Air-gapped

#!/usr/bin/env bash # # Build an offline Redis install bundle for an air-gapped Ubuntu/Debian host. # # Dependency resolution: apt resolves the FULL closure as if nothing were # installed (Dir::State::status -> an empty file), so the bundle is complete # regardless of what's on this build host - the apt equivalent of dnf's # --alldeps. The real system is never touched (download-only + throwaway status). set -euo pipefail # ---- configuration --------------------------------------------------------- # Pin the UPSTREAM Redis version (e.g. 8.6.4) - REQUIRED. # The full apt version string - epoch, Debian revision and the codename suffix # like "~noble1" - is detected automatically from the repo for THIS release, # so the same script works unchanged on jammy / bookworm / etc. REDIS_UPSTREAM="${REDIS_UPSTREAM:-8.6.4}" INCLUDE_RECOMMENDS="${INCLUDE_RECOMMENDS:-yes}" # yes = also bundle Recommends PKGS=(redis redis-server redis-tools) ARCH="$(dpkg --print-architecture)" . /etc/os-release CODENAME="${VERSION_CODENAME:?cannot detect release codename}" OUTDIR="$(pwd)/redis-offline" # Empty status file = "nothing is installed" -> apt downloads every dependency. EMPTY_STATUS="$(mktemp)" trap 'rm -f "$EMPTY_STATUS"' EXIT echo ">> target: Redis ${REDIS_UPSTREAM:-latest} | ${ID:-?} ${CODENAME} | ${ARCH}" # ---- build-host tooling + Redis repository --------------------------------- sudo apt-get update sudo apt-get install -y --no-install-recommends curl gpg ca-certificates dpkg-dev curl -fsSL https://packages.redis.io/gpg \ | sudo gpg --dearmor --yes -o /usr/share/keyrings/redis-archive-keyring.gpg sudo chmod 644 /usr/share/keyrings/redis-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb ${CODENAME} main" \ | sudo tee /etc/apt/sources.list.d/redis.list >/dev/null sudo apt-get update # ---- auto-detect the exact, codename-correct version ----------------------- # packages.redis.io serves a per-codename repo, and Ubuntu's own universe also # ships a (different, older) redis-server, so we match BOTH the upstream version # and the "~<codename>" suffix to land on the right .deb. madison lists newest # first, so head -n1 wins. SPECS=() if [ -n "$REDIS_UPSTREAM" ]; then esc="$(printf '%s' "$REDIS_UPSTREAM" | sed 's/[.[\*^$]/\\&/g')" REDIS_VERSION="$( apt-cache madison redis-server \ | awk -F'|' '{gsub(/ /,"",$2); print $2}' \ | grep -E "(^|:)${esc}-" \ | grep -F "~${CODENAME}" \ | head -n1 )" if [ -z "$REDIS_VERSION" ]; then echo "ERROR: no Redis ${REDIS_UPSTREAM} build found for '${CODENAME}'." >&2 echo "Available versions:" >&2 apt-cache madison redis-server | awk -F'|' '{print " " $2}' >&2 exit 1 fi echo ">> resolved version: ${REDIS_VERSION}" for p in "${PKGS[@]}"; do SPECS+=("${p}=${REDIS_VERSION}"); done else echo "ERROR: REDIS_UPSTREAM is required" >&2 exit 1 fi REC_FLAG="--no-install-recommends" [ "$INCLUDE_RECOMMENDS" = "yes" ] && REC_FLAG="--install-recommends" # ---- download packages + full dependency closure --------------------------- rm -rf "$OUTDIR" mkdir -p "$OUTDIR/partial" # Preview the complete closure (every .deb, base libs included). echo ">> resolving full dependency closure..." apt-get install --print-uris -y $REC_FLAG \ -o Dir::State::status="$EMPTY_STATUS" \ "${SPECS[@]}" \ | grep -oP "(?<=')[^']*\.deb" > "$OUTDIR/manifest.txt" || true echo ">> $(wc -l < "$OUTDIR/manifest.txt") package file(s) to download" # download-only + the empty status file: every dependency is fetched, but the # real system is never modified. sudo apt-get install -y --download-only $REC_FLAG \ -o Dir::State::status="$EMPTY_STATUS" \ -o Dir::Cache::archives="$OUTDIR" \ "${SPECS[@]}" sudo rm -rf "$OUTDIR/partial" "$OUTDIR/lock" sudo chown -R "$(id -u):$(id -g)" "$OUTDIR" # ---- turn the folder into a local apt repo --------------------------------- # So the air-gapped install becomes a clean `apt-get install` that pulls only # what the target actually needs (far safer than `dpkg -i *.deb`). ( cd "$OUTDIR" \ && dpkg-scanpackages -m . /dev/null > Packages \ && gzip -9c Packages > Packages.gz ) # ---- integrity manifest ---------------------------------------------------- ( cd "$OUTDIR" && sha256sum *.deb > SHA256SUMS ) echo echo ">> done." echo ">> bundle: $OUTDIR" echo ">> files: $(ls "$OUTDIR"/*.deb | wc -l) .deb" echo ">> size: $(du -sh "$OUTDIR" | cut -f1)"

chmod +x prepare_redis.sh ./prepare_redis.sh

sudo cp -r redis-offline /opt/redis-offline

# Verify integrity: cd /opt/redis-offline && sha256sum -c SHA256SUMS # Register echo "deb [trusted=yes] file:/opt/redis-offline ./" | sudo tee /etc/apt/sources.list.d/redis-offline.list # Update using ONLY this source sudo apt-get -o Dir::Etc::sourcelist="sources.list.d/redis-offline.list" -o Dir::Etc::sourceparts="/dev/null" update # Install Redis. sudo apt-get install -y redis-server redis-tools sudo systemctl enable --now redis-server

... # The following line should be commented # bind 127.0.0.1 ... # The following line should be uncommented and set to no protected-mode no ...

sudo systemctl restart redis-server

redis-cli ping

#!/usr/bin/env bash # # Build an offline Redis install bundle for an air-gapped Rocky/RHEL host. # # Note: `dnf download --resolve --alldeps` pulls the FULL dependency closure # regardless of what's installed on this build host, so a clean machine is NOT # required for completeness. The cost is a larger bundle (it grabs base libs # too). The local-repo install step below keeps that safe: on the target you # `dnf install <name>` and dnf installs only what's missing - it will NOT # force-downgrade your base system. set -euo pipefail # ---- configuration --------------------------------------------------------- # Pin the UPSTREAM Redis version (e.g. 8.6.4). Leave empty for the latest. # The release tag (".el9") and arch are filled in automatically for THIS host. REDIS_VERSION="${REDIS_VERSION:-8.6.4}" ARCH="$(uname -m)" EL_VERSION="$(rpm -E %{rhel})" OUTDIR="$(pwd)/redis-offline" echo ">> target: Redis ${REDIS_VERSION:-latest} | EL${EL_VERSION} | ${ARCH}" # ---- build-host tooling ---------------------------------------------------- sudo dnf install -y dnf-plugins-core createrepo_c # ---- Redis repository + GPG key -------------------------------------------- # baseurl tracks the EL major version; gpgkey lets dnf verify on its own. sudo tee /etc/yum.repos.d/redis.repo >/dev/null <<EOF [redis] name=Redis baseurl=https://packages.redis.io/rpm/rockylinux${EL_VERSION} enabled=1 gpgcheck=1 gpgkey=https://packages.redis.io/gpg EOF curl -fsSL https://packages.redis.io/gpg -o /tmp/redis.key sudo rpm --import /tmp/redis.key sudo dnf makecache || true # ---- resolve the exact, EL-correct NEVRA ----------------------------------- # (release tag like "1.el9" and the arch are appended automatically; newest # matching release wins). On EL8 you'd also: sudo dnf module disable redis SPEC="redis" if [ -n "$REDIS_VERSION" ]; then esc="$(printf '%s' "$REDIS_VERSION" | sed 's/[.[\*^$]/\\&/g')" SPEC="$( dnf repoquery --quiet --repo=redis --arch="${ARCH},noarch" \ --queryformat '%{name}-%{version}-%{release}.%{arch}' redis 2>/dev/null \ | grep -E -- "-${esc}-" \ | sort -V | tail -n1 )" if [ -z "$SPEC" ]; then echo "ERROR: no Redis ${REDIS_VERSION} build found for EL${EL_VERSION}/${ARCH}." >&2 echo "Available redis versions in the repo:" >&2 dnf repoquery --quiet --repo=redis redis \ --queryformat ' %{version}-%{release}.%{arch}' >&2 exit 1 fi echo ">> resolved: ${SPEC}" fi # ---- download package + full dependency closure ---------------------------- # --resolve : also fetch dependencies # --alldeps : fetch them even if already installed here (= complete bundle) rm -rf "$OUTDIR" mkdir -p "$OUTDIR" dnf download --resolve --alldeps --downloaddir "$OUTDIR" "$SPEC" # ---- turn the folder into a local dnf repo --------------------------------- # So the air-gapped install is a clean `dnf install <name>` with ordering and # dependency *selection* handled for you. Do NOT `dnf install *.rpm` - that # tries to install every base lib in the bundle and can downgrade the target. createrepo_c "$OUTDIR" # ---- bundle the GPG key + integrity manifest ------------------------------- cp -f /tmp/redis.key "$OUTDIR/RPM-GPG-KEY-redis" ( cd "$OUTDIR" && sha256sum *.rpm > SHA256SUMS ) echo echo ">> done." echo ">> bundle: $OUTDIR" echo ">> files: $(ls "$OUTDIR"/*.rpm | wc -l) .rpm" echo ">> size: $(du -sh "$OUTDIR" | cut -f1)"

chmod +x prepare_redis.sh ./prepare_redis.sh

sudo cp -r redis-offline /opt/redis-offline

# Verify integrity cd /opt/redis-offline && sha256sum -c SHA256SUMS # Install from the local folder as a temporary repo sudo dnf install -y \ --disablerepo='*' \ --repofrompath=redisoffline,/opt/redis-offline \ --setopt=redisoffline.gpgcheck=0 \ redis

... # The following line should be commented # bind 127.0.0.1 ... # The following line should be uncommented and set to no protected-mode no ...

sudo systemctl restart redis

redis-cli ping