mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-02-20 22:15:28 +01:00
bootstrap-salt update
This commit is contained in:
Josh Patterson
@@ -26,7 +26,7 @@
|
||||
#======================================================================================================================
|
||||
set -o nounset # Treat unset variables as an error
|
||||
|
||||
__ScriptVersion="2025.09.03"
|
||||
__ScriptVersion="2026.01.22"
|
||||
__ScriptName="bootstrap-salt.sh"
|
||||
|
||||
__ScriptFullName="$0"
|
||||
@@ -369,7 +369,7 @@ __usage() {
|
||||
also be specified. Salt installation will be ommitted, but some of the
|
||||
dependencies could be installed to write configuration with -j or -J.
|
||||
-d Disables checking if Salt services are enabled to start on system boot.
|
||||
You can also do this by touching ${BS_TMP_DIR}/disable_salt_checks on the target
|
||||
You can also do this by touching ${_TMP_DIR}/disable_salt_checks on the target
|
||||
host. Default: \${BS_FALSE}
|
||||
-D Show debug output
|
||||
-f Force shallow cloning for git installations.
|
||||
@@ -2819,14 +2819,25 @@ __install_salt_from_repo() {
|
||||
${_pip_cmd} install --force-reinstall --break-system-packages "${_arch_dep}"
|
||||
fi
|
||||
|
||||
echodebug "Running '${_pip_cmd} install ${_USE_BREAK_SYSTEM_PACKAGES} --no-deps --force-reinstall ${_PIP_INSTALL_ARGS} ${_TMP_DIR}/git/deps/salt*.whl'"
|
||||
_PIP_VERSION_STRING=$(${_pip_cmd} --version)
|
||||
echodebug "Installed pip version: $_PIP_VERSION_STRING"
|
||||
_PIP_MAJOR_VERSION=$(echo "$_PIP_VERSION_STRING" | sed -E 's/^pip ([0-9]+)\..*/\1/')
|
||||
|
||||
echodebug "Running ${_pip_cmd} install ${_USE_BREAK_SYSTEM_PACKAGES} --no-deps --force-reinstall ${_PIP_INSTALL_ARGS} --global-option=--salt-config-dir=$_SALT_ETC_DIR --salt-cache-dir=${_SALT_CACHE_DIR} ${SETUP_PY_INSTALL_ARGS} ${_TMP_DIR}/git/deps/salt*.whl"
|
||||
|
||||
${_pip_cmd} install ${_USE_BREAK_SYSTEM_PACKAGES} --no-deps --force-reinstall \
|
||||
${_PIP_INSTALL_ARGS} \
|
||||
--global-option="--salt-config-dir=$_SALT_ETC_DIR --salt-cache-dir=${_SALT_CACHE_DIR} ${SETUP_PY_INSTALL_ARGS}" \
|
||||
${_TMP_DIR}/git/deps/salt*.whl || return 1
|
||||
# The following branching can be removed once we no longer support distros that still ship with
|
||||
# versions of `pip` earlier than v22.1 such as Debian 11
|
||||
if [ "$_PIP_MAJOR_VERSION" -lt 23 ]; then
|
||||
echodebug "Running ${_pip_cmd} install ${_USE_BREAK_SYSTEM_PACKAGES} --no-deps --force-reinstall ${_PIP_INSTALL_ARGS} --global-option=--salt-config-dir=$_SALT_ETC_DIR --salt-cache-dir=${_SALT_CACHE_DIR} ${SETUP_PY_INSTALL_ARGS} ${_TMP_DIR}/git/deps/salt*.whl"
|
||||
${_pip_cmd} install ${_USE_BREAK_SYSTEM_PACKAGES} --no-deps --force-reinstall \
|
||||
${_PIP_INSTALL_ARGS} \
|
||||
--global-option="--salt-config-dir=$_SALT_ETC_DIR --salt-cache-dir=${_SALT_CACHE_DIR} ${SETUP_PY_INSTALL_ARGS}" \
|
||||
${_TMP_DIR}/git/deps/salt*.whl || return 1
|
||||
else
|
||||
echodebug "Running ${_pip_cmd} install ${_USE_BREAK_SYSTEM_PACKAGES} --no-deps --force-reinstall ${_PIP_INSTALL_ARGS} --config-settings=--global-option=--salt-config-dir=$_SALT_ETC_DIR --salt-cache-dir=${_SALT_CACHE_DIR} ${SETUP_PY_INSTALL_ARGS} ${_TMP_DIR}/git/deps/salt*.whl"
|
||||
${_pip_cmd} install ${_USE_BREAK_SYSTEM_PACKAGES} --no-deps --force-reinstall \
|
||||
${_PIP_INSTALL_ARGS} \
|
||||
--config-settings="--global-option=--salt-config-dir=$_SALT_ETC_DIR --salt-cache-dir=${_SALT_CACHE_DIR} ${SETUP_PY_INSTALL_ARGS}" \
|
||||
${_TMP_DIR}/git/deps/salt*.whl || return 1
|
||||
fi
|
||||
|
||||
echoinfo "Checking if Salt can be imported using ${_py_exe}"
|
||||
CHECK_SALT_SCRIPT=$(cat << EOM
|
||||
@@ -6096,7 +6107,14 @@ install_arch_linux_git_deps() {
|
||||
}
|
||||
|
||||
install_arch_linux_onedir_deps() {
|
||||
echodebug "install_arch_linux_onedir_deps() entry"
|
||||
|
||||
# Basic tooling for download/verify/extract
|
||||
pacman -Sy --noconfirm --needed wget tar gzip gnupg ca-certificates || return 1
|
||||
|
||||
# Reuse stable deps for python-yaml etc. if you want config_salt() parity
|
||||
install_arch_linux_stable_deps || return 1
|
||||
return 0
|
||||
}
|
||||
|
||||
install_arch_linux_stable() {
|
||||
@@ -6111,7 +6129,73 @@ install_arch_linux_stable() {
|
||||
pacman -S --noconfirm --needed bash || return 1
|
||||
pacman -Su --noconfirm || return 1
|
||||
# We can now resume regular salt update
|
||||
pacman -Syu --noconfirm salt || return 1
|
||||
# Except that this hasn't been in arch repos for years;
|
||||
# so we have to build from AUR
|
||||
# We use "buildgirl" because Eve demanded it.
|
||||
build_user=${build_user:-buildgirl}
|
||||
userdel "$build_user" || true
|
||||
useradd -M -r -s /usr/bin/nologin "$build_user"
|
||||
echo "$build_user ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/"$build_user"
|
||||
rm -rf /tmp/yay-bin || true
|
||||
|
||||
git clone https://aur.archlinux.org/salt.git /tmp/yay-bin
|
||||
chown -R "$build_user":"$build_user" /tmp/yay-bin
|
||||
sudo -u "$build_user" env -i \
|
||||
HOME=/tmp \
|
||||
PATH=/usr/bin:/bin:/usr/sbin:/sbin \
|
||||
MAKEFLAGS="-j$(nproc)" \
|
||||
LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 \
|
||||
makepkg -CcsiD /tmp/yay-bin \
|
||||
--noconfirm --needed \
|
||||
--noprogressbar || return 1
|
||||
|
||||
rm -f /etc/sudoers.d/"$build_user"
|
||||
rm -rf /tmp/yay-bin
|
||||
userdel "$build_user"
|
||||
return 0
|
||||
}
|
||||
|
||||
install_arch_linux_onedir() {
|
||||
echodebug "install_arch_linux_onedir() entry"
|
||||
|
||||
version="${ONEDIR_REV:-latest}"
|
||||
arch="x86_64"
|
||||
[ "$(uname -m)" = "aarch64" ] && arch="aarch64"
|
||||
|
||||
# Resolve "latest" to actual version
|
||||
if [ "$version" = "latest" ]; then
|
||||
version=$(wget -qO- https://api.github.com/repos/saltstack/salt/releases/latest \
|
||||
| grep -Eo '"tag_name": *"v[0-9.]+"' \
|
||||
| sed 's/"tag_name": *"v//;s/"//') || return 1
|
||||
fi
|
||||
|
||||
tarball="salt-${version}-onedir-linux-${arch}.tar.xz"
|
||||
url="https://github.com/saltstack/salt/releases/download/v${version}/${tarball}"
|
||||
extractdir="/tmp/salt-${version}-onedir-linux-${arch}"
|
||||
|
||||
echoinfo "Downloading Salt onedir: $url"
|
||||
wget -q "$url" -O "/tmp/${tarball}" || return 1
|
||||
|
||||
# Validate tarball
|
||||
if ! tar -tf "/tmp/${tarball}" >/dev/null 2>&1; then
|
||||
echoerror "Invalid or corrupt onedir tarball"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Prepare extraction
|
||||
rm -rf "$extractdir" || true
|
||||
rm -rf /opt/saltstack/salt || true
|
||||
mkdir -p "$extractdir"
|
||||
|
||||
# Extract and flatten (remove leading 'salt/' directory)
|
||||
# /tmp/salt-${version}-onedir-linux-${arch}
|
||||
tar --strip-components=1 -xf "/tmp/${tarball}" -C "$extractdir"
|
||||
|
||||
# Place into /opt
|
||||
mkdir -p /opt/saltstack/salt
|
||||
mv "$extractdir"/* /opt/saltstack/salt/ || return 1
|
||||
chmod -R 755 /opt/saltstack/salt
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
@@ -6249,17 +6333,48 @@ install_arch_check_services() {
|
||||
return 0
|
||||
}
|
||||
|
||||
install_arch_linux_onedir() {
|
||||
install_arch_linux_stable || return 1
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
install_arch_linux_onedir_post() {
|
||||
install_arch_linux_post || return 1
|
||||
echodebug "install_arch_linux_onedir_post() entry"
|
||||
|
||||
return 0
|
||||
# Disable any distro/AUR salt units
|
||||
systemctl disable --now salt-minion.service 2>/dev/null || true
|
||||
systemctl disable --now salt-master.service 2>/dev/null || true
|
||||
|
||||
# Drop a clean unit, same pattern as Debian/Ubuntu onedir
|
||||
cat >/etc/systemd/system/salt-minion.service <<'EOF'
|
||||
[Unit]
|
||||
Description=Salt Minion (onedir)
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/opt/saltstack/salt/salt-minion -c /etc/salt
|
||||
Restart=always
|
||||
LimitNOFILE=100000
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload
|
||||
|
||||
# Add onedir paths system-wide
|
||||
cat >/etc/profile.d/saltstack.sh <<'EOF'
|
||||
export PATH=/opt/saltstack/salt:/opt/saltstack/salt/bin:$PATH
|
||||
EOF
|
||||
|
||||
chmod 644 /etc/profile.d/saltstack.sh
|
||||
|
||||
if [ "$_START_DAEMONS" -eq $BS_TRUE ]; then
|
||||
systemctl enable --now salt-minion.service
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
#
|
||||
# Ended Arch Install Functions
|
||||
#
|
||||
|
||||
Reference in New Issue
Block a user