Ship one calls bundle, not two

- the image carried upstream's bundle beside ours for the same plugin id
- the server installed theirs first, then had to remove it, and that can fail,
  leaving an orphan directory and no calls plugin at all
- the base image has no shell, so the bundle is dropped in a stage
- troubleshooting entry for servers that already hit it

Closes #4

Author: dennisklappe

Containerfile

@@ -40,21 +40,33 @@ COPY config/overrides.json /overrides.json
 COPY scripts/merge-config.py /merge.py
 RUN python3 /merge.py /in.json /overrides.json /out.json
 
+# The prepackaged plugins, with exactly one bundle per plugin id.
+#
+# Upstream's calls bundle is removed rather than left to lose on version.
+# Winning on version describes where a start ends up, not how it gets there:
+# with both present the server installs upstream's first and then has to remove
+# it again to put ours in its place, and that removal can fail. When it does,
+# the install is abandoned and the plugin directory is left holding an orphan
+# webapp folder with no manifest and no binary, so the server comes up with no
+# calls plugin at all:
+#
+#   Removing existing installation of plugin before local install (1.12.2)
+#   removePlugin: unlinkat plugins/com.mattermost.calls: directory not empty
+#
+# The base image has no shell, so this is done in a stage and copied in, the
+# same way the web app is.
+FROM docker.io/library/alpine:3.20 AS plugins
+COPY --from=upstream /mattermost/prepackaged_plugins /out
+COPY mattermore-calls.tar.gz /out/mattermore-calls-linux-amd64.tar.gz
+RUN rm -f /out/mattermost-plugin-calls-v*.tar.gz /out/mattermost-plugin-calls-v*.tar.gz.sig
+
 FROM docker.io/mattermost/mattermost-team-edition:latest
 
 COPY --chown=2000:2000 mattermore-server /mattermost/bin/mattermost
 COPY --from=webapp --chown=2000:2000 /out /mattermost/client
 COPY --from=config --chown=2000:2000 --chmod=600 /out.json /mattermost/config/config.json
+COPY --from=plugins --chown=2000:2000 /out /mattermost/prepackaged_plugins
 
-# The plugin ships as a prepackaged bundle. Upstream refuses one without a
-# signature made with Mattermost's key, which no third party can produce, so
-# patches/server/0007 makes the signature optional for prepackaged plugins
-# while still verifying one that is present. RequirePluginSignature continues
-# to govern administrator uploads, which is a different trust boundary.
-#
-# The stock calls bundle is left in place deliberately: ours is version
-# 1000.12.3 and wins on version, so there is nothing to delete.
-COPY --chown=2000:2000 mattermore-calls.tar.gz /mattermost/prepackaged_plugins/mattermore-calls-linux-amd64.tar.gz
 
 # Group calls are switched on by upstream's own environment variable.
 ENV MM_CALLS_GROUP_CALLS_ALLOWED=true

site/src/content/docs/troubleshooting.md

@@ -97,6 +97,40 @@ prepackages. Confirm what is installed in System Console > Plugins > Calls. Our
 build shows as "Calls (Mattermore)". If it shows plain "Calls", reinstall
 Mattermore.
 
+## No calls plugin at all after an upgrade
+
+The call button is gone, the System Console lists no Calls plugin, and
+`mmctl plugin list` shows an empty enabled list.
+
+Images before the fix for this shipped **two** bundles for the same plugin id,
+Mattermore's and upstream's. On start the server installed upstream's first and
+then removed it again to put Mattermore's in place, and that removal can fail:
+
+```
+Removing existing installation of plugin before local install (existing_version 1.12.2)
+removePlugin: Unable to delete plugin., unlinkat plugins/com.mattermost.calls: directory not empty
+```
+
+The install is abandoned and what is left behind is a `com.mattermost.calls`
+directory holding an orphan `webapp` folder, with no manifest and no binary.
+
+Upgrading to an image that carries only one calls bundle stops it happening
+again, but the leftover directory has to be cleared by hand, because that is
+the thing the server cannot delete:
+
+```bash
+docker compose stop mattermost
+docker run --rm -v <project>_plugins:/p -v <project>_client-plugins:/c \
+  alpine sh -c 'rm -rf /p/com.mattermost.calls /c/com.mattermost.calls'
+docker compose start mattermost
+sleep 60
+docker compose exec -T mattermost /mattermost/bin/mmctl --local plugin list
+```
+
+The last command must report `Calls (Mattermore), Version: 1000.x.y`. Nothing
+else is lost: call settings live in the server config, not in the plugin
+directory.
+
 ## Large calls degrade
 
 Above roughly 50 participants, quality falls off.