From 9673dfaaf4eb41601c4e513296460f77bdfc9302 Mon Sep 17 00:00:00 2001 From: zuevav Date: Tue, 6 Oct 2026 18:46:39 +0300 Subject: [PATCH] =?UTF-8?q?=D0=9A=D0=BB=D1=8E=D1=87:=20=D0=B5=D1=81=D0=BB?= =?UTF-8?q?=D0=B8=20=D0=98=D0=A8=20=D0=BD=D0=B5=20=D0=BD=D0=B0=D1=88=D1=91?= =?UTF-8?q?=D0=BB=20=D0=BA=D0=BB=D1=8E=D1=87=20=D0=BD=D0=B0=20=D1=84=D0=BB?= =?UTF-8?q?=D0=B5=D1=88=D0=BA=D0=B5=20=E2=80=94=20=D1=84=D0=BB=D0=B5=D1=88?= =?UTF-8?q?=D0=BA=D0=B0=20=D0=BC=D0=BE=D0=BD=D1=82=D0=B8=D1=80=D1=83=D0=B5?= =?UTF-8?q?=D1=82=D1=81=D1=8F=20=D0=BD=D0=B0=D0=BF=D1=80=D1=8F=D0=BC=D1=83?= =?UTF-8?q?=D1=8E=20=D0=B8=20=D0=BF=D1=80=D0=BE=D0=B2=D0=B5=D1=80=D0=BA?= =?UTF-8?q?=D0=B0=20=D0=BF=D0=BE=D0=B2=D1=82=D0=BE=D1=80=D1=8F=D0=B5=D1=82?= =?UTF-8?q?=D1=81=D1=8F;=20=D0=B2=20=D0=BE=D1=88=D0=B8=D0=B1=D0=BA=D0=B5?= =?UTF-8?q?=20=E2=80=94=20=D1=87=D1=82=D0=BE=20=D0=B2=D0=B8=D0=B4=D0=B8?= =?UTF-8?q?=D1=82=20=D1=88=D0=BB=D1=8E=D0=B7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit На .29 ключ с флешки не подписывал (E0700009 «Не найден ключ ЭП»): ИШ не видел флешку. Если автомонтирование ключевой флешки не сработало, установщик монтирует её напрямую (только чтение, под igate) и проверяет подпись ещё раз. Не помогло — в ошибке: смонтирована ли флешка в /var/lib/igate/keymedia и какие ключи (*.vdk) видит ИШ. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_014FsEKyJrYF69Cj9ZXzFLRi --- deploy/linux/sbin/bj-keymedia-install | 35 +++++++++++++++++++++------ internal/lkgateway/keywizard.go | 3 ++- internal/lkgateway/onboarding_test.go | 2 +- 3 files changed, 30 insertions(+), 10 deletions(-) diff --git a/deploy/linux/sbin/bj-keymedia-install b/deploy/linux/sbin/bj-keymedia-install index 667589c..821b1ad 100755 --- a/deploy/linux/sbin/bj-keymedia-install +++ b/deploy/linux/sbin/bj-keymedia-install @@ -302,15 +302,34 @@ PY fi # ---- проверка: ключ подписывает под igate (как будет подписывать ИШ) — проверочный документ профилем ---- -KEYCHECK="skip" +KEYCHECK="skip"; KEYDIAG="" +keysign(){ # 0 — ключ подписал проверочный документ под igate + local kt ko; kt=$(mktemp -d); echo "bj key check" > "$kt/in"; chown -R igate:igate "$kt" + ko=$(timeout -k 5 60 runuser -u igate -- env HOME=/var/lib/igate LD_LIBRARY_PATH="$VDLIB" "$ZPKI" -sign -profile "$PROFILE" -registry -in "$kt/in" -out "$kt/out.p7s" 2>&1) + if [ -s "$kt/out.p7s" ]; then rm -rf "$kt"; KEYCHECK=ok; return 0; fi + rm -rf "$kt" + KEYCHECK="fail: $(printf '%s' "$ko" | grep -iE 'ошибк|результат|error' | head -1 | tr -d '"\\' | head -c 200)"; return 1 +} +keydiag(){ # что видит ИШ: смонтирована ли ключевая флешка и какие ключи (*.vdk) ему доступны + local m v + m=$(findmnt -rn -o SOURCE,FSTYPE "$DEFAULT_KEYMEDIA" 2>/dev/null | grep -v autofs | head -1) + v=$(runuser -u igate -- env HOME=/var/lib/igate sh -c 'ls -1L "$HOME"/.Validata/vdkeys/*/*.vdk "$HOME"/.Validata/vdkeys/*.vdk 2>/dev/null' | xargs -r -n1 basename | tr '\n' ' ') + KEYDIAG="флешка в $DEFAULT_KEYMEDIA: ${m:-не смонтирована}; ключи, видимые ИШ: ${v:-нет}" +} if [ "$IGATE_RES" = connected ] || [ "$IGATE_RES" = pending-channel ]; then - KT=$(mktemp -d); echo "bj key check" > "$KT/in"; chown -R igate:igate "$KT" - KO=$(timeout -k 5 60 runuser -u igate -- env HOME=/var/lib/igate LD_LIBRARY_PATH="$VDLIB" "$ZPKI" -sign -profile "$PROFILE" -registry -in "$KT/in" -out "$KT/out.p7s" 2>&1) - if [ -s "$KT/out.p7s" ]; then KEYCHECK=ok - else KEYCHECK="fail: $(printf '%s' "$KO" | grep -iE 'ошибк|результат|error' | head -1 | tr -d '"\\' | head -c 200)"; fi - rm -rf "$KT" + if ! keysign && [ -n "$TARGET_DEV" ] && [ -b "$TARGET_DEV" ] && \ + [ -z "$(findmnt -rn -o FSTYPE "$DEFAULT_KEYMEDIA" 2>/dev/null | grep -v autofs)" ]; then + # автомонтирование не сработало — смонтировать флешку напрямую (только чтение, под igate) и проверить ещё раз + FT=$(blkid -s TYPE -o value "$TARGET_DEV" 2>/dev/null) + systemctl stop "$(systemd-escape -p --suffix=automount "$DEFAULT_KEYMEDIA")" 2>/dev/null; umount "$DEFAULT_KEYMEDIA" 2>/dev/null + case "$FT" in vfat|exfat|ntfs*) MO="ro,uid=$(id -u igate),gid=$(id -g igate),fmask=0133,dmask=0022" ;; *) MO="ro" ;; esac + mkdir -p "$DEFAULT_KEYMEDIA"; mount -o "$MO" "$TARGET_DEV" "$DEFAULT_KEYMEDIA" 2>/dev/null + systemctl restart vdmkdev.service >/dev/null 2>&1; sleep 2 + keysign + fi + [ "$KEYCHECK" = ok ] || keydiag fi finish; trap - EXIT -printf '{"ok":true,"profile":"%s","spr":"%s","vdk":"%s","backup":"%s","target":"%s","rebuild":"%s","igate":"%s","igate_profile_dir":"%s","keymedia":"%s","nowrite":%s,"keycheck":"%s"}\n' \ - "$PROFILE" "$SPRNAME" "$VDK_NAME" "$BACKUP" "$TARGET_MNT" "$REBUILD_RES" "$IGATE_RES" "$IGATE_PROFILES/$PROFILE" "$KEYMEDIA_UUID" "$([ "$NOWRITE" = 1 ] && echo true || echo false)" "$KEYCHECK" +printf '{"ok":true,"profile":"%s","spr":"%s","vdk":"%s","backup":"%s","target":"%s","rebuild":"%s","igate":"%s","igate_profile_dir":"%s","keymedia":"%s","nowrite":%s,"keycheck":"%s","keydiag":"%s"}\n' \ + "$PROFILE" "$SPRNAME" "$VDK_NAME" "$BACKUP" "$TARGET_MNT" "$REBUILD_RES" "$IGATE_RES" "$IGATE_PROFILES/$PROFILE" "$KEYMEDIA_UUID" "$([ "$NOWRITE" = 1 ] && echo true || echo false)" "$KEYCHECK" "$(printf '%s' "$KEYDIAG" | tr -d '"\\')" diff --git a/internal/lkgateway/keywizard.go b/internal/lkgateway/keywizard.go index 9e9395a..5893fb1 100644 --- a/internal/lkgateway/keywizard.go +++ b/internal/lkgateway/keywizard.go @@ -663,7 +663,8 @@ func keyInstallProblem(res map[string]any) string { case igate != "connected" && igate != "pending-channel": return "профиль ИШ не сформирован — " + strings.TrimSuffix(igateRu(igate), ":") case strings.HasPrefix(check, "fail"): - return "ключ не подписывает: " + strings.TrimPrefix(check, "fail: ") + " — вставлена ли флешка с ключом?" + diag, _ := res["keydiag"].(string) + return "ключ не подписывает: " + strings.TrimPrefix(check, "fail: ") + prefixed(". Что видит шлюз — ", diag) } return "" } diff --git a/internal/lkgateway/onboarding_test.go b/internal/lkgateway/onboarding_test.go index 20eb9fe..6ad7b08 100644 --- a/internal/lkgateway/onboarding_test.go +++ b/internal/lkgateway/onboarding_test.go @@ -802,7 +802,7 @@ func TestKeyInstallProblem(t *testing.T) { {map[string]any{"rebuild": "as-is", "igate": "pending-channel", "keycheck": "ok"}, ""}, {map[string]any{"rebuild": "fail: crestor: Ошибка загрузки ключа ЭП", "igate": "skip"}, "справочник"}, {map[string]any{"rebuild": "ok", "igate": "skip"}, "профиль ИШ"}, - {map[string]any{"rebuild": "ok", "igate": "connected", "keycheck": "fail: E0D5"}, "не подписывает"}, + {map[string]any{"rebuild": "ok", "igate": "connected", "keycheck": "fail: E0D5", "keydiag": "флешка в /var/lib/igate/keymedia: не смонтирована; ключи, видимые ИШ: нет"}, "не смонтирована"}, } { got := keyInstallProblem(c.res) if (c.want == "") != (got == "") || !strings.Contains(got, c.want) {