Author SHA1 Message Date
NuklearRabbit 91f8b3e3c1 fix: allow public source manifest 2026-09-03 03:55:19 +02:00
NuklearRabbit 5f3b674df7 fix: allow line-ending policy in public fork guard 2026-09-03 03:18:35 +02:00
Jens 20f474f559 Merge pull request 'ci: make managed validation path-aware' (#1) from codex/runner-fast-path-20260903 into main
Validated workflow-only runner optimization. [skip ci]
2026-09-03 00:59:09 +00:00
NuklearRabbit 6949c7aae7 fix: normalize public shell scripts 2026-09-03 02:51:33 +02:00
Jens aa0243a8b2 ci: add lightweight validation fast path
Managed validation / full (pull_request) Failing after 14s
2026-09-03 00:29:35 +00:00
10 changed files with 286 additions and 257 deletions
+1
View File
@@ -0,0 +1 @@
*.sh text eol=lf
+28 -1
View File
@@ -50,7 +50,34 @@ jobs:
echo "Unresolved merge markers detected" >&2
exit 1
fi
# Checkout recreates only `origin`; restore the documented upstream
# MANAGED_FAST_PATH: documentation and this baseline workflow cannot
# affect the shipped runtime. Keep the required status check, but do
# not install toolchains or execute the full product suite.
if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}"
managed_base="origin/${GITHUB_BASE_REF}"
git diff --check "${managed_base}..HEAD"
mapfile -t managed_changed_files < <(
git diff --name-only --diff-filter=ACMR "${managed_base}..HEAD"
)
managed_runtime_change=0
for managed_path in "${managed_changed_files[@]}"; do
case "${managed_path}" in
*.md|*.mdx|docs/*|.github/ISSUE_TEMPLATE/*|.gitea/ISSUE_TEMPLATE/*|.gitea/runner-scope.sh|.gitea/workflows/managed-validation.yml)
;;
*)
managed_runtime_change=1
break
;;
esac
done
if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
"${#managed_changed_files[@]}"
exit 0
fi
fi # Checkout recreates only `origin`; restore the documented upstream
# identity required by the fork-boundary guard. The pinned baseline
# tag is already part of this repository, so no upstream fetch occurs.
git remote add upstream https://gitlab.com/CalcProgrammer1/OpenRGB.git
+3 -2
View File
@@ -1,7 +1,8 @@
004f81f60cd94f40a4190a251207046c49947a18665acd9d286d4ed37262000c .dockerignore
d60541998d51c1858da15f04afb54b28db56c21b86217c3cb7fc3d7ddb15c406 .editorconfig
b31877c3a1005f270a5814a32e1d3ea3e6ae88eb7857ba578dd0931d6d8517c5 .env.example
c72d7473cb0746b3eb542ec0fbbf6ef3cf1fc9ca764d703e6209a8949a2ab890 .gitea/workflows/managed-validation.yml
1d5d71dcc6ccd28ab46a335349ecc74742ca4b81f4fcad212f8d134f70f1f13e .gitattributes
54afa75021dfc20d1877132876c7808803f45568404efe27a80432a37aa43aa4 .gitea/workflows/managed-validation.yml
37071ae4aaa1cbeacdf6560459e0c2302b620d998500c42012c87c16574018a8 .github/FUNDING.yml
2c1e738d39017495aabd2daf47b0cab54c5442362c51f1c08cd460297a9308c0 .github/workflows/issue_opened.yml
47ff2411d0e07423534fbf69fee1c5b1a1a26ed98aa7adc9ae0c9f5427bcba17 .github/workflows/openrgb_upstream_compat_guard.yml
@@ -2336,7 +2337,7 @@ d367db3868ac46b452ebe8ae758a75363b24024478f7d53574ca11c46e190bc7 scripts/Licens
8ea8d87553b95b73d5fe1cc8c84d955f5091cf2572914364f549461a424bd25b scripts/git-get-branch.sh
172c4f52c197f427c79446134e0d810011ba2ce5ba89e03db156c3675608c8d1 scripts/openrgb-udev-install.sh
f527c95d094238b3a5cee99390bcd58704c1a17432f39d48ffc89ebafa80a7ba scripts/openrgb-upstream-guard.ps1
da805501744cfb3726f1c36bc91d1a42ee5c1d9cc32cbb9834336c579216734e scripts/openrgb-upstream-guard.sh
8845d95025929f8a2202fb79fe7d00c7d5cf8b87a1d80aafb878fdf17bb8d0f0 scripts/openrgb-upstream-guard.sh
aeedc69310db069e52bd770f2882046e6aa2f93c063218c6eac23e422f49113a scripts/prepare-artifacts.py
7ec8f32a79030ba625c2b7f444f3b22d70a94a983ab66189890b22b0a8cff6ea scripts/redeploy-lumaops.ps1
dd3e9e8f73b0c504c55a399ba5a5bccc9db6e9a1a596e4cc214a3762484a0058 scripts/redeploy-lumaops.sh
+19 -19
View File
@@ -1,19 +1,19 @@
#!/bin/sh
set -eu
PUID="${PUID:-99}"
PGID="${PGID:-100}"
case "$PUID:$PGID" in
*[!0-9:]*|:|*:) echo "PUID en PGID moeten numeriek zijn" >&2; exit 64 ;;
esac
groupmod --gid "$PGID" lumaops 2>/dev/null || true
usermod --uid "$PUID" --gid "$PGID" lumaops 2>/dev/null || true
mkdir -p /config/openrgb /config/lumaops /data /logs /run/lumaops
chown -R "$PUID:$PGID" /config/lumaops /data /logs /run/lumaops
chown -R "$PUID:$PGID" /config/openrgb
gosu "$PUID:$PGID" mkdir -p /data/backups
exec gosu "$PUID:$PGID" /usr/bin/tini -- /opt/venv/bin/python /opt/lumaops/supervisor.py
#!/bin/sh
set -eu
PUID="${PUID:-99}"
PGID="${PGID:-100}"
case "$PUID:$PGID" in
*[!0-9:]*|:|*:) echo "PUID en PGID moeten numeriek zijn" >&2; exit 64 ;;
esac
groupmod --gid "$PGID" lumaops 2>/dev/null || true
usermod --uid "$PUID" --gid "$PGID" lumaops 2>/dev/null || true
mkdir -p /config/openrgb /config/lumaops /data /logs /run/lumaops
chown -R "$PUID:$PGID" /config/lumaops /data /logs /run/lumaops
chown -R "$PUID:$PGID" /config/openrgb
gosu "$PUID:$PGID" mkdir -p /data/backups
exec gosu "$PUID:$PGID" /usr/bin/tini -- /opt/venv/bin/python /opt/lumaops/supervisor.py
+67 -67
View File
@@ -1,67 +1,67 @@
#!/usr/bin/env bash
set -euo pipefail
if [ "$#" -ne 1 ]; then
echo "Usage: $0 OUTPUT_DIRECTORY" >&2
exit 2
fi
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="$1"
if [ -e "$OUTPUT_DIR" ]; then
echo "Output path already exists: $OUTPUT_DIR" >&2
exit 1
fi
# Ignore checkout-only executable-bit and CRLF differences so the same guard works
# from Windows Git and WSL. Content changes still fail the export.
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
|| ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
echo "Commit or stash repository changes before creating a public export." >&2
exit 1
fi
mkdir -p "$OUTPUT_DIR"
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"
# Production deployment dispatch belongs to the private operations repository.
rm -f "$OUTPUT_DIR/.gitea/workflows/unraid-deploy.yml"
for forbidden in \
'.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
'secret.key' 'id_rsa' 'id_ed25519'; do
if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
echo "Forbidden file found in public export: $forbidden" >&2
exit 1
fi
done
if grep -RIlE --exclude='export-public-source.sh' \
'192\.168\.10\.150|NuklearRabbit' "$OUTPUT_DIR" >/dev/null; then
echo "Private deployment marker found in public export." >&2
exit 1
fi
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
echo "Unexpected file larger than 10 MiB found in public export." >&2
exit 1
fi
git -C "$OUTPUT_DIR" init -q
git -C "$OUTPUT_DIR" add .
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q -m "Publish LumaOps source"
(
cd "$OUTPUT_DIR"
git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
)
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q --amend --no-edit
git -C "$OUTPUT_DIR" tag public-release-baseline
echo "Public source export created at $OUTPUT_DIR"
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"
#!/usr/bin/env bash
set -euo pipefail
if [ "$#" -ne 1 ]; then
echo "Usage: $0 OUTPUT_DIRECTORY" >&2
exit 2
fi
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="$1"
if [ -e "$OUTPUT_DIR" ]; then
echo "Output path already exists: $OUTPUT_DIR" >&2
exit 1
fi
# Ignore checkout-only executable-bit and CRLF differences so the same guard works
# from Windows Git and WSL. Content changes still fail the export.
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
|| ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
echo "Commit or stash repository changes before creating a public export." >&2
exit 1
fi
mkdir -p "$OUTPUT_DIR"
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"
# Production deployment dispatch belongs to the private operations repository.
rm -f "$OUTPUT_DIR/.gitea/workflows/unraid-deploy.yml"
for forbidden in \
'.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
'secret.key' 'id_rsa' 'id_ed25519'; do
if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
echo "Forbidden file found in public export: $forbidden" >&2
exit 1
fi
done
if grep -RIlE --exclude='export-public-source.sh' \
'192\.168\.10\.150|NuklearRabbit' "$OUTPUT_DIR" >/dev/null; then
echo "Private deployment marker found in public export." >&2
exit 1
fi
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
echo "Unexpected file larger than 10 MiB found in public export." >&2
exit 1
fi
git -C "$OUTPUT_DIR" init -q
git -C "$OUTPUT_DIR" add .
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q -m "Publish LumaOps source"
(
cd "$OUTPUT_DIR"
git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
)
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
git -C "$OUTPUT_DIR" -c user.name='LumaOps release export' \
-c user.email='release-export@invalid.example' \
commit -q --amend --no-edit
git -C "$OUTPUT_DIR" tag public-release-baseline
echo "Public source export created at $OUTPUT_DIR"
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"
+3 -3
View File
@@ -1,3 +1,3 @@
#! /bin/bash
git show-ref | grep $(git log --pretty=%h -1) | sed 's|.*/\(.*\)|\1|' | sort -u | grep -v HEAD
#! /bin/bash
git show-ref | grep $(git log --pretty=%h -1) | sed 's|.*/\(.*\)|\1|' | sort -u | grep -v HEAD
+17 -17
View File
@@ -1,17 +1,17 @@
#! /bin/bash
# Download udev rules file
wget https://openrgb.org/releases/release_0.9/60-openrgb.rules
# If we don't have write permissions then we're running on an immutable distro
if sudo test -w /usr/lib/udev/rules.d;
then
# Move udev rules file to udev rules directory
sudo mv 60-openrgb.rules /usr/lib/udev/rules.d
else
sudo mv 60-openrgb.rules /etc/udev/rules.d
fi
# Reload the rules
sudo udevadm control --reload-rules
sudo udevadm trigger
#! /bin/bash
# Download udev rules file
wget https://openrgb.org/releases/release_0.9/60-openrgb.rules
# If we don't have write permissions then we're running on an immutable distro
if sudo test -w /usr/lib/udev/rules.d;
then
# Move udev rules file to udev rules directory
sudo mv 60-openrgb.rules /usr/lib/udev/rules.d
else
sudo mv 60-openrgb.rules /etc/udev/rules.d
fi
# Reload the rules
sudo udevadm control --reload-rules
sudo udevadm trigger
+67 -67
View File
@@ -1,67 +1,67 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"
BASELINE_TAG="${OPENRGB_BASELINE_TAG:-upstream-openrgb-1.0rc3}"
UPSTREAM_REMOTE="${OPENRGB_UPSTREAM_REMOTE:-upstream}"
PUBLIC_BASELINE_TAG="public-release-baseline"
if [ "${OPENRGB_FETCH_UPSTREAM:-0}" = "1" ]; then
echo "[INFO] Fetch upstream remote '$UPSTREAM_REMOTE'..."
git fetch "$UPSTREAM_REMOTE" --tags --prune
fi
if ! git rev-parse --verify --quiet "${BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
if git rev-parse --verify --quiet "${PUBLIC_BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
BASELINE_TAG="$PUBLIC_BASELINE_TAG"
echo "[INFO] Publieke releasebaseline wordt gebruikt."
else
echo "[ERROR] Geen upstream- of publieke baseline-tag gevonden."
exit 1
fi
fi
if [ "$BASELINE_TAG" != "$PUBLIC_BASELINE_TAG" ] && ! git remote | grep -Fxq "$UPSTREAM_REMOTE"; then
echo "[ERROR] Remote '${UPSTREAM_REMOTE}' ontbreekt. Voeg upstream eerst toe of zet OPENRGB_UPSTREAM_REMOTE."
exit 1
fi
mapfile -t CHANGED_FILES < <(git diff --name-only "${BASELINE_TAG}..HEAD")
if [ ${#CHANGED_FILES[@]} -eq 0 ]; then
echo "[INFO] Geen verschillen t.o.v. baseline '${BASELINE_TAG}'."
exit 0
fi
declare -a UNEXPECTED_FILES=()
for file in "${CHANGED_FILES[@]}"; do
allowed=0
case "$file" in
.dockerignore|.env.example|.gitleaks.toml|.gitignore|Dockerfile|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
allowed=1
;;
docs/*|lumaops/*|docker/*|scripts/*)
allowed=1
;;
esac
if [ "$allowed" -eq 0 ]; then
UNEXPECTED_FILES+=("$file")
fi
done
if [ ${#UNEXPECTED_FILES[@]} -gt 0 ]; then
echo "[ERROR] Verandering gevonden buiten de beoogde fork-patchset:"
for file in "${UNEXPECTED_FILES[@]}"; do
echo " - $file"
done
echo "[HINT] Voeg tijdelijke kernaanpassingen alleen toe met expliciete uitzonderingen in deze script/handleiding."
exit 1
fi
echo "[OK] Alleen geautoriseerde wijzigingen t.o.v. baseline '${BASELINE_TAG}'."
echo "[OK] Upstream-patchgrens blijft schoon."
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"
BASELINE_TAG="${OPENRGB_BASELINE_TAG:-upstream-openrgb-1.0rc3}"
UPSTREAM_REMOTE="${OPENRGB_UPSTREAM_REMOTE:-upstream}"
PUBLIC_BASELINE_TAG="public-release-baseline"
if [ "${OPENRGB_FETCH_UPSTREAM:-0}" = "1" ]; then
echo "[INFO] Fetch upstream remote '$UPSTREAM_REMOTE'..."
git fetch "$UPSTREAM_REMOTE" --tags --prune
fi
if ! git rev-parse --verify --quiet "${BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
if git rev-parse --verify --quiet "${PUBLIC_BASELINE_TAG}^{commit}" >/dev/null 2>&1; then
BASELINE_TAG="$PUBLIC_BASELINE_TAG"
echo "[INFO] Publieke releasebaseline wordt gebruikt."
else
echo "[ERROR] Geen upstream- of publieke baseline-tag gevonden."
exit 1
fi
fi
if [ "$BASELINE_TAG" != "$PUBLIC_BASELINE_TAG" ] && ! git remote | grep -Fxq "$UPSTREAM_REMOTE"; then
echo "[ERROR] Remote '${UPSTREAM_REMOTE}' ontbreekt. Voeg upstream eerst toe of zet OPENRGB_UPSTREAM_REMOTE."
exit 1
fi
mapfile -t CHANGED_FILES < <(git diff --name-only "${BASELINE_TAG}..HEAD")
if [ ${#CHANGED_FILES[@]} -eq 0 ]; then
echo "[INFO] Geen verschillen t.o.v. baseline '${BASELINE_TAG}'."
exit 0
fi
declare -a UNEXPECTED_FILES=()
for file in "${CHANGED_FILES[@]}"; do
allowed=0
case "$file" in
.dockerignore|.env.example|.gitattributes|.gitleaks.toml|.gitignore|Dockerfile|PUBLIC-SOURCE-MANIFEST.sha256|README.md|SECURITY.md|docker-compose*.yml|docker-compose*.yaml|startup/main_FreeBSD_Linux_MacOS.cpp|ResourceManager.cpp|ResourceManager.h|.github/*|.gitea/*)
allowed=1
;;
docs/*|lumaops/*|docker/*|scripts/*)
allowed=1
;;
esac
if [ "$allowed" -eq 0 ]; then
UNEXPECTED_FILES+=("$file")
fi
done
if [ ${#UNEXPECTED_FILES[@]} -gt 0 ]; then
echo "[ERROR] Verandering gevonden buiten de beoogde fork-patchset:"
for file in "${UNEXPECTED_FILES[@]}"; do
echo " - $file"
done
echo "[HINT] Voeg tijdelijke kernaanpassingen alleen toe met expliciete uitzonderingen in deze script/handleiding."
exit 1
fi
echo "[OK] Alleen geautoriseerde wijzigingen t.o.v. baseline '${BASELINE_TAG}'."
echo "[OK] Upstream-patchgrens blijft schoon."
+15 -15
View File
@@ -1,15 +1,15 @@
#!/usr/bin/env bash
set -euo pipefail
if ! command -v docker >/dev/null 2>&1; then
echo "[ERROR] docker command not found in PATH."
echo "[HINT] Run this on een host met Docker geïnstalleerd en beschikbaar."
exit 1
fi
echo "[INFO] Pull latest compose image/build context and recreate service"
docker compose down
docker compose build --pull --no-cache
docker compose up -d --force-recreate --remove-orphans
docker compose ps
#!/usr/bin/env bash
set -euo pipefail
if ! command -v docker >/dev/null 2>&1; then
echo "[ERROR] docker command not found in PATH."
echo "[HINT] Run this on een host met Docker geïnstalleerd en beschikbaar."
exit 1
fi
echo "[INFO] Pull latest compose image/build context and recreate service"
docker compose down
docker compose build --pull --no-cache
docker compose up -d --force-recreate --remove-orphans
docker compose ps
+66 -66
View File
@@ -1,66 +1,66 @@
#!/usr/bin/env bash
set -Eeuo pipefail
readonly PERSIST_DIR="/boot/config/plugins/lumaops"
readonly PERSIST_SCRIPT="${PERSIST_DIR}/hardware-setup.sh"
readonly LIVE_RULES="/etc/udev/rules.d/60-lumaops-openrgb.rules"
readonly BOOT_HOOK='bash /boot/config/plugins/lumaops/hardware-setup.sh --boot'
if [[ "${EUID}" -ne 0 ]]; then
echo "Dit script moet als root op de Unraid-host worden uitgevoerd." >&2
exit 77
fi
install -d -m 0755 "${PERSIST_DIR}" /etc/udev/rules.d
if [[ "${1:-}" != "--boot" ]]; then
install -m 0755 "$0" "${PERSIST_SCRIPT}"
if ! grep -Fqx "${BOOT_HOOK}" /boot/config/go; then
printf '\n# LumaOps OpenRGB hardware access\n%s\n' "${BOOT_HOOK}" >> /boot/config/go
fi
fi
modprobe i2c-dev
modprobe i2c-i801
rules_tmp="$(mktemp)"
trap 'rm -f "${rules_tmp}"' EXIT
cat > "${rules_tmp}" <<'RULES'
# LumaOps: minimum access for the detected ASUS Aura and Intel SMBus devices.
ACTION=="add|change", SUBSYSTEM=="usb", ATTR{idVendor}=="0b05", ATTR{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="hidraw", KERNEL=="hidraw*", ATTRS{idVendor}=="0b05", ATTRS{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="i2c-dev", KERNEL=="i2c-0", MODE:="0660", GROUP:="users"
RULES
install -m 0644 "${rules_tmp}" "${LIVE_RULES}"
udevadm control --reload-rules
udevadm trigger --action=change --subsystem-match=usb --attr-match=idVendor=0b05 --attr-match=idProduct=18f3
udevadm trigger --action=change --subsystem-match=hidraw
udevadm trigger --action=change --subsystem-match=i2c-dev --sysname-match=i2c-0
udevadm settle
for node in /dev/hidraw0 /dev/i2c-0; do
if [[ -e "${node}" ]]; then
chgrp users "${node}"
chmod g+rw "${node}"
fi
done
for sysdev in /sys/bus/usb/devices/*; do
[[ -f "${sysdev}/idVendor" && -f "${sysdev}/idProduct" ]] || continue
[[ "$(<"${sysdev}/idVendor")" == "0b05" && "$(<"${sysdev}/idProduct")" == "18f3" ]] || continue
busnum="$(printf '%03d' "$((10#$(<"${sysdev}/busnum")))")"
devnum="$(printf '%03d' "$((10#$(<"${sysdev}/devnum")))")"
usb_node="/dev/bus/usb/${busnum}/${devnum}"
chgrp users "${usb_node}"
chmod g+rw "${usb_node}"
done
for required in /dev/hidraw0 /dev/i2c-0; do
if [[ ! -r "${required}" || ! -w "${required}" ]]; then
echo "Hardware-node is niet lees- en schrijfbaar: ${required}" >&2
exit 69
fi
done
stat -c '%n %a %U:%G' /dev/hidraw0 /dev/i2c-0
#!/usr/bin/env bash
set -Eeuo pipefail
readonly PERSIST_DIR="/boot/config/plugins/lumaops"
readonly PERSIST_SCRIPT="${PERSIST_DIR}/hardware-setup.sh"
readonly LIVE_RULES="/etc/udev/rules.d/60-lumaops-openrgb.rules"
readonly BOOT_HOOK='bash /boot/config/plugins/lumaops/hardware-setup.sh --boot'
if [[ "${EUID}" -ne 0 ]]; then
echo "Dit script moet als root op de Unraid-host worden uitgevoerd." >&2
exit 77
fi
install -d -m 0755 "${PERSIST_DIR}" /etc/udev/rules.d
if [[ "${1:-}" != "--boot" ]]; then
install -m 0755 "$0" "${PERSIST_SCRIPT}"
if ! grep -Fqx "${BOOT_HOOK}" /boot/config/go; then
printf '\n# LumaOps OpenRGB hardware access\n%s\n' "${BOOT_HOOK}" >> /boot/config/go
fi
fi
modprobe i2c-dev
modprobe i2c-i801
rules_tmp="$(mktemp)"
trap 'rm -f "${rules_tmp}"' EXIT
cat > "${rules_tmp}" <<'RULES'
# LumaOps: minimum access for the detected ASUS Aura and Intel SMBus devices.
ACTION=="add|change", SUBSYSTEM=="usb", ATTR{idVendor}=="0b05", ATTR{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="hidraw", KERNEL=="hidraw*", ATTRS{idVendor}=="0b05", ATTRS{idProduct}=="18f3", MODE:="0660", GROUP:="users"
ACTION=="add|change", SUBSYSTEM=="i2c-dev", KERNEL=="i2c-0", MODE:="0660", GROUP:="users"
RULES
install -m 0644 "${rules_tmp}" "${LIVE_RULES}"
udevadm control --reload-rules
udevadm trigger --action=change --subsystem-match=usb --attr-match=idVendor=0b05 --attr-match=idProduct=18f3
udevadm trigger --action=change --subsystem-match=hidraw
udevadm trigger --action=change --subsystem-match=i2c-dev --sysname-match=i2c-0
udevadm settle
for node in /dev/hidraw0 /dev/i2c-0; do
if [[ -e "${node}" ]]; then
chgrp users "${node}"
chmod g+rw "${node}"
fi
done
for sysdev in /sys/bus/usb/devices/*; do
[[ -f "${sysdev}/idVendor" && -f "${sysdev}/idProduct" ]] || continue
[[ "$(<"${sysdev}/idVendor")" == "0b05" && "$(<"${sysdev}/idProduct")" == "18f3" ]] || continue
busnum="$(printf '%03d' "$((10#$(<"${sysdev}/busnum")))")"
devnum="$(printf '%03d' "$((10#$(<"${sysdev}/devnum")))")"
usb_node="/dev/bus/usb/${busnum}/${devnum}"
chgrp users "${usb_node}"
chmod g+rw "${usb_node}"
done
for required in /dev/hidraw0 /dev/i2c-0; do
if [[ ! -r "${required}" || ! -w "${required}" ]]; then
echo "Hardware-node is niet lees- en schrijfbaar: ${required}" >&2
exit 69
fi
done
stat -c '%n %a %U:%G' /dev/hidraw0 /dev/i2c-0