fix(offline): honor OFFLINE_WORK in git-ref2info and memoize TTL

Fixes #6439.

memoized_git_ref_to_info() unconditionally ran 'git ls-remote' against the
upstream source even with OFFLINE_WORK=yes; when the remote was unreachable
the build aborted with a misleading network error.

Two coordinated guards:

* memoize-cached.sh: when OFFLINE_WORK=yes, serve the cache file regardless
  of TTL (alternative is a network call that will fail). The "stale cache
  served" event is logged.

* git-ref2info.sh: early offline guard before the ls-remote loop. For
  ref_type=commit the SHA1 is taken from the ref itself (no network); for
  branch/tag we look up a pinned SHA1 in config/sources/git_sources.json.
  If neither is available, exit_with_error with a clear message instead
  of letting curl/ls-remote surface as 502.

  Same guard applied to the include_makefile_body block (curl to git host)
  since there is no local-bare fallback in scope here.

Behaviour matrix unchanged for OFFLINE_WORK=no (default).

Assisted-by: Claude:claude-opus-4.7

Author: iav

lib/functions/general/git-ref2info.sh

@@ -7,6 +7,16 @@
 # This file is a part of the Armbian Build Framework
 # https://github.com/armbian/build/
 
+# Returns the pinned sha1 for a given git source+branch from
+# config/sources/git_sources.json, or nothing if the file or entry is absent.
+# Uses jq --arg so source/branch values can't break or inject into the jq program.
+function _git_sources_pinned_sha1() {
+	declare json="${SRC}/config/sources/git_sources.json"
+	[[ -f "${json}" ]] || return 0
+	jq --raw-output --arg s "${1}" --arg b "${2}" \
+		'[.[] | select(.source == $s and .branch == $b) | .sha1] | first // empty' "${json}"
+}
+
 # This works under memoize-cached.sh::run_memoized() -- which is full of tricks.
 # Nested functions are used because the source of the momoized function is used as part of the cache hash.
 function memoized_git_ref_to_info() {
@@ -31,6 +41,21 @@ function memoized_git_ref_to_info() {
 	# Get the SHA1 of the commit
 	declare sha1
 
+	# OFFLINE_WORK guard: do not perform 'git ls-remote' when offline (#6439).
+	# Honored sources, in order: ref_type=commit (sha1 from ref itself); pinned in
+	# config/sources/git_sources.json (branch refs only). If neither yields a sha1 we
+	# fail with a clear message instead of letting the network call surface as a
+	# misleading 502/timeout.
+	if [[ "${OFFLINE_WORK}" == "yes" && "${ref_type}" != "commit" ]]; then
+		sha1="$(_git_sources_pinned_sha1 "${MEMO_DICT[GIT_SOURCE]}" "${ref_name}")"
+		if [[ "${sha1}" =~ ^[0-9a-f]{40}$ ]]; then
+			display_alert "OFFLINE_WORK: using pinned SHA1 from git_sources.json" "${ref_name} -> ${sha1}" "info"
+			refs_to_try=() # skip ls-remote loop below
+		else
+			exit_with_error "OFFLINE_WORK=yes but no SHA1 available for '${MEMO_DICT[GIT_SOURCE]}' '${ref_type}' '${ref_name}' - run online once to populate cache, or pin sha1 in config/sources/git_sources.json"
+		fi
+	fi
+
 	# Enter loop. The first that resolves to a valid sha1 wins.
 	declare to_try
 	for to_try in "${refs_to_try[@]}"; do
@@ -93,10 +118,15 @@ function memoized_git_ref_to_info() {
 		} 5<> "${SRC}"/output/info/git_sources.json 6<> "${SRC}"/output/info/git_sources.json.new
 	fi
 
-	if [[ -f "${SRC}"/config/sources/git_sources.json && ${ref_type} == "branch" ]]; then
-		cached_revision=$(jq --raw-output '.[] | select(.source == "'${MEMO_DICT[GIT_SOURCE]}'" and .branch == "'$ref_name'") |.sha1' "${SRC}"/config/sources/git_sources.json)
-		display_alert "Found cached git version" "${cached_revision}" "info"
-		[[ -z "${cached_revision}" ]] || sha1=${cached_revision}
+	if [[ "${ref_type}" == "branch" ]]; then
+		declare cached_revision
+		cached_revision="$(_git_sources_pinned_sha1 "${MEMO_DICT[GIT_SOURCE]}" "${ref_name}")"
+		if [[ "${cached_revision}" =~ ^[0-9a-f]{40}$ ]]; then
+			display_alert "Found cached git version" "${cached_revision}" "info"
+			sha1="${cached_revision}"
+		elif [[ -n "${cached_revision}" ]]; then
+			exit_with_error "Invalid pinned SHA1 '${cached_revision}' for '${MEMO_DICT[GIT_SOURCE]}' '${ref_name}' in config/sources/git_sources.json"
+		fi
 	fi
 
 	MEMO_DICT+=(["SHA1"]="${sha1}")
@@ -228,6 +258,14 @@ function memoized_git_ref_to_info() {
 			return 0
 		}
 
+		# OFFLINE_WORK guard: Makefile body is fetched via curl to git host(s) — no
+		# network when offline. We have no local fallback here (no bare-clone path in
+		# scope), so fail with a clear message instead of letting curl surface as a
+		# misleading 'undetermined' kernel version downstream (#6439).
+		if [[ "${OFFLINE_WORK}" == "yes" ]]; then
+			exit_with_error "OFFLINE_WORK=yes but Makefile body for '${MEMO_DICT[GIT_SOURCE]}' '${ref_name}' (sha1 ${sha1}) not in cache - run online once to populate ${SRC}/cache/memoize/"
+		fi
+
 		display_alert "Fetching Makefile body" "${ref_name}" "debug"
 		declare makefile_body makefile_url
 		declare makefile_version makefile_codename makefile_full_version

lib/functions/general/memoize-cached.sh

@@ -50,8 +50,8 @@ function run_memoized() {
 		# Lock is held by another process, inform user and wait with periodic feedback
 		display_alert "Waiting for lock" "another build may be running; check: docker ps -a | grep armbian" "info"
 
-		declare -i lock_wait_interval=${MEMOIZE_FLOCK_WAIT_INTERVAL:-10}  # seconds between retries/messages
-		declare -i lock_max_wait=${MEMOIZE_FLOCK_MAX_WAIT:-0}             # 0 = infinite (default for compatibility)
+		declare -i lock_wait_interval=${MEMOIZE_FLOCK_WAIT_INTERVAL:-10} # seconds between retries/messages
+		declare -i lock_max_wait=${MEMOIZE_FLOCK_MAX_WAIT:-0}            # 0 = infinite (default for compatibility)
 		declare -i lock_total_wait=0
 		declare -i lock_acquired=0
 
@@ -79,8 +79,17 @@ function run_memoized() {
 	if [[ -f "${disk_cache_file}" ]]; then
 		declare disk_cache_file_mtime_seconds
 		disk_cache_file_mtime_seconds="$(stat -c %Y "${disk_cache_file}")"
-		# if disk_cache_file is older than the ttl, delete it and continue.
+		declare cache_is_stale="no"
 		if [[ "${disk_cache_file_mtime_seconds}" -lt "$(($(date +%s) - memoize_cache_ttl))" ]]; then
+			cache_is_stale="yes"
+		fi
+		# OFFLINE_WORK: serve any cached entry regardless of TTL — the alternative is
+		# a network call that will fail (#6439). Surface that we're using a stale entry.
+		if [[ "${cache_is_stale}" == "yes" && "${OFFLINE_WORK}" == "yes" ]]; then
+			display_alert "OFFLINE_WORK: using stale cache" "${var_n}" "info"
+			cache_is_stale="no"
+		fi
+		if [[ "${cache_is_stale}" == "yes" ]]; then
 			display_alert "Deleting stale cache file" "${disk_cache_file}" "debug"
 			rm -f "${disk_cache_file}"
 		else