fix: provision OpenSSL 3.2 runtime

scripts/jenkins-server-provision.sh

@@ -4,6 +4,10 @@ set -euo pipefail
 PROVISION_TOOLS_DIR="${PROVISION_TOOLS_DIR:-provision-tools}"
 SPACETIME_BIN_SOURCE="${SPACETIME_BIN_SOURCE:-${PROVISION_TOOLS_DIR}/spacetime/spacetime}"
 OTELCOL_BIN_SOURCE="${OTELCOL_BIN_SOURCE:-${PROVISION_TOOLS_DIR}/otelcol-contrib}"
+GENARRATIVE_OPENSSL_VERSION="${GENARRATIVE_OPENSSL_VERSION:-3.2.0}"
+GENARRATIVE_OPENSSL_PREFIX="${GENARRATIVE_OPENSSL_PREFIX:-/opt/genarrative/openssl-3.2.0}"
+GENARRATIVE_OPENSSL_SOURCE_URL="${GENARRATIVE_OPENSSL_SOURCE_URL:-https://github.com/openssl/openssl/releases/download/openssl-${GENARRATIVE_OPENSSL_VERSION}/openssl-${GENARRATIVE_OPENSSL_VERSION}.tar.gz}"
+GENARRATIVE_OPENSSL_SOURCE_SHA256="${GENARRATIVE_OPENSSL_SOURCE_SHA256:-14c826f07c7e433706fb5c69fa9e25dab95684844b4c962a2cf1bf183eb4690e}"
 
 require_non_root_relative_path() {
   local label="$1"
@@ -27,6 +31,14 @@ require_path() {
   fi
 }
 
+require_cmd() {
+  local name="$1"
+  if ! command -v "${name}" >/dev/null 2>&1; then
+    echo "[server-provision] 缺少命令: ${name}" >&2
+    exit 1
+  fi
+}
+
 normalize_server_aliases() {
   printf "%s" "${SERVER_ALIASES:-}" | tr ',' ' ' | xargs
 }
@@ -87,6 +99,113 @@ install_nginx_brotli_modules() {
   fi
 }
 
+download_file() {
+  local url="$1"
+  local output="$2"
+
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL --retry 3 --retry-delay 2 "${url}" -o "${output}"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -O "${output}" "${url}"
+  else
+    echo "[server-provision] 需要 curl 或 wget 下载: ${url}" >&2
+    exit 1
+  fi
+}
+
+openssl_lib_dir_candidates() {
+  printf "%s\n" \
+    "${GENARRATIVE_OPENSSL_PREFIX}/lib64" \
+    "${GENARRATIVE_OPENSSL_PREFIX}/lib"
+}
+
+find_genarrative_openssl_lib_dir() {
+  local lib_dir
+  while IFS= read -r lib_dir; do
+    if [[ -f "${lib_dir}/libssl.so.3" && -f "${lib_dir}/libcrypto.so.3" ]]; then
+      printf "%s" "${lib_dir}"
+      return 0
+    fi
+  done < <(openssl_lib_dir_candidates)
+  return 1
+}
+
+genarrative_openssl_has_required_symbol() {
+  local lib_dir
+  lib_dir="$(find_genarrative_openssl_lib_dir 2>/dev/null || true)"
+  if [[ -z "${lib_dir}" ]]; then
+    return 1
+  fi
+  grep -a -q "OPENSSL_${GENARRATIVE_OPENSSL_VERSION}" "${lib_dir}/libssl.so.3"
+}
+
+verify_genarrative_openssl_install() {
+  local lib_dir
+  lib_dir="$(find_genarrative_openssl_lib_dir 2>/dev/null || true)"
+  if [[ -z "${lib_dir}" ]]; then
+    echo "[server-provision] OpenSSL ${GENARRATIVE_OPENSSL_VERSION} 安装后缺少 libssl.so.3/libcrypto.so.3: ${GENARRATIVE_OPENSSL_PREFIX}" >&2
+    exit 1
+  fi
+  if ! grep -a -q "OPENSSL_${GENARRATIVE_OPENSSL_VERSION}" "${lib_dir}/libssl.so.3"; then
+    echo "[server-provision] OpenSSL 动态库缺少 OPENSSL_${GENARRATIVE_OPENSSL_VERSION} 符号: ${lib_dir}/libssl.so.3" >&2
+    exit 1
+  fi
+  if ! env "LD_LIBRARY_PATH=${lib_dir}" "${GENARRATIVE_OPENSSL_PREFIX}/bin/openssl" version | grep -q "OpenSSL ${GENARRATIVE_OPENSSL_VERSION}"; then
+    echo "[server-provision] OpenSSL ${GENARRATIVE_OPENSSL_VERSION} 安装后命令验证失败: ${GENARRATIVE_OPENSSL_PREFIX}/bin/openssl" >&2
+    exit 1
+  fi
+  echo "[server-provision] OpenSSL ${GENARRATIVE_OPENSSL_VERSION} 已就绪: ${lib_dir}"
+}
+
+install_genarrative_openssl_runtime() {
+  local tmp_dir archive source_dir jobs lib_dir
+
+  echo "[server-provision] 检查 api-server/libcurl 运行时 OpenSSL ${GENARRATIVE_OPENSSL_VERSION}"
+  if [[ "${DRY_RUN}" == "true" ]]; then
+    echo "+ install OpenSSL ${GENARRATIVE_OPENSSL_VERSION} into ${GENARRATIVE_OPENSSL_PREFIX}"
+    echo "+ verify OPENSSL_${GENARRATIVE_OPENSSL_VERSION} symbol for api-server/libcurl"
+    return
+  fi
+
+  if genarrative_openssl_has_required_symbol; then
+    verify_genarrative_openssl_install
+    return
+  fi
+
+  if command -v apt-get >/dev/null 2>&1; then
+    run_cmd apt-get install -y build-essential ca-certificates curl perl tar
+  else
+    echo "[server-provision] 当前系统未使用 apt，无法自动构建 OpenSSL ${GENARRATIVE_OPENSSL_VERSION}；请手动安装到 ${GENARRATIVE_OPENSSL_PREFIX}。" >&2
+    exit 1
+  fi
+  require_cmd sha256sum
+  require_cmd tar
+
+  tmp_dir="$(mktemp -d)"
+  archive="${tmp_dir}/openssl-${GENARRATIVE_OPENSSL_VERSION}.tar.gz"
+  echo "[server-provision] 下载 OpenSSL ${GENARRATIVE_OPENSSL_VERSION}: ${GENARRATIVE_OPENSSL_SOURCE_URL}"
+  download_file "${GENARRATIVE_OPENSSL_SOURCE_URL}" "${archive}"
+  printf "%s  %s\n" "${GENARRATIVE_OPENSSL_SOURCE_SHA256}" "${archive}" | sha256sum -c -
+
+  tar -xzf "${archive}" -C "${tmp_dir}"
+  source_dir="${tmp_dir}/openssl-${GENARRATIVE_OPENSSL_VERSION}"
+  jobs="$(nproc 2>/dev/null || echo 2)"
+  (
+    cd "${source_dir}"
+    ./config --prefix="${GENARRATIVE_OPENSSL_PREFIX}" --openssldir="${GENARRATIVE_OPENSSL_PREFIX}/ssl" shared
+    make -j "${jobs}"
+    make install_sw
+  )
+  rm -rf "${tmp_dir}"
+
+  lib_dir="$(find_genarrative_openssl_lib_dir 2>/dev/null || true)"
+  if [[ -n "${lib_dir}" ]]; then
+    chmod 0755 "${GENARRATIVE_OPENSSL_PREFIX}" "${lib_dir}" || true
+    chmod 0644 "${lib_dir}/libssl.so.3" "${lib_dir}/libcrypto.so.3" || true
+  fi
+  verify_genarrative_openssl_install
+}
+
 sync_otelcol_install() {
   local target_bin="/usr/local/bin/otelcol-contrib"
   local source_bin="${OTELCOL_BIN_SOURCE}"
@@ -651,6 +770,7 @@ fi
 
 run_cmd chown -R spacetimedb:spacetimedb "${SPACETIME_ROOT}"
 run_cmd chown -R genarrative:genarrative /opt/genarrative /var/lib/genarrative /srv/genarrative
+install_genarrative_openssl_runtime
 
 if [[ ! -x "${SPACETIME_BIN_SOURCE}" ]]; then
   echo "[server-provision] spacetime CLI 不存在或不可执行: ${SPACETIME_BIN_SOURCE}" >&2