From 27eb2563868d3d592dd43d689108979ef2268b1a Mon Sep 17 00:00:00 2001 From: Tomaz Zaman Date: Wed, 12 Aug 2026 01:09:48 +0200 Subject: [PATCH 39/62] mono-update: verify the image baked this release's identity before staging After `make world`, assert /etc/mono_release in the assembled rootfs equals $RELTAG and refuse to stage otherwise. The OTA client and the on-device anti-rollback floor trust that value, so a stale identity (the 96b2fbc610 failure: the identity package not rebuilt fresh into the rootfs) would make devices misreport their version and corrupt the floor. Empty/unverifiable also refuses; set -e + the EXIT trap drop the tag so the next run rebuilds instead of shipping a mislabeled image. Co-Authored-By: Claude Opus 4.8 --- scripts/mono-update.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/scripts/mono-update.sh b/scripts/mono-update.sh index fd8aa6c3d6..8d523a8dd4 100755 --- a/scripts/mono-update.sh +++ b/scripts/mono-update.sh @@ -102,6 +102,20 @@ make defconfig make package/mono/mono-update-check/clean package/mono/mono-update-check/compile make -j"$(nproc)" world +# Verify the image actually baked THIS release's identity. The OTA client and +# the on-device anti-rollback floor trust /etc/mono_release, so a stale value +# (the 96b2fbc610 failure: identity package not rebuilt fresh into the rootfs) +# would make devices misreport their version and corrupt the floor. Check the +# assembled rootfs - the source the image is packed from - and refuse to stage +# on any mismatch (empty = could not verify = also refuse). set -e + the EXIT +# trap then drop the tag, so the next run rebuilds instead of shipping it. +built_id=$(cat build_dir/target-*/root-layerscape/etc/mono_release 2>/dev/null | head -1) +if [ "$built_id" != "$RELTAG" ]; then + echo "mono-update: FATAL: built rootfs identity '$built_id' != $RELTAG - refusing" >&2 + exit 1 +fi +echo "mono-update: verified baked identity $RELTAG" + OUT="releases/$RELTAG" BINDIR=bin/targets/layerscape/armv8_64b URLBASE="${MONO_PUBLISH_URL:-https://openwrt.mono.si}" -- 2.47.3