diff --git a/kickstart/files/kickstart.cfg b/kickstart/files/kickstart.cfg index 22515fd5..c7a24f42 100644 --- a/kickstart/files/kickstart.cfg +++ b/kickstart/files/kickstart.cfg @@ -976,6 +976,36 @@ if check_prestage -eq 0 ; then report_failure_with_msg "Unable to mount ${ISO_DEV} Error rc=${rc}" fi + local_repo_check_fail= + # Calculate local checksum and compare + checksum_file=${ISODIR}/.ostree_repo_checksum + if [ -f "${checksum_file}" ]; then + checksum_from_file=$(cat "${checksum_file}") + ilog "Verifying checksum for prestaged ${ISODIR}/ostree_repo" + pushd "${ISODIR}" > /dev/null + checksum=$(find ostree_repo -type f -exec md5sum {} + | LC_ALL=C sort | md5sum | awk '{ print $1; }') + popd > /dev/null + if [ "${checksum}" = "${checksum_from_file}" ]; then + ilog "Verified ostree checksum: ${checksum}" + else + elog "ostree checksum failed on ${ISODIR}/ostree_repo" + elog "Calculated checksum: ${checksum}" + elog "File checksum: ${checksum_from_file}" + local_repo_check_fail=true + fi + else + # No prestage checksum file is available. Use ostree fsck instead. + # The only problem with this is the length of time required for fsck to complete. + wlog "No ostree checksum file at ${checksum_file}. Performing ostree fsck instead." + if ! ostree --repo="${ISODIR}/ostree_repo" fsck; then + elog "ostree fsck failed on prestaged ${ISODIR}/ostree_repo: reverting to remote pull" + local_repo_check_fail=true + fi + fi + if [ -n "${local_repo_check_fail}" ]; then + report_failure_with_msg "ostree integrity check failed on ISO ${ISODIR}/ostree_repo" + fi + if [ -e "${ISODIR}/ks-setup.cfg" ]; then source "${ISODIR}/ks-setup.cfg" fi @@ -2814,6 +2844,14 @@ if [ "${controller}" = true ] ; then report_failure_with_msg "Unable to copy repo to /opt/platform-backup [rc=${rc}]" fi + # The summary file is not transferred on an ostree pull, so we need to + # regenerate the checksum here based on the new local repo contents + ilog "Calculating new checksum for prestaged ${backup_mount}/ostree_repo" + pushd "${backup_mount}" > /dev/null + find ostree_repo -type f -exec md5sum {} + | LC_ALL=C sort | md5sum | awk '{ print $1; }' > .ostree_repo_checksum + ilog "Calculated checksum: $(cat .ostree_repo_checksum)" + popd > /dev/null + if [ -e "/instboot/opt/platform-backup/${sw_release}" ]; then ilog "Copying images and patches to ${backup_mount}" cp -a /instboot/opt/platform-backup/${sw_release} ${backup_mount} diff --git a/kickstart/files/miniboot.cfg b/kickstart/files/miniboot.cfg index bfea210e..99c45b09 100644 --- a/kickstart/files/miniboot.cfg +++ b/kickstart/files/miniboot.cfg @@ -2057,11 +2057,45 @@ else # then set the ostree url to its location. remote_insturl= if [ -e ${backup_mount}/ostree_repo ]; then - # Preserve remote_insturl for use in 2nd ostree pull below - remote_insturl=${insturl} + local_repo_check_fail= + # Calculate local checksum and compare + checksum_file=${backup_mount}/.ostree_repo_checksum + if [ -f "${checksum_file}" ]; then + checksum_from_file=$(cat "${checksum_file}") + ilog "Verifying checksum for prestaged ${backup_mount}/ostree_repo" + pushd ${backup_mount} > /dev/null + checksum=$(find ostree_repo -type f -exec md5sum {} + | LC_ALL=C sort | md5sum | awk '{ print $1; }') + popd > /dev/null + if [ "${checksum}" = "${checksum_from_file}" ]; then + ilog "Verified ostree checksum: ${checksum}" + else + elog "ostree checksum failed on ${backup_mount}/ostree_repo" + elog "Calulated checksum: ${checksum}" + elog "File checksum: ${checksum_from_file}" + local_repo_check_fail=true + fi + else + # No prestage checksum file is available. Use ostree fsck instead. + # The only problem with this is the length of time required for fsck to complete. + wlog "No ostree checksum file at ${checksum_file}. Performing ostree fsck instead." + if ! ostree --repo="${backup_mount}/ostree_repo" fsck; then + elog "ostree fsck failed on prestaged ${backup_mount}/ostree_repo: reverting to remote pull" + local_repo_check_fail=true + fi + fi + if [ -z "${local_repo_check_fail}" ]; then + # Preserve remote_insturl for use in 2nd ostree pull below + remote_insturl=${insturl} - insturl="file:///${backup_mount}/ostree_repo" - ilog "Setting insturl to ${insturl} to use prestaged ostree_repo" + insturl="file:///${backup_mount}/ostree_repo" + ilog "Setting insturl to ${insturl} to use prestaged ostree_repo" + else + # Remove the corrupted ostree_repo. + # Avoid setting insturl which will revert to using a remote pull + elog "ostree integrity check failed: removing prestaged ${backup_mount}/ostree_repo" + rm -rf "${backup_mount}/ostree_repo" + elog "ostree integrity check failed: reverting to remote pull" + fi fi # Tell LAT to install from this local stage