[23143] | 1 | #!/bin/sh |
---|
| 2 | |
---|
[23156] | 3 | complain() { |
---|
[25664] | 4 | echo "ERROR: $*" |
---|
[24385] | 5 | logger -t "athena-auto-update" -p user.notice "$*" |
---|
[24376] | 6 | updstatus="failed" |
---|
| 7 | updmsg="$*" |
---|
[23156] | 8 | } |
---|
| 9 | |
---|
[25043] | 10 | warn() { |
---|
[25768] | 11 | updstatus="warning" |
---|
| 12 | updmsg="$*" |
---|
| 13 | echo "WARNING: $*" |
---|
[25043] | 14 | } |
---|
| 15 | |
---|
[24376] | 16 | save_success() { |
---|
[25273] | 17 | # We used to check for 'warning' here for non-fatal warnings. |
---|
| 18 | # There is no longer any such thing. |
---|
| 19 | updstatus="ok" |
---|
| 20 | updmsg="$*" |
---|
[24376] | 21 | } |
---|
| 22 | |
---|
| 23 | save_state() { |
---|
| 24 | rm -f $statfile |
---|
[24522] | 25 | echo "$updlast|$(date +"%s")|$updstatus|$updmsg" > $statfile |
---|
[24376] | 26 | } |
---|
| 27 | |
---|
[23156] | 28 | maybe_reboot() { |
---|
[25080] | 29 | if [ "$SKIP_REBOOT" = "y" ]; then |
---|
[24394] | 30 | return |
---|
| 31 | fi |
---|
[23156] | 32 | if [ -f /var/run/reboot-required ]; then |
---|
| 33 | # A package wants us to reboot the machine. Do so if no one is |
---|
| 34 | # logged in. Be paranoid about stale utmp entries. |
---|
| 35 | ttys=$(w -h -s | awk '{print $2}') |
---|
| 36 | for tty in $ttys; do |
---|
| 37 | pids=$(ps --no-heading -j -t "$tty" 2>/dev/null \ |
---|
| 38 | | awk '($1 == $3) {print $1}') |
---|
| 39 | if [ -n "$pids" ]; then |
---|
| 40 | return |
---|
| 41 | fi |
---|
| 42 | done |
---|
| 43 | # screen processes count as logins. |
---|
| 44 | if pgrep '^screen' > /dev/null; then |
---|
| 45 | return |
---|
| 46 | fi |
---|
[24376] | 47 | save_state |
---|
[23156] | 48 | reboot |
---|
| 49 | exit |
---|
| 50 | fi |
---|
| 51 | } |
---|
| 52 | |
---|
[25043] | 53 | SKIP_REBOOT="n" |
---|
| 54 | DEBUG="n" |
---|
| 55 | VERBOSE="n" |
---|
| 56 | while getopts "nvd" opt; do |
---|
| 57 | case "$opt" in |
---|
| 58 | d) DEBUG="y";; |
---|
| 59 | v) VERBOSE="y";; |
---|
| 60 | n) SKIP_REBOOT="y";; |
---|
| 61 | \?) |
---|
| 62 | echo "Usage: $0 [ -d ] [ -n ] [ -v ]" |
---|
| 63 | ;; |
---|
| 64 | esac |
---|
| 65 | done |
---|
[24394] | 66 | |
---|
[25043] | 67 | [ "$DEBUG" = "y" ] && VERBOSE="y" |
---|
| 68 | |
---|
[23143] | 69 | if [ 0 != "$(id -u)" ]; then |
---|
| 70 | echo "This script must be run as root." >&2 |
---|
| 71 | exit 1 |
---|
| 72 | fi |
---|
| 73 | |
---|
[24147] | 74 | # Don't run updates during a cluster login. |
---|
[25043] | 75 | # Unless forced |
---|
| 76 | if [ -e /var/run/athena-login ] && [ "$DEBUG" != "y" ]; then |
---|
[24147] | 77 | exit 0 |
---|
| 78 | fi |
---|
| 79 | |
---|
[23143] | 80 | # Avoid confusing the system by running two updates at once. |
---|
| 81 | pidfile=/var/run/athena-update.pid |
---|
| 82 | if [ -e $pidfile ]; then |
---|
[23148] | 83 | if ! kill -0 "$(cat $pidfile)" 2>/dev/null; then |
---|
[23143] | 84 | rm -f $pidfile |
---|
| 85 | fi |
---|
| 86 | fi |
---|
| 87 | (set -o noclobber; echo $$ > $pidfile) 2>/dev/null || exit |
---|
| 88 | |
---|
[23156] | 89 | trap 'rm -f $pidfile' EXIT |
---|
[23143] | 90 | |
---|
[24376] | 91 | statfile="/var/lib/athena-update-status" |
---|
| 92 | updstatus="unknown" |
---|
| 93 | updmsg="" |
---|
[24522] | 94 | updlast=$(date +"%s") |
---|
[24376] | 95 | |
---|
| 96 | # Get the last successful update |
---|
| 97 | if [ -f $statfile ]; then |
---|
| 98 | updlast=$(awk -F\| '{print $1;}' $statfile) |
---|
[25043] | 99 | updstatus=$(awk -F\| '{print $3;}' $statfile) |
---|
[24376] | 100 | fi |
---|
| 101 | |
---|
[23156] | 102 | # Make sure nothing expects input on stdin. |
---|
| 103 | exec </dev/null |
---|
| 104 | |
---|
[25043] | 105 | # Save a reference to STDOUT |
---|
| 106 | exec 3>&1 |
---|
| 107 | |
---|
[23717] | 108 | # Redirect further output to a log file. |
---|
| 109 | exec >>/var/log/athena-update 2>&1 |
---|
[23156] | 110 | |
---|
[23717] | 111 | # Write a log header now and a footer at exit. |
---|
[24147] | 112 | # Also write a target for cluster's /etc/nologin symlink. |
---|
[23717] | 113 | echo "-----" |
---|
| 114 | echo "** Beginning Athena auto-update at $(date)" |
---|
| 115 | |
---|
[24147] | 116 | cat > /var/run/athena-nologin << NOLOGIN |
---|
| 117 | This system is currently taking software updates. |
---|
| 118 | Please log in to a different system. |
---|
| 119 | NOLOGIN |
---|
| 120 | |
---|
[23717] | 121 | finish() { |
---|
| 122 | echo "** Ending Athena auto-update at $(date)" |
---|
| 123 | echo "-----" |
---|
| 124 | echo |
---|
| 125 | rm -f $pidfile |
---|
[24147] | 126 | rm -f /var/run/athena-nologin |
---|
[24376] | 127 | save_state |
---|
[23717] | 128 | exit |
---|
| 129 | } |
---|
| 130 | trap finish EXIT |
---|
| 131 | |
---|
| 132 | v() { |
---|
[25043] | 133 | [ "$VERBOSE" = "y" ] && echo "Running" "$@" >&3 |
---|
[23717] | 134 | echo "** Running:" "$@" |
---|
| 135 | "$@" |
---|
| 136 | } |
---|
| 137 | |
---|
| 138 | |
---|
[23786] | 139 | # Allow hesiod cluster info to specify the debathena apt release. |
---|
[23159] | 140 | # (Will do nothing if debathena-clusterinfo isn't installed.) |
---|
[23717] | 141 | [ -x /usr/sbin/save-cluster-info ] && v /usr/sbin/save-cluster-info |
---|
[23159] | 142 | cinfo=/var/run/athena-clusterinfo.sh |
---|
[23786] | 143 | slist=/etc/apt/sources.list.d/debathena.clusterinfo.list |
---|
| 144 | if [ -r "$cinfo" ] && ( [ ! -e "$slist" ] || [ -w "$slist" ] ); then |
---|
| 145 | echo "** Updating debathena.clusterinfo.list" |
---|
| 146 | [ -e "$slist" ] && rm "$slist" |
---|
| 147 | dsource="$(egrep -h '^deb(-src)? http://debathena\.mit\.edu/apt ' /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null | sort -u)" |
---|
| 148 | if [ -n "$dsource" ]; then |
---|
| 149 | (. $cinfo |
---|
| 150 | echo "# This file is automatically updated by debathena-auto-update" |
---|
| 151 | echo "# based on your Hesiod cluster information. If you want to" |
---|
| 152 | echo "# make changes, do so in another file." |
---|
| 153 | echo |
---|
| 154 | case $APT_RELEASE in |
---|
| 155 | production) ;; |
---|
[23814] | 156 | proposed) echo "$dsource" | awk '$3 !~ /-/ {$3 = $3 "-proposed"; print}' ;; |
---|
[25707] | 157 | development) echo "$dsource" | awk '$3 !~ /-/ {$3 = $3 "-proposed"; print}' |
---|
| 158 | echo "$dsource" | awk '$3 !~ /-/ {$3 = $3 "-development"; print}' ;; |
---|
[23786] | 159 | esac |
---|
| 160 | ) > $slist |
---|
| 161 | else |
---|
| 162 | echo "Never mind, I can't figure out which sources.list line is Debathena's" |
---|
| 163 | fi |
---|
| 164 | else |
---|
| 165 | echo "** Skipping update of debathena.clusterinfo.list" |
---|
[23159] | 166 | fi |
---|
| 167 | |
---|
[23174] | 168 | # Tell apt not to expect user input during package installation. |
---|
| 169 | export DEBIAN_FRONTEND=noninteractive |
---|
| 170 | |
---|
[25043] | 171 | # Set conservative defaults in case file is missing |
---|
| 172 | UPDATE_FORCE_CONFFILE=old |
---|
| 173 | RUN_UPDATE_HOOK=no |
---|
[25805] | 174 | CLEANUP_OLD_KERNELS=no |
---|
[25043] | 175 | # Process defaults file |
---|
| 176 | [ -f /etc/default/debathena-auto-update ] && . /etc/default/debathena-auto-update |
---|
| 177 | # On cluster machines, force our desired settings |
---|
| 178 | # Ignore /etc/default/debathena-auto-update |
---|
| 179 | if dpkg-query --showformat '${Status}\n' -W "debathena-cluster" 2>/dev/null | grep -q ' installed$'; then |
---|
[25805] | 180 | CLEANUP_OLD_KERNELS=yes |
---|
[25043] | 181 | UPDATE_FORCE_CONFFILE=new |
---|
| 182 | RUN_UPDATE_HOOK=yes |
---|
| 183 | fi |
---|
| 184 | |
---|
[25052] | 185 | UPDATE_HOOK_URL="https://athena10.mit.edu/update-hook/debathena-update-hook.sh" |
---|
| 186 | UPDATE_HOOK_SUM="https://athena10.mit.edu/update-hook/debathena-update-hook-sha256sum" |
---|
| 187 | MITCA="/usr/share/debathena-auto-update/mitCA.crt" |
---|
| 188 | UPDATE_HOOK="/var/run/debathena-update-hook.sh" |
---|
[25043] | 189 | |
---|
| 190 | rm -f $UPDATE_HOOK |
---|
[25052] | 191 | if [ "$RUN_UPDATE_HOOK" = "yes" ] && \ |
---|
[25043] | 192 | curl -sf -o $UPDATE_HOOK --cacert $MITCA $UPDATE_HOOK_URL; then |
---|
| 193 | chmod 500 $UPDATE_HOOK |
---|
[25052] | 194 | SHA256SUM="$(curl -sf --cacert $MITCA $UPDATE_HOOK_SUM)" |
---|
[25043] | 195 | rv=$? |
---|
[25070] | 196 | if [ $rv != 0 ]; then |
---|
[25043] | 197 | complain "Failed to retrieve $UPDATE_HOOK_SUM (curl returned $rv)" |
---|
| 198 | exit |
---|
| 199 | fi |
---|
[25070] | 200 | LOCALSUM="$(sha256sum $UPDATE_HOOK | awk '{print $1}')" |
---|
| 201 | if [ "$SHA256SUM" != "$LOCALSUM" ]; then |
---|
| 202 | complain "bad update hook checksum ($SHA256SUM != $LOCALSUM)" |
---|
| 203 | exit |
---|
| 204 | fi |
---|
| 205 | if ! [ -f "/var/lib/athena-update-hooks/$SHA256SUM" ]; then |
---|
[25090] | 206 | if ! v $UPDATE_HOOK; then |
---|
[25070] | 207 | complain "update hook returned non-zero status" |
---|
| 208 | exit |
---|
| 209 | else |
---|
| 210 | touch "/var/lib/athena-update-hooks/$SHA256SUM" |
---|
| 211 | fi |
---|
| 212 | fi |
---|
[25043] | 213 | fi |
---|
| 214 | |
---|
[25664] | 215 | echo "Running apt-get install" |
---|
| 216 | if ! v apt-get --fix-broken --assume-yes install; then |
---|
| 217 | # Don't fail, because maybe dpkg --configure -a will save us |
---|
| 218 | echo "ERROR: apt-get install failed, but continuing anyway" |
---|
[25043] | 219 | fi |
---|
| 220 | |
---|
| 221 | |
---|
[24337] | 222 | # Configure any unconfigured packages (Trac #407) |
---|
| 223 | if ! v dpkg --configure -a; then |
---|
| 224 | complain "Failed to configure unconfigured packages." |
---|
| 225 | exit |
---|
| 226 | fi |
---|
| 227 | |
---|
| 228 | # A recently configured package may want a reboot |
---|
[24376] | 229 | save_success "Rebooted after dpkg --configure -a" |
---|
[24337] | 230 | maybe_reboot |
---|
| 231 | |
---|
[25043] | 232 | # Ensure that the mirrors aren't broken |
---|
[25768] | 233 | # Google's apt repos are ridiculously picky |
---|
| 234 | urls=$(cat /etc/apt/sources.list /etc/apt/sources.list.d/*.list | awk '!/^deb/ {next;} $2 ~ /^https/ {printf $2; if ($2 !~ /\/$/) printf "/"; printf "dists/"$3"/Release\n"}' | sort -u) |
---|
[25043] | 235 | failed="" |
---|
| 236 | for u in $urls; do |
---|
| 237 | curl -m 60 -sfL -o /dev/null $u |
---|
| 238 | if [ $? != 0 ]; then |
---|
| 239 | if [ -z "$failed" ]; then |
---|
| 240 | failed=$u |
---|
| 241 | else |
---|
| 242 | failed="$failed $u" |
---|
| 243 | fi |
---|
| 244 | fi |
---|
| 245 | done |
---|
| 246 | if [ -n "$failed" ]; then |
---|
| 247 | warn "Failed to contact mirror(s): $failed" |
---|
| 248 | exit |
---|
| 249 | fi |
---|
| 250 | |
---|
[25664] | 251 | # Update the apt cache. |
---|
| 252 | if ! v apt-get --assume-yes update; then |
---|
| 253 | complain "apt-get update failed" |
---|
[23156] | 254 | exit |
---|
| 255 | fi |
---|
| 256 | |
---|
[25070] | 257 | # If new licenses were installed since the last update, deal. |
---|
[24980] | 258 | licenses=/usr/share/debathena-license-config/debathena-license-selections |
---|
[25049] | 259 | if [ -f /var/lib/debathena-license-config/reconfigure_required ]; then |
---|
[25080] | 260 | rm -f /var/lib/debathena-license-config/reconfigure_required |
---|
[25049] | 261 | if [ -f $licenses ]; then |
---|
| 262 | for p in $(awk '{print $1}' $licenses); do |
---|
| 263 | if dpkg-query --showformat '${Status}\n' -W $p 2>/dev/null | grep -q ' installed$'; then |
---|
| 264 | if ! v dpkg-reconfigure -fnoninteractive $p; then |
---|
[25070] | 265 | # Don't fail here |
---|
[25049] | 266 | complain "Failed to dpkg-reconfigure $p" |
---|
| 267 | fi |
---|
| 268 | fi |
---|
| 269 | done |
---|
| 270 | else |
---|
| 271 | complain "Could not find $licenses" |
---|
| 272 | exit |
---|
| 273 | fi |
---|
| 274 | fi |
---|
[24980] | 275 | |
---|
[25049] | 276 | |
---|
[23156] | 277 | # Exit quietly (except for perhaps rebooting) if there are no upgrades |
---|
| 278 | # to take. |
---|
[25664] | 279 | pattern='^0 upgraded, 0 newly installed, 0 to remove' |
---|
| 280 | if v apt-get --simulate --assume-yes dist-upgrade | grep -q "$pattern"; then |
---|
[23717] | 281 | echo "Nothing to do!" |
---|
[24376] | 282 | save_success "No updates" |
---|
[23156] | 283 | maybe_reboot |
---|
| 284 | exit |
---|
| 285 | fi |
---|
| 286 | |
---|
| 287 | # Download packages first. |
---|
[25664] | 288 | echo "Downloading packages..." |
---|
| 289 | if ! v apt-get --quiet --assume-yes --download-only dist-upgrade; then |
---|
[23156] | 290 | complain "download failed" |
---|
| 291 | exit |
---|
[23143] | 292 | fi |
---|
| 293 | |
---|
[25664] | 294 | APTGET_OPTS= |
---|
[24941] | 295 | case $UPDATE_FORCE_CONFFILE in |
---|
| 296 | old) |
---|
[25664] | 297 | APTGET_OPTS="-o Dpkg::Options::=--force-confold" |
---|
[24966] | 298 | export UCF_FORCE_CONFFOLD=1 |
---|
[24941] | 299 | ;; |
---|
| 300 | new) |
---|
[25664] | 301 | APTGET_OPTS="-o Dpkg::Options::=--force-confnew" |
---|
[24966] | 302 | export UCF_FORCE_CONFFNEW=1 |
---|
[24941] | 303 | ;; |
---|
| 304 | *) |
---|
| 305 | complain "Invalid value for UPDATE_FORCE_CONFFILE" |
---|
| 306 | exit |
---|
| 307 | ;; |
---|
| 308 | esac |
---|
| 309 | |
---|
[24457] | 310 | |
---|
[25664] | 311 | # Perform the update. In some corner cases, apt-get might decide |
---|
[23143] | 312 | # that the best course of action is to remove the Debathena |
---|
| 313 | # metapackage, so be paranoid about that. |
---|
[25664] | 314 | result="$(apt-get --quiet --assume-yes --simulate dist-upgrade)" |
---|
| 315 | if [ $? -ne 0 ]; then |
---|
| 316 | complain "apt-get simulation failed!" |
---|
| 317 | elif echo "$result" | egrep -q '^Remv debathena-(cluster|workstation|login-graphical|login|standard|auto-update) '; then |
---|
| 318 | complain "metapackages would be removed by update:" $result |
---|
[23156] | 319 | else |
---|
[25664] | 320 | if v apt-get $APTGET_OPTS --quiet --assume-yes dist-upgrade; then |
---|
[25362] | 321 | # Successful update, reset $updlast |
---|
| 322 | updlast=$(date +"%s") |
---|
| 323 | save_success "Successful update" |
---|
[25664] | 324 | else |
---|
| 325 | complain "Simulation was successful, but update failed (shouldn't happen)" |
---|
[25362] | 326 | fi |
---|
[23143] | 327 | fi |
---|
| 328 | |
---|
[25805] | 329 | # Cleanup old kernels |
---|
[25828] | 330 | # This can probably go away once /boot is no longer on its own |
---|
| 331 | # partition. |
---|
[25805] | 332 | if [ "$CLEANUP_OLD_KERNELS" = "yes" ]; then |
---|
| 333 | echo "Cleaning up old kernels..." |
---|
| 334 | kernels=$(dpkg-query -W -f '${Package}:${Status}\n' linux-image-\*-generic | \ |
---|
| 335 | awk -F ':' '$2=="install ok installed" {print $1;}' | \ |
---|
| 336 | sed -e 's/^linux-image-//' | sort -V) |
---|
| 337 | numkernels=$(echo "$kernels" | wc -l) |
---|
| 338 | echo "Found $numkernels kernels: $kernels" |
---|
| 339 | if [ $numkernels -gt 2 ]; then |
---|
| 340 | toremove=$(echo "$kernels" | head -$(($numkernels-2))) |
---|
| 341 | kpkgs= |
---|
| 342 | for k in $toremove; do |
---|
| 343 | if [ "$(uname -r)" != "$k" ]; then |
---|
| 344 | kpkgs="$kpkgs linux-image-$k" |
---|
| 345 | fi |
---|
| 346 | done |
---|
| 347 | echo "Will remove these kernels: $kpkgs" |
---|
| 348 | echo "Simulating..." |
---|
| 349 | if v apt-get -y -s remove $kpkgs; then |
---|
| 350 | echo "Simulation ok, proceeding..." |
---|
| 351 | if ! v apt-get -y remove $kpkgs; then |
---|
| 352 | warn "Something went wrong trying to remove kernels!" |
---|
| 353 | fi |
---|
| 354 | else |
---|
| 355 | warn "Simulation failed!" |
---|
| 356 | fi |
---|
| 357 | fi |
---|
| 358 | fi |
---|
| 359 | |
---|
[25859] | 360 | # Auto-remove packages |
---|
| 361 | echo "Attempting to auto-remove old packages" |
---|
| 362 | echo "Simulating..." |
---|
| 363 | AUTOREMOVE="$(apt-get --assume-yes --simulate autoremove)" |
---|
| 364 | if [ $? -ne 0 ]; then |
---|
| 365 | warn "Auto-remove simulation failed!" |
---|
| 366 | elif echo "$AUTOREMOVE" | egrep -q '^Remv debathena-(cluster|workstation|login-graphical|login|standard|auto-update) '; then |
---|
| 367 | warn "Metapackages would be removed by auto-remove!" |
---|
| 368 | else |
---|
| 369 | if ! v apt-get -y autoremove; then |
---|
| 370 | complain "Auto-remove failed even though simulation succeeded (shouldn't happen)" |
---|
| 371 | fi |
---|
| 372 | fi |
---|
| 373 | |
---|
[23549] | 374 | # Finally, update the apt-file cache |
---|
| 375 | v apt-file update |
---|
| 376 | |
---|
[23156] | 377 | maybe_reboot |
---|
[23143] | 378 | exit |
---|