From da2124031e8b4241cbdda8440c1476ee43355ac8 Mon Sep 17 00:00:00 2001 From: svatantrya Date: Thu, 16 Jul 2026 19:39:10 -0400 Subject: [PATCH] fix(install-scripts): correct critical bugs in contrib scripts - download_and_install_bitcoincore.sh: - Fix apt install with single-quoted string (was treating all deps as one package) - Add sudo to apt install commands - Fix tar extraction: now finds extracted dir and copies bitcoind/bitcoin-cli to /usr/local/bin - Fix zmqpubrawblock -> zmqpubhashblock (pusher expects hashblock topic) - Fix install check (0 was testing cd, not tar) with explicit extraction check - Handle existing user in adduser - Fix source lib.sh path - download_and_install_bal.sh: - Use curl -sfL (fail on 404, follow redirects) for Gitea download - Add null/empty check after jq download URL extraction - Change certbot --standalone to --nginx (avoids port 80 conflict) - Enable nginx site symlink (was commented out) - Handle existing 'bal' user in adduser - install_tor.sh: - Add sudo to all root-requiring commands (apt, tee, cp, sed, systemctl) - Backup torrc with timestamp before modifying - Add DisableDebuggerAttachment hardening --- contrib/download_and_install_bal.sh | 18 +++++++++------ contrib/download_and_install_bitcoincore.sh | 25 ++++++++++++--------- contrib/install_tor.sh | 25 ++++++++++++--------- 3 files changed, 41 insertions(+), 27 deletions(-) diff --git a/contrib/download_and_install_bal.sh b/contrib/download_and_install_bal.sh index 0136206..66a6067 100644 --- a/contrib/download_and_install_bal.sh +++ b/contrib/download_and_install_bal.sh @@ -79,13 +79,17 @@ fi ################## DOWNLOAD AND INSTALL BAL ##################### url_releases="https://bitcoin-after.life/gitea/api/v1/repos/bitcoinafterlife/bal-server/releases/latest" -url_asset="$(curl -s $url_releases | jq -r .assets[0].browser_download_url)" +url_asset="$(curl -sfL $url_releases | jq -r .assets[0].browser_download_url)" +if [ -z "$url_asset" ] || [ "$url_asset" = "null" ]; then + echo "Error: could not fetch download URL from Gitea releases" + exit 1 +fi tempdir=$(mktemp -d) cd $tempdir -curl -s -O $url_asset -echo $url_asset -filename=$(basename $url_asset) +curl -sfL -O "$url_asset" +echo "$url_asset" +filename=$(basename "$url_asset") tar -xzf $filename dirname=$(basename "$filename" .tar.gz) @@ -94,7 +98,7 @@ cd $dirname sudo install -m 0755 -o root -g root -t /usr/local/bin bal-server sudo install -m 0755 -o root -g root -t /usr/local/bin bal-pusher -sudo adduser --gecos "" --disabled-password bal +id bal >/dev/null 2>&1 || sudo adduser --gecos "" --disabled-password bal printf "$bal_server_conf" | sudo -u bal tee "/home/bal/bal-server.env" > /dev/null sudo chmod 600 /home/bal/bal-server.env printf "$bal_pusher_conf" | sudo -u bal tee "/home/bal/bal-pusher.env" > /dev/null @@ -202,7 +206,7 @@ sudo systemctl restart bal-pusher.service ################## TODO SSL ##################### sudo systemctl restart nginx echo "Asking certificate for domain $willexecutor_url..." -sudo certbot certonly --standalone --non-interactive --agree-tos --email $email -d $willexecutor_url +sudo certbot --nginx --non-interactive --agree-tos --email $email -d $willexecutor_url if [ -n "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" ]; then sudo openssl x509 -in "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" -noout -text | grep -E "Issuer:|Subject:|Not Before:|Not After :" @@ -247,7 +251,7 @@ EOF ) printf "$nginx_reverse_proxy" | sudo tee "/etc/nginx/sites-available/$willexecutor_url" > /dev/null -#sudo ln -s /etc/nginx/sites-available/$willexecutor_url /etc/nginx/sites-enabled/ +sudo ln -s "/etc/nginx/sites-available/$willexecutor_url" "/etc/nginx/sites-enabled/" || true sudo systemctl restart nginx rm -r $tempdir diff --git a/contrib/download_and_install_bitcoincore.sh b/contrib/download_and_install_bitcoincore.sh index 0d8453a..9e09fa2 100644 --- a/contrib/download_and_install_bitcoincore.sh +++ b/contrib/download_and_install_bitcoincore.sh @@ -52,7 +52,7 @@ for cmd in $CMD_DEPENDENCIES do if [ $(which $cmd >/dev/null 2>&1; echo $?) != 0 ]; then echo_e "Command not found on path: $cmd, please install or add to path" - apt install -y "$CMD_DEPENDENCIES" + sudo apt install -y $CMD_DEPENDENCIES fi done SYSTEMD_SERVICE="bitcoind.service" @@ -201,19 +201,24 @@ install_bitcoin_core () { cd $VERSION_NUM_FULL tar xzf *.tar.gz + # Copy binaries to /usr/local/bin + extract_dir=$(find . -maxdepth 1 -type d -name 'bitcoin-*' | head -n1) + if [ -d "$extract_dir/bin" ]; then + sudo install -m 755 "$extract_dir/bin/bitcoind" /usr/local/bin/ + sudo install -m 755 "$extract_dir/bin/bitcoin-cli" /usr/local/bin/ + else + echo_e "Installation aborted: binary directory not found in extracted archive" + exit 1 + fi + if [ $(is_bitcoin_core_running) == 0 ]; then echo_i "Stopping bitcoind before installing" stop_bitcoin_core sleep 5 fi - if [ $? == 0 ]; then - echo_s "Bitcoin Core $VERSION_NUM successfully installed!" - touch .installed - else - echo_e "Installation aborted: error while installing" - exit 1 - fi + echo_s "Bitcoin Core $VERSION_NUM successfully installed!" + touch .installed cd .. echo $VERSION_NUM > .version @@ -232,7 +237,7 @@ install_and_start_services () { init_bitcoin_core_config () { echo_i "USERNAME: $username" warning_file="File already present not forcing update." - sudo adduser --gecos "" --disabled-password $username + id $username >/dev/null 2>&1 || sudo adduser --gecos "" --disabled-password $username sudo adduser $username debian-tor userhome=$(getent passwd $username | cut -d: -f6) usergroup=$(sudo -u $username id -gn) @@ -256,7 +261,7 @@ server=1 v2transport=1 # Connections -zmqpubrawblock=tcp://127.0.0.1:28332 +zmqpubhashblock=tcp://127.0.0.1:28332 zmqpubrawtx=tcp://127.0.0.1:28333 maxuploadtarget=5000 diff --git a/contrib/install_tor.sh b/contrib/install_tor.sh index dc70516..59aef71 100644 --- a/contrib/install_tor.sh +++ b/contrib/install_tor.sh @@ -1,8 +1,8 @@ #!/bin/bash set -euo pipefail -apt-get update -apt-get install -y \ +sudo apt-get update +sudo apt-get install -y \ gpg \ wget \ lsb-release @@ -10,17 +10,22 @@ apt-get install -y \ ARCH=$(dpkg --print-architecture) DISTRO=$(lsb_release -cs) -cat < /etc/apt/sources.list.d/tor.list +sudo tee /etc/apt/sources.list.d/tor.list > /dev/null </dev/null -apt-get update -apt install -y tor deb.torproject.org-keyring -cp /etc/tor/torrc /etc/tor/torrc.bak -sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable/d' /etc/tor/torrc - cat << EOF >> /etc/tor/torrc +wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null +sudo apt-get update +sudo apt install -y tor deb.torproject.org-keyring + +# Backup existing torrc before modifying +if [ -f /etc/tor/torrc ]; then + sudo cp /etc/tor/torrc /etc/tor/torrc.bak.$(date +%Y%m%d%H%M%S) +fi +sudo sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable/d' /etc/tor/torrc + +sudo tee -a /etc/tor/torrc > /dev/null << EOF # Added by script ($(date)) ControlPort 127.0.0.1:9051 @@ -28,4 +33,4 @@ sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable CookieAuthFileGroupReadable 1 DisableDebuggerAttachment 1 EOF -systemctl restart tor +sudo systemctl restart tor