feat(hololake): provision signed in-app update bootstrap

product-source/hololake-platform/guanghu-os/scripts/guanghu-master-init.sh

@@ -17,6 +17,7 @@ readonly AI_DISCOVERY=/opt/guanghu/ai-discovery/server.js
 readonly PNCC_RUNTIME=/usr/local/libexec/guanghu/pncc-runtime.mjs
 readonly PNCC_REPOSITORY=/var/lib/guanghu/personas/ICE-P-ZY001/pncc/repository
 readonly PNCC_STATE_ROOT=/run/guanghu/pncc
+readonly HOLOLAKE_RELEASE_BRIDGE=/usr/local/libexec/guanghu/hololake-release-bridge
 
 declare -a CHILDREN=()
 RECOVERY_ARMED=0
@@ -125,6 +126,7 @@ start_bridge() {
   require_file "$AI_DISCOVERY"
   require_file "$PNCC_RUNTIME"
   require_file "$PNCC_REPOSITORY/.hololake/persona/manifest.json"
+  require_file "$HOLOLAKE_RELEASE_BRIDGE"
 
   start_root sshd /usr/sbin/sshd -D -e \
     -o UsePAM=no -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no \
@@ -163,6 +165,9 @@ start_bridge() {
     --repository "$PNCC_REPOSITORY" --state-root "$PNCC_STATE_ROOT" \
     --node-id "$NODE_ID" --host 127.0.0.1 --port 3923
   wait_http pncc-runtime http://127.0.0.1:3923/health 200 30
+
+  start_root hololake-release-bridge "$HOLOLAKE_RELEASE_BRIDGE"
+  wait_http hololake-release-broadcast http://127.0.0.1:3940/health 200 30
 }
 
 runtime_watch() {
@@ -183,6 +188,7 @@ runtime_watch() {
     listen_ready 8088 || fatal "runtime_projection_lost"
     listen_ready 3922 || fatal "runtime_navigation_lost"
     listen_ready 3923 || fatal "runtime_pncc_lost"
+    listen_ready 3940 || fatal "runtime_hololake_release_lost"
   done
 }
 
@@ -203,6 +209,7 @@ preflight() {
   getent passwd guanghu | grep -q '^guanghu:x:998:998:'
   for path in "$HLCC" "$APP_HUB" "$AI_DISCOVERY" "$PNCC_RUNTIME" \
     "$PNCC_REPOSITORY/.hololake/persona/manifest.json" /usr/sbin/sshd \
+    "$HOLOLAKE_RELEASE_BRIDGE" \
     /usr/bin/node /usr/bin/python3 /usr/bin/setpriv /usr/bin/grub-editenv; do
     [[ -e $path && ! -L $path || $path == /usr/bin/python3 ]]
   done