587 lines
15 KiB
Bash
587 lines
15 KiB
Bash
#!/bin/bash
|
||
# patch_applier.sh - 企业级补丁包应用脚本
|
||
|
||
set -euo pipefail
|
||
shopt -s nullglob extglob
|
||
|
||
# 脚本目录
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
CONFIG_FILE="${SCRIPT_DIR}/patch_config.sh"
|
||
|
||
# 颜色定义
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
BLUE='\033[0;34m'
|
||
PURPLE='\033[0;35m'
|
||
CYAN='\033[0;36m'
|
||
NC='\033[0m'
|
||
|
||
# 日志函数
|
||
log() {
|
||
local level="$1"
|
||
local message="$2"
|
||
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
||
|
||
case "$level" in
|
||
"INFO") color="$GREEN" ;;
|
||
"WARN") color="$YELLOW" ;;
|
||
"ERROR") color="$RED" ;;
|
||
"DEBUG") color="$BLUE" ;;
|
||
*) color="$NC" ;;
|
||
esac
|
||
|
||
echo -e "${color}[$timestamp] [$level]${NC} $message" | tee -a "$LOG_FILE"
|
||
}
|
||
|
||
info() { log "INFO" "$1"; }
|
||
warn() { log "WARN" "$1"; }
|
||
error() { log "ERROR" "$1"; }
|
||
debug() { log "DEBUG" "$1"; }
|
||
|
||
# 配置和初始化
|
||
load_config() {
|
||
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||
error "配置文件不存在: $CONFIG_FILE"
|
||
exit 1
|
||
fi
|
||
|
||
source "$CONFIG_FILE"
|
||
info "配置文件加载完成"
|
||
|
||
# 设置默认值
|
||
: ${LOG_LEVEL:="INFO"}
|
||
: ${LOG_FILE:="/tmp/patch_apply_$(date +%Y%m%d_%H%M%S).log"}
|
||
: ${BACKUP_DIR:="/var/backups/patch"}
|
||
: ${TEMP_DIR:="/tmp/patch_apply_$$"}
|
||
}
|
||
|
||
setup_environment() {
|
||
mkdir -p "$(dirname "$LOG_FILE")"
|
||
mkdir -p "$BACKUP_DIR"
|
||
mkdir -p "$TEMP_DIR"
|
||
|
||
info "日志文件: $LOG_FILE"
|
||
info "备份目录: $BACKUP_DIR"
|
||
info "临时目录: $TEMP_DIR"
|
||
}
|
||
|
||
cleanup() {
|
||
if [[ -d "$TEMP_DIR" ]]; then
|
||
rm -rf "$TEMP_DIR"
|
||
info "临时目录已清理: $TEMP_DIR"
|
||
fi
|
||
}
|
||
|
||
trap cleanup EXIT
|
||
|
||
# 验证函数
|
||
verify_package() {
|
||
local package_path="$1"
|
||
|
||
info "开始验证补丁包: $package_path"
|
||
|
||
# 检查文件存在性
|
||
if [[ ! -f "$package_path" ]]; then
|
||
error "补丁包不存在: $package_path"
|
||
return 1
|
||
fi
|
||
|
||
# 检查文件大小
|
||
local size=$(stat -c%s "$package_path" 2>/dev/null || echo "0")
|
||
if [[ $size -eq 0 ]]; then
|
||
error "补丁包为空: $package_path"
|
||
return 1
|
||
fi
|
||
|
||
# 验证校验和
|
||
if [[ -f "${package_path}.sha256" ]]; then
|
||
info "验证校验和..."
|
||
if sha256sum -c "${package_path}.sha256" >/dev/null 2>&1; then
|
||
info "✅ 校验和验证通过"
|
||
else
|
||
error "❌ 校验和验证失败"
|
||
return 1
|
||
fi
|
||
fi
|
||
|
||
# 验证签名
|
||
if [[ -f "${package_path}.sig" ]]; then
|
||
info "验证签名..."
|
||
if command -v gpg >/dev/null 2>&1; then
|
||
if gpg --verify "${package_path}.sig" "$package_path" >/dev/null 2>&1; then
|
||
info "✅ 签名验证通过"
|
||
else
|
||
error "❌ 签名验证失败"
|
||
return 1
|
||
fi
|
||
else
|
||
warn "GPG未安装，跳过签名验证"
|
||
fi
|
||
fi
|
||
|
||
# 验证压缩包完整性
|
||
if ! tar -tzf "$package_path" >/dev/null 2>&1; then
|
||
error "❌ 压缩包损坏或格式错误"
|
||
return 1
|
||
fi
|
||
|
||
info "✅ 补丁包验证通过"
|
||
return 0
|
||
}
|
||
|
||
# 备份函数
|
||
create_backup() {
|
||
local backup_name="backup_$(date +%Y%m%d_%H%M%S)"
|
||
local backup_path="$BACKUP_DIR/$backup_name.tar.gz"
|
||
|
||
info "创建应用前备份: $backup_path"
|
||
|
||
# 获取需要备份的文件列表
|
||
local files_to_backup=()
|
||
while IFS='|' read -r change_type path old_info new_info; do
|
||
case "$change_type" in
|
||
"MODIFIED"|"DELETED")
|
||
local target_file="$path"
|
||
if [[ -f "$target_file" ]]; then
|
||
files_to_backup+=("$target_file")
|
||
fi
|
||
;;
|
||
esac
|
||
done < "$TEMP_DIR/changes.txt"
|
||
|
||
if [[ ${#files_to_backup[@]} -eq 0 ]]; then
|
||
info "无需备份文件"
|
||
return 0
|
||
fi
|
||
|
||
# 创建备份
|
||
tar -czf "$backup_path" "${files_to_backup[@]}"
|
||
|
||
local backup_size=$(du -h "$backup_path" | cut -f1)
|
||
info "✅ 备份创建完成: $backup_path ($backup_size)"
|
||
echo "$backup_path"
|
||
}
|
||
|
||
# 补丁应用函数
|
||
extract_package() {
|
||
local package_path="$1"
|
||
local extract_dir="$2"
|
||
|
||
info "解压补丁包到: $extract_dir"
|
||
|
||
mkdir -p "$extract_dir"
|
||
|
||
if tar -xzf "$package_path" -C "$extract_dir"; then
|
||
info "✅ 补丁包解压完成"
|
||
return 0
|
||
else
|
||
error "❌ 补丁包解压失败"
|
||
return 1
|
||
fi
|
||
}
|
||
|
||
apply_file_changes() {
|
||
local patch_dir="$1"
|
||
|
||
info "开始应用文件变更..."
|
||
|
||
local applied_count=0
|
||
local failed_count=0
|
||
|
||
# 读取变更清单
|
||
local manifest_file="$patch_dir/MANIFEST.MF"
|
||
if [[ ! -f "$manifest_file" ]]; then
|
||
error "清单文件不存在: $manifest_file"
|
||
return 1
|
||
fi
|
||
|
||
# 处理每个变更
|
||
while IFS='|' read -r change_type path extra_info; do
|
||
case "$change_type" in
|
||
"ADDED"|"MODIFIED")
|
||
apply_file_addition_modification "$patch_dir" "$path" "$change_type"
|
||
result=$?
|
||
;;
|
||
"DELETED")
|
||
apply_file_deletion "$path"
|
||
result=$?
|
||
;;
|
||
*)
|
||
warn "未知变更类型: $change_type"
|
||
result=1
|
||
;;
|
||
esac
|
||
|
||
if [[ $result -eq 0 ]]; then
|
||
((applied_count++))
|
||
else
|
||
((failed_count++))
|
||
fi
|
||
done < <(grep -E "^(ADDED|MODIFIED|DELETED)" "$manifest_file")
|
||
|
||
info "文件变更应用完成: $applied_count 成功, $failed_count 失败"
|
||
|
||
if [[ $failed_count -gt 0 ]]; then
|
||
return 1
|
||
fi
|
||
return 0
|
||
}
|
||
|
||
apply_file_addition_modification() {
|
||
local patch_dir="$1"
|
||
local file_path="$2"
|
||
local change_type="$3"
|
||
|
||
local source_file="$patch_dir/files/$file_path"
|
||
local target_file="/$file_path" # 绝对路径
|
||
local target_dir=$(dirname "$target_file")
|
||
|
||
# 检查源文件是否存在
|
||
if [[ ! -f "$source_file" ]]; then
|
||
error "源文件不存在: $source_file"
|
||
return 1
|
||
fi
|
||
|
||
# 创建目标目录
|
||
if [[ ! -d "$target_dir" ]]; then
|
||
mkdir -p "$target_dir"
|
||
debug "创建目录: $target_dir"
|
||
fi
|
||
|
||
# 备份原文件（如果是修改操作）
|
||
if [[ "$change_type" == "MODIFIED" ]] && [[ -f "$target_file" ]]; then
|
||
local backup_file="$TEMP_DIR/backup/$file_path"
|
||
mkdir -p "$(dirname "$backup_file")"
|
||
cp -p "$target_file" "$backup_file"
|
||
debug "备份原文件: $target_file -> $backup_file"
|
||
fi
|
||
|
||
# 复制文件
|
||
if cp -p "$source_file" "$target_file"; then
|
||
# 设置权限（从清单中读取）
|
||
set_file_permissions "$target_file" "$change_type"
|
||
info "✅ 应用文件: $file_path ($change_type)"
|
||
return 0
|
||
else
|
||
error "❌ 文件应用失败: $file_path"
|
||
return 1
|
||
fi
|
||
}
|
||
|
||
apply_file_deletion() {
|
||
local file_path="$1"
|
||
local target_file="/$file_path"
|
||
|
||
if [[ ! -f "$target_file" ]]; then
|
||
warn "文件不存在，无需删除: $target_file"
|
||
return 0
|
||
fi
|
||
|
||
# 备份文件
|
||
local backup_file="$TEMP_DIR/backup/$file_path"
|
||
mkdir -p "$(dirname "$backup_file")"
|
||
cp -p "$target_file" "$backup_file"
|
||
|
||
# 删除文件
|
||
if rm -f "$target_file"; then
|
||
info "✅ 删除文件: $file_path"
|
||
|
||
# 尝试删除空目录
|
||
local parent_dir=$(dirname "$target_file")
|
||
while [[ "$parent_dir" != "/" ]] && rmdir "$parent_dir" 2>/dev/null; do
|
||
debug "删除空目录: $parent_dir"
|
||
parent_dir=$(dirname "$parent_dir")
|
||
done
|
||
|
||
return 0
|
||
else
|
||
error "❌ 文件删除失败: $file_path"
|
||
return 1
|
||
fi
|
||
}
|
||
|
||
set_file_permissions() {
|
||
local file_path="$1"
|
||
local change_type="$2"
|
||
|
||
# 根据文件类型设置权限
|
||
case "$file_path" in
|
||
*.sh|*.bash)
|
||
chmod 755 "$file_path"
|
||
;;
|
||
*.php|*.py|*.pl)
|
||
chmod 644 "$file_path"
|
||
;;
|
||
/etc/*|/var/www/*)
|
||
chmod 644 "$file_path"
|
||
;;
|
||
*)
|
||
chmod 644 "$file_path"
|
||
;;
|
||
esac
|
||
|
||
debug "设置权限: $file_path -> $(stat -c %a "$file_path")"
|
||
}
|
||
|
||
# 验证应用结果
|
||
verify_application() {
|
||
local patch_dir="$1"
|
||
|
||
info "开始验证应用结果..."
|
||
|
||
local manifest_file="$patch_dir/MANIFEST.MF"
|
||
local verification_passed=true
|
||
|
||
while IFS='|' read -r change_type path extra_info; do
|
||
case "$change_type" in
|
||
"ADDED"|"MODIFIED")
|
||
if ! verify_file_application "$path" "$change_type" "$patch_dir"; then
|
||
verification_passed=false
|
||
fi
|
||
;;
|
||
"DELETED")
|
||
if ! verify_file_deletion "$path"; then
|
||
verification_passed=false
|
||
fi
|
||
;;
|
||
esac
|
||
done < <(grep -E "^(ADDED|MODIFIED|DELETED)" "$manifest_file")
|
||
|
||
if $verification_passed; then
|
||
info "✅ 应用验证通过"
|
||
return 0
|
||
else
|
||
error "❌ 应用验证失败"
|
||
return 1
|
||
fi
|
||
}
|
||
|
||
verify_file_application() {
|
||
local file_path="$1"
|
||
local change_type="$2"
|
||
local patch_dir="$3"
|
||
|
||
local target_file="/$file_path"
|
||
local source_file="$patch_dir/files/$file_path"
|
||
|
||
# 检查文件是否存在
|
||
if [[ ! -f "$target_file" ]]; then
|
||
error "❌ 文件不存在: $target_file"
|
||
return 1
|
||
fi
|
||
|
||
# 检查文件内容
|
||
local source_hash=$(sha256sum "$source_file" | cut -d' ' -f1)
|
||
local target_hash=$(sha256sum "$target_file" | cut -d' ' -f1)
|
||
|
||
if [[ "$source_hash" != "$target_hash" ]]; then
|
||
error "❌ 文件内容不匹配: $file_path"
|
||
return 1
|
||
fi
|
||
|
||
debug "✅ 文件验证通过: $file_path"
|
||
return 0
|
||
}
|
||
|
||
verify_file_deletion() {
|
||
local file_path="$1"
|
||
local target_file="/$file_path"
|
||
|
||
if [[ -f "$target_file" ]]; then
|
||
error "❌ 文件未成功删除: $target_file"
|
||
return 1
|
||
fi
|
||
|
||
debug "✅ 文件删除验证通过: $file_path"
|
||
return 0
|
||
}
|
||
|
||
# 回滚准备
|
||
create_rollback_point() {
|
||
local patch_path="$1"
|
||
local backup_path="$2"
|
||
|
||
local rollback_info_file="$BACKUP_DIR/rollback_info.json"
|
||
local patch_name=$(basename "$patch_path")
|
||
local timestamp=$(date +%Y%m%d_%H%M%S)
|
||
|
||
local rollback_info=$(cat << EOF
|
||
{
|
||
"patch_name": "$patch_name",
|
||
"apply_time": "$(date -Iseconds)",
|
||
"backup_path": "$backup_path",
|
||
"rollback_path": "$BACKUP_DIR/rollback_${timestamp}.tar.gz",
|
||
"status": "applied"
|
||
}
|
||
EOF
|
||
)
|
||
|
||
echo "$rollback_info" > "$rollback_info_file"
|
||
info "回滚点创建完成: $rollback_info_file"
|
||
}
|
||
|
||
# 通知函数
|
||
send_application_notification() {
|
||
local status="$1"
|
||
local patch_path="$2"
|
||
local message="$3"
|
||
|
||
if [[ "$NOTIFICATIONS_ENABLED" != "true" ]]; then
|
||
return 0
|
||
fi
|
||
|
||
case "$status" in
|
||
"start")
|
||
local subject="补丁应用开始"
|
||
local color="#3498db"
|
||
;;
|
||
"success")
|
||
local subject="补丁应用成功"
|
||
local color="#2ecc71"
|
||
;;
|
||
"failure")
|
||
local subject="补丁应用失败"
|
||
local color="#e74c3c"
|
||
;;
|
||
*)
|
||
local subject="补丁应用通知"
|
||
local color="#95a5a6"
|
||
;;
|
||
esac
|
||
|
||
# Slack通知
|
||
if [[ -n "$SLACK_WEBHOOK" ]]; then
|
||
send_slack_notification "$subject" "$message" "$color"
|
||
fi
|
||
}
|
||
|
||
send_slack_notification() {
|
||
local subject="$1"
|
||
local message="$2"
|
||
local color="$3"
|
||
|
||
local payload=$(cat << EOF
|
||
{
|
||
"attachments": [
|
||
{
|
||
"color": "$color",
|
||
"title": "$subject",
|
||
"text": "$message",
|
||
"fields": [
|
||
{
|
||
"title": "补丁文件",
|
||
"value": "$(basename "$PATCH_PATH")",
|
||
"short": true
|
||
},
|
||
{
|
||
"title": "应用时间",
|
||
"value": "$(date)",
|
||
"short": true
|
||
},
|
||
{
|
||
"title": "应用主机",
|
||
"value": "$(hostname)",
|
||
"short": true
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
EOF
|
||
)
|
||
|
||
if command -v curl >/dev/null 2>&1; then
|
||
curl -s -X POST -H 'Content-type: application/json' \
|
||
--data "$payload" "$SLACK_WEBHOOK" >/dev/null && \
|
||
info "Slack通知发送成功"
|
||
fi
|
||
}
|
||
|
||
# 主应用函数
|
||
apply_patch() {
|
||
local patch_path="$1"
|
||
local dry_run="${2:-false}"
|
||
|
||
info "开始应用补丁包: $patch_path"
|
||
send_application_notification "start" "$patch_path" "开始应用补丁"
|
||
|
||
# 验证补丁包
|
||
if ! verify_package "$patch_path"; then
|
||
error "补丁包验证失败"
|
||
send_application_notification "failure" "$patch_path" "补丁包验证失败"
|
||
return 1
|
||
fi
|
||
|
||
# 解压补丁包
|
||
local extract_dir="$TEMP_DIR/extract"
|
||
if ! extract_package "$patch_path" "$extract_dir"; then
|
||
send_application_notification "failure" "$patch_path" "补丁包解压失败"
|
||
return 1
|
||
fi
|
||
|
||
# 如果是干跑模式，只验证不应用
|
||
if [[ "$dry_run" == "true" ]]; then
|
||
info "干跑模式: 只验证不应用"
|
||
verify_application "$extract_dir"
|
||
return 0
|
||
fi
|
||
|
||
# 创建备份
|
||
local backup_path=$(create_backup)
|
||
|
||
# 应用变更
|
||
if ! apply_file_changes "$extract_dir"; then
|
||
error "文件变更应用失败"
|
||
send_application_notification "failure" "$patch_path" "文件应用失败"
|
||
return 1
|
||
fi
|
||
|
||
# 验证应用结果
|
||
if ! verify_application "$extract_dir"; then
|
||
error "应用验证失败"
|
||
send_application_notification "failure" "$patch_path" "应用验证失败"
|
||
return 1
|
||
fi
|
||
|
||
# 创建回滚点
|
||
create_rollback_point "$patch_path" "$backup_path"
|
||
|
||
info "✅ 补丁应用完成"
|
||
send_application_notification "success" "$patch_path" "补丁应用成功"
|
||
return 0
|
||
}
|
||
|
||
# 主函数
|
||
main() {
|
||
local patch_path="${1:-}"
|
||
local dry_run="${2:-false}"
|
||
|
||
if [[ -z "$patch_path" ]]; then
|
||
echo "用法: $0 <补丁包路径> [dry-run]"
|
||
echo "示例:"
|
||
echo " $0 /opt/patches/patch-security-hotfix-1.2.3.tar.gz"
|
||
echo " $0 /opt/patches/patch-security-hotfix-1.2.3.tar.gz dry-run"
|
||
exit 1
|
||
fi
|
||
|
||
# 加载配置
|
||
load_config
|
||
|
||
# 设置环境
|
||
setup_environment
|
||
|
||
# 应用补丁
|
||
if apply_patch "$patch_path" "$dry_run"; then
|
||
info "🎉 补丁应用成功完成"
|
||
exit 0
|
||
else
|
||
error "💥 补丁应用失败"
|
||
exit 1
|
||
fi
|
||
}
|
||
|
||
# 异常处理
|
||
trap 'error "脚本执行中断"; cleanup; exit 1' INT TERM
|
||
|
||
main "$@" |