mirror of
https://github.com/hansjone/netx.git
synced 2026-10-15 04:53:20 +08:00
oliver
846aa3e680
- packaging/linux: netx-<ver>-linux-x86_64.tar.gz with bundled Python 3.12, PostgreSQL 16 and web/dist (glibc >= 2.17). install.sh (install/update/ reinstall), netxctl (start/stop/status/logs, set-port, set-bind, set-pg-port, reconfigure-db, check-update/update/auto-update, backup, uninstall), systemd units, nohup fallback without systemd. Privilege drop, detaching and tar go through the bundled Python, so bare images without su/runuser/setsid/tar work. - Updates: same GitHub/Forgejo/manifest sources as Windows, sha256 verified, pre-update pg_dump, automatic rollback when the new version does not come up. - Non-loopback bind: generated bootstrap admin password and NETX_UME_VERIFY_TLS=true, as security_bootstrap requires. - Build in manylinux2014 + check_bundle.sh (GLIBC <= 2.17, no missing libs); release-linux.yml builds on v* tags and smoke-tests offline on CentOS 7, Rocky 9, Ubuntu 18.04/24.04, Debian 12, openSUSE Leap 15 and openEuler 22.03 before attaching to the release. - Windows: Setup DB page gets a bundled PG port field and /BundledPgPort=; set_pg_port.ps1 + tray "Built-in database port"; reconfigure keeps the configured port; postgresql.conf is written without a BOM (PS 5.1 Set-Content -Encoding utf8 broke postgres). - Forgejo/GitHub publish scripts include the Linux package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
37 lines
1.7 KiB
Bash
Executable file
37 lines
1.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Fail when any ELF in the stage needs glibc newer than MAX or a shared library
|
|
# that is neither in the bundle nor on the base-system allowlist.
|
|
# check_bundle.sh <stage-dir> [max-glibc=2.17]
|
|
set -euo pipefail
|
|
STAGE="$1"
|
|
MAX="${2:-2.17}"
|
|
# Present on every glibc distro (libcrypt.so.1 only backs the unused _crypt module).
|
|
ALLOW=" libc.so.6 libm.so.6 libdl.so.2 libpthread.so.0 librt.so.1 libutil.so.1 libcrypt.so.1 libnsl.so.1 libresolv.so.2 ld-linux-x86-64.so.2 libgcc_s.so.1 libstdc++.so.6 "
|
|
|
|
is_elf() { [[ "$(head -c4 "$1" 2>/dev/null | od -An -c | tr -d ' ')" == '177ELF' ]]; }
|
|
|
|
declare -A HAVE=()
|
|
ELFS=()
|
|
while IFS= read -r -d '' f; do
|
|
is_elf "${f}" && ELFS+=("${f}")
|
|
done < <(find "${STAGE}" -type f \( -name '*.so*' -o -perm -u+x \) -print0)
|
|
for f in "${ELFS[@]}"; do HAVE["$(basename "${f}")"]=1; done
|
|
while IFS= read -r -d '' l; do HAVE["$(basename "${l}")"]=1; done < <(find "${STAGE}" -type l -name '*.so*' -print0)
|
|
|
|
bad=0
|
|
for f in "${ELFS[@]}"; do
|
|
top="$(objdump -T "${f}" 2>/dev/null | grep -o 'GLIBC_[0-9][0-9.]*' | sed 's/GLIBC_//' | sort -V | tail -n1 || true)"
|
|
if [[ -n "${top}" && "$(printf '%s\n%s\n' "${top}" "${MAX}" | sort -V | tail -n1)" != "${MAX}" ]]; then
|
|
echo "[FAIL] ${f#"${STAGE}"/} needs GLIBC_${top} (> ${MAX})"
|
|
bad=1
|
|
fi
|
|
while IFS= read -r need; do
|
|
need="${need##*/}" # $ORIGIN/../lib/libfoo.so -> libfoo.so
|
|
[[ -z "${need}" || "${ALLOW}" == *" ${need} "* ]] && continue
|
|
[[ -n "${HAVE[${need}]:-}" ]] && continue
|
|
echo "[FAIL] ${f#"${STAGE}"/} needs ${need} (not bundled)"
|
|
bad=1
|
|
done < <(readelf -d "${f}" 2>/dev/null | sed -n 's/.*(NEEDED).*\[\(.*\)\]/\1/p')
|
|
done
|
|
echo "==> checked ${#ELFS[@]} ELF files (max GLIBC ${MAX})"
|
|
exit "${bad}"
|