1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
#!/bin/bash
# Apply the patched gnome-keyring package to a live host (ratio, later velox).
#
# Runs only after the VM gates passed and only when Craig says go. Every step
# is reversible: the encrypted keyring files are backed up with their modes,
# the stock package stays in the pacman cache for a one-command rollback, and
# only the keyring service is restarted (one unlock prompt is expected, to be
# answered in the normal system dialog, never in chat).
#
# deploy-ratio.sh build build the package from the repo recipe (as the user)
# deploy-ratio.sh install back up, install, restart the daemon, verify
# deploy-ratio.sh rollback reinstall the cached stock 1:51.1-1 and restart
# deploy-ratio.sh verify show versions, owner, restart counter, recent crashes
set -euo pipefail
repo="${ARCHSETUP_DIR:-$HOME/code/archsetup}"
recipe="$repo/packages/gnome-keyring"
build_dir="${BUILD_DIR:-$HOME/.cache/archsetup-build/gnome-keyring}"
stock_pkg="/var/cache/pacman/pkg/gnome-keyring-1:51.1-1-x86_64.pkg.tar.zst"
backup_root="$HOME/.local/share/keyrings-backup"
verify() {
echo "host: $(uname -n)"
pacman -Q gnome-keyring glib2
systemctl --user show gnome-keyring-daemon.service -p ActiveState -p NRestarts -p MainPID -p ExecMainStartTimestamp
busctl --user status org.freedesktop.secrets 2>/dev/null | grep -E '^(PID|Comm)=' || echo "no Secret Service owner"
echo "aborts in the last hour: $(journalctl --user -u gnome-keyring-daemon.service --since '1 hour ago' --no-pager 2>/dev/null | grep -c 'Scheduled restart job')"
sha256sum /usr/bin/gnome-keyring-daemon
}
case "${1:-}" in
build)
[ -f "$recipe/PKGBUILD" ] || { echo "recipe missing: $recipe" >&2; exit 1; }
rm -rf "$build_dir"; mkdir -p "$build_dir"; cp -a "$recipe/." "$build_dir/"
(cd "$build_dir" && makepkg --noconfirm -s)
ls -la "$build_dir"/*.pkg.tar.zst
;;
install)
pkg=$(ls "$build_dir"/gnome-keyring-1:51.1-1.1-x86_64.pkg.tar.zst)
[ -f "$stock_pkg" ] || { echo "stock package not in cache for rollback: $stock_pkg" >&2; exit 1; }
# Permission-protected backup of the encrypted keyring files, modes kept.
stamp=$(date +%Y%m%d-%H%M%S)
mkdir -p "$backup_root"; chmod 700 "$backup_root"
cp -a "$HOME/.local/share/keyrings" "$backup_root/keyrings-$stamp"
chmod -R go-rwx "$backup_root"
echo "backup: $backup_root/keyrings-$stamp"
sudo pacman -U --noconfirm "$pkg"
# Only the keyring service restarts; the socket unit stays. One unlock
# prompt is expected afterwards.
systemctl --user restart gnome-keyring-daemon.service
sleep 2
verify
;;
rollback)
sudo pacman -U --noconfirm "$stock_pkg"
systemctl --user restart gnome-keyring-daemon.service
sleep 2
verify
;;
verify)
verify
;;
*)
sed -n '2,13p' "$0"; exit 2 ;;
esac
|
