From faff5e3fd03deb45e4dcbed2ab7d178a81b52606 Mon Sep 17 00:00:00 2001 From: jiajingbin Date: Fri, 10 Apr 2026 19:52:54 +0800 Subject: [PATCH 1/5] feat: add inject_nexus_repo.sh to inject Nexus mirror repo --- .../scripts/offline_env/inject_nexus_repo.sh | 348 ++++++++++++++++++ 1 file changed, 348 insertions(+) create mode 100755 .github/scripts/offline_env/inject_nexus_repo.sh diff --git a/.github/scripts/offline_env/inject_nexus_repo.sh b/.github/scripts/offline_env/inject_nexus_repo.sh new file mode 100755 index 0000000..d77ef17 --- /dev/null +++ b/.github/scripts/offline_env/inject_nexus_repo.sh @@ -0,0 +1,348 @@ +#!/bin/bash +# ============================================================================= +# inject_nexus_repo.sh — Inject a Nexus mirror repo into the current OS +# +# Writes a nexus-.repo (RPM) or nexus-.list (DEB) alongside the +# original OS repo file. The original repo is NEVER modified. +# +# Run this script directly on the target machine. All parameters have +# defaults or are auto-detected, so a plain invocation with no args works +# on any supported OS with the default Nexus instance: +# ./inject_nexus_repo.sh +# +# OS / version are auto-detected from /etc/os-release. +# Supported OS IDs: ubuntu, debian, centos, kylin, openeuler +# +# Verified Nexus repo mappings (https://nexus.tdengine.net): +# OS Nexus repo Upstream mirror +# ubuntu ubuntu http://cn.archive.ubuntu.com/ubuntu +# debian debian{N} http://deb.debian.org/debian +# centos centos http://mirrors.aliyun.com/centos +# kylin kylinv10 http://update.cs2c.com.cn:8080 +# openeuler openeuler https://repo.openeuler.org +# +# Usage: +# inject_nexus_repo.sh [OPTIONS] +# +# Options: +# --nexus-url= Nexus base URL +# Default: https://nexus.tdengine.net +# --os-key= OS family: ubuntu|debian|centos|kylin|openeuler +# Default: auto-detect from /etc/os-release +# --os-ver= OS version string (e.g. 22.04, v10-sp3-2403) +# Default: auto-detect from /etc/os-release +# -h|--help Show this help and exit +# ============================================================================= + +set -euo pipefail + +# ======================== Color helpers ======================== +RED='\033[1;31m'; GREEN='\033[1;32m'; YELLOW='\033[1;33m'; CYAN='\033[1;36m'; RESET='\033[0m' +red_echo() { echo -e "${RED}$*${RESET}" >&2; } +green_echo() { echo -e "${GREEN}$*${RESET}"; } +yellow_echo() { echo -e "${YELLOW}$*${RESET}"; } +cyan_echo() { echo -e "${CYAN}$*${RESET}"; } + +# ======================== Defaults ============================ +NEXUS_URL="https://nexus.tdengine.net" +OS_KEY="" # auto-detect from /etc/os-release if empty +OS_VER="" # auto-detect from /etc/os-release if empty + +# ======================== Parse args ========================== +show_usage() { + grep '^# ' "$0" | sed -n '/^# Usage:/,/^# =====/p' | sed 's/^# \?//' + exit 0 +} + +for arg in "$@"; do + case "$arg" in + --nexus-url=*) NEXUS_URL="${arg#*=}" ;; + --os-key=*) OS_KEY="${arg#*=}" ;; + --os-ver=*) OS_VER="${arg#*=}" ;; + -h|--help) show_usage ;; + *) red_echo "Unknown argument: $arg"; exit 1 ;; + esac +done + +# ======================== OS auto-detection =================== +# Reads /etc/os-release from the host (native mode) or from the target +# container (container mode) and normalises the values into OS_KEY / OS_VER. +# +# Normalisation rules per OS family: +# ubuntu : VERSION_ID=22.04 → os_ver=22.04 +# debian : VERSION_ID=12 → os_ver=12 +# centos : VERSION_ID=7 → os_ver=7 +# openeuler: VERSION_ID=22.03 +# PRETTY_NAME="openEuler 22.03 (LTS-SP1)" +# → os_ver=22.03-lts-sp1 +# kylin : VERSION="V10 (Halberd)" → os_ver=v10-sp3-2403 (codename-based mapping) + +_read_os_release() { + cat /etc/os-release 2>/dev/null || true +} + +# Extract a field value from os-release content (strips surrounding quotes). +_field() { + local content="$1" field="$2" + printf '%s' "$content" \ + | grep -i "^${field}=" | head -1 \ + | cut -d= -f2- | tr -d '"' | tr -d "'" +} + +detect_os() { + local content + content="$(_read_os_release)" + + if [[ -z "$content" ]]; then + red_echo "ERROR: Could not read /etc/os-release" + exit 1 + fi + + local id version_id pretty_name + id=$(_field "$content" "ID" | tr '[:upper:]' '[:lower:]') + version_id=$(_field "$content" "VERSION_ID") + pretty_name=$(_field "$content" "PRETTY_NAME") + + # ---- Resolve OS_KEY ---- + if [[ -z "$OS_KEY" ]]; then + case "$id" in + ubuntu) OS_KEY="ubuntu" ;; + debian) OS_KEY="debian" ;; + centos) OS_KEY="centos" ;; + kylin) OS_KEY="kylin" ;; + openeuler) OS_KEY="openeuler" ;; + *) + red_echo "ERROR: Unsupported OS ID '${id}' — supported: ubuntu debian centos kylin openeuler" + exit 1 + ;; + esac + yellow_echo "Auto-detected OS key : ${OS_KEY}" + fi + + # ---- Resolve OS_VER ---- + if [[ -z "$OS_VER" ]]; then + case "$OS_KEY" in + ubuntu|debian|centos) + OS_VER="$version_id" + ;; + openeuler) + # Parse "(LTS-SP1)" / "(LTS)" from PRETTY_NAME. + # e.g. "openEuler 24.03 (LTS-SP2)" → "24.03-lts-sp2" + local oe_suffix + oe_suffix=$(printf '%s' "$pretty_name" \ + | grep -oP '\(LTS[^)]*\)' \ + | tr -d '()' \ + | tr '[:upper:]' '[:lower:]' \ + | sed 's/ /-/g' || true) + if [[ -n "$oe_suffix" ]]; then + OS_VER="${version_id}-${oe_suffix}" + else + OS_VER="${version_id}" + yellow_echo "WARNING: LTS/SP suffix not found in '${pretty_name}'; using VERSION_ID only" + fi + ;; + kylin) + # Kylin does NOT embed SP numbers in os-release; it uses release code names. + # VERSION="V10 (Codename)" — extract codename and map to known SP version. + # Known mappings (from actual Kylin release images): + # Tercel → v10-sp1 + # Sword → v10-sp2 + # Lance → v10-sp3 + # Halberd → v10-sp3-2403 + local codename + codename=$(printf '%s' "$content" \ + | grep '^VERSION=' \ + | grep -oP '(?<=\()\w+(?=\))' \ + | head -1 || true) + + case "$codename" in + Tercel) OS_VER="v10-sp1" ;; + Sword) OS_VER="v10-sp2" ;; + Lance) OS_VER="v10-sp3" ;; + Halberd) OS_VER="v10-sp3-2403" ;; + "") + red_echo "ERROR: Cannot extract codename from VERSION field; content:" + red_echo "$(printf '%s' "$content" | grep '^VERSION=')" + exit 1 + ;; + *) + red_echo "ERROR: Unknown Kylin codename '${codename}'; supported: Tercel Sword Lance Halberd" + exit 1 + ;; + esac + ;; + esac + + if [[ -z "$OS_VER" ]]; then + red_echo "ERROR: Could not detect OS version for '${OS_KEY}'" + exit 1 + fi + yellow_echo "Auto-detected OS ver : ${OS_VER}" + fi +} + +# ======================== Write helpers ======================= +_write_file() { + local dest="$1" content="$2" + printf '%s' "$content" > "$dest" +} + +# Disable original OS repo files so yum/apt uses ONLY the Nexus repo. +# RPM: renames *.repo (excluding nexus-*.repo) → *.repo.disabled +# DEB: renames sources.list and sources.list.d/*.list (excluding nexus-*.list) +_disable_original_repos() { + local pkg_family="$1" + if [[ "$pkg_family" == "rpm" ]]; then + local f + for f in /etc/yum.repos.d/*.repo; do + [[ "$(basename "$f")" == nexus-* ]] && continue + [[ -f "$f" ]] || continue + mv "$f" "${f}.disabled" + yellow_echo "Disabled: $f" + done + else + local f + # disable /etc/apt/sources.list + if [[ -f /etc/apt/sources.list ]]; then + mv /etc/apt/sources.list /etc/apt/sources.list.disabled + yellow_echo "Disabled: /etc/apt/sources.list" + fi + # disable sources.list.d/*.list (excluding nexus-*.list) + for f in /etc/apt/sources.list.d/*.list; do + [[ "$(basename "$f")" == nexus-* ]] && continue + [[ -f "$f" ]] || continue + mv "$f" "${f}.disabled" + yellow_echo "Disabled: $f" + done + fi +} + +# ======================== Main injection ====================== +inject() { + local nexus_base="${NEXUS_URL%/}" + + cyan_echo "=== Nexus repo injection ===" + cyan_echo " Nexus URL : ${nexus_base}" + cyan_echo " OS : ${OS_KEY}:${OS_VER}" + + local nexus_repo="" path_prefix="" pkg_family="rpm" + local subrepos=() + + case "${OS_KEY}" in + openeuler) + nexus_repo="openeuler" + local oe_ver; oe_ver=$(printf '%s' "$OS_VER" | tr '[:lower:]' '[:upper:]') + path_prefix="openEuler-${oe_ver}" + subrepos=("OS" "everything" "EPOL/main" "update") + ;; + centos) + nexus_repo="centos" + path_prefix="centos/${OS_VER}" + subrepos=("os" "updates" "extras") + ;; + kylin) + nexus_repo="kylinv10" + local kylin_ver + case "$OS_VER" in + v10-sp1) kylin_ver="V10SP1.1" ;; + *) kylin_ver=$(printf '%s' "$OS_VER" | sed 's/v10-sp/V10SP/') ;; + esac + path_prefix="NS/V10/${kylin_ver}/os/adv/lic" + subrepos=("base" "updates") + ;; + ubuntu) + pkg_family="deb" + nexus_repo="ubuntu" + ;; + debian) + pkg_family="deb" + local debian_major="${OS_VER%%.*}" + nexus_repo="debian${debian_major}" + ;; + *) + yellow_echo "WARNING: No Nexus mapping for OS '${OS_KEY}', skipping" + exit 0 + ;; + esac + + # ---- RPM: write .repo file ---- + if [[ "$pkg_family" == "rpm" ]]; then + local repo_content="" subrepo + for subrepo in "${subrepos[@]}"; do + local section_id="nexus-${subrepo//\//-}" + repo_content+="[${section_id}] +name=Nexus ${OS_KEY} ${subrepo} +baseurl=${nexus_base}/repository/${nexus_repo}/${path_prefix}/${subrepo}/\$basearch/ +enabled=1 +gpgcheck=0 +sslverify=0 +metadata_expire=1h + +" + done + + # Write the nexus repo into a dedicated directory that yum.conf will + # point reposdir at. This way, even if a package update (e.g. centos-release) + # restores files under /etc/yum.repos.d/, yum never loads them again. + local nexus_reposdir="/etc/yum.repos.d.nexus" + mkdir -p "$nexus_reposdir" + local dest="${nexus_reposdir}/nexus-${OS_KEY}.repo" + yellow_echo "Writing: ${dest} (${#subrepos[@]} sections)" + _write_file "$dest" "$repo_content" + + # Override reposdir in yum.conf so yum only looks in our dedicated dir. + if grep -q '^reposdir=' /etc/yum.conf 2>/dev/null; then + sed -i "s|^reposdir=.*|reposdir=${nexus_reposdir}|" /etc/yum.conf + else + echo "reposdir=${nexus_reposdir}" >> /etc/yum.conf + fi + yellow_echo "Set reposdir=${nexus_reposdir} in /etc/yum.conf" + + # Also disable existing repo files to avoid confusion if reposdir is ever reset. + _disable_original_repos "rpm" + green_echo "Done — Nexus yum repo active; original repos disabled" + + # ---- DEB: write .list file ---- + else + local os_rel_content; os_rel_content="$(_read_os_release)" + local codename + codename=$(_field "$os_rel_content" "VERSION_CODENAME") + [[ -z "$codename" ]] && codename=$(_field "$os_rel_content" "UBUNTU_CODENAME") + if [[ -z "$codename" ]]; then + yellow_echo "WARNING: Cannot detect codename from /etc/os-release, skipping DEB injection" + exit 0 + fi + + local components="main restricted universe multiverse" + [[ "$OS_KEY" == "debian" ]] && components="main contrib non-free non-free-firmware" + local security_repo="${nexus_repo}-security" + local list_content="deb ${nexus_base}/repository/${nexus_repo} ${codename} ${components} +deb ${nexus_base}/repository/${nexus_repo} ${codename}-updates ${components} +deb ${nexus_base}/repository/${security_repo} ${codename}-security ${components} +" + local dest="/etc/apt/sources.list.d/nexus-${OS_KEY}.list" + yellow_echo "Writing: ${dest} (codename=${codename})" + _write_file "$dest" "$list_content" + + # Disable TLS peer verification for the Nexus host — needed when Nexus uses + # a self-signed / internal CA that the OS doesn't have in its trust store. + # [trusted=yes] in sources.list only skips GPG, NOT the TLS handshake. + local nexus_host; nexus_host=$(printf '%s' "$nexus_base" | sed 's|https\?://||;s|/.*||') + local ssl_conf="Acquire::https::${nexus_host}::Verify-Peer \"false\"; +Acquire::https::${nexus_host}::Verify-Host \"false\"; +" + local ssl_dest="/etc/apt/apt.conf.d/99nexus-ssl.conf" + yellow_echo "Writing: ${ssl_dest} (host=${nexus_host})" + _write_file "$ssl_dest" "$ssl_conf" + _disable_original_repos "deb" + green_echo "Done — Nexus apt source active; original sources disabled" + fi +} + +# ======================== Entry point ======================== +# When called by build_offline_pkg.sh with --nexus-url="" (Nexus disabled), +# exit silently without doing anything. +[[ -z "$NEXUS_URL" ]] && exit 0 + +detect_os +inject From 2cf525460f72d4189aa44fa454b7a3952f17903e Mon Sep 17 00:00:00 2001 From: jiajingbin <39030567+jiajingbin@users.noreply.github.com> Date: Sat, 11 Apr 2026 00:23:21 +0800 Subject: [PATCH 2/5] Update .github/scripts/offline_env/inject_nexus_repo.sh Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- .github/scripts/offline_env/inject_nexus_repo.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/offline_env/inject_nexus_repo.sh b/.github/scripts/offline_env/inject_nexus_repo.sh index d77ef17..6d400bc 100755 --- a/.github/scripts/offline_env/inject_nexus_repo.sh +++ b/.github/scripts/offline_env/inject_nexus_repo.sh @@ -86,7 +86,7 @@ _field() { local content="$1" field="$2" printf '%s' "$content" \ | grep -i "^${field}=" | head -1 \ - | cut -d= -f2- | tr -d '"' | tr -d "'" + | cut -d= -f2- | tr -d '"' | tr -d "'" || true } detect_os() { From d98394452c25fa52d954596af71ee9c0c058f7e9 Mon Sep 17 00:00:00 2001 From: jiajingbin <39030567+jiajingbin@users.noreply.github.com> Date: Sat, 11 Apr 2026 00:26:14 +0800 Subject: [PATCH 3/5] Update .github/scripts/offline_env/inject_nexus_repo.sh Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- .github/scripts/offline_env/inject_nexus_repo.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/scripts/offline_env/inject_nexus_repo.sh b/.github/scripts/offline_env/inject_nexus_repo.sh index 6d400bc..8f68191 100755 --- a/.github/scripts/offline_env/inject_nexus_repo.sh +++ b/.github/scripts/offline_env/inject_nexus_repo.sh @@ -42,7 +42,10 @@ red_echo() { echo -e "${RED}$*${RESET}" >&2; } green_echo() { echo -e "${GREEN}$*${RESET}"; } yellow_echo() { echo -e "${YELLOW}$*${RESET}"; } cyan_echo() { echo -e "${CYAN}$*${RESET}"; } - +if [[ $EUID -ne 0 ]]; then + red_echo "ERROR: This script must be run as root" + exit 1 +fi # ======================== Defaults ============================ NEXUS_URL="https://nexus.tdengine.net" OS_KEY="" # auto-detect from /etc/os-release if empty From b5406a10da91c3ba3cdf15330f247130be235f27 Mon Sep 17 00:00:00 2001 From: jiajingbin <39030567+jiajingbin@users.noreply.github.com> Date: Sat, 11 Apr 2026 00:26:47 +0800 Subject: [PATCH 4/5] Update .github/scripts/offline_env/inject_nexus_repo.sh Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- .github/scripts/offline_env/inject_nexus_repo.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/scripts/offline_env/inject_nexus_repo.sh b/.github/scripts/offline_env/inject_nexus_repo.sh index 8f68191..a447dac 100755 --- a/.github/scripts/offline_env/inject_nexus_repo.sh +++ b/.github/scripts/offline_env/inject_nexus_repo.sh @@ -294,8 +294,8 @@ metadata_expire=1h _write_file "$dest" "$repo_content" # Override reposdir in yum.conf so yum only looks in our dedicated dir. - if grep -q '^reposdir=' /etc/yum.conf 2>/dev/null; then - sed -i "s|^reposdir=.*|reposdir=${nexus_reposdir}|" /etc/yum.conf + if grep -q '^[[:space:]]*reposdir[[:space:]]*=' /etc/yum.conf 2>/dev/null; then + sed -i "s|^[[:space:]]*reposdir[[:space:]]*=.*|reposdir=${nexus_reposdir}|" /etc/yum.conf else echo "reposdir=${nexus_reposdir}" >> /etc/yum.conf fi From 637d57120b684d1eccdb566aace6f11b41253ee5 Mon Sep 17 00:00:00 2001 From: jiajingbin Date: Sat, 11 Apr 2026 14:15:39 +0800 Subject: [PATCH 5/5] fix: fix with copilot and gemini bot --- .../scripts/offline_env/inject_nexus_repo.sh | 123 +++++++++++++----- 1 file changed, 91 insertions(+), 32 deletions(-) diff --git a/.github/scripts/offline_env/inject_nexus_repo.sh b/.github/scripts/offline_env/inject_nexus_repo.sh index d77ef17..41d8aff 100755 --- a/.github/scripts/offline_env/inject_nexus_repo.sh +++ b/.github/scripts/offline_env/inject_nexus_repo.sh @@ -2,8 +2,19 @@ # ============================================================================= # inject_nexus_repo.sh — Inject a Nexus mirror repo into the current OS # -# Writes a nexus-.repo (RPM) or nexus-.list (DEB) alongside the -# original OS repo file. The original repo is NEVER modified. +# Adds a nexus-.repo (RPM) or nexus-.list + apt.conf.d ssl snippet +# (DEB) so the system can pull packages from a private Nexus instance. +# +# Default behaviour (safe / additive): +# The existing OS repo files are LEFT INTACT. Nexus is added alongside +# them; the package manager will use whichever source responds first. +# +# With --disable-originals (destructive / offline mode): +# Existing repo files are renamed to *.disabled so the Nexus mirror +# becomes the sole package source. The Nexus URL is validated for +# reachability before any files are renamed. +# Original repo files are preserved with the .disabled suffix and can +# be restored manually by renaming them back. # # Run this script directly on the target machine. All parameters have # defaults or are auto-detected, so a plain invocation with no args works @@ -31,6 +42,9 @@ # Default: auto-detect from /etc/os-release # --os-ver= OS version string (e.g. 22.04, v10-sp3-2403) # Default: auto-detect from /etc/os-release +# --disable-originals Rename existing OS repo files to *.disabled and +# (RPM) redirect yum reposdir to a nexus-only dir. +# Default: off (original files are not touched) # -h|--help Show this help and exit # ============================================================================= @@ -45,8 +59,9 @@ cyan_echo() { echo -e "${CYAN}$*${RESET}"; } # ======================== Defaults ============================ NEXUS_URL="https://nexus.tdengine.net" -OS_KEY="" # auto-detect from /etc/os-release if empty -OS_VER="" # auto-detect from /etc/os-release if empty +OS_KEY="" # auto-detect from /etc/os-release if empty +OS_VER="" # auto-detect from /etc/os-release if empty +DISABLE_ORIGINALS=false # rename existing repo files (opt-in) # ======================== Parse args ========================== show_usage() { @@ -56,14 +71,27 @@ show_usage() { for arg in "$@"; do case "$arg" in - --nexus-url=*) NEXUS_URL="${arg#*=}" ;; - --os-key=*) OS_KEY="${arg#*=}" ;; - --os-ver=*) OS_VER="${arg#*=}" ;; - -h|--help) show_usage ;; + --nexus-url=*) NEXUS_URL="${arg#*=}" ;; + --os-key=*) OS_KEY="${arg#*=}" ;; + --os-ver=*) OS_VER="${arg#*=}" ;; + --disable-originals) DISABLE_ORIGINALS=true ;; + -h|--help) show_usage ;; *) red_echo "Unknown argument: $arg"; exit 1 ;; esac done +# ======================== Validate user-supplied OS_KEY ======= +# Validate early so a typo fails loudly before any OS changes are made. +if [[ -n "$OS_KEY" ]]; then + case "$OS_KEY" in + ubuntu|debian|centos|kylin|openeuler) ;; + *) + red_echo "ERROR: Unsupported --os-key '${OS_KEY}' — must be one of: ubuntu debian centos kylin openeuler" + exit 1 + ;; + esac +fi + # ======================== OS auto-detection =================== # Reads /etc/os-release from the host (native mode) or from the target # container (container mode) and normalises the values into OS_KEY / OS_VER. @@ -187,6 +215,30 @@ _write_file() { printf '%s' "$content" > "$dest" } +# Validate that the Nexus base URL is reachable before making destructive changes. +# Uses curl with a short timeout; skips check if curl is not available. +_check_nexus_reachability() { + local url="$1" + if ! command -v curl &>/dev/null; then + yellow_echo "WARNING: curl not found — skipping Nexus reachability check" + return 0 + fi + yellow_echo "Checking Nexus reachability: ${url}" + local http_code + http_code=$(curl -sko /dev/null -w '%{http_code}' \ + --connect-timeout 5 --max-time 10 \ + --insecure "${url}" 2>/dev/null || true) + # Accept any HTTP response (including 4xx/5xx) — a response means the host is up. + # Only treat connection-level failures (http_code empty or 000) as unreachable. + if [[ -z "$http_code" || "$http_code" == "000" ]]; then + red_echo "ERROR: Nexus URL '${url}' is unreachable (connection failed)." + red_echo " Refusing to disable original repos to avoid leaving the system without package sources." + red_echo " Fix the URL or omit --disable-originals if Nexus is not accessible." + exit 1 + fi + yellow_echo "Nexus reachable (HTTP ${http_code})" +} + # Disable original OS repo files so yum/apt uses ONLY the Nexus repo. # RPM: renames *.repo (excluding nexus-*.repo) → *.repo.disabled # DEB: renames sources.list and sources.list.d/*.list (excluding nexus-*.list) @@ -260,8 +312,9 @@ inject() { nexus_repo="debian${debian_major}" ;; *) - yellow_echo "WARNING: No Nexus mapping for OS '${OS_KEY}', skipping" - exit 0 + # Should never be reached after early validation, but guard anyway. + red_echo "ERROR: No Nexus mapping for OS_KEY '${OS_KEY}'" + exit 1 ;; esac @@ -281,26 +334,27 @@ metadata_expire=1h " done - # Write the nexus repo into a dedicated directory that yum.conf will - # point reposdir at. This way, even if a package update (e.g. centos-release) - # restores files under /etc/yum.repos.d/, yum never loads them again. - local nexus_reposdir="/etc/yum.repos.d.nexus" - mkdir -p "$nexus_reposdir" - local dest="${nexus_reposdir}/nexus-${OS_KEY}.repo" - yellow_echo "Writing: ${dest} (${#subrepos[@]} sections)" - _write_file "$dest" "$repo_content" - - # Override reposdir in yum.conf so yum only looks in our dedicated dir. - if grep -q '^reposdir=' /etc/yum.conf 2>/dev/null; then - sed -i "s|^reposdir=.*|reposdir=${nexus_reposdir}|" /etc/yum.conf + if [[ "$DISABLE_ORIGINALS" == true ]]; then + # Validate Nexus is reachable before disabling originals — if the URL is + # wrong the system must not be left without any working package source. + _check_nexus_reachability "${nexus_base}" + # Write nexus repo to the standard directory alongside existing repos, + # then rename originals so yum ignores them (.repo suffix required by yum). + # NOTE: package updates (e.g. centos-release) may restore original .repo + # files; re-run this script or exclude such packages with + # `yum update --exclude=centos-release` if that is a concern. + local dest="/etc/yum.repos.d/nexus-${OS_KEY}.repo" + yellow_echo "Writing: ${dest} (${#subrepos[@]} sections)" + _write_file "$dest" "$repo_content" + _disable_original_repos "rpm" + green_echo "Done — Nexus yum repo active; original repos disabled" else - echo "reposdir=${nexus_reposdir}" >> /etc/yum.conf + # Safe mode: write into the standard reposdir; existing repos are kept. + local dest="/etc/yum.repos.d/nexus-${OS_KEY}.repo" + yellow_echo "Writing: ${dest} (${#subrepos[@]} sections)" + _write_file "$dest" "$repo_content" + green_echo "Done — Nexus yum repo added; original repos kept" fi - yellow_echo "Set reposdir=${nexus_reposdir} in /etc/yum.conf" - - # Also disable existing repo files to avoid confusion if reposdir is ever reset. - _disable_original_repos "rpm" - green_echo "Done — Nexus yum repo active; original repos disabled" # ---- DEB: write .list file ---- else @@ -309,8 +363,8 @@ metadata_expire=1h codename=$(_field "$os_rel_content" "VERSION_CODENAME") [[ -z "$codename" ]] && codename=$(_field "$os_rel_content" "UBUNTU_CODENAME") if [[ -z "$codename" ]]; then - yellow_echo "WARNING: Cannot detect codename from /etc/os-release, skipping DEB injection" - exit 0 + red_echo "ERROR: Cannot detect release codename from /etc/os-release — cannot configure apt source" + exit 1 fi local components="main restricted universe multiverse" @@ -334,8 +388,13 @@ Acquire::https::${nexus_host}::Verify-Host \"false\"; local ssl_dest="/etc/apt/apt.conf.d/99nexus-ssl.conf" yellow_echo "Writing: ${ssl_dest} (host=${nexus_host})" _write_file "$ssl_dest" "$ssl_conf" - _disable_original_repos "deb" - green_echo "Done — Nexus apt source active; original sources disabled" + if [[ "$DISABLE_ORIGINALS" == true ]]; then + _check_nexus_reachability "${nexus_base}" + _disable_original_repos "deb" + green_echo "Done — Nexus apt source active; original sources disabled" + else + green_echo "Done — Nexus apt source added; original sources kept" + fi fi }