Rénich Bon Ćirić
89d6f66be8
* Implementación del rol de Ansible 'siguldry' para CentOS Stream 10 * Migración del plugin de firmas de Koji Hub a un spooler asíncrono * Modificación de roles para utilizar empaquetamiento RPM nativo de siguldry-pkcs11 * Documentación de decisiones (ADRs) y roadmap en docs/technical/ * Limpieza de binarios locales pesados de PKCS#11 en Ansible Co-developed-by: Gemini AI <renich+gemini@woralelandia.com> Signed-off-by: Rénich Bon Ćirić <renich@woralelandia.com>
136 lines
No EOL
4.3 KiB
Shell
Executable file
136 lines
No EOL
4.3 KiB
Shell
Executable file
#!/usr/bin/bash
|
|
set -e
|
|
|
|
# Configuration
|
|
DIST_GIT_CACHE_DIR="/var/lib/dist-git/cache"
|
|
GIT_BASE_URL="https://git.mx-os.mx/RPMs"
|
|
UPSTREAM_CACHE_URL="https://sources.stream.centos.org/sources/rpms"
|
|
DEFAULT_BRANCH="c10s"
|
|
|
|
if [ -z "$1" ]; then
|
|
echo "Usage: $0 <PACKAGE_NAME> [BRANCH]"
|
|
echo "Example: $0 bash c10s"
|
|
exit 1
|
|
fi
|
|
|
|
PKG="$1"
|
|
BRANCH="${2:-$DEFAULT_BRANCH}"
|
|
|
|
SOURCES_URL="${GIT_BASE_URL}/${PKG}/raw/branch/${BRANCH}/sources"
|
|
TEMP_DIR=$(mktemp -d)
|
|
|
|
# Ensure we are running as root to write to cache
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "Please run as root."
|
|
exit 1
|
|
fi
|
|
|
|
cleanup() {
|
|
rm -rf "${TEMP_DIR}"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "Processing package: ${PKG} (Branch: ${BRANCH})"
|
|
echo "Fetching sources file from: ${SOURCES_URL}"
|
|
|
|
# Download sources file
|
|
if ! wget -q -O "${TEMP_DIR}/sources" "${SOURCES_URL}"; then
|
|
echo "Error: Could not fetch sources file. Check package name, branch, or network."
|
|
# It might be 404 if no sources file exists (some meta-packages). This is not fatal, just nothing to do.
|
|
echo "Assuming no sources or repo not found."
|
|
exit 0
|
|
fi
|
|
|
|
if [ ! -s "${TEMP_DIR}/sources" ]; then
|
|
echo "Sources file is empty. Nothing to import."
|
|
exit 0
|
|
fi
|
|
|
|
# Process sources file
|
|
# Format: SHA512 (filename) = hash
|
|
while read -r line; do
|
|
# Skip empty lines
|
|
[[ -z "$line" ]] && continue
|
|
|
|
# Parse line
|
|
# Expecting: SHA512 (filename) = hash
|
|
# We can use regex or simple awk/cut
|
|
hash_type=$(echo "$line" | awk '{print $1}')
|
|
filename_part=$(echo "$line" | cut -d'(' -f2 | cut -d')' -f1)
|
|
hash=$(echo "$line" | awk '{print $4}')
|
|
|
|
if [ "$hash_type" != "SHA512" ]; then
|
|
echo "Warning: Unsupported hash type $hash_type for $filename_part. Skipping."
|
|
continue
|
|
fi
|
|
|
|
echo "Found source: ${filename_part} (Hash: ${hash})"
|
|
|
|
# Format 1: Fedora/CentOS Stream 9+ (includes algorithm)
|
|
# URL: upstream/pkg/filename/algo/hash/filename
|
|
# Note: Algo is usually lowercase in URL
|
|
algo_lower=$(echo "$hash_type" | tr '[:upper:]' '[:lower:]')
|
|
DOWNLOAD_URL_1="${UPSTREAM_CACHE_URL}/${PKG}/${filename_part}/${algo_lower}/${hash}/${filename_part}"
|
|
|
|
# Format 2: Older CentOS (no algorithm)
|
|
# URL: upstream/pkg/filename/hash/filename
|
|
DOWNLOAD_URL_2="${UPSTREAM_CACHE_URL}/${PKG}/${filename_part}/${hash}/${filename_part}"
|
|
|
|
# Define Local Path (Matching CentOS Stream Structure: rpms/pkg/file/algo/hash/file)
|
|
LOCAL_PATH="${DIST_GIT_CACHE_DIR}/rpms/${PKG}/${filename_part}/${algo_lower}/${hash}/${filename_part}"
|
|
|
|
if [ -f "${LOCAL_PATH}" ]; then
|
|
echo " - File already exists in local cache. Verifying..."
|
|
current_hash=$(sha512sum "${LOCAL_PATH}" | awk '{print $1}')
|
|
if [ "$current_hash" == "$hash" ]; then
|
|
echo " - Hash matches. Skipping download."
|
|
continue
|
|
else
|
|
echo " - Hash Mismatch! Redownloading."
|
|
rm -f "${LOCAL_PATH}"
|
|
fi
|
|
fi
|
|
|
|
DOWNLOAD_SUCCESS=0
|
|
|
|
echo " - Attempting download from: ${DOWNLOAD_URL_1}"
|
|
if wget -O "${TEMP_DIR}/${filename_part}" "${DOWNLOAD_URL_1}"; then
|
|
echo " - Download successful."
|
|
DOWNLOAD_SUCCESS=1
|
|
else
|
|
echo " - Format 1 failed. Trying Format 2: ${DOWNLOAD_URL_2}"
|
|
if wget -O "${TEMP_DIR}/${filename_part}" "${DOWNLOAD_URL_2}"; then
|
|
echo " - Download successful."
|
|
DOWNLOAD_SUCCESS=1
|
|
else
|
|
echo " - Error: Failed to download file from both formats."
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Verify Hash
|
|
echo "Calculating hash for: ${TEMP_DIR}/${filename_part}"
|
|
downloaded_hash=$(sha512sum "${TEMP_DIR}/${filename_part}" | awk '{print $1}')
|
|
|
|
if [ "$downloaded_hash" != "$hash" ]; then
|
|
echo " - Error: Downloaded file hash mismatch!"
|
|
echo " Expected: $hash"
|
|
echo " Got: $downloaded_hash"
|
|
rm -f "${TEMP_DIR}/${filename_part}"
|
|
exit 1
|
|
fi
|
|
|
|
# Move and Set Permissions/SELinux context efficiently
|
|
install -D -o git -g git -m 644 "${TEMP_DIR}/${filename_part}" "${LOCAL_PATH}"
|
|
|
|
# Restore SELinux context specifically for the new file if needed
|
|
if command -v restorecon >/dev/null 2>&1; then
|
|
restorecon "${LOCAL_PATH}"
|
|
fi
|
|
|
|
echo " - Successfully imported."
|
|
|
|
|
|
done < "${TEMP_DIR}/sources"
|
|
|
|
echo "Done." |