mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-07-16 22:04:33 +02:00
Mike Reeves
8b488f9226
A failed highstate mid-upgrade left /etc/soversion already advanced to the target version (the highstate stamps it from the pillar via the soversionfile state), so a re-run of soup saw INSTALLEDVERSION == NEWVERSION and reported "already running the latest version", stranding the box with post-upgrade steps never run. Introduce /etc/sopostversion, a soup-owned marker (no salt state manages it) that records post-upgrade walk progress. It is seeded from the pre-upgrade version before the highstate, advanced after each post_to_* step, and removed on successful completion. upgrade_check treats a leftover marker as "upgrade not finished" and resumes the remaining post steps instead of bailing. Also fix the hotfix path: /etc/sohotfix was written before the hotfix highstate, so a failed hotfix highstate looked already-applied on re-run. Since no salt state manages /etc/sohotfix, defer its write (update_version) until after the highstate succeeds so it is an honest completion marker.