fix: normalize public shell scripts

This commit is contained in:
NuklearRabbit
2026-09-03 02:51:33 +02:00
parent 7f1c0e5f71
commit 6949c7aae7
9 changed files with 263 additions and 261 deletions
+67 -67
View File
@@ -1,67 +1,67 @@
#!/usr/bin/env bash
set -euo pipefail
if [ "$#" -ne 1 ]; then
echo "Usage: $0 OUTPUT_DIRECTORY" >&2
exit 2
fi
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="$1"
if [ -e "$OUTPUT_DIR" ]; then
echo "Output path already exists: $OUTPUT_DIR" >&2
exit 1
fi
# Ignore checkout-only executable-bit and CRLF differences so the same guard works
# from Windows Git and WSL. Content changes still fail the export.
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
|| ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
echo "Commit or stash repository changes before creating a public export." >&2
exit 1
fi
mkdir -p "$OUTPUT_DIR"
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"
# Production deployment dispatch belongs to the private operations repository.
rm -f "$OUTPUT_DIR/.gitea/workflows/unraid-deploy.yml"
for forbidden in \
'.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
'secret.key' 'id_rsa' 'id_ed25519'; do
if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
echo "Forbidden file found in public export: $forbidden" >&2
exit 1
fi
done
if grep -RIlE --exclude='export-public-source.sh' \
'192\.168\.10\.150|NuklearRabbit' "$OUTPUT_DIR" >/dev/null; then
echo "Private deployment marker found in public export." >&2
exit 1
fi
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
echo "Unexpected file larger than 10 MiB found in public export." >&2
exit 1
fi
git -C "$OUTPUT_DIR" init -q
git -C "$OUTPUT_DIR" add .
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q -m "Publish LumaOps source"
(
cd "$OUTPUT_DIR"
git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
)
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q --amend --no-edit
git -C "$OUTPUT_DIR" tag public-release-baseline
echo "Public source export created at $OUTPUT_DIR"
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"
#!/usr/bin/env bash
set -euo pipefail
if [ "$#" -ne 1 ]; then
echo "Usage: $0 OUTPUT_DIRECTORY" >&2
exit 2
fi
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="$1"
if [ -e "$OUTPUT_DIR" ]; then
echo "Output path already exists: $OUTPUT_DIR" >&2
exit 1
fi
# Ignore checkout-only executable-bit and CRLF differences so the same guard works
# from Windows Git and WSL. Content changes still fail the export.
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
|| ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
echo "Commit or stash repository changes before creating a public export." >&2
exit 1
fi
mkdir -p "$OUTPUT_DIR"
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"
# Production deployment dispatch belongs to the private operations repository.
rm -f "$OUTPUT_DIR/.gitea/workflows/unraid-deploy.yml"
for forbidden in \
'.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
'secret.key' 'id_rsa' 'id_ed25519'; do
if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
echo "Forbidden file found in public export: $forbidden" >&2
exit 1
fi
done
if grep -RIlE --exclude='export-public-source.sh' \
'192\.168\.10\.150|NuklearRabbit' "$OUTPUT_DIR" >/dev/null; then
echo "Private deployment marker found in public export." >&2
exit 1
fi
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
echo "Unexpected file larger than 10 MiB found in public export." >&2
exit 1
fi
git -C "$OUTPUT_DIR" init -q
git -C "$OUTPUT_DIR" add .
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q -m "Publish LumaOps source"
(
cd "$OUTPUT_DIR"
git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
)
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q --amend --no-edit
git -C "$OUTPUT_DIR" tag public-release-baseline
echo "Public source export created at $OUTPUT_DIR"
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"
+3 -3
View File
@@ -1,3 +1,3 @@
#! /bin/bash
git show-ref | grep $(git log --pretty=%h -1) | sed 's|.*/\(.*\)|\1|' | sort -u | grep -v HEAD
#! /bin/bash
git show-ref | grep $(git log --pretty=%h -1) | sed 's|.*/\(.*\)|\1|' | sort -u | grep -v HEAD
+17 -17
View File
@@ -1,17 +1,17 @@
#! /bin/bash
# Download udev rules file
wget https://openrgb.org/releases/release_0.9/60-openrgb.rules
# If we don't have write permissions then we're running on an immutable distro
if sudo test -w /usr/lib/udev/rules.d;
then
# Move udev rules file to udev rules directory
sudo mv 60-openrgb.rules /usr/lib/udev/rules.d
else
sudo mv 60-openrgb.rules /etc/udev/rules.d
fi
# Reload the rules
sudo udevadm control --reload-rules
sudo udevadm trigger
#! /bin/bash
# Download udev rules file
wget https://openrgb.org/releases/release_0.9/60-openrgb.rules
# If we don't have write permissions then we're running on an immutable distro
if sudo test -w /usr/lib/udev/rules.d;
then
# Move udev rules file to udev rules directory
sudo mv 60-openrgb.rules /usr/lib/udev/rules.d
else
sudo mv 60-openrgb.rules /etc/udev/rules.d
fi
# Reload the rules
sudo udevadm control --reload-rules
sudo udevadm trigger
+67 -67
View File
@@ -1,67 +1,67 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"
BASELINE_TAG="${OPENRGB_BASELINE_TAG:-upstream-openrgb-1.0rc3}"
UPSTREAM_REMOTE="${OPENRGB_UPSTREAM_REMOTE:-upstream}"
PUBLIC_BASELINE_TAG="public-release-baseline"
if [ "${OPENRGB_FETCH_UPSTREAM:-0}" = "1" ]; then
echo "[INFO] Fetch upstream remote '$UPSTREAM_REMOTE'..."
git fetch "$UPSTREAM_REMOTE" --tags --prune
fi
if ! git rev-parse --verify --quiet "${BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
if git rev-parse --verify --quiet "${PUBLIC_BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
BASELINE_TAG="$PUBLIC_BASELINE_TAG"
echo "[INFO] Publieke releasebaseline wordt gebruikt."
else
echo "[ERROR] Geen upstream- of publieke baseline-tag gevonden."
exit 1
fi
fi
if [ "$BASELINE_TAG" != "$PUBLIC_BASELINE_TAG" ] && ! git remote | grep -Fxq "$UPSTREAM_REMOTE"; then
echo "[ERROR] Remote '${UPSTREAM_REMOTE}' ontbreekt. Voeg upstream eerst toe of zet OPENRGB_UPSTREAM_REMOTE."
exit 1
fi
mapfile -t CHANGED_FILES < <(git diff --name-only "${BASELINE_TAG}..HEAD")
if [ ${#CHANGED_FILES[@]} -eq 0 ]; then
echo "[INFO] Geen verschillen t.o.v. baseline '${BASELINE_TAG}'."
exit 0
fi
declare -a UNEXPECTED_FILES=()
for file in "${CHANGED_FILES[@]}"; do
allowed=0
case "$file" in
.dockerignore|.env.example|.gitleaks.toml|.gitignore|Dockerfile|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
allowed=1
;;
docs/*|lumaops/*|docker/*|scripts/*)
allowed=1
;;
esac
if [ "$allowed" -eq 0 ]; then
UNEXPECTED_FILES+=("$file")
fi
done
if [ ${#UNEXPECTED_FILES[@]} -gt 0 ]; then
echo "[ERROR] Verandering gevonden buiten de beoogde fork-patchset:"
for file in "${UNEXPECTED_FILES[@]}"; do
echo " - $file"
done
echo "[HINT] Voeg tijdelijke kernaanpassingen alleen toe met expliciete uitzonderingen in deze script/handleiding."
exit 1
fi
echo "[OK] Alleen geautoriseerde wijzigingen t.o.v. baseline '${BASELINE_TAG}'."
echo "[OK] Upstream-patchgrens blijft schoon."
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"
BASELINE_TAG="${OPENRGB_BASELINE_TAG:-upstream-openrgb-1.0rc3}"
UPSTREAM_REMOTE="${OPENRGB_UPSTREAM_REMOTE:-upstream}"
PUBLIC_BASELINE_TAG="public-release-baseline"
if [ "${OPENRGB_FETCH_UPSTREAM:-0}" = "1" ]; then
echo "[INFO] Fetch upstream remote '$UPSTREAM_REMOTE'..."
git fetch "$UPSTREAM_REMOTE" --tags --prune
fi
if ! git rev-parse --verify --quiet "${BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
if git rev-parse --verify --quiet "${PUBLIC_BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
BASELINE_TAG="$PUBLIC_BASELINE_TAG"
echo "[INFO] Publieke releasebaseline wordt gebruikt."
else
echo "[ERROR] Geen upstream- of publieke baseline-tag gevonden."
exit 1
fi
fi
if [ "$BASELINE_TAG" != "$PUBLIC_BASELINE_TAG" ] && ! git remote | grep -Fxq "$UPSTREAM_REMOTE"; then
echo "[ERROR] Remote '${UPSTREAM_REMOTE}' ontbreekt. Voeg upstream eerst toe of zet OPENRGB_UPSTREAM_REMOTE."
exit 1
fi
mapfile -t CHANGED_FILES < <(git diff --name-only "${BASELINE_TAG}..HEAD")
if [ ${#CHANGED_FILES[@]} -eq 0 ]; then
echo "[INFO] Geen verschillen t.o.v. baseline '${BASELINE_TAG}'."
exit 0
fi
declare -a UNEXPECTED_FILES=()
for file in "${CHANGED_FILES[@]}"; do
allowed=0
case "$file" in
.dockerignore|.env.example|.gitleaks.toml|.gitignore|Dockerfile|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
allowed=1
;;
docs/*|lumaops/*|docker/*|scripts/*)
allowed=1
;;
esac
if [ "$allowed" -eq 0 ]; then
UNEXPECTED_FILES+=("$file")
fi
done
if [ ${#UNEXPECTED_FILES[@]} -gt 0 ]; then
echo "[ERROR] Verandering gevonden buiten de beoogde fork-patchset:"
for file in "${UNEXPECTED_FILES[@]}"; do
echo " - $file"
done
echo "[HINT] Voeg tijdelijke kernaanpassingen alleen toe met expliciete uitzonderingen in deze script/handleiding."
exit 1
fi
echo "[OK] Alleen geautoriseerde wijzigingen t.o.v. baseline '${BASELINE_TAG}'."
echo "[OK] Upstream-patchgrens blijft schoon."
+15 -15
View File
@@ -1,15 +1,15 @@
#!/usr/bin/env bash
set -euo pipefail
if ! command -v docker >/dev/null 2>&1; then
echo "[ERROR] docker command not found in PATH."
echo "[HINT] Run this on een host met Docker geïnstalleerd en beschikbaar."
exit 1
fi
echo "[INFO] Pull latest compose image/build context and recreate service"
docker compose down
docker compose build --pull --no-cache
docker compose up -d --force-recreate --remove-orphans
docker compose ps
#!/usr/bin/env bash
set -euo pipefail
if ! command -v docker >/dev/null 2>&1; then
echo "[ERROR] docker command not found in PATH."
echo "[HINT] Run this on een host met Docker geïnstalleerd en beschikbaar."
exit 1
fi
echo "[INFO] Pull latest compose image/build context and recreate service"
docker compose down
docker compose build --pull --no-cache
docker compose up -d --force-recreate --remove-orphans
docker compose ps
+66 -66
View File
@@ -1,66 +1,66 @@
#!/usr/bin/env bash
set -Eeuo pipefail
readonly PERSIST_DIR="/boot/config/plugins/lumaops"
readonly PERSIST_SCRIPT="${PERSIST_DIR}/hardware-setup.sh"
readonly LIVE_RULES="/etc/udev/rules.d/60-lumaops-openrgb.rules"
readonly BOOT_HOOK='bash /boot/config/plugins/lumaops/hardware-setup.sh --boot'
if [[ "${EUID}" -ne 0 ]]; then
echo "Dit script moet als root op de Unraid-host worden uitgevoerd." >&2
exit 77
fi
install -d -m 0755 "${PERSIST_DIR}" /etc/udev/rules.d
if [[ "${1:-}" != "--boot" ]]; then
install -m 0755 "$0" "${PERSIST_SCRIPT}"
if ! grep -Fqx "${BOOT_HOOK}" /boot/config/go; then
printf '\n# LumaOps OpenRGB hardware access\n%s\n' "${BOOT_HOOK}" >> /boot/config/go
fi
fi
modprobe i2c-dev
modprobe i2c-i801
rules_tmp="$(mktemp)"
trap 'rm -f "${rules_tmp}"' EXIT
cat > "${rules_tmp}" <<'RULES'
# LumaOps: minimum access for the detected ASUS Aura and Intel SMBus devices.
ACTION=="add|change", SUBSYSTEM=="usb", ATTR{idVendor}=="0b05", ATTR{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="hidraw", KERNEL=="hidraw*", ATTRS{idVendor}=="0b05", ATTRS{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="i2c-dev", KERNEL=="i2c-0", MODE:="0660", GROUP:="users"
RULES
install -m 0644 "${rules_tmp}" "${LIVE_RULES}"
udevadm control --reload-rules
udevadm trigger --action=change --subsystem-match=usb --attr-match=idVendor=0b05 --attr-match=idProduct=18f3
udevadm trigger --action=change --subsystem-match=hidraw
udevadm trigger --action=change --subsystem-match=i2c-dev --sysname-match=i2c-0
udevadm settle
for node in /dev/hidraw0 /dev/i2c-0; do
if [[ -e "${node}" ]]; then
chgrp users "${node}"
chmod g+rw "${node}"
fi
done
for sysdev in /sys/bus/usb/devices/*; do
[[ -f "${sysdev}/idVendor" && -f "${sysdev}/idProduct" ]] || continue
[[ "$(<"${sysdev}/idVendor")" == "0b05" && "$(<"${sysdev}/idProduct")" == "18f3" ]] || continue
busnum="$(printf '%03d' "$((10#$(<"${sysdev}/busnum")))")"
devnum="$(printf '%03d' "$((10#$(<"${sysdev}/devnum")))")"
usb_node="/dev/bus/usb/${busnum}/${devnum}"
chgrp users "${usb_node}"
chmod g+rw "${usb_node}"
done
for required in /dev/hidraw0 /dev/i2c-0; do
if [[ ! -r "${required}" || ! -w "${required}" ]]; then
echo "Hardware-node is niet lees- en schrijfbaar: ${required}" >&2
exit 69
fi
done
stat -c '%n %a %U:%G' /dev/hidraw0 /dev/i2c-0
#!/usr/bin/env bash
set -Eeuo pipefail
readonly PERSIST_DIR="/boot/config/plugins/lumaops"
readonly PERSIST_SCRIPT="${PERSIST_DIR}/hardware-setup.sh"
readonly LIVE_RULES="/etc/udev/rules.d/60-lumaops-openrgb.rules"
readonly BOOT_HOOK='bash /boot/config/plugins/lumaops/hardware-setup.sh --boot'
if [[ "${EUID}" -ne 0 ]]; then
echo "Dit script moet als root op de Unraid-host worden uitgevoerd." >&2
exit 77
fi
install -d -m 0755 "${PERSIST_DIR}" /etc/udev/rules.d
if [[ "${1:-}" != "--boot" ]]; then
install -m 0755 "$0" "${PERSIST_SCRIPT}"
if ! grep -Fqx "${BOOT_HOOK}" /boot/config/go; then
printf '\n# LumaOps OpenRGB hardware access\n%s\n' "${BOOT_HOOK}" >> /boot/config/go
fi
fi
modprobe i2c-dev
modprobe i2c-i801
rules_tmp="$(mktemp)"
trap 'rm -f "${rules_tmp}"' EXIT
cat > "${rules_tmp}" <<'RULES'
# LumaOps: minimum access for the detected ASUS Aura and Intel SMBus devices.
ACTION=="add|change", SUBSYSTEM=="usb", ATTR{idVendor}=="0b05", ATTR{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="hidraw", KERNEL=="hidraw*", ATTRS{idVendor}=="0b05", ATTRS{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="i2c-dev", KERNEL=="i2c-0", MODE:="0660", GROUP:="users"
RULES
install -m 0644 "${rules_tmp}" "${LIVE_RULES}"
udevadm control --reload-rules
udevadm trigger --action=change --subsystem-match=usb --attr-match=idVendor=0b05 --attr-match=idProduct=18f3
udevadm trigger --action=change --subsystem-match=hidraw
udevadm trigger --action=change --subsystem-match=i2c-dev --sysname-match=i2c-0
udevadm settle
for node in /dev/hidraw0 /dev/i2c-0; do
if [[ -e "${node}" ]]; then
chgrp users "${node}"
chmod g+rw "${node}"
fi
done
for sysdev in /sys/bus/usb/devices/*; do
[[ -f "${sysdev}/idVendor" && -f "${sysdev}/idProduct" ]] || continue
[[ "$(<"${sysdev}/idVendor")" == "0b05" && "$(<"${sysdev}/idProduct")" == "18f3" ]] || continue
busnum="$(printf '%03d' "$((10#$(<"${sysdev}/busnum")))")"
devnum="$(printf '%03d' "$((10#$(<"${sysdev}/devnum")))")"
usb_node="/dev/bus/usb/${busnum}/${devnum}"
chgrp users "${usb_node}"
chmod g+rw "${usb_node}"
done
for required in /dev/hidraw0 /dev/i2c-0; do
if [[ ! -r "${required}" || ! -w "${required}" ]]; then
echo "Hardware-node is niet lees- en schrijfbaar: ${required}" >&2
exit 69
fi
done
stat -c '%n %a %U:%G' /dev/hidraw0 /dev/i2c-0