Harden node-serviced updates

.github/workflows/command-tests.yml

@@ -16,6 +16,8 @@ on:
       - "tests/unit_lib_github.sh"
       - "tests/unit_pasarguard.sh"
       - "tests/unit_pgnode.sh"
+      - "tests/test_node_service_transaction_guard.sh"
+      - "tests/test_node_service_readiness_tls.sh"
       - "tests/unit_pgnode_service.sh"
       - "tests/unit_restore_archive_safety.sh"
       - "tests/unit_lib_system.sh"
@@ -32,6 +34,8 @@ on:
       - "tests/unit_lib_system.sh"
       - "tests/unit_pasarguard.sh"
       - "tests/unit_pgnode.sh"
+      - "tests/test_node_service_transaction_guard.sh"
+      - "tests/test_node_service_readiness_tls.sh"
       - "tests/unit_pgnode_service.sh"
       - "tests/unit_restore_archive_safety.sh"
   workflow_dispatch:
@@ -57,6 +61,10 @@ jobs:
         run: bash tests/unit_pasarguard.sh
       - name: Run pg-node.sh unit tests
         run: bash tests/unit_pgnode.sh
+      - name: Run node service transaction guard tests
+        run: bash tests/test_node_service_transaction_guard.sh
+      - name: Run node service DNS-SAN readiness test
+        run: bash tests/test_node_service_readiness_tls.sh
       - name: Run pg-node-service.sh unit tests
         run: bash tests/unit_pgnode_service.sh
       - name: Run restore archive-safety unit tests

README.md

@@ -108,3 +108,15 @@
 
 Use `help` to view all commands:
 `pg-node help`
+
+### node-serviced update safety
+
+`service-install`, `service-update`, and `service-uninstall` serialize mutations with a persistent `flock` lock and require
+Linux `setsid` (both normally provided by `util-linux`). Older `setsid` versions without `--wait` are supported. Update and
+rollback probes also require Bash, `awk`, `curl`, and `openssl`; release installation requires `jq`, `tar`, and a SHA-256
+tool (`sha256sum` or `shasum`).
+
+Readiness uses the same `.env` semantics as `node-serviced`: optional `export`, `=` or `:`, last duplicate wins, comments,
+single- and double-quoted values, double-quote escapes, and prior-key expansion. The file is parsed as data and is never
+sourced or evaluated. `NODE_SERVICE_READINESS_DEADLINE_SECONDS` bounds the complete readiness loop (default `30`), while
+`NODE_SERVICE_READINESS_TIMEOUT_SECONDS` bounds an individual authenticated HTTPS probe.

lib/common.sh

@@ -62,7 +62,7 @@ temp_root_dir() {
         root="/var/lib/pasarguard-scripts/tmp"
     fi
 
-    mkdir -p "$root"
+    mkdir -p "$root" || return 1
     printf '%s\n' "$root"
 }
 
@@ -72,10 +72,10 @@ create_temp_dir() {
     local candidate=""
     local attempt=0
 
-    root=$(temp_root_dir)
+    root=$(temp_root_dir) || return 1
     while [ "$attempt" -lt 20 ]; do
         candidate="${root}/${prefix}-$$-${RANDOM}-${attempt}"
-        if mkdir "$candidate" 2>/dev/null; then
+        if (umask 077 && mkdir "$candidate") 2>/dev/null; then
             printf '%s\n' "$candidate"
             return 0
         fi
@@ -90,7 +90,7 @@ create_temp_file() {
     local suffix="${2:-}"
     local root=""
 
-    root=$(temp_root_dir)
+    root=$(temp_root_dir) || return 1
     create_temp_file_in_dir "$root" "$prefix" "$suffix"
 }
 
@@ -101,10 +101,10 @@ create_temp_file_in_dir() {
     local candidate=""
     local attempt=0
 
-    mkdir -p "$dir"
+    mkdir -p "$dir" || return 1
     while [ "$attempt" -lt 20 ]; do
         candidate="${dir}/${prefix}-$$-${RANDOM}-${attempt}${suffix}"
-        if (set -C; : >"$candidate") 2>/dev/null; then
+        if (umask 077; set -C; : >"$candidate") 2>/dev/null; then
             printf '%s\n' "$candidate"
             return 0
         fi

lib/github.sh

@@ -18,7 +18,7 @@ github_download_file() {
 
 backup_scripts() {
     local backup_dir=""
-    backup_dir=$(create_temp_dir "scripts-backup")
+    backup_dir=$(create_temp_dir "scripts-backup") || return 1
 
     # Backup main scripts
     [ -f "/usr/local/bin/pasarguard" ] && cp "/usr/local/bin/pasarguard" "$backup_dir/"
@@ -110,7 +110,7 @@ install_shared_libs_from_repo() {
     local tmp_dir=""
     local lib_name=""
 
-    tmp_dir=$(create_temp_dir "shared-libs")
+    tmp_dir=$(create_temp_dir "shared-libs") || return 1
     mkdir -p "$SHARED_LIB_INSTALL_DIR"
 
     for lib_name in "$@"; do