diff options
| -rw-r--r-- | frontends/etc/dserver/dtail-netbsd.json.tpl | 2 | ||||
| -rw-r--r-- | frontends/etc/rc.d/dserver-netbsd.tpl | 5 | ||||
| -rw-r--r-- | frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl | 4 | ||||
| -rw-r--r-- | packages/Makefile | 11 | ||||
| -rw-r--r-- | packages/scripts/pkg-dtail-netbsd.sh | 17 |
5 files changed, 32 insertions, 7 deletions
diff --git a/frontends/etc/dserver/dtail-netbsd.json.tpl b/frontends/etc/dserver/dtail-netbsd.json.tpl index cd99560..634fcca 100644 --- a/frontends/etc/dserver/dtail-netbsd.json.tpl +++ b/frontends/etc/dserver/dtail-netbsd.json.tpl @@ -90,7 +90,7 @@ }, "Server": { "SSHBindAddress": "0.0.0.0", - "HostKeyFile": "/var/run/dserver/cache/ssh_host_key", + "HostKeyFile": "/var/db/dserver/ssh_host_key", "HostKeyBits": 2048, "MapreduceLogFormat": "default", "MaxConcurrentCats": 2, diff --git a/frontends/etc/rc.d/dserver-netbsd.tpl b/frontends/etc/rc.d/dserver-netbsd.tpl index 7bd118c..31ac1f6 100644 --- a/frontends/etc/rc.d/dserver-netbsd.tpl +++ b/frontends/etc/rc.d/dserver-netbsd.tpl @@ -21,10 +21,13 @@ start_precmd="dserver_precmd" dserver_precmd() { # /var/run is volatile on NetBSD — recreate the runtime dirs and - # repopulate the SSH key cache on every service start. + # repopulate the SSH key cache on every service start. The SSH host + # key lives in persistent /var/db/dserver so it survives reboots + # (a regenerated host key would break clients' known_hosts). install -d -o dserver -m 0755 /var/log/dserver install -d -o dserver -m 0755 /var/run/dserver install -d -o dserver -m 0755 /var/run/dserver/cache + install -d -o dserver -m 0700 /var/db/dserver if [ -x /usr/local/bin/dserver-update-key-cache.sh ]; then /usr/local/bin/dserver-update-key-cache.sh fi diff --git a/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl b/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl index c50cb72..e30d21f 100644 --- a/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl +++ b/frontends/scripts/dserver-update-key-cache-netbsd.sh.tpl @@ -1,7 +1,9 @@ #!/bin/sh # Refresh the dserver SSH key cache from user authorized_keys files. # NetBSD variant: called from the dserver rc.d start_precmd (because -# /var/run is volatile across reboots) and from a daily root cron job. +# /var/run is volatile across reboots) and from a daily root cron job that +# is added manually at install time (not by the package) — see the pkgrepo +# skill's dtail-package.md for the crontab entry. CACHEDIR=/var/run/dserver/cache DSERVER_USER=dserver diff --git a/packages/Makefile b/packages/Makefile index 860d683..f81859e 100644 --- a/packages/Makefile +++ b/packages/Makefile @@ -28,6 +28,10 @@ # ENTRY — Go main package path relative to SRC (default: cmd/$(NAME)/main.go) SHELL := /bin/bash +# -e: with .ONESHELL a whole recipe runs as one shell script, so without -e a +# failing intermediate line (remote pkg_create, scp, doas cp upload, ...) +# would NOT stop the recipe and make would exit 0 — silently "succeeding". +.SHELLFLAGS := -ec .ONESHELL: # SSH targets for production hosts @@ -81,7 +85,7 @@ DTAIL_VERSION = $(shell grep 'Version string' $(DTAIL_SRC)/internal/version/ve DTAIL_BINARIES := dserver dcat dgrep dmap dtail dtailhealth # NetBSD package versions must not contain dashes (dash separates name from # version in pkg naming), so 4.3.2-ng becomes 4.3.2ng -DTAIL_NETBSD_VERSION = $(shell echo $(DTAIL_VERSION) | tr -d -) +DTAIL_NETBSD_VERSION = $(shell echo $(DTAIL_VERSION) | tr -d '-') CONF_FRONTENDS := $(abspath $(dir $(abspath $(lastword $(MAKEFILE_LIST))))../frontends) DTAIL_RPM_FILES := $(abspath $(dir $(abspath $(lastword $(MAKEFILE_LIST))))files/dtail-rocky) @@ -222,8 +226,11 @@ dtail-freebsd: # on pi0 with pkg_create, upload package + pkg_summary.gz to the PV via f0. # .zst log files are not supported in this binary; gzip still works. dtail-netbsd: + @test -n "$(DTAIL_NETBSD_VERSION)" || { echo "Error: could not extract DTail version from $(DTAIL_SRC)"; exit 1; } @echo "Building DTail $(DTAIL_VERSION) for NetBSD/arm64..." - rm -rf /tmp/dtail-netbsd-binaries + @# Remove stale artifacts from previous runs so a failed build can never + @# silently upload an old package. + rm -rf /tmp/dtail-netbsd-binaries /tmp/dtail-$(DTAIL_NETBSD_VERSION).tgz /tmp/dtail-netbsd-pkg_summary.gz mkdir -p /tmp/dtail-netbsd-binaries cd $(DTAIL_SRC) && for bin in $(DTAIL_BINARIES); do \ echo " Cross-compiling $$bin for NetBSD..."; \ diff --git a/packages/scripts/pkg-dtail-netbsd.sh b/packages/scripts/pkg-dtail-netbsd.sh index f3bc9d6..cbddd24 100644 --- a/packages/scripts/pkg-dtail-netbsd.sh +++ b/packages/scripts/pkg-dtail-netbsd.sh @@ -8,6 +8,10 @@ # NetBSD repo ever holds more than dtail, regenerate the summary across all # .tgz files in the repo directory instead. # +# The package deliberately ships no install script for the dserver user/group: +# creating them is a documented one-time install step (see the pkgrepo skill's +# dtail-package.md), matching how the FreeBSD package handles it. +# # Arguments: # $1 — version (NetBSD-safe, no dashes — e.g. 4.3.2ng) @@ -18,6 +22,10 @@ PATH=/usr/sbin:/usr/bin:/bin:$PATH export PATH VERSION="$1" +if [ -z "$VERSION" ]; then + echo "Error: version argument missing (would build dtail-.tgz)" >&2 + exit 1 +fi NAME="dtail" COMMENT="Distributed log tail and grep tool" DESC="DTail is a distributed DevOps tool for tailing, grepping, catting, and @@ -89,7 +97,12 @@ pkg_create \ -p "$WORKDIR/stage" \ "$WORKDIR/out/${NAME}-${VERSION}.tgz" -# Repo metadata for pkgin (pkg_add itself doesn't need it) -( cd "$WORKDIR/out" && pkg_info -X ./*.tgz | gzip -9 > pkg_summary.gz ) +# Repo metadata for pkgin (pkg_add itself doesn't need it). Write the summary +# to a temp file first: piping pkg_info straight into gzip would mask a +# pkg_info failure (set -e without pipefail) and publish a truncated summary. +( cd "$WORKDIR/out" && \ + pkg_info -X ./*.tgz > pkg_summary.tmp && \ + gzip -9 < pkg_summary.tmp > pkg_summary.gz && \ + rm pkg_summary.tmp ) echo "NetBSD package ${NAME}-${VERSION} built in $WORKDIR/out/" |