archy/image-recipe/scripts/convert-iso-to-disk.sh

66 lines
1.7 KiB
Bash
Raw Normal View History

release(v1.7.41-alpha): post-OTA auto-rollback so a bad release cannot strand the fleet Closes failure mode FM5 from docs/bulletproof-containers.md: the v1.7.38 + v1.7.39 rollouts left every affected node on an unreachable UI (nginx 500) with no recovery path short of SSH. This release adds a self-check guardrail to the update flow. What changed: - apply_update() writes a pending-verify marker with old+new version and a 150s deadline immediately before scheduling the service restart. - verify_pending_update() runs from main.rs startup. If the marker is present and within its freshness window, the new binary waits 15s for nginx + backend to settle, then probes https://127.0.0.1/ every 5s for up to 90s (self-signed certs accepted). - On any probe success within the window, the marker is cleared and nothing else happens. - On window-exhaust, the new binary: 1. Moves the broken /opt/archipelago/web-ui to web-ui.failed.<ts> (quarantined, not deleted, so we can post-mortem). 2. Restores web-ui.bak on top of web-ui. 3. Calls rollback_update() to restore the previous binary. 4. Updates state.current_version to reflect the rollback. 5. systemctl --no-block restart archipelago so the OLD binary boots. - Markers older than 10 minutes are treated as stale and cleared without probing, so a crashed-during-startup marker from weeks ago cannot spontaneously roll back a healthy node on a later reboot. - rollback_update() binary copy now goes through host_sudo instead of tokio::fs::copy, so it escapes the service's ProtectSystem=strict mount namespace. Without this, the rollback silently failed with EROFS on /usr/local/bin and orphaned the rollback - the exact opposite of what auto-rollback is for. Tests: 4 new unit tests in update::tests covering marker round-trip, absent-marker noop, no-panic on verify_pending_update with nothing to verify, and an invariant assert that the 90s probe window stays below the 600s stale threshold. All passing. Side fix: scripts/create-release-manifest.sh was dying with exit 141 (SIGPIPE from tar tvzf pipe head pipe awk) under set -euo pipefail. Replaced with a single awk NR==1 that doesn't short-circuit the upstream pipe, so the release-build flow is idempotent again.
2026-04-22 16:14:35 -04:00
#!/bin/bash
# Convert ISO image to bootable disk image
# Creates a raw disk image that can be flashed directly
set -e
OUTPUT_DIR="${1:-../results}"
ARCHIPELAGO_VERSION="${ARCHIPELAGO_VERSION:-0.1.0}"
ARCH="${ARCH:-x86_64}"
echo "💾 Converting ISO to disk image..."
# Find ISO file
ISO_FILE=$(ls "$OUTPUT_DIR"/*.iso 2>/dev/null | head -1)
if [ -z "$ISO_FILE" ]; then
echo "❌ No ISO file found in $OUTPUT_DIR"
exit 1
fi
echo " Source ISO: $ISO_FILE"
# Create disk image (4GB minimum)
DISK_SIZE=4096 # 4GB in MB
DISK_IMG="$OUTPUT_DIR/archipelago-${ARCHIPELAGO_VERSION}-${ARCH}.img"
echo " Creating disk image: $DISK_IMG"
# Check if we have required tools
if ! command -v dd >/dev/null 2>&1; then
echo "❌ dd not found"
exit 1
fi
# Create empty disk image
dd if=/dev/zero of="$DISK_IMG" bs=1M count=$DISK_SIZE 2>/dev/null || {
echo "❌ Failed to create disk image"
exit 1
}
# Note: Full disk image creation with partitions requires:
# - parted or fdisk
# - mkfs.vfat, mkfs.ext4
# - losetup (Linux only)
# - grub-install
# For now, we'll create a simple approach:
# The ISO can be used directly, or users can use tools like:
# - balenaEtcher (macOS/Linux GUI)
# - Rufus (Windows)
# - dd (command line)
echo "⚠️ Full disk image conversion requires additional tools"
echo " For now, use the ISO file directly with:"
echo " - balenaEtcher (recommended)"
echo " - dd command (see docs)"
echo ""
echo " ISO file: $ISO_FILE"
echo " Size: $(du -h "$ISO_FILE" | cut -f1)"
# Clean up empty image file
rm -f "$DISK_IMG"
echo ""
echo "💡 Tip: Use the ISO file with a USB flashing tool"
echo " The ISO is bootable and can be flashed directly"