From 068734da16c2be9fd3f968e2b6a8cd99d443ba2d Mon Sep 17 00:00:00 2001 From: hotyue <52734432+hotyue@users.noreply.github.com> Date: Tue, 21 Apr 2026 05:45:50 +0000 Subject: [PATCH] =?UTF-8?q?fix(ota):=20=E5=BC=95=E5=85=A5=20bash=20-n=20?= =?UTF-8?q?=E8=AF=AD=E6=B3=95=E6=A0=91=E5=AE=8C=E6=95=B4=E6=80=A7=E6=A0=A1?= =?UTF-8?q?=E9=AA=8C=EF=BC=8C=E5=BD=BB=E5=BA=95=E9=98=BB=E6=96=AD=E5=9B=A0?= =?UTF-8?q?=E7=BD=91=E7=BB=9C=E6=B3=A2=E5=8A=A8=E4=B8=8B=E8=BD=BD=E4=B8=8D?= =?UTF-8?q?=E5=85=A8=E5=AF=BC=E8=87=B4=E7=9A=84=E5=8D=95=E7=82=B9=E6=AD=BB?= =?UTF-8?q?=E6=9C=BA=E9=A3=8E=E9=99=A9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- core/agent_daemon.sh | 8 +++++--- core/install.sh | 2 +- core/mod_trust.sh | 2 +- core/updater.sh | 2 +- master/install_master.sh | 2 +- master/tg_master.sh | 13 ++++++++++++- 6 files changed, 21 insertions(+), 8 deletions(-) diff --git a/core/agent_daemon.sh b/core/agent_daemon.sh index 954c0b4..60eaa5f 100755 --- a/core/agent_daemon.sh +++ b/core/agent_daemon.sh @@ -370,10 +370,12 @@ class AgentHandler(http.server.BaseHTTPRequestHandler): self.end_headers() self.wfile.write(b"Action Accepted: trigger_ota\n") - # [修复] 逃逸 Systemd Cgroup，防止 Agent 在升级时被同归于尽机制误杀 + # [修复] 逃逸 Systemd Cgroup，并引入 bash -n 语法树校验防砖机制 import shutil - repo_url = "https://raw.githubusercontent.com/hotyue/IP-Sentinel/main" - ota_cmd = f"export SILENT_OTA='true'; curl -fsSL {repo_url}/core/install.sh -o /tmp/ota_agent.sh && bash /tmp/ota_agent.sh > /opt/ip_sentinel/logs/ota_upgrade.log 2>&1" + repo_url = "https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.3-dev" + + # [v3.6.3 修复] 🚀 下载后先执行 if bash -n 语法校验，通过后再执行覆盖 + ota_cmd = f"export SILENT_OTA='true'; curl -fsSL {repo_url}/core/install.sh -o /tmp/ota_agent.sh && if bash -n /tmp/ota_agent.sh; then bash /tmp/ota_agent.sh > /opt/ip_sentinel/logs/ota_upgrade.log 2>&1; else echo 'OTA Checksum Failed: Script corrupted' > /opt/ip_sentinel/logs/ota_upgrade.log; fi" if shutil.which("systemd-run"): full_cmd = f"systemd-run --quiet --no-block bash -c \"{ota_cmd}\"" diff --git a/core/install.sh b/core/install.sh index f0e0118..d27a732 100755 --- a/core/install.sh +++ b/core/install.sh @@ -15,7 +15,7 @@ if [ "$EUID" -ne 0 ]; then fi # 你的 GitHub 仓库 Raw 数据直链前缀 -REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/main" +REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.3-dev" # 临时改为开发地址用于测试 # REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.2-rc" INSTALL_DIR="/opt/ip_sentinel" diff --git a/core/mod_trust.sh b/core/mod_trust.sh index 3870940..c106a2a 100755 --- a/core/mod_trust.sh +++ b/core/mod_trust.sh @@ -9,7 +9,7 @@ INSTALL_DIR="/opt/ip_sentinel" CONFIG_FILE="${INSTALL_DIR}/config.conf" UA_FILE="${INSTALL_DIR}/data/user_agents.txt" # 你的 GitHub 仓库 Raw 数据直链前缀 -REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/main" +REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.3-dev" # 临时改为私库地址用于测试 # REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.2-rc" diff --git a/core/updater.sh b/core/updater.sh index df78a26..25a3816 100755 --- a/core/updater.sh +++ b/core/updater.sh @@ -10,7 +10,7 @@ CONFIG_FILE="${INSTALL_DIR}/config.conf" UA_TIME_FILE="${INSTALL_DIR}/core/.ua_last_update" # GitHub 仓库 Raw 数据直链前缀 -REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/main" +REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.3-dev" # 临时改为开发地址用于测试 # REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.2-rc" diff --git a/master/install_master.sh b/master/install_master.sh index e87fa80..3559dcf 100755 --- a/master/install_master.sh +++ b/master/install_master.sh @@ -15,7 +15,7 @@ if [ "$EUID" -ne 0 ]; then fi # 你的 GitHub 仓库 Raw 数据直链前缀 -REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/main" +REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.3-dev" # 临时改为开发地址用于测试 # REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.2-rc" diff --git a/master/tg_master.sh b/master/tg_master.sh index ab0a744..0e8276e 100755 --- a/master/tg_master.sh +++ b/master/tg_master.sh @@ -10,7 +10,7 @@ CONF="/opt/ip_sentinel_master/master.conf" source "$CONF" # [核心: 运行态版本继承与云通信地址] -REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/main" +REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.3-dev" # 临时改为开发地址用于测试 # REPO_RAW_URL="https://raw.githubusercontent.com/hotyue/IP-Sentinel/v3.6.2-rc" # MASTER_VERSION 已经在上方的 source "$CONF" 中被载入 @@ -262,6 +262,17 @@ while true; do # 下载最新的 master install 脚本作为幽灵进程 curl -fsSL "${REPO_RAW_URL}/master/install_master.sh" -o "/tmp/install_master.sh" + + # [v3.6.3 修复] 🚀 OTA 防砖机制：严格校验脚本完整性 + if ! bash -n "/tmp/install_master.sh" >/dev/null 2>&1; then + if [ -n "$MSG_ID" ]; then + edit_msg "$CHAT_ID" "$MSG_ID" "❌ OTA 传输受损：脚本下载不完整，已触发防砖熔断，升级取消！" + else + send_msg "$CHAT_ID" "❌ OTA 传输受损：脚本下载不完整，已触发防砖熔断，升级取消！" + fi + continue + fi + chmod +x "/tmp/install_master.sh" # 抛出幽灵进程进行脱壳升级，传递静默变量与回执 ID