diff options
| author | Paul Buetow <paul@buetow.org> | 2026-07-09 10:18:21 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-07-09 10:18:21 +0300 |
| commit | 037fc22517361d3a9973cb8dc09040c378c2d913 (patch) | |
| tree | fe09b6a73eb6a94ba0e053f79e011d03caf075ab /frontends | |
| parent | 1ea362740236e8e12ea9459a5065f8571a81a99e (diff) | |
packages: harden NetBSD dtail pipeline (review findings)
- Makefile: .SHELLFLAGS := -ec — with .ONESHELL a failing intermediate
recipe line (remote pkg_create, scp, PV upload) previously did not
stop the recipe and make exited 0; also remove stale /tmp package
artifacts at target start so a failed build can never silently
re-upload an old tgz, guard against an empty extracted version, and
quote the tr operand
- dtail-netbsd.json.tpl + rc.d: move the SSH host key from volatile
/var/run/dserver/cache to persistent /var/db/dserver/ssh_host_key so
it survives reboots (clients re-accept the key once after upgrade)
- pkg-dtail-netbsd.sh: reject a missing version argument; write the
pkg_summary via a temp file so a pkg_info failure cannot publish a
truncated pkg_summary.gz; document that the dserver user/group is a
deliberate manual install step
- key-cache template: comment now states the daily cron entry is added
manually at install time (documented in the pkgrepo skill)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Diffstat (limited to 'frontends')
| -rw-r--r-- | frontends/etc/dserver/dtail-netbsd.json.tpl | 2 | ||||
| -rw-r--r-- | frontends/etc/rc.d/dserver-netbsd.tpl | 5 | ||||
| -rw-r--r-- | frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl | 4 |
3 files changed, 8 insertions, 3 deletions
diff --git a/frontends/etc/dserver/dtail-netbsd.json.tpl b/frontends/etc/dserver/dtail-netbsd.json.tpl index cd99560..634fcca 100644 --- a/frontends/etc/dserver/dtail-netbsd.json.tpl +++ b/frontends/etc/dserver/dtail-netbsd.json.tpl @@ -90,7 +90,7 @@ }, "Server": { "SSHBindAddress": "0.0.0.0", - "HostKeyFile": "/var/run/dserver/cache/ssh_host_key", + "HostKeyFile": "/var/db/dserver/ssh_host_key", "HostKeyBits": 2048, "MapreduceLogFormat": "default", "MaxConcurrentCats": 2, diff --git a/frontends/etc/rc.d/dserver-netbsd.tpl b/frontends/etc/rc.d/dserver-netbsd.tpl index 7bd118c..31ac1f6 100644 --- a/frontends/etc/rc.d/dserver-netbsd.tpl +++ b/frontends/etc/rc.d/dserver-netbsd.tpl @@ -21,10 +21,13 @@ start_precmd="dserver_precmd" dserver_precmd() { # /var/run is volatile on NetBSD — recreate the runtime dirs and - # repopulate the SSH key cache on every service start. + # repopulate the SSH key cache on every service start. The SSH host + # key lives in persistent /var/db/dserver so it survives reboots + # (a regenerated host key would break clients' known_hosts). install -d -o dserver -m 0755 /var/log/dserver install -d -o dserver -m 0755 /var/run/dserver install -d -o dserver -m 0755 /var/run/dserver/cache + install -d -o dserver -m 0700 /var/db/dserver if [ -x /usr/local/bin/dserver-update-key-cache.sh ]; then /usr/local/bin/dserver-update-key-cache.sh fi diff --git a/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl b/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl index c50cb72..e30d21f 100644 --- a/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl +++ b/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl @@ -1,7 +1,9 @@ #!/bin/sh # Refresh the dserver SSH key cache from user authorized_keys files. # NetBSD variant: called from the dserver rc.d start_precmd (because -# /var/run is volatile across reboots) and from a daily root cron job. +# /var/run is volatile across reboots) and from a daily root cron job that +# is added manually at install time (not by the package) — see the pkgrepo +# skill's dtail-package.md for the crontab entry. CACHEDIR=/var/run/dserver/cache DSERVER_USER=dserver |