archy/image-recipe/write-usb-dd.sh

70 lines
1.9 KiB
Bash
Raw Normal View History

release(v1.7.41-alpha): post-OTA auto-rollback so a bad release cannot strand the fleet Closes failure mode FM5 from docs/bulletproof-containers.md: the v1.7.38 + v1.7.39 rollouts left every affected node on an unreachable UI (nginx 500) with no recovery path short of SSH. This release adds a self-check guardrail to the update flow. What changed: - apply_update() writes a pending-verify marker with old+new version and a 150s deadline immediately before scheduling the service restart. - verify_pending_update() runs from main.rs startup. If the marker is present and within its freshness window, the new binary waits 15s for nginx + backend to settle, then probes https://127.0.0.1/ every 5s for up to 90s (self-signed certs accepted). - On any probe success within the window, the marker is cleared and nothing else happens. - On window-exhaust, the new binary: 1. Moves the broken /opt/archipelago/web-ui to web-ui.failed.<ts> (quarantined, not deleted, so we can post-mortem). 2. Restores web-ui.bak on top of web-ui. 3. Calls rollback_update() to restore the previous binary. 4. Updates state.current_version to reflect the rollback. 5. systemctl --no-block restart archipelago so the OLD binary boots. - Markers older than 10 minutes are treated as stale and cleared without probing, so a crashed-during-startup marker from weeks ago cannot spontaneously roll back a healthy node on a later reboot. - rollback_update() binary copy now goes through host_sudo instead of tokio::fs::copy, so it escapes the service's ProtectSystem=strict mount namespace. Without this, the rollback silently failed with EROFS on /usr/local/bin and orphaned the rollback - the exact opposite of what auto-rollback is for. Tests: 4 new unit tests in update::tests covering marker round-trip, absent-marker noop, no-panic on verify_pending_update with nothing to verify, and an invariant assert that the 90s probe window stays below the 600s stale threshold. All passing. Side fix: scripts/create-release-manifest.sh was dying with exit 141 (SIGPIPE from tar tvzf pipe head pipe awk) under set -euo pipefail. Replaced with a single awk NR==1 that doesn't short-circuit the upstream pipe, so the release-build flow is idempotent again.
2026-04-22 16:14:35 -04:00
#!/bin/bash
#
# Write Archipelago ISO to USB using dd
#
# Usage: ./write-usb-dd.sh /dev/diskN
#
set -e
if [ -z "$1" ]; then
echo "Usage: $0 /dev/diskN"
echo ""
echo "Available disks:"
diskutil list external
exit 1
fi
USB_DISK="$1"
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ISO_FILE="$SCRIPT_DIR/results/archipelago-debian-13-x86_64.iso"
if [ ! -f "$ISO_FILE" ]; then
echo "❌ ISO not found: $ISO_FILE"
echo ""
echo "Build the ISO first with: ./build-debian-iso.sh"
exit 1
fi
# Get raw disk for faster writes
RAW_DISK="${USB_DISK/disk/rdisk}"
echo "╔════════════════════════════════════════════════════════╗"
echo "║ Write Archipelago ISO to USB ║"
echo "╚════════════════════════════════════════════════════════╝"
echo ""
echo "⚠️ WARNING: This will COMPLETELY ERASE $USB_DISK"
echo ""
echo "📀 ISO: $(basename "$ISO_FILE")"
echo "💾 USB: $USB_DISK (raw: $RAW_DISK)"
echo ""
echo "Press Ctrl+C to cancel, or Enter to continue..."
read
echo "🔓 Unmounting USB..."
diskutil unmountDisk "$USB_DISK" || true
echo ""
echo "📝 Writing ISO with dd (this may take a few minutes)..."
echo " Using raw disk $RAW_DISK for faster write..."
echo ""
# Use dd to write the ISO directly
sudo dd if="$ISO_FILE" of="$RAW_DISK" bs=4m status=progress
echo ""
echo "🔄 Syncing..."
sync
echo ""
echo "✅ Done! USB is ready."
echo ""
echo "Now:"
echo " 1. Eject the USB safely: diskutil eject $USB_DISK"
echo " 2. Insert into target machine"
echo " 3. Boot from USB (F12 or similar for boot menu)"
echo ""
echo "Default login (live mode):"
echo " Username: user"
echo " Password: live"