Skip to content

Commit 9865dc9

Browse files
yorickdowneyorickdowne
authored
Better ETHDSECUNDO and Compose version check (#2550)
1 parent ece843e commit 9865dc9

1 file changed

Lines changed: 131 additions & 132 deletions

File tree

‎ethd‎

Lines changed: 131 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ __docker_major_version=""
1313
__docker_minor_version=""
1414
__docker_patch_version=""
1515
__compose_exe="docker compose"
16+
__compose_version=""
17+
__compose_major=""
18+
__compose_minor=""
1619
__old_compose=0
1720
__compose_upgraded=0
1821
__distro=""
@@ -226,38 +229,41 @@ __upgrade_docker() {
226229
local runc_fixed_version
227230
local yn
228231

232+
if [[ -z "${ETHDSECUNDO:-}" && "${__command}" = "update" ]]; then # Run this after getting the new ethd
233+
return
234+
fi
235+
229236
# A vulnerable runc may be found in Debian <= 13 or Ubuntu <= 24.04
230237
# The Debian code can be removed when Debian 13 goes EOL in 2030.
231238
# The Ubuntu code can be removed when Ubuntu 24.04 goes EOL in 2029.
232-
if [[ -n "${ETHDSECUNDO-}" || ! "${__command}" = "update" ]]; then # Don't run this twice
233-
if (( __docker_major_version < 28 )) ||
234-
(( __docker_major_version == 28 && __docker_minor_version < 5 )) ||
235-
(( __docker_major_version == 28 && __docker_minor_version == 5 && __docker_patch_version < 2 )); then
236-
runc_version=$(runc --version | awk '{ gsub(/[-\+~]/, " ", $3); $0=$0; print $3 }')
237-
runc_major_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[1]; }')
238-
runc_minor_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[2]; }')
239-
runc_patch_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[3]; }')
240-
241-
if [[ "${__distro}" =~ (ubuntu|debian) ]]; then
242-
if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
243-
if [[ "${__distro}" =~ debian ]]; then
244-
if [[ "${__os_major_version}" -gt 13 ]]; then # Assume Debian 14 and up are fine
245-
return
246-
fi
247-
runc_dpkg_version=$(dpkg-query -W -f='${Version}\n' runc)
248-
case ${__os_major_version} in
239+
if (( __docker_major_version < 28 )) ||
240+
(( __docker_major_version == 28 && __docker_minor_version < 5 )) ||
241+
(( __docker_major_version == 28 && __docker_minor_version == 5 && __docker_patch_version < 2 )); then
242+
runc_version=$(runc --version | awk '{ gsub(/[-\+~]/, " ", $3); $0=$0; print $3 }')
243+
runc_major_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[1]; }')
244+
runc_minor_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[2]; }')
245+
runc_patch_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[3]; }')
246+
247+
if [[ "${__distro}" =~ (ubuntu|debian) ]]; then
248+
if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
249+
if [[ "${__distro}" =~ debian ]]; then
250+
if [[ "${__os_major_version}" -gt 13 ]]; then # Assume Debian 14 and up are fine
251+
return
252+
fi
253+
runc_dpkg_version=$(dpkg-query -W -f='${Version}\n' runc)
254+
case ${__os_major_version} in
249255
# These fixed versions are a guess and have not been released
250-
13) runc_fixed_version="1.1.15+ds1-2+deb13u1";;
251-
12) runc_fixed_version="1.1.5+ds1-1+deb12u2";; # I don't expect to hit this, because docker.io is old
252-
11) runc_fixed_version="1.0.0~rc93+ds1-5+deb11u6";; # I don't expect to hit this, because docker.io is old
253-
*) echo "Cannot check runc on Debian ${__os_major_version}. Please update to ${__min_debian} or later"; return;;
254-
esac
255-
if dpkg --compare-versions "${runc_dpkg_version}" lt "${runc_fixed_version}"; then
256-
echo
257-
echo "Docker ${__docker_version} with runc ${runc_version} detected"
258-
echo "This version of runc is vulnerable"
259-
echo "If an updated version of runc is available, please install it"
260-
echo "Alternatively, consider uninstalling runc and replacing it with crun"
256+
13) runc_fixed_version="1.1.15+ds1-2+deb13u1";;
257+
12) runc_fixed_version="1.1.5+ds1-1+deb12u2";; # I don't expect to hit this, because docker.io is old
258+
11) runc_fixed_version="1.0.0~rc93+ds1-5+deb11u6";; # I don't expect to hit this, because docker.io is old
259+
*) echo "Cannot check runc on Debian ${__os_major_version}. Please update to ${__min_debian} or later"; return;;
260+
esac
261+
if dpkg --compare-versions "${runc_dpkg_version}" lt "${runc_fixed_version}"; then
262+
echo
263+
echo "Docker ${__docker_version} with runc ${runc_version} detected"
264+
echo "This version of runc is vulnerable"
265+
echo "If an updated version of runc is available, please install it"
266+
echo "Alternatively, consider uninstalling runc and replacing it with crun"
261267
# Commented out until fixed versions have actually been released
262268
# if [ "${__non_interactive}" -eq 0 ]; then
263269
# while true; do
@@ -271,64 +277,63 @@ __upgrade_docker() {
271277
# esac
272278
# done
273279
# fi
280+
fi
281+
else # This is Ubuntu and they fixed it with runc 1.3.3
282+
if (( runc_major_version == 1 && runc_minor_version < 3 )) ||
283+
(( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
284+
echo
285+
echo "Docker ${__docker_version} with runc ${runc_version} detected"
286+
echo "This version of runc is vulnerable"
287+
__nag_os_version
288+
if [ "${__eol_os}" -eq 1 ]; then
289+
echo "${__project_name} cannot update runc on Ubuntu ${__os_major_version}."
290+
return
274291
fi
275-
else # This is Ubuntu and they fixed it with runc 1.3.3
276-
if (( runc_major_version == 1 && runc_minor_version < 3 )) ||
277-
(( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
278-
echo
279-
echo "Docker ${__docker_version} with runc ${runc_version} detected"
280-
echo "This version of runc is vulnerable"
281-
__nag_os_version
282-
if [[ "${__eol_os}" -eq 1 ]]; then
283-
echo "${__project_name} cannot update runc on Ubuntu ${__os_major_version}."
284-
return
285-
fi
286-
echo "It is recommended that you update runc"
287-
if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
288-
while true; do
289-
read -rp "Do you want to update runc (yes/no) " yn
290-
case "${yn}" in
291-
[Nn]*) echo "Please be sure to update runc yourself!"; return;;
292-
*)
293-
${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade runc
294-
break
295-
;;
296-
esac
297-
done
298-
fi
292+
echo "It is recommended that you update runc"
293+
if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
294+
while true; do
295+
read -rp "Do you want to update runc (yes/no) " yn
296+
case "${yn}" in
297+
[Nn]*) echo "Please be sure to update runc yourself!"; return;;
298+
*)
299+
${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade runc
300+
break
301+
;;
302+
esac
303+
done
299304
fi
300305
fi
301-
elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
302-
echo
303-
echo "Docker ${__docker_version} detected"
304-
echo "This version of Docker has a vulnerable runc binary"
305-
__nag_os_version
306-
if [[ "${__eol_os}" -eq 1 ]]; then
307-
echo "${__project_name} cannot update Docker-CE on ${__distro} ${__os_major_version}."
308-
return
309-
fi
310-
echo "It is recommended that you update Docker-CE"
311-
if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
312-
while true; do
313-
read -rp "Do you want to update Docker-CE? (yes/no) " yn
314-
case "${yn}" in
315-
[Nn]*) echo "Please be sure to update Docker CE yourself!"; return;;
316-
*)
317-
${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade docker-ce containerd.io
318-
break
319-
;;
320-
esac
321-
done
322-
fi
323306
fi
324-
else
325-
if (( runc_major_version == 1 && runc_minor_version < 2 )) ||
326-
(( runc_major_version == 1 && runc_minor_version == 2 && runc_patch_version < 8 )) ||
327-
(( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
328-
echo
329-
echo "Docker ${__docker_version} with runc ${runc_version} detected"
330-
echo "This version of runc may be vulnerable, but ${__project_name} cannot update it on ${__distro}"
307+
elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
308+
echo
309+
echo "Docker ${__docker_version} detected"
310+
echo "This version of Docker has a vulnerable runc binary"
311+
__nag_os_version
312+
if [[ "${__eol_os}" -eq 1 ]]; then
313+
echo "${__project_name} cannot update Docker-CE on ${__distro} ${__os_major_version}."
314+
return
331315
fi
316+
echo "It is recommended that you update Docker-CE"
317+
if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
318+
while true; do
319+
read -rp "Do you want to update Docker-CE? (yes/no) " yn
320+
case "${yn}" in
321+
[Nn]*) echo "Please be sure to update Docker CE yourself!"; return;;
322+
*)
323+
${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade docker-ce containerd.io
324+
break
325+
;;
326+
esac
327+
done
328+
fi
329+
fi
330+
else
331+
if (( runc_major_version == 1 && runc_minor_version < 2 )) ||
332+
(( runc_major_version == 1 && runc_minor_version == 2 && runc_patch_version < 8 )) ||
333+
(( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
334+
echo
335+
echo "Docker ${__docker_version} with runc ${runc_version} detected"
336+
echo "This version of runc may be vulnerable, but ${__project_name} cannot update it on ${__distro}"
332337
fi
333338
fi
334339
fi
@@ -401,18 +406,16 @@ __check_compose_version() {
401406
# Compose V1 is in Debian 11 and Debian 12. The Debian-specific code can be removed when Debian 12 goes EOL in 2028.
402407
# Compose V1 is in Ubuntu 22.04 and 24.04. The Compose version check can be removed when Ubuntu 24.04 goes EOL in 2029.
403408

404-
# Check for Compose V2 (docker compose) vs Compose V1 (docker-compose)
409+
# Check for Compose V2+ (docker compose) vs Compose V1 (docker-compose)
405410
if docker compose version >/dev/null 2>&1; then
406411
__compose_version=$(${__docker_sudo} docker compose version | sed -n -E -e "s/.*version [v]?([0-9.-]*).*/\1/ip")
407412
__compose_major=${__compose_version%%.*}
408413
__compose_minor=${__compose_version#*.}
409414
__compose_minor=${__compose_minor%%.*}
410415
if [[ "${__compose_major}" -eq 1 ]]; then
411416
__old_compose=1
412-
elif [[ "${__compose_minor}" -lt 18 ]]; then
417+
elif [[ "${__compose_major}" -eq 2 && "${__compose_minor}" -lt 18 ]]; then
413418
__old_compose=1
414-
else
415-
__old_compose=0
416419
fi
417420
else
418421
__old_compose=1
@@ -421,54 +424,50 @@ __check_compose_version() {
421424
__compose_minor=${__compose_version#*.}
422425
__compose_minor=${__compose_minor%%.*}
423426
fi
424-
if [ "${__old_compose}" -eq 1 ]; then
425-
if [[ "${__compose_major}" -eq 1 ]]; then
426-
# This runs before the actual update command, in the main section. ethd exits if it can't upgrade, therefore
427-
# no check for ${ETHDSECUNDO} or command update, here
428-
echo
429-
echo "You are using docker-compose ${__compose_version}, which is unsupported by Docker, Inc."
430-
echo "${__project_name} only supports Compose V2."
431-
echo
432-
if [[ "${__distro}" = "ubuntu" ]]; then
433-
echo "It is recommended that you replace Compose V1 with Compose V2."
434-
if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
435-
while true; do
436-
read -rp "Do you want to update Docker Compose to V2? (yes/no) " yn
437-
case "${yn}" in
438-
[Nn]*)
439-
echo "Please be sure to update Docker Compose yourself!"
440-
echo "You can install it with \"sudo apt update && sudo apt install docker-compose-v2\"."
441-
echo "You can remove the old docker-compose:"
442-
echo "\"sudo apt-mark manual docker.io && sudo apt --autoremove remove docker-compose\""
443-
break
444-
;;
445-
*) __upgrade_compose; break;;
446-
esac
447-
done
448-
fi
449-
elif [[ "${__distro}" =~ debian ]]; then
450-
if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
451-
if [[ "${__os_major_version}" -lt 13 ]]; then
452-
echo "Debian ${__os_major_version}'s docker.io does not ship with Compose V2. Please replace docker.io with docker-ce"
453-
echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
454-
else
455-
echo "Debian ${__os_major_version} ships with Compose V2."
456-
echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
457-
echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
458-
fi
459-
else
460-
echo "You appear to be using Docker CE, which ships with Compose V2."
461-
echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
462-
echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
463-
fi
427+
if [[ "${__compose_major}" -gt 1 ]]; then
428+
return
429+
fi
430+
431+
# This runs before the actual update command, in the main section. ethd exits if it can't upgrade, therefore
432+
# no check for ${ETHDSECUNDO} or command update, here
433+
echo
434+
echo "You are using docker-compose ${__compose_version}, which is unsupported by Docker, Inc."
435+
echo "${__project_name} only supports Compose V2."
436+
echo
437+
if [[ "${__distro}" = "ubuntu" ]]; then
438+
echo "It is recommended that you replace Compose V1 with Compose V2."
439+
if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
440+
while true; do
441+
read -rp "Do you want to update Docker Compose to V2? (yes/no) " yn
442+
case "${yn}" in
443+
[Nn]*)
444+
echo "Please be sure to update Docker Compose yourself!"
445+
echo "You can install it with \"sudo apt update && sudo apt install docker-compose-v2\"."
446+
echo "You can remove the old docker-compose:"
447+
echo "\"sudo apt-mark manual docker.io && sudo apt --autoremove remove docker-compose\""
448+
break
449+
;;
450+
*) __upgrade_compose; break;;
451+
esac
452+
done
453+
fi
454+
elif [[ "${__distro}" =~ debian ]]; then
455+
if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
456+
if [[ "${__os_major_version}" -lt 13 ]]; then
457+
echo "Debian ${__os_major_version}'s docker.io does not ship with Compose V2. Please replace docker.io with docker-ce"
458+
echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
464459
else
465-
echo "${__project_name} does not know how to update Docker Compose on ${__distro}"
466-
fi
467-
else # Old Compose V2
468-
if [[ -n "${ETHDSECUNDO-}" || ! "${__command}" = "update" ]]; then # Don't run this twice
469-
true # Nothing now for old V2; maybe in future we'll do the update for the user
460+
echo "Debian ${__os_major_version} ships with Compose V2."
461+
echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
462+
echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
470463
fi
464+
else
465+
echo "You appear to be using Docker CE, which ships with Compose V2."
466+
echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
467+
echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
471468
fi
469+
else
470+
echo "${__project_name} does not know how to update Docker Compose on ${__distro}"
472471
fi
473472
}
474473

@@ -2115,7 +2114,7 @@ update() {
21152114
fi
21162115
fi
21172116

2118-
if [[ -z "${ETHDSECUNDO-}" ]]; then
2117+
if [[ -z "${ETHDSECUNDO:-}" ]]; then
21192118
set +e
21202119
${__as_owner} git config pull.rebase false
21212120
var="ETH_DOCKER_TAG"
@@ -6160,7 +6159,7 @@ fi
61606159

61616160
if [[ "${__old_compose}" -eq 1 && "${__compose_major}" -eq 2 ]]; then
61626161
echo "You are using Docker Compose ${__compose_version}, which has been shown to cause issues with new features"
6163-
echo "${__project_name} may require Compose v2.18.1 or later in future"
6162+
echo "${__project_name} requires Compose v2.18 or later"
61646163
echo
61656164
echo "It is recommended that you update Compose."
61666165
if [[ "${__distro}" =~ (debian|ubuntu) ]]; then

0 commit comments

Comments
 (0)