$OPENSSL_BIN" pkeyutl -verify -pubin -inkey "$key" -rawin -in "$checksum" -sigfile "$signature" >/dev/null 2>&1; then
|
||
# Accept a base64-encoded detached signature as a convenience for
|
||
# operators, while the release workflow emits the safer raw 64 bytes.
|
||
local decoded
|
||
decoded=$(mktemp)
|
||
if ! "$OPENSSL_BIN" base64 -d -A -in "$signature" -out "$decoded" >/dev/null 2>&1 \
|
||
|| ! "$OPENSSL_BIN" pkeyutl -verify -pubin -inkey "$key" -rawin -in "$checksum" -sigfile "$decoded" >/dev/null 2>&1; then
|
||
rm -f -- "$decoded"
|
||
die 'SHA256SUMS 签名校验失败'
|
||
fi
|
||
rm -f -- "$decoded"
|
||
fi
|
||
fi
|
||
elif [[ -n "$signature" || -n "$key" ]]; then
|
||
log 'warning: signature verification disabled by explicit --allow-unsigned'
|
||
fi
|
||
}
|
||
|
||
safe_extract() {
|
||
local archive=$1 dest=$2 entry listing stats count expanded
|
||
local max_archive_bytes=$((MAX_RELEASE_MB * 1024 * 1024))
|
||
local max_extract_bytes=$((MAX_EXTRACT_MB * 1024 * 1024))
|
||
local archive_bytes
|
||
archive_bytes=$(wc -c < "$archive" | tr -d '[:space:]')
|
||
[[ "$archive_bytes" =~ ^[0-9]+$ && "$archive_bytes" -le "$max_archive_bytes" ]] || die 'release archive exceeds the compressed size limit'
|
||
# Only regular files and directories are accepted. Device nodes, FIFOs,
|
||
# sockets, symlinks and hardlinks must never be materialised as root.
|
||
listing=$(mktemp)
|
||
if ! LC_ALL=C tar -tvzf "$archive" --numeric-owner > "$listing" 2>/dev/null; then
|
||
rm -f -- "$listing"
|
||
die 'release archive is not a valid tar.gz file'
|
||
fi
|
||
stats=$(LC_ALL=C awk -v limit="$max_extract_bytes" -v max_entries="$MAX_ARCHIVE_ENTRIES" '
|
||
$1 !~ /^[-d]/ { bad=1; exit 3 }
|
||
{
|
||
entry_size = 0;
|
||
for (i = 2; i <= NF; i++) {
|
||
if ($i ~ /^[0-9]+$/) entry_size = $i + 0;
|
||
if ($i ~ /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)$/) break;
|
||
}
|
||
count += 1; size += ($1 ~ /^-/ ? entry_size : 0);
|
||
if (count > max_entries || size > limit) exit 2
|
||
}
|
||
END { if (bad) exit 3; printf "%d %d\n", count, size }
|
||
' "$listing") || { rm -f -- "$listing"; die 'release archive contains too many entries or unsupported special files'; }
|
||
count=${stats%% *}; expanded=${stats##* }
|
||
[[ "$count" =~ ^[0-9]+$ && "$expanded" =~ ^[0-9]+$ ]] || { rm -f -- "$listing"; die 'release archive metadata is invalid'; }
|
||
while IFS= read -r entry; do
|
||
if [[ "$entry" == /* || "$entry" == ../* || "$entry" == */../* || "$entry" == .. || "$entry" == */.. ]]; then
|
||
rm -f -- "$listing"
|
||
die "unsafe archive path: $entry"
|
||
fi
|
||
done < <(LC_ALL=C tar -tzf "$archive")
|
||
rm -f -- "$listing"
|
||
mkdir -p "$dest"
|
||
chmod 700 "$dest"
|
||
LC_ALL=C tar -xzf "$archive" -C "$dest" --no-same-owner --no-same-permissions
|
||
}
|
||
|
||
normalize_release_tree() {
|
||
local root=$1 item relative
|
||
[[ -d "$root" && ! -L "$root" ]] || die 'release extraction directory is invalid'
|
||
if find "$root" -type l -print -quit | grep -q .; then
|
||
die 'release archive contains a symbolic link'
|
||
fi
|
||
if find "$root" ! -type d ! -type f ! -type l -print -quit | grep -q .; then
|
||
die 'release archive contains an unsupported file type'
|
||
fi
|
||
find "$root" -type d -exec chmod 755 {} +
|
||
find "$root" -type f -exec chmod 644 {} +
|
||
for item in "$root/bin"/* "$root/scripts"/*.sh "$root/runtime/bin"/*; do
|
||
[[ -f "$item" && ! -L "$item" ]] || continue
|
||
chmod 755 "$item"
|
||
done
|
||
}
|
||
|
||
stat_uid() { stat -c '%u' "$1" 2>/dev/null || stat -f '%u' "$1"; }
|
||
stat_mode() { stat -c '%a' "$1" 2>/dev/null || stat -f '%Lp' "$1"; }
|
||
stat_mode_bits() {
|
||
local mode
|
||
mode=$(stat_mode "$1")
|
||
[[ "$mode" =~ ^[0-7]+$ ]] || die "无法读取路径权限：$1"
|
||
printf '%d' "$((8#$mode))"
|
||
}
|
||
|
||
validate_trusted_tool() {
|
||
local configured=$1 label=$2 resolved uid mode_bits
|
||
[[ -n "$configured" && "$configured" != *[[:space:]]* && "$configured" != *[[:cntrl:]]* ]] || die "$label 路径无效"
|
||
resolved=$(command -v "$configured" 2>/dev/null || true)
|
||
[[ -n "$resolved" && -x "$resolved" && ! -L "$resolved" ]] || die "$label 必须指向可信可执行文件"
|
||
if (( EUID == 0 )); then
|
||
uid=$(stat_uid "$resolved")
|
||
mode_bits=$(stat_mode_bits "$resolved")
|
||
[[ "$uid" == 0 && $((mode_bits & 18)) -eq 0 ]] || die "$label 必须由 root 拥有且不可被其他用户写入"
|
||
fi
|
||
}
|
||
|
||
version_is_newer() {
|
||
local candidate=$1 current=$2 ordered candidate_core current_core
|
||
[[ "$candidate" != "$current" ]] || return 1
|
||
candidate_core=${candidate%%+*}
|
||
current_core=${current%%+*}
|
||
[[ "$candidate_core" != "$current_core" ]] || return 1
|
||
if sort -V </dev/null >/dev/null 2>&1; then
|
||
ordered=$(printf '%s\n' "$current" "$candidate" | sort -V | tail -n 1)
|
||
[[ "$ordered" == "$candidate" ]]
|
||
return
|
||
fi
|
||
# Linux installs use GNU sort -V; this conservative fallback compares the
|
||
# numeric core and treats a stable release as newer than its prerelease.
|
||
local c_core=${candidate%%[-+]*} v_core=${current%%[-+]*}
|
||
local c_pre='' v_pre=''
|
||
[[ "$candidate" == *-* ]] && c_pre=${candidate#*-}
|
||
[[ "$current" == *-* ]] && v_pre=${current#*-}
|
||
local c_major c_minor c_patch v_major v_minor v_patch
|
||
IFS='.' read -r c_major c_minor c_patch <<< "$c_core"
|
||
IFS='.' read -r v_major v_minor v_patch <<< "$v_core"
|
||
local pair left right
|
||
for pair in "$c_major $v_major" "$c_minor $v_minor" "$c_patch $v_patch"; do
|
||
read -r left right <<< "$pair"
|
||
if (( 10#$left != 10#$right )); then (( 10#$left > 10#$right )); return; fi
|
||
done
|
||
[[ -z "$c_pre" && -n "$v_pre" ]] && return 0
|
||
[[ -n "$c_pre" && -z "$v_pre" ]] && return 1
|
||
[[ "$candidate" > "$current" ]]
|
||
}
|
||
|
||
assert_path_chain() {
|
||
local target=$1 allowed_uid=${2:-0} current component relative uid mode_bits
|
||
[[ "$target" = /* && "$target" != *$'\n'* && "$target" != *$'\r'* ]] || die "路径必须是绝对路径：$target"
|
||
relative=${target#/}
|
||
current=/
|
||
IFS='/' read -r -a _path_parts <<< "$relative"
|
||
for component in "${_path_parts[@]}"; do
|
||
[[ -n "$component" && "$component" != . && "$component" != .. ]] || continue
|
||
current="${current%/}/$component"
|
||
if [[ -L "$current" ]]; then die "路径不能包含符号链接：$current"; fi
|
||
if [[ -e "$current" ]]; then
|
||
[[ -d "$current" ]] || die "路径不是目录：$current"
|
||
uid=$(stat_uid "$current")
|
||
[[ "$uid" == 0 || "$uid" == "$allowed_uid" ]] || die "路径目录必须由 root 拥有：$current"
|
||
mode_bits=$(stat_mode_bits "$current")
|
||
# A root-owned sticky directory (for example a hardened /tmp) is fine,
|
||
# but ownership is always required before traversing an existing parent.
|
||
(( (mode_bits & 18) == 0 || (mode_bits & 512) != 0 )) || die "路径目录权限过宽：$current"
|
||
else
|
||
mkdir "$current"
|
||
chmod 700 "$current"
|
||
fi
|
||
done
|
||
}
|
||
|
||
ensure_root_directory() {
|
||
local directory=$1 mode=${2:-755} uid mode_bits
|
||
assert_path_chain "$directory"
|
||
[[ -d "$directory" && ! -L "$directory" ]] || die "安装目录无效：$directory"
|
||
uid=$(stat_uid "$directory")
|
||
[[ "$uid" == 0 ]] || die "安装目录必须由 root 拥有：$directory"
|
||
mode_bits=$(stat_mode_bits "$directory")
|
||
(( (mode_bits & 18) == 0 )) || die "安装目录不能被组或其他用户写入：$directory"
|
||
chmod "$mode" "$directory"
|
||
chown root:root "$directory"
|
||
}
|
||
|
||
ensure_data_directory() {
|
||
local directory=$1 owner_uid mode_bits
|
||
owner_uid=$(id -u tallynote)
|
||
# The service owns its private data tree. Permit that one explicit owner
|
||
# while keeping every installation/configuration path root-owned.
|
||
assert_path_chain "$directory" "$owner_uid"
|
||
[[ -d "$directory" && ! -L "$directory" ]] || die "数据目录无效：$directory"
|
||
mode_bits=$(stat_mode_bits "$directory")
|
||
(( (mode_bits & 18) == 0 )) || die "数据目录不能被组或其他用户写入：$directory"
|
||
# A root-owned directory from an earlier manual install is safe to adopt;
|
||
# an unrelated non-root owner is not.
|
||
local current_uid
|
||
current_uid=$(stat_uid "$directory")
|
||
[[ "$current_uid" == 0 || "$current_uid" == "$owner_uid" ]] || die "数据目录由不受信用户拥有：$directory"
|
||
DATA_DIR_ORIGINAL_OWNER=$(stat -c '%u:%g' "$directory" 2>/dev/null || stat -f '%u:%g' "$directory")
|
||
# Temporarily make the parent root-owned while its children are checked and
|
||
# repaired. This prevents the service account from swapping a checked child
|
||
# for a symlink between the lstat and the privileged chown/chmod calls.
|
||
chown root:root "$directory"
|
||
chmod 700 "$directory"
|
||
DATA_DIR_TEMP_ROOT=1
|
||
for child in files staging exports; do
|
||
local child_path="$directory/$child"
|
||
assert_path_chain "$child_path" "$owner_uid"
|
||
[[ -d "$child_path" && ! -L "$child_path" ]] || die "数据子目录无效：$child_path"
|
||
chown tallynote:tallynote "$child_path"
|
||
chmod 700 "$child_path"
|
||
done
|
||
chown tallynote:tallynote "$directory"
|
||
chmod 700 "$directory"
|
||
DATA_DIR_TEMP_ROOT=0
|
||
}
|
||
|
||
stop_existing_services() {
|
||
command -v systemctl >/dev/null 2>&1 || return 0
|
||
local unit
|
||
# Stop the path trigger first so it cannot launch the privileged updater while
|
||
# the data tree is being repaired.
|
||
for unit in tallynote-update.path tallynote-update.service tallynote.service; do
|
||
if systemctl is-active --quiet "$unit"; then
|
||
case "$unit" in
|
||
tallynote.service) INSTALL_WAS_ACTIVE=1 ;;
|
||
tallynote-update.path) INSTALL_PATH_WAS_ACTIVE=1 ;;
|
||
tallynote-update.service) INSTALL_UPDATE_WAS_ACTIVE=1 ;;
|
||
esac
|
||
systemctl stop "$unit" || die "无法停止现有服务：$unit"
|
||
fi
|
||
done
|
||
}
|
||
|
||
rollback_install_if_needed() {
|
||
local result=$? rollback_tmp
|
||
if (( INSTALL_SWITCHED == 1 && INSTALL_COMMITTED == 0 )); then
|
||
if [[ -n "$INSTALL_PREVIOUS_TARGET" && -d "$INSTALL_PREVIOUS_TARGET" ]]; then
|
||
rollback_tmp="$PREFIX/.current-rollback-$$-${RANDOM}.tmp"
|
||
if [[ ! -e "$rollback_tmp" ]] && ln -s -- "$INSTALL_PREVIOUS_TARGET" "$rollback_tmp" && mv -Tf -- "$rollback_tmp" "$PREFIX/current"; then
|
||
:
|
||
else
|
||
rm -f -- "$rollback_tmp" 2>/dev/null || true
|
||
fi
|
||
else
|
||
rm -f -- "$PREFIX/current" 2>/dev/null || true
|
||
fi
|
||
if [[ -n "$INSTALL_NEW_RELEASE" && -d "$INSTALL_NEW_RELEASE" ]]; then
|
||
rm -rf -- "$INSTALL_NEW_RELEASE" 2>/dev/null || true
|
||
fi
|
||
fi
|
||
if (( DATA_DIR_TEMP_ROOT == 1 )) && [[ -n "$DATA_DIR_ORIGINAL_OWNER" && -d "$DATA_DIR" && ! -L "$DATA_DIR" ]]; then
|
||
chown -- "$DATA_DIR_ORIGINAL_OWNER" "$DATA_DIR" 2>/dev/null || true
|
||
chmod 700 "$DATA_DIR" 2>/dev/null || true
|
||
DATA_DIR_TEMP_ROOT=0
|
||
fi
|
||
if (( INSTALL_COMMITTED == 0 )) && [[ -n "$INSTALL_BACKUP_DIR" && -d "$INSTALL_BACKUP_DIR" ]]; then
|
||
local backup_name target
|
||
for backup_name in tallynote.service tallynote-update.service tallynote-update.path tallynote.env update-signing-key.pub; do
|
||
case "$backup_name" in
|
||
tallynote.env) target="$CONFIG_DIR/tallynote.env" ;;
|
||
update-signing-key.pub) target="$CONFIG_DIR/update-signing-key.pub" ;;
|
||
*) target="/etc/systemd/system/$backup_name" ;;
|
||
esac
|
||
[[ ! -L "$target" ]] || continue
|
||
if [[ -f "$INSTALL_BACKUP_DIR/$backup_name" ]]; then
|
||
cp -a -- "$INSTALL_BACKUP_DIR/$backup_name" "$target" 2>/dev/null || true
|
||
else
|
||
rm -f -- "$target" 2>/dev/null || true
|
||
fi
|
||
done
|
||
fi
|
||
if command -v systemctl >/dev/null 2>&1; then
|
||
if (( INSTALL_WAS_ACTIVE == 1 )); then systemctl start tallynote.service 2>/dev/null || true; fi
|
||
if (( INSTALL_UPDATE_WAS_ACTIVE == 1 )); then systemctl start tallynote-update.service 2>/dev/null || true; fi
|
||
if (( INSTALL_PATH_WAS_ACTIVE == 1 )); then systemctl start tallynote-update.path 2>/dev/null || true; fi
|
||
fi
|
||
if [[ -n "$INSTALL_WORK_DIR" && -d "$INSTALL_WORK_DIR" ]]; then
|
||
rm -rf -- "$INSTALL_WORK_DIR" 2>/dev/null || true
|
||
fi
|
||
return "$result"
|
||
}
|
||
|
||
backup_install_files() {
|
||
local directory=$1 target name
|
||
mkdir -p "$directory"
|
||
chmod 700 "$directory"
|
||
for name in tallynote.service tallynote-update.service tallynote-update.path; do
|
||
target="/etc/systemd/system/$name"
|
||
[[ ! -L "$target" ]] || die "现有 systemd 单元不能是符号链接：$target"
|
||
if [[ -e "$target" ]]; then
|
||
[[ -f "$target" ]] || die "现有 systemd 单元不是普通文件：$target"
|
||
cp -a -- "$target" "$directory/$name"
|
||
fi
|
||
done
|
||
for name in tallynote.env update-signing-key.pub; do
|
||
target="$CONFIG_DIR/$name"
|
||
[[ ! -L "$target" ]] || die "现有配置不能是符号链接：$target"
|
||
if [[ -e "$target" ]]; then
|
||
[[ -f "$target" ]] || die "现有配置不是普通文件：$target"
|
||
cp -a -- "$target" "$directory/$name"
|
||
fi
|
||
done
|
||
}
|
||
|
||
read_env_value() {
|
||
local file=$1 key=$2
|
||
sed -n "s/^${key}=//p" "$file" | head -n 1
|
||
}
|
||
|
||
env_key_count() {
|
||
local file=$1 key=$2
|
||
awk -v key="$key" 'index($0, key "=") == 1 { count += 1 } END { print count + 0 }' "$file"
|
||
}
|
||
|
||
validate_env_value() {
|
||
local value=$1 label=$2
|
||
[[ "$value" != *[[:cntrl:]]* ]] || die "$label 不能包含控制字符"
|
||
[[ ${#value} -le 4096 ]] || die "$label 过长"
|
||
}
|
||
|
||
validate_semver() {
|
||
local value=$1 prerelease part
|
||
[[ "$value" =~ ^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]] || return 1
|
||
[[ "$value" == *-* ]] || return 0
|
||
prerelease=${value#*-}
|
||
prerelease=${prerelease%%+*}
|
||
IFS='.' read -r -a _prerelease_parts <<< "$prerelease"
|
||
for part in "${_prerelease_parts[@]}"; do
|
||
[[ ! "$part" =~ ^0[0-9]+$ ]] || return 1
|
||
done
|
||
}
|
||
|
||
validate_install_path() {
|
||
local value=$1 label=$2
|
||
[[ "$value" = /* && "$value" != *$'\n'* && "$value" != *$'\r'* ]] || die "$label 必须是绝对路径"
|
||
[[ "$value" =~ ^/[A-Za-z0-9._/-]+$ && "$value" != *"/../"* && "$value" != */.. && "$value" != *"//"* ]] || die "$label 包含不受支持的路径字符"
|
||
}
|
||
|
||
validate_existing_env() {
|
||
local file=$1 value metadata_host
|
||
[[ ! -L "$file" && -f "$file" ]] || die '现有环境文件不是普通文件'
|
||
[[ "$(stat_uid "$file")" == 0 ]] || die '现有环境文件必须由 root 拥有'
|
||
local mode_bits
|
||
mode_bits=$(stat_mode_bits "$file")
|
||
(( (mode_bits & 18) == 0 )) || die '环境文件不能被组或其他用户写入'
|
||
local key key_count
|
||
for key in TALLYNOTE_INSTALL_PREFIX TALLYNOTE_DATA_DIR TALLYNOTE_UPDATE_REQUIRE_SIGNATURE TALLYNOTE_UPDATE_METADATA_URL TALLYNOTE_UPDATE_ALLOWED_HOSTS TALLYNOTE_UPDATE_PUBLIC_KEY_FILE; do
|
||
key_count=$(env_key_count "$file" "$key")
|
||
[[ "$key_count" =~ ^[0-9]+$ && "$key_count" -le 1 ]] || die "环境文件包含重复配置：$key"
|
||
done
|
||
value=$(read_env_value "$file" TALLYNOTE_INSTALL_PREFIX)
|
||
[[ -z "$value" || "${value%/}" == "${PREFIX%/}" ]] || die '环境文件中的安装目录与本次安装不一致'
|
||
value=$(read_env_value "$file" TALLYNOTE_DATA_DIR)
|
||
[[ -z "$value" || "${value%/}" == "${DATA_DIR%/}" ]] || die '环境文件中的数据目录与本次安装不一致'
|
||
value=$(read_env_value "$file" TALLYNOTE_UPDATE_REQUIRE_SIGNATURE)
|
||
[[ -z "$value" || "$value" == true ]] || die '环境文件禁止关闭发布签名校验'
|
||
value=$(read_env_value "$file" TALLYNOTE_UPDATE_METADATA_URL)
|
||
if [[ -n "$value" ]]; then
|
||
validate_env_value "$value" '环境文件更新源'
|
||
metadata_host=$(url_host "$value")
|
||
assert_allowed_url "$value"
|
||
[[ -n "$metadata_host" ]] || die '环境文件更新源无效'
|
||
fi
|
||
}
|
||
|
||
install_release() {
|
||
local archive=$1 version=$2 tmp release_dir current_tmp=''
|
||
tmp=$(mktemp -d)
|
||
trap 'rm -rf "$tmp" "$current_tmp" 2>/dev/null || true' RETURN
|
||
safe_extract "$archive" "$tmp/unpacked"
|
||
normalize_release_tree "$tmp/unpacked"
|
||
[[ -d "$tmp/unpacked/dist" ]] || die 'release archive must contain dist/ at its root'
|
||
[[ -x "$tmp/unpacked/bin/tallynote" ]] || die 'release archive must contain executable bin/tallynote'
|
||
[[ -f "$tmp/unpacked/package.json" && -f "$tmp/unpacked/dist/server/index.js" && -f "$tmp/unpacked/dist/web/index.html" ]] || die 'release archive is incomplete'
|
||
[[ -f "$tmp/unpacked/systemd/tallynote.service" && -f "$tmp/unpacked/systemd/tallynote-update.service" && -f "$tmp/unpacked/systemd/tallynote-update.path" ]] || die 'release archive is missing systemd units'
|
||
[[ -f "$tmp/unpacked/systemd/tallynote.env.example" && -x "$tmp/unpacked/scripts/tallynote-update.sh" && -x "$tmp/unpacked/scripts/tallynote-update-runner.sh" ]] || die 'release archive is missing update support files'
|
||
grep -Eq '"version"[[:space:]]*:[[:space:]]*"'"$version"'"([,}]|[[:space:]])' "$tmp/unpacked/package.json" || die 'release package version does not match requested version'
|
||
ensure_root_directory "$PREFIX" 755
|
||
ensure_root_directory "$PREFIX/releases" 755
|
||
release_dir="$PREFIX/releases/$version"
|
||
[[ ! -e "$release_dir" ]] || die "release already exists: $release_dir"
|
||
if [[ -L "$PREFIX/current" ]]; then
|
||
current_target=$(readlink -f -- "$PREFIX/current")
|
||
[[ "$current_target" == "$PREFIX/releases/"* && -d "$current_target" ]] || die 'current 符号链接指向安装目录之外'
|
||
INSTALL_PREVIOUS_TARGET=$current_target
|
||
elif [[ -e "$PREFIX/current" ]]; then
|
||
die "$PREFIX/current exists and is not a symlink"
|
||
fi
|
||
mv "$tmp/unpacked" "$release_dir"
|
||
INSTALL_NEW_RELEASE=$release_dir
|
||
chown -R root:root "$release_dir"
|
||
chmod 755 "$release_dir"
|
||
current_tmp="$PREFIX/.current.$$.tmp"
|
||
ln -s "$release_dir" "$current_tmp"
|
||
mv -Tf "$current_tmp" "$PREFIX/current"
|
||
INSTALL_SWITCHED=1
|
||
}
|
||
|
||
prune_releases() {
|
||
local current_target current_name version kept=0
|
||
current_target=$(readlink -f -- "$PREFIX/current" 2>/dev/null || true)
|
||
current_name=$(basename -- "$current_target")
|
||
[[ "$current_name" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]] || return 0
|
||
mapfile -t versions < <(
|
||
find "$PREFIX/releases" -mindepth 1 -maxdepth 1 -type d -printf '%f\n' \
|
||
| awk '/^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$/' \
|
||
| version_sort_desc
|
||
)
|
||
# KEEP_RELEASES counts the active release. Always retain current even when
|
||
# a distro's version sort has unusual prerelease ordering.
|
||
for version in "${versions[@]}"; do
|
||
if [[ "$version" == "$current_name" ]]; then
|
||
kept=$((kept + 1))
|
||
continue
|
||
fi
|
||
if (( kept < KEEP_RELEASES )); then
|
||
kept=$((kept + 1))
|
||
else
|
||
rm -rf -- "$PREFIX/releases/$version"
|
||
fi
|
||
done
|
||
}
|
||
|
||
main() {
|
||
# These variables are useful for isolated tests, but a root install must
|
||
# never execute an untrusted PATH entry supplied through sudo's environment.
|
||
if (( APPLY )) || [[ -n "${TALLYNOTE_UNAME_BIN+x}" ]]; then
|
||
validate_trusted_tool "$UNAME_BIN" 'uname'
|
||
fi
|
||
if (( APPLY )) || [[ -n "${TALLYNOTE_OPENSSL_BIN+x}" ]]; then
|
||
validate_trusted_tool "$OPENSSL_BIN" 'openssl'
|
||
fi
|
||
detect_platform
|
||
[[ "$KEEP_RELEASES" =~ ^[1-9][0-9]*$ ]] || die '--keep-releases must be a positive integer'
|
||
validate_install_path "$PREFIX" '安装目录'
|
||
validate_install_path "$DATA_DIR" '数据目录'
|
||
validate_install_path "$CONFIG_DIR" '配置目录'
|
||
validate_env_value "$REPOSITORY_URL" '仓库地址'
|
||
validate_env_value "$RELEASE_API_URL" 'Release API 地址'
|
||
validate_env_value "$RELEASE_BASE_URL" 'Release 地址'
|
||
validate_allowed_hosts
|
||
# Bind every network request to the configured release service before any
|
||
# redirect is followed. A CDN can be added explicitly through
|
||
# TALLYNOTE_RELEASE_ALLOWED_HOSTS when the operator has reviewed it.
|
||
append_allowed_host "$(url_host "$RELEASE_API_URL")"
|
||
append_allowed_host "$(url_host "$REPOSITORY_URL")"
|
||
if [[ "$VERSION" == "latest" ]]; then
|
||
if (( ! APPLY )); then
|
||
[[ -z "$RELEASE_BASE_URL" ]] || require_https "$RELEASE_BASE_URL"
|
||
log 'version: latest (release lookup happens with --apply)'
|
||
log 'dry-run: pass --version VERSION to preview an exact artifact'
|
||
return 0
|
||
fi
|
||
resolve_latest_version
|
||
fi
|
||
validate_semver "$VERSION" || die 'version must be a semantic version (for example 1.2.3)'
|
||
VERSION=${VERSION#v}
|
||
if [[ -L "$PREFIX/current" ]]; then
|
||
current_target=$(readlink -f -- "$PREFIX/current" 2>/dev/null || true)
|
||
current_version=$(basename -- "$current_target")
|
||
if validate_semver "$current_version" >/dev/null 2>&1 && [[ "$ALLOW_DOWNGRADE" != true ]] && ! version_is_newer "$VERSION" "$current_version"; then
|
||
die "拒绝安装不高于当前版本的 release：当前 $current_version，候选 $VERSION（如确需降级请使用 --allow-downgrade）"
|
||
fi
|
||
fi
|
||
release_urls
|
||
local artifact archive checksum signature artifact_url work release_dir
|
||
artifact=${RELEASE_FILE:+$(basename -- "$RELEASE_FILE")}
|
||
artifact=${artifact:-tallynote-${VERSION}-linux-${TALLYNOTE_ARCH}-${TALLYNOTE_LIBC}.tar.gz}
|
||
[[ "$artifact" =~ ^[A-Za-z0-9][A-Za-z0-9._+\-]*\.(tar\.gz|tgz|tar)$ ]] || die 'release 文件名无效'
|
||
artifact_url="$RELEASE_BASE_URL/$artifact"
|
||
log "platform: ${TALLYNOTE_ARCH}/${TALLYNOTE_LIBC}; release: ${VERSION#v}"
|
||
log "layout: $PREFIX/releases + atomic $PREFIX/current; data: $DATA_DIR"
|
||
if (( ! APPLY )); then log 'dry-run: pass --apply to download, verify, extract, and configure systemd'; return 0; fi
|
||
[[ "$REQUIRE_SIGNATURE" == true || "$ALLOW_UNSIGNED" -eq 1 ]] || die '生产安装必须校验发布签名；仅隔离开发环境可使用 --allow-unsigned'
|
||
[[ "$("$UNAME_BIN" -s)" == Linux ]] || die '安装器只允许在 Linux 上执行 --apply'
|
||
[[ $EUID -eq 0 ]] || die '--apply must run as root'
|
||
for command_name in curl sha256sum tar install sed awk find systemctl; do
|
||
command -v "$command_name" >/dev/null 2>&1 || die "$command_name is required"
|
||
done
|
||
command -v "$OPENSSL_BIN" >/dev/null 2>&1 || die 'openssl is required'
|
||
work=$(mktemp -d)
|
||
INSTALL_WORK_DIR=$work
|
||
INSTALL_BACKUP_DIR="$work/original"
|
||
trap rollback_install_if_needed EXIT
|
||
archive="$work/$artifact"
|
||
if [[ -n "$RELEASE_FILE" && -f "$RELEASE_FILE" && ! -L "$RELEASE_FILE" ]]; then
|
||
cp -- "$RELEASE_FILE" "$archive"
|
||
chmod 600 "$archive"
|
||
[[ "$(wc -c < "$archive" | tr -d '[:space:]')" -le $((MAX_RELEASE_MB * 1024 * 1024)) ]] || die '本地 release 文件超过大小限制'
|
||
else
|
||
[[ -z "$RELEASE_FILE" ]] || die '本地 release 文件不存在或是符号链接'
|
||
download "$artifact_url" "$archive"
|
||
fi
|
||
checksum="$work/SHA256SUMS"
|
||
SHA256_URL=${SHA256_URL:-$RELEASE_BASE_URL/SHA256SUMS}
|
||
if [[ -n "$SHA256_FILE" && -f "$SHA256_FILE" && ! -L "$SHA256_FILE" ]]; then
|
||
cp -- "$SHA256_FILE" "$checksum"
|
||
chmod 600 "$checksum"
|
||
[[ "$(wc -c < "$checksum" | tr -d '[:space:]')" -le $((2 * 1024 * 1024)) ]] || die '本地 SHA256SUMS 文件过大'
|
||
else
|
||
[[ -z "$SHA256_FILE" ]] || die '本地 SHA256SUMS 文件不存在或是符号链接'
|
||
download "$SHA256_URL" "$checksum" $((2 * 1024 * 1024))
|
||
fi
|
||
signature=''
|
||
if [[ "$REQUIRE_SIGNATURE" == true ]]; then
|
||
if [[ "$SIGNATURE_FORMAT" == gpg ]]; then
|
||
SIGNATURE_URL=${SIGNATURE_URL:-$RELEASE_BASE_URL/$artifact.asc}
|
||
signature="$work/$artifact.asc"
|
||
else
|
||
SIGNATURE_URL=${SIGNATURE_URL:-$RELEASE_BASE_URL/SHA256SUMS.sig}
|
||
signature="$work/SHA256SUMS.sig"
|
||
fi
|
||
download "$SIGNATURE_URL" "$signature" $((64 * 1024))
|
||
elif [[ -n "$SIGNATURE_URL" ]]; then
|
||
signature="$work/SHA256SUMS.sig"
|
||
download "$SIGNATURE_URL" "$signature" $((64 * 1024))
|
||
fi
|
||
SIGNING_KEY=${SIGNING_KEY:-$UPDATE_PUBLIC_KEY_FILE}
|
||
verify_archive "$archive" "$checksum" "$signature" "$SIGNING_KEY"
|
||
[[ "$PREFIX" = /* && "$DATA_DIR" = /* && "$CONFIG_DIR" = /* ]] || die '安装、数据和配置目录必须是绝对路径'
|
||
[[ ! -L "$DATA_DIR" && ! -L "$PREFIX" && ! -L "$CONFIG_DIR" ]] || die 'installation/data/config paths must not be symlinks'
|
||
id tallynote >/dev/null 2>&1 || useradd --system --user-group --home-dir "$DATA_DIR" --shell /usr/sbin/nologin tallynote
|
||
backup_install_files "$INSTALL_BACKUP_DIR"
|
||
stop_existing_services
|
||
ensure_root_directory "$PREFIX" 755
|
||
ensure_root_directory "$PREFIX/releases" 755
|
||
ensure_root_directory "$PREFIX/.update-work" 700
|
||
ensure_root_directory "$CONFIG_DIR" 755
|
||
ensure_data_directory "$DATA_DIR"
|
||
if [[ -e "$CONFIG_DIR/tallynote.env" ]]; then
|
||
validate_existing_env "$CONFIG_DIR/tallynote.env"
|
||
fi
|
||
install_release "$archive" "$VERSION"
|
||
release_dir="$PREFIX/releases/$VERSION"
|
||
[[ -f "$release_dir/systemd/tallynote.service" && -f "$release_dir/systemd/tallynote-update.service" && -f "$release_dir/systemd/tallynote-update.path" ]] || die 'release package is missing systemd unit files'
|
||
[[ -f "$release_dir/systemd/tallynote.env.example" && -f "$release_dir/scripts/tallynote-update-runner.sh" ]] || die 'release package is missing update support files'
|
||
install -d -m 755 /usr/local/libexec /etc/systemd/system
|
||
local unit_tmp
|
||
unit_tmp=$(mktemp -d)
|
||
sed "s#/opt/tallynote#$PREFIX#g; s#/var/lib/tallynote#$DATA_DIR#g" "$release_dir/systemd/tallynote.service" > "$unit_tmp/tallynote.service"
|
||
sed "s#/opt/tallynote#$PREFIX#g; s#/var/lib/tallynote#$DATA_DIR#g; s#/var/lib/tallynote-backups#$(dirname -- "$DATA_DIR")/tallynote-backups#g" "$release_dir/systemd/tallynote-update.service" > "$unit_tmp/tallynote-update.service"
|
||
sed "s#/var/lib/tallynote#$DATA_DIR#g" "$release_dir/systemd/tallynote-update.path" > "$unit_tmp/tallynote-update.path"
|
||
install -o root -g root -m 644 "$unit_tmp/tallynote.service" /etc/systemd/system/tallynote.service
|
||
install -o root -g root -m 644 "$unit_tmp/tallynote-update.service" /etc/systemd/system/tallynote-update.service
|
||
install -o root -g root -m 644 "$unit_tmp/tallynote-update.path" /etc/systemd/system/tallynote-update.path
|
||
rm -rf "$unit_tmp"
|
||
install -o root -g root -m 755 "$release_dir/scripts/tallynote-update.sh" /usr/local/sbin/tallynote-update
|
||
install -o root -g root -m 755 "$release_dir/scripts/tallynote-update-runner.sh" /usr/local/libexec/tallynote-update-runner
|
||
ensure_root_directory "$(dirname -- "$DATA_DIR")/tallynote-backups" 700
|
||
if [[ ! -f "$CONFIG_DIR/tallynote.env" ]]; then
|
||
sed "s#/opt/tallynote#$PREFIX#g; s#/var/lib/tallynote#$DATA_DIR#g" "$release_dir/systemd/tallynote.env.example" > "$CONFIG_DIR/tallynote.env"
|
||
chown root:root "$CONFIG_DIR/tallynote.env"
|
||
chmod 640 "$CONFIG_DIR/tallynote.env"
|
||
fi
|
||
ensure_env_key() {
|
||
local key=$1 value=$2
|
||
[[ "$key" =~ ^[A-Z0-9_]+$ ]] || die '环境变量名无效'
|
||
validate_env_value "$value" "$key"
|
||
if ! grep -qE "^${key}=" "$CONFIG_DIR/tallynote.env"; then
|
||
if [[ -s "$CONFIG_DIR/tallynote.env" && "$(tail -c 1 "$CONFIG_DIR/tallynote.env")" != $'\n' ]]; then
|
||
printf '\n' >> "$CONFIG_DIR/tallynote.env"
|
||
fi
|
||
printf '%s=%s\n' "$key" "$value" >> "$CONFIG_DIR/tallynote.env"
|
||
fi
|
||
}
|
||
ensure_env_key TALLYNOTE_INSTALL_PREFIX "$PREFIX"
|
||
ensure_env_key TALLYNOTE_DATA_DIR "$DATA_DIR"
|
||
ensure_env_key TALLYNOTE_UPDATE_STRATEGY systemd
|
||
ensure_env_key TALLYNOTE_UPDATE_METADATA_URL "$RELEASE_API_URL"
|
||
ensure_env_key TALLYNOTE_UPDATE_ALLOWED_HOSTS "$RELEASE_ALLOWED_HOSTS"
|
||
ensure_env_key TALLYNOTE_UPDATE_REQUIRE_SIGNATURE true
|
||
# The bootstrap verification key is also the key used by the privileged
|
||
# updater unless the operator already configured a separate one.
|
||
UPDATE_PUBLIC_KEY_FILE=${UPDATE_PUBLIC_KEY_FILE:-$SIGNING_KEY}
|
||
if [[ -n "$UPDATE_PUBLIC_KEY_FILE" ]]; then
|
||
validate_install_path "$UPDATE_PUBLIC_KEY_FILE" '更新公钥路径'
|
||
[[ -f "$UPDATE_PUBLIC_KEY_FILE" && ! -L "$UPDATE_PUBLIC_KEY_FILE" ]] || die 'update public key file is invalid'
|
||
[[ "$(stat_uid "$UPDATE_PUBLIC_KEY_FILE")" == 0 ]] || die 'update public key file must be root-owned'
|
||
install -o root -g tallynote -m 640 "$UPDATE_PUBLIC_KEY_FILE" "$CONFIG_DIR/update-signing-key.pub"
|
||
if grep -qE '^TALLYNOTE_UPDATE_PUBLIC_KEY_FILE=' "$CONFIG_DIR/tallynote.env"; then
|
||
sed -i "s#^TALLYNOTE_UPDATE_PUBLIC_KEY_FILE=.*#TALLYNOTE_UPDATE_PUBLIC_KEY_FILE=$CONFIG_DIR/update-signing-key.pub#" "$CONFIG_DIR/tallynote.env"
|
||
else
|
||
printf 'TALLYNOTE_UPDATE_PUBLIC_KEY_FILE=%s\n' "$CONFIG_DIR/update-signing-key.pub" >> "$CONFIG_DIR/tallynote.env"
|
||
fi
|
||
fi
|
||
chown root:root "$CONFIG_DIR/tallynote.env"
|
||
chmod 640 "$CONFIG_DIR/tallynote.env"
|
||
systemctl daemon-reload
|
||
systemctl enable --now tallynote.service tallynote-update.path
|
||
prune_releases
|
||
INSTALL_COMMITTED=1
|
||
trap - EXIT
|
||
rm -rf -- "$INSTALL_WORK_DIR" 2>/dev/null || true
|
||
INSTALL_WORK_DIR=''
|
||
log 'installed; inspect with systemctl status tallynote.service'
|
||
}
|
||
main "$@"
|