new version 1.2.4

This commit is contained in:
MacRimi
2026-07-18 21:09:40 +02:00
parent 52d7e20979
commit 451f541342
21 changed files with 1069 additions and 176 deletions

View File

@@ -85,87 +85,167 @@ lvm_repair_check() {
cleanup_duplicate_repos_pve9() {
msg_info "$(translate "Cleaning up duplicate repositories...")"
local sources_file="/etc/apt/sources.list"
local temp_file=$(mktemp)
local cleaned_count=0
declare -A seen_repos
if [ ! -s "$sources_file" ]; then
return 0
fi
while IFS= read -r line || [[ -n "$line" ]]; do
if [[ "$line" =~ ^[[:space:]]*# ]] || [[ -z "$line" ]]; then
echo "$line" >> "$temp_file"
continue
fi
if [[ "$line" =~ ^deb ]]; then
read -r _ url dist components <<< "$line"
local key="${url}_${dist}"
if [[ -v "seen_repos[$key]" ]]; then
echo "# $line" >> "$temp_file"
cleaned_count=$((cleaned_count + 1))
msg_info "$(translate "Commented duplicate: $url $dist")"
local sources_file="/etc/apt/sources.list"
local cleaned_count=0
# Helper: extract a DEB822 field's value from a .sources file. Handles
# both `Field: value` and folded continuations. Returns the FIRST value
# only (URIs / Suites / Components with multiple entries are read as a
# single whitespace-separated string that callers split themselves).
_deb822_get() {
local file="$1" field="$2"
[[ -f "$file" ]] || return 1
awk -v F="$field" '
BEGIN{ IGNORECASE=1 }
/^[[:space:]]*$/{ next }
/^[^[:space:]]/{
if (match($0, "^"F"[[:space:]]*:[[:space:]]*")) {
print substr($0, RSTART+RLENGTH)
exit
}
}
' "$file"
}
# Helper: back up a file once before modifying, so an accidental
# comment-out is always recoverable next to the original.
_backup_once() {
local file="$1"
[[ -f "$file" ]] || return 0
local ts backup
ts=$(date +%Y%m%d_%H%M%S)
backup="${file}.proxmenux-backup.${ts}"
[[ -f "$backup" ]] || cp -a "$file" "$backup"
}
# ── Phase 1 — comment intra-file duplicates in sources.list by URL+Suite ──
if [ -s "$sources_file" ]; then
local temp_file
temp_file=$(mktemp)
declare -A seen_repos
local file_changed=0
while IFS= read -r line || [[ -n "$line" ]]; do
if [[ "$line" =~ ^[[:space:]]*# ]] || [[ -z "$line" ]]; then
echo "$line" >> "$temp_file"
continue
fi
if [[ "$line" =~ ^deb ]]; then
read -r _ url dist components <<< "$line"
local key="${url}_${dist}"
# Portable "is this associative-array key set?" — `[[ -v arr[key] ]]`
# is only reliable in bash 4.4+; `${var+set}` works everywhere.
if [[ -n "${seen_repos[$key]+set}" ]]; then
echo "# $line" >> "$temp_file"
cleaned_count=$((cleaned_count + 1))
file_changed=1
msg_info "$(translate "Commented duplicate: $url $dist")"
else
echo "$line" >> "$temp_file"
seen_repos[$key]="$components"
fi
else
echo "$line" >> "$temp_file"
seen_repos[$key]="$components"
fi
done < "$sources_file"
if [[ "$file_changed" -eq 1 ]]; then
_backup_once "$sources_file"
mv "$temp_file" "$sources_file"
chmod 644 "$sources_file"
else
echo "$line" >> "$temp_file"
fi
done < "$sources_file"
mv "$temp_file" "$sources_file"
chmod 644 "$sources_file"
if [ -f "/etc/apt/sources.list.d/proxmox.sources" ]; then
if grep -q "^deb.*download\.proxmox\.com" "$sources_file"; then
sed -i '/^deb.*download\.proxmox\.com/s/^/# /' "$sources_file"
cleaned_count=$((cleaned_count + 1))
fi
for list_file in /etc/apt/sources.list.d/pve-*.list; do
if [ -f "$list_file" ] && [[ "$list_file" != "/etc/apt/sources.list.d/pve-enterprise.list" ]]; then
if grep -q "^deb" "$list_file"; then
sed -i 's/^deb/# deb/g' "$list_file"
cleaned_count=$((cleaned_count + 1))
fi
fi
done
if [ -f "/etc/apt/sources.list.d/debian.sources" ]; then
if grep -q "^deb.*deb\.debian\.org" "$sources_file"; then
sed -i '/^deb.*deb\.debian\.org/s/^/# /' "$sources_file"
cleaned_count=$((cleaned_count + 1))
fi
if grep -q "^deb.*security\.debian\.org" "$sources_file"; then
sed -i '/^deb.*security\.debian\.org/s/^/# /' "$sources_file"
cleaned_count=$((cleaned_count + 1))
fi
rm -f "$temp_file"
fi
fi
# ── Phase 2 — comment lines duplicating what proxmox.sources already declares ──
# Comparison is EXACT on URL + Suite + at least one Component match, so a
# legitimate custom repo the user added under `download.proxmox.com` (e.g.
# /debian/pbs, /debian/ceph-squid, or the same URL pinned to a different
# suite) is preserved untouched.
if [ -f "/etc/apt/sources.list.d/proxmox.sources" ]; then
local pmx_uri pmx_suite pmx_comps
pmx_uri=$(_deb822_get /etc/apt/sources.list.d/proxmox.sources URIs)
pmx_suite=$(_deb822_get /etc/apt/sources.list.d/proxmox.sources Suites)
pmx_comps=$(_deb822_get /etc/apt/sources.list.d/proxmox.sources Components)
_match_and_comment() {
local target_file="$1" uri="$2" suite="$3" comps="$4"
[[ -f "$target_file" ]] || return 0
[[ -n "$uri" && -n "$suite" && -n "$comps" ]] || return 0
local base_uri="${uri#http://}"
base_uri="${base_uri#https://}"
base_uri="${base_uri%/}"
local first_comp
first_comp=$(awk '{print $1}' <<< "$comps")
local matched=0
while IFS= read -r ln; do
[[ "$ln" =~ ^[[:space:]]*# ]] && continue
[[ "$ln" =~ ^deb ]] || continue
read -r _ line_url line_suite line_comps <<< "$ln"
local ln_base="${line_url#http://}"
ln_base="${ln_base#https://}"
ln_base="${ln_base%/}"
[[ "$ln_base" == "$base_uri" ]] || continue
[[ "$line_suite" == "$suite" ]] || continue
[[ " $line_comps " == *" $first_comp "* ]] || continue
matched=1
break
done < "$target_file"
if [[ "$matched" -eq 1 ]]; then
_backup_once "$target_file"
# Anchored sed: reconstruct the exact deb prefix to avoid
# eating unrelated lines. Escape URL for regex safety.
local esc_uri esc_suite esc_comp
esc_uri=$(printf '%s' "$uri" | sed 's/[][\.^$*/]/\\&/g')
esc_suite=$(printf '%s' "$suite" | sed 's/[][\.^$*/]/\\&/g')
esc_comp=$(printf '%s' "$first_comp" | sed 's/[][\.^$*/]/\\&/g')
sed -i -E "/^deb[[:space:]]+${esc_uri}[[:space:]]+${esc_suite}[[:space:]]+.*(^| )${esc_comp}( |$)/s/^/# /" "$target_file"
cleaned_count=$((cleaned_count + 1))
fi
}
_match_and_comment "$sources_file" "$pmx_uri" "$pmx_suite" "$pmx_comps"
# Only walk a fixed allowlist of known-legacy PVE list files. Any
# other pve-*.list on disk is assumed to be user-authored (custom
# mirror, backports, staging) and left alone.
local legacy_pve_lists=(
/etc/apt/sources.list.d/pve-public-repo.list
/etc/apt/sources.list.d/pve-install-repo.list
/etc/apt/sources.list.d/pve-no-subscription.list
)
for legacy in "${legacy_pve_lists[@]}"; do
_match_and_comment "$legacy" "$pmx_uri" "$pmx_suite" "$pmx_comps"
done
# Same exact-match approach for debian.sources vs sources.list.
if [ -f "/etc/apt/sources.list.d/debian.sources" ]; then
local dbn_uri dbn_suite dbn_comps
dbn_uri=$(_deb822_get /etc/apt/sources.list.d/debian.sources URIs)
dbn_suite=$(_deb822_get /etc/apt/sources.list.d/debian.sources Suites)
dbn_comps=$(_deb822_get /etc/apt/sources.list.d/debian.sources Components)
# `Suites` in debian.sources holds multiple ("trixie trixie-updates"),
# walk each so both duplicates get commented if present.
for suite_iter in $dbn_suite; do
_match_and_comment "$sources_file" "$dbn_uri" "$suite_iter" "$dbn_comps"
done
fi
fi
# ── Phase 3 — remove ONLY the well-known legacy files, and only when the
# modern replacement already exists ──
if [ -f "/etc/apt/sources.list.d/proxmox.sources" ]; then
for old_file in /etc/apt/sources.list.d/pve-public-repo.list /etc/apt/sources.list.d/pve-install-repo.list; do
if [ -f "$old_file" ]; then
_backup_once "$old_file"
rm -f "$old_file"
cleaned_count=$((cleaned_count + 1))
fi
done
fi
if [ $cleaned_count -gt 0 ]; then
msg_ok "$(translate "Cleaned up $cleaned_count duplicate/old repositories")"
apt-get update > /dev/null 2>&1 || true
@@ -193,7 +273,7 @@ cleanup_duplicate_repos_pve9_() {
if [[ "$line" =~ ^deb ]]; then
read -r _ url dist components <<< "$line"
local key="${url}_${dist}"
if [[ -v "seen_repos[$key]" ]]; then
if [[ -n "${seen_repos[$key]+set}" ]]; then
echo "# $line" >> "$temp_file"
cleaned_count=$((cleaned_count + 1))
else
@@ -276,7 +356,7 @@ cleanup_duplicate_repos_pve8() {
if [[ "$line" =~ ^[[:space:]]*deb ]]; then
read -r _ url dist components <<< "$line"
local key="${url}_${dist}"
if [[ -v "seen_repos[$key]" ]]; then
if [[ -n "${seen_repos[$key]+set}" ]]; then
echo "# $line" >> "$temp_file"
cleaned_count=$((cleaned_count + 1))
else

View File

@@ -0,0 +1,267 @@
#!/bin/bash
# ==========================================================
# Proxmox VE Update Script — Safe / Non-Invasive Variant
# ==========================================================
# Author : MacRimi
# Copyright : (c) 2024 MacRimi
# License : GPL-3.0
# ==========================================================
# Description:
# Update path intended for a Proxmox host ALREADY in
# production. Unlike scripts/global/update-pve8.sh and
# update-pve9_2.sh (invoked by post_install), this variant
# NEVER modifies the operator's own configuration:
#
# - Does NOT disable Enterprise / Ceph repositories
# - Does NOT delete legacy repo files
# - Does NOT overwrite proxmox.sources / debian.sources
# when they already exist
# - Does NOT purge alternative NTP services
# - Does NOT force-install zfsutils / chrony /
# proxmox-backup-restore-image
# - Does NOT write no-firmware-warnings.conf
#
# What it DOES:
# 1. Sanity checks (disk space, network)
# 2. ensure_repositories() — only when repos are MISSING
# 3. apt-get update, with automatic GPG key import when apt
# reports NO_PUBKEY (any repo, user's or ours)
# 4. cleanup_duplicate_repos() — exact URL+Suite+Component
# match against proxmox.sources / debian.sources; leaves
# unrelated custom `download.proxmox.com/*` and
# user-authored pve-*.list files alone; backs each file
# up before modifying
# 5. Detect pending upgrades + security count
# 6. Confirmation dialog
# 7. apt-get full-upgrade with --force-confdef / --force-confold
# (never overwrites the operator's edited config files)
# 8. lvm_repair_check() — refreshes VG metadata when disks
# passed through to guest VMs (DSM, TrueNAS, …) come back
# with old PV headers
# 9. apt-get autoremove + autoclean
#
# Reboot detection is handled by the caller (utilities/proxmox_update.sh).
# ==========================================================
LOCAL_SCRIPTS="/usr/local/share/proxmenux/scripts"
BASE_DIR="/usr/local/share/proxmenux"
UTILS_FILE="$BASE_DIR/utils.sh"
APT_ENV="env DEBIAN_FRONTEND=noninteractive LC_ALL=C LANG=C"
if [[ -f "$UTILS_FILE" ]]; then
source "$UTILS_FILE"
fi
load_language
initialize_cache
download_common_functions() {
if ! source "$LOCAL_SCRIPTS/global/common-functions.sh"; then
return 1
fi
}
# ensure_repositories() lives with the install helpers.
source_install_functions() {
local f="$LOCAL_SCRIPTS/global/utils-install-functions.sh"
if [[ -f "$f" ]]; then
source "$f"
fi
}
update_pve_safe() {
local pve_version
pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+' | head -1)
if [[ -z "$pve_version" ]]; then
msg_error "$(translate "Unable to detect Proxmox version")"
return 1
fi
local start_time
start_time=$(date +%s)
local log_file="/var/log/proxmox-update-$(date +%Y%m%d-%H%M%S).log"
# Screen capture: replay the pre-upgrade context lines after `clear`
# so the operator keeps the visual history around the noisy apt run.
local screen_capture="/tmp/proxmenux_screen_capture_$$.txt"
: > "$screen_capture"
download_common_functions
source_install_functions
{
msg_info2 "$(translate "Detected: Proxmox VE $pve_version — running safe update path")"
} | tee -a "$screen_capture"
# ── 1. Sanity checks ──
local available_space
available_space=$(df /var/cache/apt/archives | awk 'NR==2 {print int($4/1024)}')
if [ "$available_space" -lt 1024 ]; then
msg_error "$(translate "Insufficient disk space. Available: ${available_space}MB")"
echo -e
msg_success "$(translate "Press Enter to return to menu...")"
read -r
rm -f "$screen_capture"
return 1
fi
if ! ping -c 1 download.proxmox.com >/dev/null 2>&1; then
msg_error "$(translate "Cannot reach Proxmox repositories")"
echo -e
msg_success "$(translate "Press Enter to return to menu...")"
read -r
rm -f "$screen_capture"
return 1
fi
# ── 2. ensure_repositories: adds base Proxmox+Debian repos only if
# they don't already exist. On a configured host this is a no-op. ──
if declare -f ensure_repositories >/dev/null 2>&1; then
ensure_repositories
fi
# ── 3. apt-get update with automatic key recovery ──
local update_output update_exit_code
update_output=$(apt-get update 2>&1)
update_exit_code=$?
if [ $update_exit_code -eq 0 ]; then
msg_ok "$(translate "Package lists updated successfully")" | tee -a "$screen_capture"
else
if echo "$update_output" | grep -Eq "NO_PUBKEY|GPG error"; then
local key
key=$(echo "$update_output" | sed -n 's/.*NO_PUBKEY \([0-9A-F]\{8,40\}\).*/\1/p' | head -1)
if [ -n "$key" ]; then
mkdir -p /etc/apt/keyrings
if command -v gpg >/dev/null 2>&1; then
if gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" \
&& gpg --batch --export "$key" | gpg --dearmor -o "/etc/apt/keyrings/${key}.gpg"; then
msg_ok "$(translate "Imported missing GPG key: $key")" | tee -a "$screen_capture"
else
msg_warn "$(translate "Keyrings method failed; trying apt-key fallback")"
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "$key" >/dev/null 2>&1 || true
fi
else
msg_warn "$(translate "gpg not found; trying apt-key fallback")"
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "$key" >/dev/null 2>&1 || true
fi
fi
if apt-get update > "$log_file" 2>&1; then
msg_ok "$(translate "Package lists updated after GPG fix")" | tee -a "$screen_capture"
else
msg_error "$(translate "Failed to update package lists. Check log: $log_file")"
rm -f "$screen_capture"
return 1
fi
elif echo "$update_output" | grep -Eq "404|Failed to fetch"; then
msg_warn "$(translate "Some repositories are not available, continuing with available ones...")"
else
msg_error "$(translate "Failed to update package lists. Check log: $log_file")"
echo "Error details: $update_output"
rm -f "$screen_capture"
return 1
fi
fi
# ── 4. Precise duplicate cleanup (exact URL+Suite+Component match,
# backs up files before modifying). Skipped if unavailable. ──
if declare -f cleanup_duplicate_repos >/dev/null 2>&1; then
cleanup_duplicate_repos
fi
# ── 5-6. Detect + confirm ──
local current_pve_version available_pve_version upgradable security_updates
current_pve_version=$(pveversion 2>/dev/null | grep -oP 'pve-manager/\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)
available_pve_version=$(apt-cache policy pve-manager 2>/dev/null | grep -oP 'Candidate: \K[0-9]+\.[0-9]+\.[0-9]+' | head -1)
upgradable=$($APT_ENV apt list --upgradable 2>/dev/null | sed '1d' | sed '/^\s*$/d' | wc -l)
security_updates=$($APT_ENV apt list --upgradable 2>/dev/null | sed '1d' | grep -ci '\-security')
local menu_text
menu_text="$(translate "System Update Information")\n\n"
menu_text+="$(translate "Current PVE Version"): $current_pve_version\n"
if [ -n "$available_pve_version" ] && [ "$available_pve_version" != "$current_pve_version" ]; then
menu_text+="$(translate "Available PVE Version"): $available_pve_version\n"
fi
menu_text+="\n$(translate "Package Updates Available"): $upgradable\n"
menu_text+="$(translate "Security Updates"): $security_updates\n\n"
if [ "$upgradable" -eq 0 ]; then
menu_text+="$(translate "System is already up to date")"
whiptail --title "$(translate "Update Status")" --msgbox "$menu_text" 15 70
apt-get -y autoremove >/dev/null 2>&1 || true
apt-get -y autoclean >/dev/null 2>&1 || true
rm -f "$screen_capture"
return 0
fi
menu_text+="$(translate "Do you want to proceed with the system update?")"
if ! whiptail --title "$(translate "Proxmox Update")" --yesno "$menu_text" 18 70; then
msg_info2 "$(translate "Update cancelled by user")"
apt-get -y autoremove >/dev/null 2>&1 || true
apt-get -y autoclean >/dev/null 2>&1 || true
rm -f "$screen_capture"
return 0
fi
# ── 7. Full upgrade — --force-confdef/confold preserves user-edited configs ──
# Redraw the ProxMenux frame before apt starts printing so the operator
# keeps the visual context around the noisy upgrade output.
clear
show_proxmenux_logo
msg_title "$(translate "$SCRIPT_TITLE")"
cat "$screen_capture"
# apt's own progress bar (Progress: [ %]) prints on stderr and only
# when stdout is a TTY. We pipe stderr through tee to keep a log copy
# while letting apt keep its interactive stdout, so the native bar
# keeps rendering at the bottom of the terminal as the user expects.
DEBIAN_FRONTEND=noninteractive apt -y \
-o Dpkg::Options::='--force-confdef' \
-o Dpkg::Options::='--force-confold' \
full-upgrade 2> >(tee -a "$log_file" >&2)
local upgrade_exit_code=$?
echo -e
# Redraw once more so the wrap-up (LVM check, cleanup, summary) reads
# cleanly instead of scrolling under half-a-screen of apt noise.
clear
show_proxmenux_logo
msg_title "$(translate "$SCRIPT_TITLE")"
cat "$screen_capture"
if [ $upgrade_exit_code -ne 0 ]; then
msg_error "$(translate "System upgrade failed. Check log: $log_file")"
rm -f "$screen_capture"
return 1
fi
msg_ok "$(translate "System upgrade completed")"
# ── 8. LVM header repair (only touches VGs actually flagged as stale) ──
if declare -f lvm_repair_check >/dev/null 2>&1; then
lvm_repair_check
fi
# ── 9. Final cleanup ──
apt-get -y autoremove >/dev/null 2>&1 || true
apt-get -y autoclean >/dev/null 2>&1 || true
msg_ok "$(translate "Cleanup finished")"
local end_time duration minutes seconds
end_time=$(date +%s)
duration=$((end_time - start_time))
minutes=$((duration / 60))
seconds=$((duration % 60))
echo -e "${TAB}${BGN}$(translate "====== PVE UPDATE COMPLETED ======")${CL}"
echo -e "${TAB}${GN}⏱️ $(translate "Duration")${CL}: ${BL}${minutes}m ${seconds}s${CL}"
echo -e "${TAB}${GN}📄 $(translate "Log file")${CL}: ${BL}$log_file${CL}"
echo -e "${TAB}${GN}📦 $(translate "Packages upgraded")${CL}: ${BL}$upgradable${CL}"
echo -e "${TAB}${GN}🖥️ $(translate "Proxmox VE")${CL}: ${BL}${available_pve_version:-$current_pve_version}${CL}"
msg_ok "$(translate "Proxmox VE safe update completed")"
rm -f "$screen_capture"
}
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
update_pve_safe
fi