From be7d8a2aa77d06ef5773b27ac2fba3fe05addaf9 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Wed, 15 Jul 2026 11:35:04 -0400 Subject: [PATCH] soup: make partial-upgrade state clear and avoid re-running completed upgrades After a partial upgrade, /etc/soversion already reads the target version, so soup's startup line "Found that Security Onion X is currently installed" made it look finished even as soup resumed. When a resume marker is present and differs from the installed version, print an explicit NOTE that the grid is only partially upgraded and this run will resume and complete it. Also clear any stale resume marker in the already-latest path so a successfully completed upgrade is never mistaken for a partial one and re-run on a later invocation (the marker is normally removed at the end of postupgrade_changes; this is a belt-and-suspenders guard). --- salt/manager/tools/sbin/soup | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 4fcdfebf9..1200fc423 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -1118,6 +1118,10 @@ upgrade_check() { fi echo "Checking to see if there are hotfixes needed" if [ "$HOTFIXVERSION" == "$CURRENTHOTFIX" ]; then + # Reaching here means we are at the target version and NOT resuming (the resume + # check above returned otherwise). Clear any stale resume marker so a completed + # upgrade is never mistaken for a partial one and re-run on a later invocation. + rm -f "$POSTVERSION_FILE" echo "You are already running the latest version of Security Onion." exit 0 else @@ -1813,6 +1817,15 @@ main() { set_minionid MINION_ROLE=$(lookup_role) echo "Found that Security Onion $INSTALLEDVERSION is currently installed." + # /etc/soversion is stamped to the target version before the upgrade fully + # completes, so a lingering resume marker means this grid is only partially + # upgraded even though the line above shows the target version. Make that explicit + # so it is not mistaken for a finished upgrade. + if [ -f "$POSTVERSION_FILE" ] && [ "$(cat "$POSTVERSION_FILE")" != "$INSTALLEDVERSION" ]; then + echo "" + echo "NOTE: A previous upgrade to $INSTALLEDVERSION did not finish. This grid is" + echo " partially upgraded and this soup run will resume and complete it." + fi echo "" check_minimum_version