From 19a7201d1d911c9f25bc112a3e0d2218eb6c14a2 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 2 Sep 2026 11:22:23 +0200 Subject: fix(packaging): ship the example hub config, and stop leaving /etc/meshbay open MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three defects, found while answering whether installing the .deb would land where the production server was just moved to by hand. - **The example config was never packaged.** `build-hub.sh` copied `packaging/conf/hub.toml.example` under `if [ -f ]`, and that path does not exist in this repo — so every package ever built shipped no example at all and said nothing about it. The postinst places no config either, on purpose (a shipped hub.toml is overwritten on upgrade; a shipped secret gets run in production), which left an installed hub with nothing to copy from. The file now exists, documents every key `config.py` reads including the captcha `allowed_hosts` the desktop client needs, and the copy is a hard failure rather than a silent skip. - **`/etc/meshbay` was created 0755.** It holds the hub's Ed25519 private key and its database password. The file modes protect the contents, but a world-listable config directory tells anyone with a shell what a hub keeps and where. Now 0750 root:meshbay, in both the deb postinst and the rpm scriptlet; the service reads it by group. - **The rpm would have failed to build on the new file.** `%files` claimed nothing under /etc, and rpmbuild refuses an installed file no line claims. It now declares the directory and the example, with explicit `%attr` and `%config` so an operator's edits become .rpmsave rather than vanishing. Package modes no longer follow the builder's umask either — the same source tree produced 775/664 on a machine with umask 002 and 755/644 with 022. `install -m` sets them. Verified by building: the deb now carries ./etc/meshbay/ at drwxr-x--- with hub.toml.example at 0644, and the embedded postinst tightens the directory as belt and braces rather than as the only thing making it right. The rpm path is unverified — no rpmbuild on this machine. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014UtzVrzM7e2tG9fSpkR9ML --- packaging/rpm/meshbay-hub.spec | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'packaging/rpm') diff --git a/packaging/rpm/meshbay-hub.spec b/packaging/rpm/meshbay-hub.spec index 73df0b9..50bd977 100644 --- a/packaging/rpm/meshbay-hub.spec +++ b/packaging/rpm/meshbay-hub.spec @@ -32,7 +32,11 @@ getent passwd meshbay >/dev/null || \ %systemd_post meshbay-hub.service install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub install -d -o meshbay -g meshbay -m 750 /var/log/meshbay -install -d -m 755 /etc/meshbay +# 750, not 755: this directory holds the hub's private key and its +# database password. The file modes protect the contents, but a +# world-listable config directory tells anyone with a shell what a +# hub keeps and where. The service reads it by group. +install -d -o root -g meshbay -m 750 /etc/meshbay %preun %systemd_preun meshbay-hub.service @@ -47,6 +51,13 @@ install -d -m 755 /etc/meshbay /opt/meshbay-common/venv/bin/meshbay-hub /usr/bin/meshbay-hub %{_unitdir}/meshbay-hub.service +# The example config, and the directory it lands in. Both have to be declared: +# build-hub.sh stages them, and rpmbuild fails the build on an installed file +# no %files line claims. %config so an operator's edits are kept as .rpmsave +# rather than silently replaced — it is under /etc, whatever its name says. +# The mode matches %post; the `meshbay` group exists by then, %pre makes it. +%dir %attr(0750, root, meshbay) /etc/meshbay +%config %attr(0644, root, meshbay) /etc/meshbay/hub.toml.example %changelog * Sun Aug 31 2026 MeshBay Team - %{version}-1 -- cgit v1.2.3