\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// #!/usr/bin/env bash set -o pipefail set -o errexit # Script to upgrade ImunifyAV and/or Imunify360 # bypassing gradual rollout VERSION="1.5" PACKAGES='' PRODUCT_AV='imunify-antivirus' PRODUCT_I360='imunify360-firewall' IMUNIFY_ANTIVIRUS_PACKAGES="imunify-antivirus \ ai-bolit \ alt-common-release \ alt-php-hyperscan \ imunify-release \ imunify-common \ imunify-notifier \ imunify-core \ imunify-realtime-av \ imunify-realtime-av-imrt2 \ rustbolit \ imunify-ui \ imunify-wp-security \ imunify360-venv \ alt-php-internal \ app-version-detector" IMUNIFY360_FIREWALL_PACKAGES="imunify360-firewall \ imunify-antivirus \ ai-bolit \ alt-common-release \ alt-php-hyperscan \ imunify-release \ imunify-common \ imunify-notifier \ imunify-core \ imunify-realtime-av \ imunify-realtime-av-imrt2 \ rustbolit \ imunify-ui \ imunify-wp-security \ imunify360-venv \ cloudlinux-backup-utils \ imunify360-ossec \ imunify360-pam \ imunify360-php-i360 \ imunify360-webshield-bundle \ imunify360-unified-access-logger \ alt-php-internal \ app-version-detector" IMUNIFY360_FIREWALL_RPM_ONLY_PACKAGES="imunify-auditd-log-reader \ minidaemon" IMUNIFY_ANTIVIRUS_RPM_ONLY_PACKAGES="minidaemon" REPORT_CMD="${REPORT_CMD:-/usr/libexec/report-command-error}" DEBIAN_VERSION_FILE="${DEBIAN_VERSION_FILE:-/etc/debian_version}" INTEGRITY_SCRIPT_PATH="${INTEGRITY_SCRIPT_PATH:-/opt/imunify360/venv/share/imunify360/scripts/imunify-check-pkg-integrity}" # Source the integrity script for shared functions: # filter_verify_noise, filter_whitelisted_files, check_dpkg_verify_supported, # INTEGRITY_WHITELIST_FILES if [[ -f "$INTEGRITY_SCRIPT_PATH" ]]; then source "$INTEGRITY_SCRIPT_PATH" fi verify_single_package() { local pkg="$1" local raw_output="" case "$OSTYPE" in centos) raw_output=$(rpm -V "$pkg" 2>&1) || raw_output="${raw_output}" ;; debian) raw_output=$(dpkg -V "$pkg" 2>&1) || raw_output="${raw_output}" ;; esac local filtered="" filtered=$(echo "$raw_output" | filter_verify_noise | filter_whitelisted_files) if [[ -n "$filtered" ]]; then echo "$filtered" return 1 fi return 0 } reinstall_package_centos() { local pkg="$1" echo " Reinstalling $pkg via yum..." if ! yum -y reinstall "$pkg" --enablerepo="imunify360-rollout-*-bypass"; then echo " WARNING: yum reinstall $pkg failed" return 1 fi return 0 } reinstall_package_debian() { local pkg="$1" echo " Reinstalling $pkg via apt-get..." if ! apt-get install --reinstall -y "$pkg"; then echo " WARNING: apt-get reinstall $pkg failed" return 1 fi return 0 } check_and_reinstall_broken_packages() { if ! type filter_verify_noise &>/dev/null; then echo "Integrity check: integrity script not available, skipping" return 0 fi if [[ -z "${PACKAGES:-}" ]]; then return 0 fi if [[ "$OSTYPE" == "debian" ]]; then if ! check_dpkg_verify_supported; then echo "Integrity check: dpkg -V not supported, skipping" return 0 fi fi echo "Integrity check: verifying packages after update..." local had_broken=false for pkg in $PACKAGES; do local verify_output="" local verify_rc=0 verify_output=$(verify_single_package "$pkg" 2>&1) || verify_rc=$? if [[ $verify_rc -ne 0 ]] && [[ -n "$verify_output" ]]; then if echo "$verify_output" | grep -q "is not installed"; then continue fi had_broken=true echo " BROKEN: $pkg" echo "$verify_output" | sed 's/^/ /' local reinstall_rc=0 case "$OSTYPE" in centos) reinstall_package_centos "$pkg" || reinstall_rc=$? ;; debian) reinstall_package_debian "$pkg" || reinstall_rc=$? ;; esac if [[ $reinstall_rc -eq 0 ]]; then local recheck_output="" local recheck_rc=0 recheck_output=$(verify_single_package "$pkg" 2>&1) || recheck_rc=$? if [[ $recheck_rc -eq 0 ]]; then echo " Fixed: $pkg" else echo " WARNING: $pkg could not fix after reinstall, still broken" fi fi fi done if [[ "$had_broken" == "true" ]]; then echo "Integrity check: broken packages found, running Sentry report..." if [[ -x "${REPORT_CMD}" ]] && [[ -x "${INTEGRITY_SCRIPT_PATH}" ]]; then "${REPORT_CMD}" "${INTEGRITY_SCRIPT_PATH}" || true fi else echo "Integrity check: all packages OK" fi return 0 } detect_cloudways_environment() { hostname=$(hostname -f) lowercase_hostname=$(echo "$hostname" | tr '[:upper:]' '[:lower:]') if echo "$lowercase_hostname" | grep -Eq "\.cloudwaysapps\.com|cloudwaysstagingapps\.com"; then is_cloudways=true elif [ -f /usr/local/sbin/apm ]; then if /usr/local/sbin/apm info | grep -q "Cloudways"; then is_cloudways=true else is_cloudways=false fi else is_cloudways=false fi } detect_ostype() { if [ ! -f /etc/os-release ] then OSTYPE=centos else source /etc/os-release if echo $ID $ID_LIKE | grep debian >/dev/null then OSTYPE=debian else OSTYPE=centos fi fi } detect_product_debian() { if dpkg -l "$PRODUCT_AV" 2>/dev/null | grep -E -q "^.i\s+${PRODUCT_AV}"; then PACKAGES="$IMUNIFY_ANTIVIRUS_PACKAGES" fi if dpkg -l "$PRODUCT_I360" 2>/dev/null | grep -E -q "^.i\s+${PRODUCT_I360}"; then PACKAGES="$IMUNIFY360_FIREWALL_PACKAGES" fi } detect_product_centos() { if rpm -q "${PRODUCT_AV}" >/dev/null; then PACKAGES="$IMUNIFY_ANTIVIRUS_PACKAGES \ $IMUNIFY_ANTIVIRUS_RPM_ONLY_PACKAGES" fi if rpm -q "${PRODUCT_I360}" >/dev/null; then PACKAGES="$IMUNIFY360_FIREWALL_PACKAGES \ $IMUNIFY360_FIREWALL_RPM_ONLY_PACKAGES" fi } update_centos() { yum -y update $PACKAGES --enablerepo="imunify360-rollout-*-bypass" if rpm -qi imunify-patchman &>/dev/null; then # optional yum -y update imunify-patchman --setopt=obsoletes=0 --enablerepo="imunify360-rollout-*-bypass" || true