diff options
| author | Paul Buetow <paul@buetow.org> | 2026-07-09 10:18:21 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-07-09 10:18:21 +0300 |
| commit | 037fc22517361d3a9973cb8dc09040c378c2d913 (patch) | |
| tree | fe09b6a73eb6a94ba0e053f79e011d03caf075ab /frontends/etc/rc.d | |
| parent | 1ea362740236e8e12ea9459a5065f8571a81a99e (diff) | |
packages: harden NetBSD dtail pipeline (review findings)
- Makefile: .SHELLFLAGS := -ec — with .ONESHELL a failing intermediate
recipe line (remote pkg_create, scp, PV upload) previously did not
stop the recipe and make exited 0; also remove stale /tmp package
artifacts at target start so a failed build can never silently
re-upload an old tgz, guard against an empty extracted version, and
quote the tr operand
- dtail-netbsd.json.tpl + rc.d: move the SSH host key from volatile
/var/run/dserver/cache to persistent /var/db/dserver/ssh_host_key so
it survives reboots (clients re-accept the key once after upgrade)
- pkg-dtail-netbsd.sh: reject a missing version argument; write the
pkg_summary via a temp file so a pkg_info failure cannot publish a
truncated pkg_summary.gz; document that the dserver user/group is a
deliberate manual install step
- key-cache template: comment now states the daily cron entry is added
manually at install time (documented in the pkgrepo skill)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Diffstat (limited to 'frontends/etc/rc.d')
| -rw-r--r-- | frontends/etc/rc.d/dserver-netbsd.tpl | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/frontends/etc/rc.d/dserver-netbsd.tpl b/frontends/etc/rc.d/dserver-netbsd.tpl index 7bd118c..31ac1f6 100644 --- a/frontends/etc/rc.d/dserver-netbsd.tpl +++ b/frontends/etc/rc.d/dserver-netbsd.tpl @@ -21,10 +21,13 @@ start_precmd="dserver_precmd" dserver_precmd() { # /var/run is volatile on NetBSD — recreate the runtime dirs and - # repopulate the SSH key cache on every service start. + # repopulate the SSH key cache on every service start. The SSH host + # key lives in persistent /var/db/dserver so it survives reboots + # (a regenerated host key would break clients' known_hosts). install -d -o dserver -m 0755 /var/log/dserver install -d -o dserver -m 0755 /var/run/dserver install -d -o dserver -m 0755 /var/run/dserver/cache + install -d -o dserver -m 0700 /var/db/dserver if [ -x /usr/local/bin/dserver-update-key-cache.sh ]; then /usr/local/bin/dserver-update-key-cache.sh fi |