Files
Bose-SoundTouch/scripts/on-device-install/aftertouch
T
Tobias GesellchenandClaude Sonnet 5 4a1e722069 fix(on-device-install): daemon restart never replaced the running process
Three stacked bugs, found and confirmed on real hardware while
downgrading a speaker: the new binary landed on disk correctly, but
the running service kept reporting the old version indefinitely.

- install.sh called `/etc/init.d/aftertouch start`, not `restart`,
  after installing. start-stop-daemon silently refuses to launch a
  second instance when one is already running, and the init script
  never checked its exit status, so the old process was never
  replaced.

- The init script started the daemon through a `sh -c "exec ... |
  logger"` pipeline, on the assumption that `exec` lets --make-pidfile
  record the daemon's own PID. POSIX forks each side of a pipe into
  its own process, so the wrapper shell (not the daemon) was the one
  actually tracked. `stop` killed the wrapper, which doesn't forward
  SIGTERM to its children, orphaning the real daemon to keep running
  and keep holding :8000 forever.

- Once the wrapper correctly tracked the daemon's own PID, a further
  race surfaced: start-stop-daemon's own "already running?" check
  matched on generic `/bin/sh` identity, so a `restart`'s `start`
  phase could catch the previous wrapper still mid-teardown and
  silently refuse to launch a new one (masked by --quiet, looking
  like a 120s hang).

Fixed by calling `restart` instead of `start` in install.sh, and by
having the wrapper shell record the daemon's real PID itself (via $!)
while keying start-stop-daemon's own check on that same pidfile
instead of process identity.

Verified on hardware: three consecutive restart cycles, each fast,
each with the pidfile matching the live daemon PID and daemon output
flowing through syslog again via logread.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-16 15:54:00 +02:00

192 lines
6.9 KiB
Bash

#!/bin/sh
### BEGIN INIT INFO
# Provides: aftertouch-service
# Required-Start: $network $local_fs
# Required-Stop: $network $local_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Run AfterTouch on this device
# Description: Start/stop AfterTouch soundtouch-service
### END INIT INFO
NAME="aftertouch-service"
DESC="Bose AfterTouch service"
DAEMON="/opt/aftertouch/aftertouch-service"
PIDFILE="/var/run/$NAME.pid"
DATADIR="/opt/aftertouch/data"
SCRIPTNAME="/etc/init.d/$NAME"
USER="root"
LOG_TAG="aftertouch"
# Export PATH
export PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
# Sanity check executable
test -x "$DAEMON" || {
echo "ERROR: Cannot execute $DAEMON (check path and permissions)." >&2
exit 1
}
case "$1" in
start)
echo "Starting $DESC..."
mount -o remount,rw / >/dev/null 2>&1 || {
echo "ERROR: remount failed." >&2
exit 1
}
mkdir -p "$DATADIR"
# Route stdout + stderr through `logger -t $LOG_TAG` so the
# daemon's output lands in busybox syslog (bounded ring buffer,
# never grows on disk). Users diagnose with:
#
# logread | grep aftertouch | tail -20
# logread -f | grep aftertouch # live tail
#
# This used to be a `--startas "/bin/sh" -- -c "exec $DAEMON | logger"`
# pipeline, on the theory that `exec` replaces /bin/sh so --make-pidfile
# records the daemon's own PID. That's wrong for a *piped* command:
# POSIX requires each side of a pipe to run in its own forked process,
# so the top-level /bin/sh forks two children (one execs into the
# daemon, one becomes logger) and stays alive itself, blocked in
# wait() -- --make-pidfile recorded *that* wrapper's PID, not the
# daemon's. `stop` then killed the wrapper, which doesn't forward
# SIGTERM to its children, orphaning the real daemon (reparented to
# init) to keep running -- and keep holding :8000 -- forever, silently
# surviving every later stop/start/restart.
#
# A first fix attempt dropped the wrapper shell entirely in favor of
# `--exec "$DAEMON"` directly, with a plain shell-level `>FIFO`
# redirection on the start-stop-daemon invocation. That broke logging
# instead: this busybox's `--background` resets the backgrounded
# child's own stdio, ignoring the outer redirection, so the daemon's
# output never reached the FIFO -- confirmed on hardware (`logger`
# exited immediately with nothing to read, `logread` showed nothing
# new).
#
# This version keeps a wrapper shell -- its *own* FIFO redirection,
# set up by its own script logic rather than inherited from outside,
# isn't affected by whatever --background did to its stdio -- but has
# the wrapper record the daemon's real PID itself instead of trusting
# --make-pidfile. $! after a single, non-piped backgrounded command is
# portably that command's own PID; --make-pidfile can only ever see
# whatever process start-stop-daemon directly forked (the wrapper),
# never a PID from inside it.
LOGFIFO="/tmp/$NAME.fifo"
rm -f "$LOGFIFO"
mkfifo "$LOGFIFO"
# --pidfile (without --make-pidfile, since the wrapper writes it itself
# once it knows the daemon's real PID) makes start-stop-daemon's own
# "already running?" check keyed on *our* pidfile, not on "/bin/sh"
# identity. Without this, --startas "/bin/sh" is itself the match
# criterion -- and since the wrapper stays alive for the daemon's whole
# lifetime (blocked in its own `wait`), and `stop` only confirms the
# *daemon* PID died (not that the wrapper has finished tearing down),
# a `restart` firing `start` right after `stop` can catch the previous
# wrapper still mid-teardown. start-stop-daemon then silently refuses
# ("/bin/sh is already running", swallowed by --quiet) while the
# script burns its full 120s timeout waiting for a daemon that was
# never launched. Confirmed on hardware: a bare
# `start-stop-daemon --startas "/bin/sh" -- -c "echo hi"` was refused
# with exactly that message while a prior wrapper was still alive.
start-stop-daemon --start \
--quiet \
--pidfile "$PIDFILE" \
--background \
--chuid "$USER" \
--startas "/bin/sh" \
-- -c "logger -t $LOG_TAG <'$LOGFIFO' & \"$DAEMON\" --data-dir '$DATADIR' --record-interactions=false --discovery-interval=60m >'$LOGFIFO' 2>&1 & echo \$! >'$PIDFILE'; wait"
tries=0
max_tries=60
while [ $tries -lt $max_tries ]; do
if curl -fsS http://localhost:8000 >/dev/null 2>&1; then
exit 0
fi
sleep 2
tries=$((tries + 1))
done
echo "ERROR: daemon started but http://localhost:8000 never responded within $((max_tries * 2))s." >&2
echo " Inspect the daemon's syslog output:" >&2
echo " logread | grep $LOG_TAG | tail -20" >&2
exit 1
;;
stop)
echo "Stopping $DESC..."
if [ -f "$PIDFILE" ]; then
PID=$(cat "$PIDFILE")
start-stop-daemon --stop \
--quiet \
--oknodo \
--pidfile "$PIDFILE"
# Wait up to 15 s for SIGTERM to take effect before escalating.
# The Go HTTP server exits promptly on SIGTERM in normal conditions;
# the loop handles the rare case where it is stuck in a blocking syscall.
tries=0
while [ $tries -lt 15 ] && kill -0 "$PID" 2>/dev/null; do
sleep 1
tries=$((tries + 1))
done
if kill -0 "$PID" 2>/dev/null; then
echo "Warning: $NAME (PID $PID) still alive after ${tries}s; sending SIGKILL..." >&2
kill -9 "$PID" 2>/dev/null || true
sleep 1
fi
rm -f "$PIDFILE"
else
echo "No $NAME running (no PID file)." >&2
fi
;;
restart|force-reload)
"$0" stop
sleep 2
"$0" start
;;
status)
if [ -f "$PIDFILE" ]; then
PID=$(cat "$PIDFILE")
if kill -0 "$PID" 2>/dev/null; then
# PID is alive — does it actually serve HTTP? A live process
# with a dead listener is the symptom behind issue #250
# (Gustour's ST30: status said running, curl said
# connection-refused). Distinguish the two states here so
# status isn't a false-positive.
if curl -fsS --max-time 3 http://localhost:8000 >/dev/null 2>&1; then
echo "$NAME is running (PID $PID, http://localhost:8000 responding)."
exit 0
else
echo "$NAME PID $PID is alive but http://localhost:8000 is not responding." >&2
echo "Recent log:" >&2
logread 2>/dev/null | grep "$LOG_TAG" | tail -10 >&2
exit 3
fi
else
echo "$NAME is not running (PID file exists but process is dead)." >&2
exit 1
fi
else
echo "$NAME is not running."
exit 3
fi
;;
*)
echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload|status}"
exit 1
;;
esac
exit 0