feat(hololake): provision signed in-app update bootstrap

product-source/hololake-platform/guanghu-os/scripts/hololake-release-bridge.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+set -Eeuo pipefail
+
+# Resident HoloLake update bridge for JD-FD-PRIMARY under the Guanghu
+# supervisor. The release origin remains loopback-only. A dedicated,
+# port-forwarding-only SSH identity exposes exactly one loopback port on the
+# registered BS-GZ-006 HTTPS front door.
+
+readonly RELEASE_SERVER=/opt/guanghu/hololake-release-broadcast-candidate/current/server.mjs
+readonly RELEASE_STATE_ROOT=/var/lib/guanghu/hololake-release-broadcast
+readonly RELEASE_PORT=3940
+readonly TUNNEL_KEY=/etc/guanghu/secrets/hololake-release-tunnel-ed25519
+readonly TUNNEL_KNOWN_HOSTS=/etc/guanghu/secrets/hololake-release-tunnel-known-hosts
+readonly FRONT_DOOR_HOST=43.139.217.141
+readonly FRONT_DOOR_USER=hololake-tunnel
+readonly FRONT_DOOR_PORT=19440
+
+declare -a CHILDREN=()
+
+cleanup() {
+  trap - EXIT INT TERM
+  for pid in "${CHILDREN[@]:-}"; do
+    kill "$pid" 2>/dev/null || true
+  done
+  wait 2>/dev/null || true
+}
+trap cleanup EXIT INT TERM
+
+require_exact_runtime() {
+  [[ -f $RELEASE_SERVER && ! -L $RELEASE_SERVER ]] || {
+    # current is an audited immutable-release symlink; resolve it and reject a
+    # non-regular final target rather than following arbitrary path material.
+    local resolved
+    resolved=$(readlink -f "$RELEASE_SERVER")
+    [[ $resolved == /opt/guanghu/hololake-release-broadcast-candidate/*/server.mjs ]]
+    [[ -f $resolved && ! -L $resolved ]]
+  }
+  [[ -f $TUNNEL_KEY && ! -L $TUNNEL_KEY ]]
+  [[ -f $TUNNEL_KNOWN_HOSTS && ! -L $TUNNEL_KNOWN_HOSTS ]]
+  [[ $(stat -c '%a' "$TUNNEL_KEY") == 600 ]]
+}
+
+start_pair() {
+  CHILDREN=()
+  /usr/bin/setpriv --reuid=989 --regid=989 --init-groups --inh-caps=-all --reset-env \
+    /usr/bin/env HOME=/nonexistent USER=hololake-release LOGNAME=hololake-release \
+    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
+    HOLOLAKE_RELEASE_HOST=127.0.0.1 HOLOLAKE_RELEASE_PORT="$RELEASE_PORT" \
+    HOLOLAKE_RELEASE_STATE_ROOT="$RELEASE_STATE_ROOT" \
+    /usr/bin/node "$RELEASE_SERVER" &
+  CHILDREN+=("$!")
+
+  /usr/bin/ssh -N \
+    -i "$TUNNEL_KEY" -o IdentitiesOnly=yes -o BatchMode=yes \
+    -o UserKnownHostsFile="$TUNNEL_KNOWN_HOSTS" -o StrictHostKeyChecking=yes \
+    -o ExitOnForwardFailure=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=3 \
+    -R "127.0.0.1:${FRONT_DOOR_PORT}:127.0.0.1:${RELEASE_PORT}" \
+    "${FRONT_DOOR_USER}@${FRONT_DOOR_HOST}" &
+  CHILDREN+=("$!")
+}
+
+main() {
+  require_exact_runtime
+  while :; do
+    start_pair
+    wait -n "${CHILDREN[@]}" || true
+    for pid in "${CHILDREN[@]}"; do kill "$pid" 2>/dev/null || true; done
+    wait 2>/dev/null || true
+    sleep 2
+  done
+}
+
+main "$@"