Fix handling of added, deleted, and corrupt boot files

A user was running into issues installing the kernel-container bundle on
Clear Linux. Namely, all missing files marked as boot were not
installed.

The root issue is that the bundle-add action does not set the "fix"
global variable before calling ignore(), so ignore() mistakenly returns
true when considering boot files that are missing, but not marked
deleted.

Because 'bundle-add' should be installing new boot files, and 'verify
--fix' should be repairing boot files if they have mismatching hashes,
remove the global "fix" variable entirely, since in all current call
sites, the "fix" behavior is expected.

Also, add another call to ignore() in remove_orphaned_files() to ensure
that any file that should be ignored (including deleted boot files) are
not removed during a 'verify --fix'.

Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>

include/swupd.h

@@ -112,7 +112,6 @@ extern bool verify_bundles_only;
 extern bool ignore_config;
 extern bool ignore_state;
 extern bool ignore_orphans;
-extern bool fix;
 extern char *format_string;
 extern char *path_prefix;
 extern bool set_format_string(char *userinput);

src/globals.c

@@ -44,7 +44,6 @@ bool ignore_config = true;
 bool ignore_state = true;
 #endif
 bool ignore_orphans = true;
-bool fix = false;
 char *format_string = NULL;
 char *path_prefix = NULL; /* must always end in '/' */
 char *mounted_dirs = NULL;

src/heuristics.c

@@ -113,14 +113,19 @@ void apply_heuristics(struct file *file)
 	config_file_heuristics(file);
 }
 
+/* Determines whether or not FILE should be ignored for this swupd action. Note
+ * that boot files are ignored only if they are marked as deleted; this does
+ * not happen in current manifests produced by swupd-server, but this check is
+ * enabled in case swupd-server ever allows for deleted boot files in manifests
+ * in the future.
+ */
 bool ignore(struct file *file)
 {
 	if ((file->is_config) ||
 	    is_config(file->filename) || // ideally we trust the manifest but short term reapply check here
 	    (file->is_state) ||
 	    is_state(file->filename) ||			    // ideally we trust the manifest but short term reapply check here
-	    (file->is_boot && fix && file->is_deleted) ||   // shouldn't happen
-	    (file->is_boot && !fix && !file->is_deleted) || // default ignore
+	    (file->is_boot && file->is_deleted) ||
 	    (ignore_orphans && file->is_orphan)) {
 		update_skip++;
 		file->do_not_update = 1;

src/manifest.c

@@ -554,9 +554,7 @@ struct list *create_update_list(struct manifest *current, struct manifest *serve
 {
 	struct list *output = NULL;
 	struct list *list;
-	bool fix_tmp = fix;
 
-	fix = true;
 	update_count = 0;
 	update_skip = 0;
 	list = list_head(server->files);
@@ -578,7 +576,6 @@ struct list *create_update_list(struct manifest *current, struct manifest *serve
 	}
 	update_count = list_len(output) - update_skip;
 
-	fix = fix_tmp;
 	return output;
 }
 

src/verify.c

@@ -455,6 +455,7 @@ static void deal_with_hash_mismatches(struct manifest *official_manifest, bool r
 		file = iter->data;
 		iter = iter->next;
 
+		// Note: boot files not marked as deleted are candidates for verify/fix
 		if (file->is_deleted ||
 		    ignore(file)) {
 			continue;
@@ -523,6 +524,14 @@ static void remove_orphaned_files(struct manifest *official_manifest)
 			continue;
 		}
 
+		/* Note: boot files marked as deleted should not be deleted by
+		 * verify/fix; this task is delegated to an external program
+		 * (currently /usr/bin/kernel_updater.sh).
+		 */
+		if (ignore(file)) {
+			continue;
+		}
+
 		fullname = mk_full_filename(path_prefix, file->filename);
 		if (fullname == NULL) {
 			abort();