feat(linux): reinstall an existing Service when upgrading the package

The deb postinst and rpm %post now reinstall the Service in place when an
upgrade finds its systemd unit, reusing the unit's group so package-manager
runs without a sudo/pkexec user keep the same IPC access. First installs and
disabled, masked, or group-less units are left alone; failures warn and exit
0 because neither dpkg nor rpm can restore the previous Service from a failed
postinst.

The in-app updater stops a Service-run core before installing on Linux and
restarts it if the install fails, so the post-update restart does not fail on
the session lost when the Service restarts.

Refs #8515

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Tunglies
2026-11-09 18:02:22 +08:00
co-authored by Copilot
parent c3531bbbf2
commit cdd704f980
5 changed files with 122 additions and 8 deletions
@@ -5,6 +5,44 @@ chmod +x /usr/bin/clash-verge-service-install
chmod +x /usr/bin/clash-verge-service-uninstall
chmod +x /usr/bin/clash-verge-service
# Failures only warn: dpkg and rpm cannot restore the previous Service from a failed postinst,
# and a failing script would leave the upgraded package unconfigured or report the update as failed.
reinstall_existing_service() {
local unit="/etc/systemd/system/clash-verge-service.service"
# Only a unit kept by an upgrade-aware removal script shows the Service existed before this upgrade.
if [ ! -f "$unit" ] || [ -L "$unit" ]; then
return 0
fi
if [ ! -d /run/systemd/system ]; then
echo "Warning: systemd is not running, so Clash Verge Service was not reinstalled; reinstall it from Clash Verge." >&2
return 0
fi
if ! systemctl is-enabled --quiet clash-verge-service.service; then
echo "Clash Verge Service is disabled; leaving it unchanged." >&2
return 0
fi
# Package managers run without the invoking user's identity, so keep the group that may use the Service.
local group gid
group="$(sed -n 's/^Group=//p' "$unit" | head -n 1)"
gid=""
if [ -n "$group" ]; then
gid="$(getent group "$group" | cut -d: -f3)"
fi
if [ -z "$gid" ]; then
echo "Warning: the Clash Verge Service group '$group' could not be resolved, so the Service was not reinstalled; reinstall it from Clash Verge." >&2
return 0
fi
if ! CLASH_VERGE_SERVICE_GID="$gid" /usr/bin/clash-verge-service-install --install-service; then
echo "Warning: reinstalling Clash Verge Service failed; reinstall it from Clash Verge." >&2
fi
}
# Upgrades keep an existing Service current; first installs never add one. No success is reported:
# a previous package whose %preun uninstalls unconditionally still removes the Service afterwards.
if [ "$1" -ge 2 ]; then
reinstall_existing_service
fi
# The enforcement file exists in both Enforcing and Permissive mode.
if [ ! -e /sys/fs/selinux/enforce ]; then
exit 0
+37
View File
@@ -3,6 +3,43 @@ chmod +x /usr/bin/clash-verge-service-install
chmod +x /usr/bin/clash-verge-service-uninstall
chmod +x /usr/bin/clash-verge-service
# Failures only warn: dpkg and rpm cannot restore the previous Service from a failed postinst,
# and a failing script would leave the upgraded package unconfigured or report the update as failed.
reinstall_existing_service() {
local unit="/etc/systemd/system/clash-verge-service.service"
# Only a unit kept by an upgrade-aware removal script shows the Service existed before this upgrade.
if [ ! -f "$unit" ] || [ -L "$unit" ]; then
return 0
fi
if [ ! -d /run/systemd/system ]; then
echo "Warning: systemd is not running, so Clash Verge Service was not reinstalled; reinstall it from Clash Verge." >&2
return 0
fi
if ! systemctl is-enabled --quiet clash-verge-service.service; then
echo "Clash Verge Service is disabled; leaving it unchanged." >&2
return 0
fi
# Package managers run without the invoking user's identity, so keep the group that may use the Service.
local group gid
group="$(sed -n 's/^Group=//p' "$unit" | head -n 1)"
gid=""
if [ -n "$group" ]; then
gid="$(getent group "$group" | cut -d: -f3)"
fi
if [ -z "$gid" ]; then
echo "Warning: the Clash Verge Service group '$group' could not be resolved, so the Service was not reinstalled; reinstall it from Clash Verge." >&2
return 0
fi
if ! CLASH_VERGE_SERVICE_GID="$gid" /usr/bin/clash-verge-service-install --install-service; then
echo "Warning: reinstalling Clash Verge Service failed; reinstall it from Clash Verge." >&2
fi
}
# Upgrades keep an existing Service current; first installs never add one.
if [ "$1" = "configure" ] && [ -n "$2" ]; then
reinstall_existing_service
fi
. /etc/os-release
if [ "$ID" = "deepin" ]; then