From 7bf226e73b2bed74f502ee79c21f368a1d91334c Mon Sep 17 00:00:00 2001 From: Jorijn van der Graaf Date: Sat, 5 Sep 2026 22:26:06 +0200 Subject: [PATCH] fp6-vendor-blobs: the checksum the extractor change forgot, and a check that finds the next one in a second CI run 52 failed at minute 57 with `fp6-vendor-blobs-extract: FAILED` from abuild's checksum verification: 9575e55 changed the extractor and left its sha512sums entry alone. Nothing was installed or published; latest is the run-51 image. Fix the sum, and stop paying an hour to learn it. check-aports.sh sources every APKBUILD under aports/ and compares the committed sha512sums of its local source files (scripts, units, configs, patches, including ones in a subdirectory) against the files themselves. build.sh runs it before pmbootstrap touches anything, so this class of mistake now fails in the first seconds of a run and prints the line to paste. Aports whose sums build.sh regenerates with pmbootstrap checksum are read from build.sh and skipped, so the two lists cannot drift. Verified: the checker reports exactly the run-52 mismatch on the tree as pushed and nothing on the tree as fixed; a scratch copy with one corrupted sum is caught; the fixed aport builds under abuild in an alpine:edge container (the only complaint was the throwaway signing key at the index step, which the CI's pmbootstrap flow does not have). --- aports/device/fp6-vendor-blobs/APKBUILD | 2 +- build.sh | 5 +++ check-aports.sh | 55 +++++++++++++++++++++++++ 3 files changed, 61 insertions(+), 1 deletion(-) create mode 100755 check-aports.sh diff --git a/aports/device/fp6-vendor-blobs/APKBUILD b/aports/device/fp6-vendor-blobs/APKBUILD index 8dc7a5b..0a6d8c8 100644 --- a/aports/device/fp6-vendor-blobs/APKBUILD +++ b/aports/device/fp6-vendor-blobs/APKBUILD @@ -55,7 +55,7 @@ package() { } sha512sums=" -a71b2c86f980734d0aae6e135b26272fe52ae5603050bea52f55f7e74c8bd98c62b6194047711248d4fef40851792adc47d77c40016d99a0d68ecd2459894b80 fp6-vendor-blobs-extract +2caafdedf93e103516834a1f815dd828ecee66c82d569e4a925ccc6bd6ac75d6778290adb02db69538af3bb6ad36cee5c13c8afba2c722a4c4550efe761ba8a0 fp6-vendor-blobs-extract b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800 fp6-vendor-blobs.service 9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a fp6-vendor-blobs.preset " diff --git a/build.sh b/build.sh index 805c6a3..8da477b 100755 --- a/build.sh +++ b/build.sh @@ -47,6 +47,11 @@ FPD_SHA256=" PMAPORTS_REPO=https://gitlab.postmarketos.org/postmarketOS/pmaports.git cd "$(dirname "$0")" +# Fail in seconds, not at minute 57: a stale sha512sum in one of our own +# aports (run 52, fp6-vendor-blobs 1-r2) only surfaces when abuild reaches that +# aport, an hour into the run. This checks every aport's local source files +# against the committed sums before pmbootstrap does anything. +./check-aports.sh # pmbootstrap refuses to run as root: install deps, then re-exec as a build # user with passwordless sudo (pmbootstrap escalates itself where needed). diff --git a/check-aports.sh b/check-aports.sh new file mode 100755 index 0000000..018c671 --- /dev/null +++ b/check-aports.sh @@ -0,0 +1,55 @@ +#!/bin/sh -eu +# check-aports.sh - verify the committed sha512sums of every aport's LOCAL +# source files (scripts, units, configs, patches) against the files actually +# in the aport directory. +# +# Why this exists: CI run 52 (2026-09-05) died after 57 minutes, at the point +# abuild reached fp6-vendor-blobs, because the extractor had been changed and +# its sha512sum had not. abuild finds that only when it gets to that aport; +# this finds it in under a second, before pmbootstrap does anything. build.sh +# runs it first; run it by hand before pushing too. +# +# Out of scope, by design: sources fetched from a URL (abuild verifies those +# against the same sums after fetching), and the aports whose sums build.sh +# regenerates at build time with 'pmbootstrap checksum' (their tarballs are +# generated there and do not exist here) - that list is read from build.sh so +# the two cannot drift apart. +cd "$(dirname "$0")" +regen=$(sed -n 's/^pmbootstrap checksum \([a-z0-9-]*\)$/\1/p' build.sh | tr '\n' ' ') +rc=0 +for d in aports/*/*/; do + [ -f "$d/APKBUILD" ] || continue + d=${d%/} + case " $regen " in *" ${d##*/} "*) continue ;; esac + info=$(cd "$d" && sh -c '. ./APKBUILD; printf "%s\n" $source; printf "==\n"; printf "%s\n" "$sha512sums"' 2>/dev/null) || { + echo "$d: APKBUILD does not source cleanly" >&2; rc=1; continue + } + srcs=$(printf '%s\n' "$info" | sed '/^==$/,$d') + sums=$(printf '%s\n' "$info" | sed '1,/^==$/d') + for s in $srcs; do + case "$s" in + *://*) continue ;; # remote: abuild fetches and verifies + *::*) f=${s%%::*} ;; + *) f=${s##*/} ;; + esac + # a local source may sit in a subdirectory (rules/00_log_all.nft); + # the sums entry is keyed by its basename either way + path="$d/$s"; [ -f "$path" ] || path="$d/$f" + want=$(printf '%s\n' "$sums" | awk -v f="$f" '$2==f{print $1}') + [ "$want" = REPLACED_BY_CI ] && continue + if [ ! -f "$path" ]; then + echo "$d: local source '$s' is missing" >&2; rc=1; continue + fi + if [ -z "$want" ]; then + echo "$d: '$f' has no sha512sums entry" >&2; rc=1; continue + fi + have=$(sha512sum "$path" | awk '{print $1}') + if [ "$want" != "$have" ]; then + echo "$d: sha512 MISMATCH for '$f' (APKBUILD has ${want%"${want#????????????????}"}..., file is ${have%"${have#????????????????}"}...)" >&2 + echo "$d: fix: update the sha512sums entry to: $have $f" >&2 + rc=1 + fi + done +done +[ "$rc" = 0 ] && echo "check-aports: all local source checksums match" +exit $rc