jvtrudel/harmony
1
0
Fork 0
forked from NationTech/harmony
Code Pull Requests Activity

manage opnsense source images using harmony-ve-opnsense-img-src

Browse Source
This commit is contained in:
Jérémy Viau-Trudel
2025-11-07 01:14:30 -05:00
parent e80ad70a4f
commit 06c9d78049
2 changed files with 259 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
examples/opnsense/scripts/common
View File

@@ -7,3 +7,11 @@ _fatal(){
>&2 echo stopping...
exit 1
}
pushd () {
command pushd "$@" > /dev/null
}
popd () {
command popd "$@" > /dev/null
}

257
examples/opnsense/scripts/harmony-ve-opnsense-img-src
View File

@@ -11,12 +11,13 @@ harmony-ve-opnsense-img-src()(
SCRIPTS_DIR=$(readlink -f "$(dirname "${BASH_SOURCE}")")
. "${SCRIPTS_DIR}/common"
OPNSENSE_SRC_BASE_URL=https://pkg.opnsense.org/releases/
DEFAULT_KVM_IMG_DIR=/var/lib/libvirt/images
OPNSENSE_SRC_BASE_URL=https://pkg.opnsense.org/releases
ALT1_SRC_BASE_URL=https://mirror.vraphim.com/opnsense/releases
ALT2_SRC_BASE_URL=https://mirror.winsub.kr/opnsense/releases
DEFAULT_KVM_IMG_DIR=$HOME/.harmony-ve/img-src
KVM_IMG_DIR=${KVM_IMG_DIR:-$DEFAULT_KVM_IMG_DIR}
[ -d "$KVM_IMG_DIR" ] || mkdir -p "${KVM_IMG_DIR}"
_short_help(){
cat <<-EOM
@@ -34,8 +35,8 @@ harmony-ve-opnsense-img-src()(
harmony-vee-opnsense-img-src [GLOBAL_OPTIONS] COMMAND [OPTIONS]
harmony-vee-opnsense-img-src list [--remote]
harmony-vee-opnsense-img-src check [VERSION]
harmony-vee-opnsense-img-src download [VERSION]
harmony-vee-opnsense-img-src check [VERSION]
harmony-vee-opnsense-img-src delete [VERSION]
EOM
@@ -58,7 +59,7 @@ EOM
- for 'list', show local images available
- for 'list --remote', show available upstream images
- for 'check' and 'download', when no VERSION is specified, use the latest
- for 'download', when no VERSION is specified, use the latest
- for 'delete', when no VERSION is specified, delete all image
- use the 'nano' flavor
EOM
@@ -67,6 +68,223 @@ EOM
# Implement functions
_parse_version_from_image_file_string(){
#https://pkg.opnsense.org/releases/25.7/OPNsense-25.7-nano-amd64.img.bz2
echo "$1" | cut -d '/' -f 5
}
_list_local_images(){
ls "${KVM_IMG_DIR}" | grep "OPNsense-" | grep "\-nano\-amd64\.img" | cut -d'-' -f 2 | sort -u -r
}
_list_remote_images(){
curl -L -s "${OPNSENSE_SRC_BASE_URL}" | sed 's/</\n</g' | grep href | grep 2 | cut -d'>' -f 2 | cut -d '/' -f 1 | sort -r
}
_latest_version(){
_list_remote_images | head -n 1
}
_is_downloaded(){
version=$1
name="${KVM_IMG_DIR}/OPNsense-${version}-nano-amd64.img"
[ -f "$name" ] && return 0 || return 1
}
_is_valid_version(){
version=${1}
matched_version=$(_list_remote_images | grep "$version")
[ "$matched_version" != "" ] && return 0 || return 1
}
_download_img(){
version=$1
_download_crypto_files $version
pushd "${KVM_IMG_DIR}"
name="OPNsense-${version}-nano-amd64.img"
compressed_name=$name.bz2
_is_downloaded $version && {
_warn "Image '$name' is already downloaded"
} || {
url=$OPNSENSE_SRC_BASE_URL/$version/$compressed_name
>&2 echo DOWNLOAD $url
wget -q -c "${url}"
_verify_image_checksum $version
>&2 echo DECOMPRESS $url
bzip2 -d $compressed_name
}
popd
}
_compare_files_checksum(){
file1=$1
file2=$2
sha256_1=$(openssl sha256 $file1 | cut -d" " -f2)
sha256_2=$(openssl sha256 $file2 | cut -d" " -f2)
[ "$sha256_1" = "$sha256_2" ] || return 1
}
_download_crypto_files(){
# see: https://docs.opnsense.org/manual/install.html#download-and-verification
version=$1
pushd "${KVM_IMG_DIR}"
# download multiple pubkeys from different server
pubkey="OPNsense-${version}.pub"
rm -f $pubkey $pubkey.sig $pubkey.alt1 $pubkey.alt2
url=$OPNSENSE_SRC_BASE_URL/$version/$pubkey
wget -q -c "${url}"
# failing:
wget -q -c "${url}.sig"
rm -f /tmp/file.sig
openssl base64 -d -in $pubkey.sig -out /tmp/file.sig
openssl dgst -sha256 -verify $pubkey -signature /tmp/file.sig $pubkey || _fatal "Can't verify the signature of the public key"
url_alt1=$ALT1_SRC_BASE_URL/$version/$pubkey
wget -q -c -O "$pubkey.alt1" "${url_alt1}"
url_alt2=$ALT2_SRC_BASE_URL/$version/$pubkey
wget -q -c -O "$pubkey.alt2" "${url_alt2}"
_compare_files_checksum $pubkey $pubkey.alt1 || { popd && _fatal "Fail to compare pubkeys" ; }
_compare_files_checksum $pubkey $pubkey.alt2 || { popd && _fatal "Fail to compare pubkeys" ; }
img_sig="OPNsense-${version}-nano-amd64.img.sig"
sha256_name="OPNsense-${version}-checksums-amd64.sha256"
sha256_sig=$sha256_name.sig
[ ! -f "$img_sig" ] || rm $img_sig
[ ! -f "$sha256_name" ] || rm $sha256_name
[ ! -f "$sha256_sig" ] || rm $sha256_sig
for file in $img_sig $sha256_name $sha256_sig;
do
url=$OPNSENSE_SRC_BASE_URL/$version/$file
wget -q -c "${url}"
done
rm -f /tmp/file.sig
openssl base64 -d -in $sha256_sig -out /tmp/file.sig
openssl dgst -sha256 -verify $pubkey -signature /tmp/file.sig $sha256_name || _fatal "Can't verify the signature of the checksum file"
popd
}
_download(){
version=${1:-}
[ "${version:-}" != "" ] || _fatal "Must pass a VERSION for downloading"
_is_valid_version $version || _fatal "'$version' is not a valid version number"
_download_img ${version}
}
_verify_image_checksum(){
failed=1
version=$1
name="OPNsense-${version}-nano-amd64.img.bz2"
sha256_file="OPNsense-${version}-checksums-amd64.sha256"
pushd "${KVM_IMG_DIR}"
sha256=$(cat $sha256_file | grep "$name" | cut -d'=' -f 2 | tr -s [:space:])
echo "$sha256 $name" | sha256sum -c || failed=0
popd
[ "$failed" = "1" ] || _fatal "Checksum failed for '$name'"
}
_verify_image_signature(){
version=$1
pushd "${KVM_IMG_DIR}"
# download multiple pubkeys from different server
pubkey="OPNsense-${version}.pub"
img_name="OPNsense-${version}-nano-amd64.img"
img_sig="${img_name}.sig"
rm -f /tmp/file.sig
openssl base64 -d -in $img_sig -out /tmp/file.sig
openssl dgst -sha256 -verify $pubkey -signature /tmp/file.sig $img_name || _fatal "Can't verify image signature"
}
_check(){
version=${1:-}
if [ "${version:-}" = "" ] ; then
for version in $(_list_local_images);
do
>&2 echo check $version
_download_crypto_files $version
_verify_image_signature $version
done
else
_download_crypto_files $version
_verify_image_signature $version
fi
}
_delete(){
version=${1:-}
if [ -z "${version:-1}" ]; then
_clear
pushd "${KVM_IMG_DIR}"
rm -f *.img
popd
else
pushd "${KVM_IMG_DIR}"
rm -f *$version*.img
popd
fi
}
_clear(){
pushd "${KVM_IMG_DIR}"
rm -f *.pub *.sig *.bz2 *.alt1 *.alt2 *.sha256
popd
}
case "${1:-}" in
@@ -77,7 +295,31 @@ case "${1:-}" in
_short_help
_extra_help
;;
# Commands entrypoints
ls|list)
if [ "${2:-}" == "" ]; then
_list_local_images
elif [ "${2:-}" == "--remote" ]; then
_list_remote_images
else
_warn "Unknown option '$2'"
fi
;;
download)
_download "${2:-"$(_latest_version)"}"
;;
delete)
_delete "${@:2}"
;;
check)
_check "${@:2}"
;;
show)
ls $KVM_IMG_DIR | cat
;;
clear)
_clear "${@:2}"
;;
*)
_warn "Unknown COMMAND '$1'"
exit 1
@@ -89,3 +331,6 @@ esac
[ "$0" != "${BASH_SOURCE}" ] || harmony-ve-opnsense-img-src "${@}"
# todo: refactor
# todo: enhance output management