deb: make helper scripts fail safely

The post-install script could report success after an account or ownership operation failed, and the package build helper selected broad archive and source-tree globs that could consume stale artifacts.

Enable immediate post-install failure propagation and derive the exact package version, archive, and staging tree from configure.ac. The build helper now recreates only that version's generated inputs instead of selecting arbitrary glob matches.

Author: stevegrubb

deb/build_deb.sh

@@ -1,29 +1,56 @@
 #! /bin/bash
 
-set -e
+set -euo pipefail
+
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+top_dir=$(cd -- "${script_dir}/.." && pwd)
+version=$(sed -n 's/^AC_INIT(\[fapolicyd\],\[\([^]]*\)\].*/\1/p' \
+	"${top_dir}/configure.ac")
+if [ "${version}" = "" ] ; then
+	echo "Unable to determine fapolicyd version" >&2
+	exit 1
+fi
+
+dist_dir="fapolicyd-${version}"
+source_archive="${top_dir}/${dist_dir}.tar.gz"
+build_archive="${script_dir}/${dist_dir}.tar.gz"
+source_dir="${script_dir}/${dist_dir}"
+
+# make dist otherwise reuses an existing archive, which may not match the
+# current source tree.
+rm -f "${source_archive}"
+make -C "${top_dir}" dist
+if [ ! -f "${source_archive}" ] ; then
+	echo "Expected distribution archive ${source_archive} was not created" >&2
+	exit 1
+fi
+
+# Recreate only this version's packaging tree so repeated runs cannot select
+# stale archives or unpack over the previous debmake output.
+rm -rf "${source_dir}"
+cp "${source_archive}" "${build_archive}"
+tar -xzf "${build_archive}" -C "${script_dir}"
+if [ ! -d "${source_dir}" ] ; then
+	echo "Expected distribution directory ${source_dir} was not extracted" >&2
+	exit 1
+fi
 
-cd .. || exit 1
-make dist
-cd deb || exit 1
-cp ../fapolicyd-*.tar.gz .
-
-tar zxvf fapolicyd-*.tar.gz
 
 (
-	cd fapolicyd-*/ || exit 1
+	cd "${source_dir}"
 
 	# Ugly work around for INSTALL.tmp
 	# Need to figure out proper fix.
 	mv INSTALL INSTALL.tmp
 )
 
-tar zcvf fapolicyd-*.tar.gz fapolicyd-*/
-cd fapolicyd-*/ || exit 1
+tar -C "${script_dir}" -czf "${build_archive}" "${dist_dir}"
+cd "${source_dir}"
 
 debmake
 
-cp ../rules debian/
-cp ../postinst debian/
-cp ../README.Debian debian/
+cp "${script_dir}/rules" debian/
+cp "${script_dir}/postinst" debian/
+cp "${script_dir}/README.Debian" debian/
 
 debuild

deb/postinst

@@ -1,5 +1,7 @@
 #! /bin/sh
 
+set -e
+
 adduser --system --group fapolicyd
 mkdir -p /etc/fapolicyd/rules.d
 mkdir -p /etc/fapolicyd/trust.d
@@ -12,4 +14,3 @@ chown fapolicyd:fapolicyd /var/lib/fapolicyd/
 chown root:fapolicyd /run/fapolicyd/
 chmod 0770 /run/fapolicyd/
 
-