nuttx-apps/system/nxpkg/pkg_main.c
aviralgarg05 455af497ca system/nxpkg: address lifecycle review findings.
Fix real correctness/security gaps found during review, on top of the
network sync and CLI completion work:

- pkg_install(): commit the installed database before writing the
  current/previous pointer files, and before advancing transaction
  state past ACTIVATED. Those are recovery bookkeeping and convenience
  mirrors respectively - once the installed database itself is
  durably committed, a failure to refresh either one must not trigger
  the failure-cleanup path, which could otherwise delete a payload the
  database now legitimately points at. Also stop treating an existing
  version directory as newly created when reinstalling an
  already-installed version, so a failed reinstall can't delete a
  working install.

- pkg_uninstall()/pkg_rollback(): acquire the per-package install lock
  in addition to the installed-db lock, drop the entry from the
  authoritative database first, and only then remove payload files -
  a crash between those two steps can leave orphaned files, which are
  reclaimable, but never leaves the database pointing at a payload
  that's already gone.

- pkg_sync(): stage each sync to a PID-qualified temp filename instead
  of a single fixed name, so concurrent sync calls can no longer race
  on the same staging file. Return real negative errno codes instead
  of EXIT_SUCCESS/EXIT_FAILURE, matching the rest of this API; pkg_main.c
  maps that back to a process exit code at the CLI boundary.

- pkg_metadata_parse_installed_entry(): validate that name/current/
  previous/every entry in versions[] are safe path components, and that
  current (and previous, if set) actually appear in versions[] - a
  corrupted or tampered installed-packages database can no longer
  reference a nonexistent version or smuggle a path-traversal sequence
  through a field this code already trusted implicitly.

- pkg_store_write_all()/pkg_repo_sink(): treat a zero-byte write() as
  -EIO instead of looping on it silently.

- Removed the malloc()-falls-back-to-kmm_malloc() logic in pkg_malloc/
  pkg_zalloc/pkg_realloc/pkg_free entirely - it required tracking which
  allocator owned a given pointer via kmm_heapmember(), which is
  specific to this target's flat, single-heap memory model and not a
  sound general application API. These are now plain wrappers around
  malloc/calloc/realloc/free.

- Added pkg_metadata_load_manifest_path(), so a caller (e.g. the
  nxstore GUI frontend, launching an installed package) can load the
  manifest actually recorded for a specific installed version, instead
  of combining a rollback-selected version with whatever the current
  catalog happens to describe for that package name - those can
  disagree after a rollback if the catalog has since moved on.

- Storage root default changed from /tmp/nxpkg to /var/lib/nxpkg,
  following the conventional persistent application-data location
  instead of a path whose own name suggests non-persistent storage. A
  board without persistent storage mounted at /var, or that wants a
  different location (e.g. an SD card), still overrides this via
  CONFIG_SYSTEM_NXPKG_ROOT as before.

- Moved system/nxpkg/README.txt into the companion NuttX documentation
  PR rather than shipping user-facing documentation as an in-tree
  README.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: aviralgarg05 <gargaviral99@gmail.com>
2026-07-24 15:25:58 +05:30

171 lines
4.8 KiB
C

/****************************************************************************
* apps/system/nxpkg/pkg_main.c
*
* SPDX-License-Identifier: Apache-2.0
*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership. The
* ASF licenses this file to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance with the
* License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations
* under the License.
*
****************************************************************************/
/****************************************************************************
* Included Files
****************************************************************************/
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <netutils/cJSON.h>
#include "pkg.h"
/****************************************************************************
* Pre-processor Definitions
****************************************************************************/
#define PKG_USAGE \
"Usage: %s <install|update|remove|rollback|list|available|sync|help> " \
"[args]\n"
/****************************************************************************
* Public Functions
****************************************************************************/
int main(int argc, FAR char *argv[])
{
FAR const char *cmd;
cJSON_Hooks hooks;
hooks.malloc_fn = malloc;
hooks.free_fn = free;
cJSON_InitHooks(&hooks);
if (argc < 2)
{
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
cmd = argv[1];
if (strcmp(cmd, "help") == 0 || strcmp(cmd, "--help") == 0 ||
strcmp(cmd, "-h") == 0)
{
fprintf(stdout, PKG_USAGE, argv[0]);
return EXIT_SUCCESS;
}
if (strcmp(cmd, "install") == 0)
{
if (argc != 3)
{
pkg_error("install expects exactly one package name");
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
/* pkg_install() returns a real negative errno on the meaningful
* pipeline failures (nxstore uses that directly), not just
* EXIT_SUCCESS/EXIT_FAILURE - normalize to a plain 0/1 shell exit
* status here.
*/
return pkg_install(argv[2]) == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
}
/* "update" is a package name resolving to whatever version is latest
* in the local index - pkg_install() already handles the "already
* installed at a different version" transition transparently via
* pkg_install_update_installed(), so no separate code path is needed.
*/
if (strcmp(cmd, "update") == 0)
{
if (argc != 3)
{
pkg_error("update expects exactly one package name");
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
return pkg_install(argv[2]) == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
}
if (strcmp(cmd, "remove") == 0 || strcmp(cmd, "uninstall") == 0)
{
if (argc != 3)
{
pkg_error("remove expects exactly one package name");
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
return pkg_uninstall(argv[2]);
}
if (strcmp(cmd, "rollback") == 0)
{
if (argc != 3)
{
pkg_error("rollback expects exactly one package name");
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
return pkg_rollback(argv[2]);
}
if (strcmp(cmd, "list") == 0)
{
if (argc != 2)
{
pkg_error("list does not take additional arguments");
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
return pkg_list(stdout);
}
if (strcmp(cmd, "available") == 0)
{
if (argc != 2)
{
pkg_error("available does not take additional arguments");
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
return pkg_available(stdout);
}
if (strcmp(cmd, "sync") == 0)
{
if (argc != 3)
{
pkg_error("sync expects exactly one index source");
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}
return pkg_sync(argv[2]) == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
}
fprintf(stderr, "ERROR: Unknown subcommand '%s'\n", cmd);
fprintf(stderr, PKG_USAGE, argv[0]);
return EXIT_FAILURE;
}