From ff0de7e0b29ac3b3ef597d8ed5b4b558556ac99d Mon Sep 17 00:00:00 2001 From: Ilker Manap Date: Sat, 31 Oct 2026 09:32:54 +0100 Subject: [PATCH] Release image upload: the image directory belongs to the deploy user The image job built as root and uploaded as the deploy user, so publish-image.sh could not write SHA256SUMS (v0.3.0's image job failed). The job hands the directory over after the build, and publish-image.sh checks the SHA256SUMS build-image.sh wrote instead of rewriting it. Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/release.yml | 1 + deploy/publish-image.sh | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index b5d68d3..5bac01d 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -97,6 +97,7 @@ jobs: ssh "$USER@$HOST" "sudo rm -rf $W && mkdir -p $W/src" scp -q -r agent deploy/publish-image.sh "$USER@$HOST:$W/src/" ssh "$USER@$HOST" "sudo env AUTHKEYS= BUILD=$W/build OUT=$W/image bash $W/src/agent/build-image.sh > $W/build.log 2>&1 || { tail -40 $W/build.log; exit 1; }; tail -5 $W/build.log" + ssh "$USER@$HOST" "sudo chown -R \$(id -u):\$(id -g) $W/image" # the upload runs as the deploy user # refuse an image that lets someone in (a listing that fails refuses too) ssh "$USER@$HOST" "sudo unsquashfs -l $W/image/filesystem.squashfs > $W/files" || { echo "::error::cannot list the image" >&2; exit 1; } diff --git a/deploy/publish-image.sh b/deploy/publish-image.sh index 2963a82..b56f9a6 100755 --- a/deploy/publish-image.sh +++ b/deploy/publish-image.sh @@ -11,7 +11,8 @@ IMG=${IMG:-/srv/rollcall/image} HDR=$(mktemp); trap 'rm -f "$HDR"' EXIT printf 'Authorization: token %s\n' "$GITEA_TOKEN" > "$HDR" # not on curl's command line (ps) cd "$IMG" -sha256sum vmlinuz initrd.img filesystem.squashfs > SHA256SUMS +# build-image.sh writes SHA256SUMS; check it, or make it for an image without one +if [ -f SHA256SUMS ]; then sha256sum -c --quiet SHA256SUMS; else sha256sum vmlinuz initrd.img filesystem.squashfs > SHA256SUMS; fi id=$(curl -fsS -H "@$HDR" "$API/releases/tags/$TAG" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])') existing=$(curl -fsS -H "@$HDR" "$API/releases/$id/assets" | python3 -c 'import json,sys;[print(a["id"],a["name"]) for a in json.load(sys.stdin)]') for f in vmlinuz initrd.img filesystem.squashfs SHA256SUMS; do