From: Daniel F. Dickinson Date: Sun, 5 Jul 2026 11:50:00 +0000 (-0400) Subject: nut: enable shared NSS certificate/key database for upsd and upsmon X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=b384d15813a05efaee33fec3455f6bd7f77d83e2;p=openwrt-packages.git nut: enable shared NSS certificate/key database for upsd and upsmon Create a group to allow sharing directories files between upsd and upsmon, and create a shared NSS certificate/key database on postinst of nut-common (providing the database dir does not already exist). Also enables preserving the shared database across sysupgrades. Signed-off-by: Daniel F. Dickinson --- diff --git a/net/nut/Makefile b/net/nut/Makefile index d4bb8195d..0883ad61f 100644 --- a/net/nut/Makefile +++ b/net/nut/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=nut PKG_VERSION:=2.8.5 -PKG_RELEASE:=4 +PKG_RELEASE:=5 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://www.networkupstools.org/source/2.8/ @@ -98,6 +98,8 @@ define Package/nut-server/install $(PKG_BUILD_DIR)/libhid-ups.parsed-usermap $(SED) 's^### insert libhid-ups.parsed-usermap content here ###^\ncat "$(PKG_BUILD_DIR)/libhid-ups.parsed-usermap"^e' $(PKG_BUILD_DIR)/30-libhid-ups $(INSTALL_BIN) $(PKG_BUILD_DIR)/30-libhid-ups $(1)/etc/hotplug.d/usb/30-libhid-ups + $(INSTALL_DIR) $(1)/etc/uci-defaults + $(INSTALL_DATA) ./files/nut-server.default $(1)/etc/uci-defaults/90_nut-server endef define Package/nut-common @@ -108,7 +110,8 @@ define Package/nut-common +NUT_DRIVER_USB:libusb-compat \ +NUT_DRIVER_NEON:libneon \ +NUT_SSL:libopenssl \ - +NUT_SSL_NSS:libnss + +NUT_SSL_NSS:libnss \ + +NUT_SSL_NSS:nss-utils endef define Package/nut-common/description @@ -118,6 +121,7 @@ endef define Package/nut-common/conffiles /etc/nut/nut.conf +/etc/nut/cert_db/ endef define Package/nut-common/install @@ -133,12 +137,15 @@ define Package/nut-common/install $(if $(CONFIG_NUT_SSL_NSS),printf "%s" "nss" >$(PKG_BUILD_DIR)/ssl_backend) $(if $(CONFIG_NUT_SSL)$(CONFIG_NUT_SSL_NSS),,printf "%s" "none" >$(PKG_BUILD_DIR)/ssl_backend) $(INSTALL_DATA) $(PKG_BUILD_DIR)/ssl_backend $(1)/usr/share/nut/ssl_backend + $(INSTALL_DIR) $(1)/etc/uci-defaults + $(INSTALL_DATA) ./files/nut-common.default $(1)/etc/uci-defaults/89_nut-common endef define Package/nut-server $(call Package/nut/Default) TITLE+= (server) - DEPENDS:=nut +nut-common + DEPENDS:=nut \ + +nut-common USERID:=nut=113:nut=113 endef @@ -158,10 +165,17 @@ define Package/nut-server/conffiles /etc/nut/ups.conf endef +define Package/nut-server/postinst +#!/bin/sh +[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_nut-server) && rm -f /etc/uci-defaults/90_nut-server +exit 0 +endef + define Package/nut-upsmon $(call Package/nut/Default) TITLE+= (monitor) - DEPENDS:=nut +nut-common + DEPENDS:=nut \ + +nut-common USERID:=nutmon=114:nutmon=114 endef @@ -180,6 +194,12 @@ define Package/nut-upsmon/conffiles /etc/nut/upsmon.conf endef +define Package/nut-upsmon/postinst +#!/bin/sh +[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_nut-upsmon) && rm -f /etc/uci-defaults/90_nut-upsmon +exit 0 +endef + define Package/nut-upsmon/install $(INSTALL_DIR) $(1)/etc/nut $(INSTALL_DIR) $(1)/usr/sbin @@ -194,6 +214,7 @@ define Package/nut-upsmon/install $(INSTALL_DIR) $(1)/etc/config $(INSTALL_CONF) ./files/nut_monitor $(1)/etc/config/nut_monitor ln -sf /var/etc/nut/upsmon.conf $(1)/etc/nut/upsmon.conf + $(INSTALL_DATA) ./files/nut-upsmon.default $(1)/etc/uci-defaults/90_nut-upsmon endef define Package/nut-upsmon/conffiles diff --git a/net/nut/files/nut-common.default b/net/nut/files/nut-common.default new file mode 100644 index 000000000..efb6c6555 --- /dev/null +++ b/net/nut/files/nut-common.default @@ -0,0 +1,67 @@ +#!/bin/sh +# In recent (relevant) versions of shellcheck busybox is a valid shell type +# shellcheck shell=busybox + +# uci-defaults script to setup nut-common package +# * create (if not present) shared group for directories shared with nut-upsmon +# * install/create NSS certificate/key database + +# IPKG_INSTROOT is intentionally only set when building an image and +# is intentionally empty on a live OpenWrt device + +# Shellcheck source paths intentionally point to the location of files of +# the scripts in the development environment (where shellcheck is used), not +# on the live OpenWrt device. + +# This script lives in nut-common package, which is independent of the +# nut-upsmon package in which nut-upsmon.default lives + +# The separate packages limit the opportunities for code-sharing across the +# scripts. + +# Only run this uci-defaults script on a live OpenWrt device +[ -z "${IPKG_INSTROOT}" ] || exit 0 + +# shellcheck source=net/nut/files/functions.sh.functions +. /lib/functions.sh || { + # As the uci-defaults environment in which this runs does not have logging + # available, nor is stderr captured or displayed on the console, these messages + # exist only to assist when debugging manual runs of the script. + printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to source 'functions.sh'" || true + exit 1 +} + +if ! group_exists "nutgrp"; then + group_add_next "nutgrp" +fi + +if [ -n "$(command -v certutil)" ]; then + if [ ! -d /etc/nut/cert_db ]; then + old_umask="$(umask)" + umask 027 + { + mkdir -p /etc/nut/cert_db + chgrp nutgrp /etc/nut/cert_db + } || { + printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to create '/etc/nut/cert_db' with the needed group and permissions" || true + umask "$old_umask" + exit 1 + } + umask "$old_umask" + + # We only create the database if the directory did not exist before running this script, as we + # do not wish to overwrite an existing database + certutil -N -d /etc/nut/cert_db --empty-password || { + printf "'%s': '%s'" "nut-common.default" "FATAL: Unable to create empty certificate database" + umask "$old_umask" + exit 1 + } + chgrp nutgrp /etc/nut/cert_db/* + # certutil does not honour umask so we must set permissions with chmod + chmod 0640 /etc/nut/cert_db/* + else + # If /etc/nut/cert_db already exists, we assume it is a pre-existing install + # and do not override potential system administrator initiated changes. + : + fi +fi diff --git a/net/nut/files/nut-server.default b/net/nut/files/nut-server.default new file mode 100644 index 000000000..8d6be2fca --- /dev/null +++ b/net/nut/files/nut-server.default @@ -0,0 +1,38 @@ +#!/bin/sh +# In recent (relevant) versions of shellcheck busybox is a valid shell type +# shellcheck shell=busybox + +# uci-defaults script to setup nut-server package +# * create (if not present) shared group for directories shared with nut-upsmon +# * install/create NSS certificate/key database + +# IPKG_INSTROOT is intentionally only set when building an image and +# is intentionally empty on a live OpenWrt device + +# Shellcheck source paths intentionally point to the location of files of +# the scripts in the development environment (where shellcheck is used), not +# on the live OpenWrt device. + +# This script lives in nut-server package, which is independent of the +# nut-upsmon package in which nut-upsmon.default lives + +# The separate packages limit the opportunities for code-sharing across the +# scripts. + +# Only run this uci-defaults script on a live OpenWrt device +[ -z "${IPKG_INSTROOT}" ] || exit 0 + +# shellcheck source=net/nut/files/functions.sh.functions +. /lib/functions.sh || { + # As the uci-defaults environment in which this runs does not have logging + # available, nor is stderr captured or displayed on the console, these messages + # exist only to assist when debugging manual runs of the script. + printf "'%s': '%s'" "nut-server.default" "FATAL: Unable to source 'functions.sh'" || true + exit 1 +} + +if ! group_exists "nutgrp"; then + group_add_next "nutgrp" +fi + +group_add_user "nutgrp" "nut" diff --git a/net/nut/files/nut-upsmon.default b/net/nut/files/nut-upsmon.default new file mode 100644 index 000000000..3eda29918 --- /dev/null +++ b/net/nut/files/nut-upsmon.default @@ -0,0 +1,38 @@ +#!/bin/sh +# In recent (relevant) versions of shellcheck busybox is a valid shell type +# shellcheck shell=busybox + +# uci-defaults script to setup nut-upsmon package +# * create (if not present) shared group for directories shared with nut-server +# * install/create NSS certificate/key database + +# IPKG_INSTROOT is intentionally only set when building an image and +# is intentionally empty on a live OpenWrt device + +# Shellcheck source paths intentionally point to the location of files of +# the scripts in the development environment (where shellcheck is used), not +# on the live OpenWrt device. + +# This script lives in nut-upsmon package, which is independent of the +# nut-server package in which nut-server.default lives + +# The separate packages limit the opportunities for code-sharing across the +# scripts. + +# Only run this uci-defaults script on a live OpenWrt device +[ -z "${IPKG_INSTROOT}" ] || exit 0 + +# shellcheck source=net/nut/files/functions.sh.functions +. /lib/functions.sh || { + # As the uci-defaults environment in which this runs does not have logging + # available, nor is stderr captured or displayed on the console, these messages + # exist only to assist when debugging manual runs of the script. + printf "'%s': '%s'" "nut-upsmon.default" "FATAL: Unable to source 'functions.sh'" || true + exit 1 +} + +if ! group_exists "nutgrp"; then + group_add_next "nutgrp" +fi + +group_add_user "nutgrp" "nutmon"