💐 Sync 2026-10-06 12:33:44

minigate/scripts/install.sh

@@ -0,0 +1,162 @@
+#!/bin/sh
+
+set -eu
+
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+
+REPOSITORY="tpxcer/minigate"
+LATEST_ROOT="https://github.com/${REPOSITORY}/releases/latest/download"
+TMP_DIR=""
+SOURCE_NAME=""
+RELEASE_VERSION=""
+EXPECTED_HASH=""
+DOWNLOADER=""
+
+info() {
+    printf '[minigate] %s\n' "$*"
+}
+
+die() {
+    printf '[minigate] 安装失败：%s\n' "$*" >&2
+    exit 1
+}
+
+cleanup() {
+    case "$TMP_DIR" in
+        /tmp/minigate.*) rm -rf -- "$TMP_DIR" ;;
+    esac
+}
+
+check_system() {
+    [ "$(id -u)" = "0" ] || die "请使用 root 用户运行"
+    [ -r /etc/openwrt_release ] || die "未检测到 OpenWrt / ImmortalWrt"
+    command -v tar >/dev/null 2>&1 || die "系统缺少 tar"
+    command -v awk >/dev/null 2>&1 || die "系统缺少 awk"
+    command -v sha256sum >/dev/null 2>&1 || die "系统缺少 sha256sum"
+}
+
+detect_downloader() {
+    if command -v curl >/dev/null 2>&1; then
+        DOWNLOADER="curl"
+    elif command -v wget >/dev/null 2>&1; then
+        DOWNLOADER="wget"
+    else
+        die "系统缺少 curl 和 wget"
+    fi
+}
+
+fetch_to_file() {
+    case "$DOWNLOADER" in
+        curl)
+            curl -fsSL --proto '=https' --tlsv1.2 \
+                --connect-timeout 10 --max-time 180 --retry 2 --retry-delay 1 \
+                -o "$2" "$1"
+            ;;
+        wget)
+            wget -q -O "$2" "$1"
+            ;;
+    esac
+}
+
+valid_version() {
+    printf '%s' "$1" | grep -Eq '^[0-9]{4}\.(0?[1-9]|1[0-2])\.(0?[1-9]|[12][0-9]|3[01])(-[1-9][0-9]*)?$'
+}
+
+read_release() {
+    release_data=$(awk '
+        $2 ~ /^minigate-v[0-9][0-9.]*(-[1-9][0-9]*)?-src\.tar\.gz$/ {
+            count++
+            hash=$1
+            file=$2
+        }
+        END {
+            if (count != 1) exit 1
+            print hash " " file
+        }
+    ' "$1") || return 1
+
+    EXPECTED_HASH=${release_data%% *}
+    SOURCE_NAME=${release_data#* }
+    RELEASE_VERSION=${SOURCE_NAME#minigate-v}
+    RELEASE_VERSION=${RELEASE_VERSION%-src.tar.gz}
+
+    [ "${#EXPECTED_HASH}" = "64" ] || return 1
+    case "$EXPECTED_HASH" in
+        *[!0-9a-fA-F]*) return 1 ;;
+    esac
+    valid_version "$RELEASE_VERSION"
+}
+
+verify_source() {
+    actual_hash=$(sha256sum "$1" | awk '{print $1}')
+    expected_lower=$(printf '%s' "$EXPECTED_HASH" | tr 'A-F' 'a-f')
+    [ "$actual_hash" = "$expected_lower" ] || die "源码包 SHA-256 校验失败"
+
+    if tar -tzf "$1" | awk '{
+        path=$0
+        sub(/^\.\//, "", path)
+        if (path ~ /^\// || path ~ /(^|\/)\.\.(\/|$)/) bad=1
+    } END { exit bad ? 0 : 1 }'; then
+        die "源码包包含不安全路径"
+    fi
+}
+
+verify_metadata() {
+    source_dir="$1"
+    grep -Fxq "PKG_VERSION:=${RELEASE_VERSION}" "$source_dir/Makefile" || return 1
+    grep -Fxq "PKG_VERSION=\"${RELEASE_VERSION}\"" "$source_dir/scripts/build-ipk.sh" || return 1
+    grep -Fxq "CURRENT_VERSION=\"${RELEASE_VERSION}\"" "$source_dir/root/usr/lib/minigate/update.sh" || return 1
+    [ -f "$source_dir/install.sh" ] || return 1
+}
+
+download_release() {
+    attempt=1
+    while [ "$attempt" -le 3 ]; do
+        sums_before="$TMP_DIR/SHA256SUMS.before"
+        sums_after="$TMP_DIR/SHA256SUMS.after"
+
+        fetch_to_file "$LATEST_ROOT/SHA256SUMS" "$sums_before" || die "无法下载 SHA256SUMS"
+        read_release "$sums_before" || die "SHA256SUMS 中没有唯一、有效的 minigate 源码包"
+        info "正在下载 minigate v${RELEASE_VERSION}"
+        fetch_to_file "$LATEST_ROOT/$SOURCE_NAME" "$TMP_DIR/$SOURCE_NAME" || die "无法下载 $SOURCE_NAME"
+        fetch_to_file "$LATEST_ROOT/SHA256SUMS" "$sums_after" || die "无法再次确认 SHA256SUMS"
+
+        if cmp -s "$sums_before" "$sums_after"; then
+            return 0
+        fi
+
+        info "下载期间发现新版本，正在重新获取"
+        attempt=$((attempt + 1))
+    done
+    die "下载期间版本连续变化，请稍后重试"
+}
+
+restart_luci() {
+    rm -rf /tmp/luci-*cache* 2>/dev/null || true
+    if [ -x /etc/init.d/uhttpd ]; then
+        /etc/init.d/uhttpd restart
+    fi
+}
+
+main() {
+    check_system
+    detect_downloader
+    TMP_DIR=$(mktemp -d /tmp/minigate.XXXXXX) || die "无法创建临时目录"
+    trap cleanup 0
+    trap 'exit 1' 1 2 3 15
+
+    download_release
+    verify_source "$TMP_DIR/$SOURCE_NAME"
+    info "SHA-256 校验通过"
+
+    mkdir -p "$TMP_DIR/source"
+    tar -xzf "$TMP_DIR/$SOURCE_NAME" -C "$TMP_DIR/source" || die "源码包解压失败"
+    verify_metadata "$TMP_DIR/source" || die "源码包版本信息不一致"
+
+    /bin/sh "$TMP_DIR/source/install.sh"
+    restart_luci
+    info "minigate v${RELEASE_VERSION} 安装完成"
+}
+
+main "$@"