From: Toke Høiland-Jørgensen <redacted>
Date: Mon, 31 Aug 2026 08:55:12 +0000 (+0200)
Subject: net/acme-acmesh: prevent concurrent execution of acme.sh instances
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=5f54a2b916cfc13b80ff094c98f43aa40f3769af;p=openwrt-packages.git

net/acme-acmesh: prevent concurrent execution of acme.sh instances

After switching ACME to being run through procd, individual ACME
instances are now executed in parallel instead of sequentially. This
causes acme.sh to become confused in certain cases. Petr reported that
certificate files ended up with the wrong contents after updating to
OpenWrt 25.12.

Fix this by wrapping the acme.sh execution in a global `flock` keyed on
a file in the state directory. The procd instances will still run in
parallel, but they'll all serialise on the same lock, so only one
acme.sh instance will run at a time.

Fixes: 76b676e4ebbb ("acme.sh: move to procd to ensure logging gets to syslog")
Reported-by: Petr Novák <redacted>
Signed-off-by: Toke Høiland-Jørgensen <redacted>
---

diff --git a/net/acme-acmesh/Makefile b/net/acme-acmesh/Makefile
index dd6fa34f9..2e7fea9b9 100644
--- a/net/acme-acmesh/Makefile
+++ b/net/acme-acmesh/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=acme-acmesh
 PKG_VERSION:=3.1.3
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/acmesh-official/acme.sh/tar.gz/$(PKG_VERSION)?
diff --git a/net/acme-acmesh/files/hook.sh b/net/acme-acmesh/files/hook.sh
index 7466594aa..20845651c 100644
--- a/net/acme-acmesh/files/hook.sh
+++ b/net/acme-acmesh/files/hook.sh
@@ -105,6 +105,7 @@ get)
 	esac
 
 	log info "Running ACME for $main_domain with validation_method $validation_method"
+        lock_file="$state_dir/acme-sh.lock"
 
 	staging_moved=0
 	if [ -e "$domain_dir" ]; then
@@ -117,7 +118,7 @@ get)
 			log info "$ACME $*"
 			trap "handle_signal renew Renewal" INT TERM
 			add_nft_rule "$main_domain" "$listen_port"
-			$ACME "$@" &
+			flock "$lock_file" $ACME "$@" &
 			wait $!
 			status=$?
 			trap - INT TERM
@@ -199,7 +200,7 @@ get)
 
 	log info "$ACME $*"
 	trap "handle_signal issue Issuance" INT TERM
-	"$ACME" "$@" \
+	flock "$lock_file" "$ACME" "$@" \
 		--pre-hook "$NOTIFY prepare" \
 		--renew-hook "$NOTIFY renewed" &
 	wait $!