Linux: add a distro version check to prevent unintentional updates

Add a helper script to check the reported distro version at /etc/os-release at the start of a provisioning and at the end of it, compare them, and throw an error if there is any difference even at the most minor patch level e.g. Ubuntu 24.04.0 -> 24.04.1. Task-number: QTQAINFRA-7810 Pick-to: 6.11 6.8 Change-Id: If4f1e997aef40037ee876bc3843ed09a5412615f Reviewed-by: Simo Fält <simo.falt@qt.io> (cherry picked from commit d4992d4da4) Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Update submodules on '6.12 in qt/qt5'
2026-09-05 00:37:37 +08:00 · 2026-09-03 05:22:34 +00:00 · 2026-09-02 20:17:17 +00:00 · 2026-09-01 04:22:07 +00:00
72 changed files with 301 additions and 62 deletions
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 The Qt Company Ltd.
+# SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+
+set -e
+
+OS_STATE_DIR="/var/lib/qtciid"
+OS_STATE_FILE="$OS_STATE_DIR/os-version"
+
+get_os_id() {
+    if [[ -r /etc/os-release ]]; then
+        # shellcheck disable=SC1091
+        . /etc/os-release
+        # os-release contains ID of the distro (e.g. 'ubuntu')
+        # VERSION e.g. '24.04.1 LTS (Noble Numbat)'
+        if [[ -n "${ID:-}" && -n "${VERSION:-}" ]]; then
+            echo "${ID}:${VERSION}"
+            return 0
+        fi
+    fi
+
+    echo "unknown:unknown"
+    return 1
+}
+
+record_os_version() {
+    local os_id
+
+    os_id="$(get_os_id)"
+
+    if [[ "$os_id" == "unknown:unknown" ]]; then
+        echo "ERROR: Unable to determine OS version"
+        exit 1
+    fi
+
+    sudo mkdir -p "$OS_STATE_DIR"
+    echo "$os_id" | sudo tee "$OS_STATE_FILE" > /dev/null
+
+    echo "OS version: $os_id"
+}
+
+verify_os_version_unchanged() {
+    if [[ ! -f "$OS_STATE_FILE" ]]; then
+        echo "ERROR: OS version state file missing: $OS_STATE_FILE"
+        exit 1
+    fi
+
+    local start_version current_version
+
+    start_version="$(cat "$OS_STATE_FILE")"
+    current_version="$(get_os_id)"
+
+    if [[ "$current_version" == "unknown:unknown" ]]; then
+        echo "ERROR: Unable to determine current OS version"
+        exit 1
+    fi
+
+    if [[ "$start_version" != "$current_version" ]]; then
+        echo "ERROR: OS version changed during provisioning!"
+        echo "  Start version : $start_version"
+        echo "  End version   : $current_version"
+        exit 1
+    fi
+
+    echo "OS version unchanged ($current_version)"
+}
@@ -2,25 +2,38 @@
 # Copyright (C) 2024 The Qt Company Ltd.
 # SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only

-download_ffmpeg() {
-    local version="${1:-"n8.1.2"}"
-    local sha1="${2:-a7f4ce77209afdadca9f371db261e8d69903dc85}"
+download_ffmpeg() (
+    local version="${1:-"9.0.1"}"
+    local sha1="${2:-89c318905212e6b67e10e42ab10ab8007e0aefda}"

-    local ffmpeg_name="FFmpeg-$version"
+    local ffmpeg_name="FFmpeg-n$version"
    local target_dir="$HOME"
    local ffmpeg_source_dir="$target_dir/$ffmpeg_name"

    if [ ! -d "$ffmpeg_source_dir" ]; then
-        local url_public="https://github.com/FFmpeg/FFmpeg/archive/refs/tags/$version.tar.gz"
-        local url_cached="http://ci-files01-hki.ci.qt.io/input/ffmpeg/FFmpeg-$version.tar.gz"
+        local url_public="https://ffmpeg.org/releases/ffmpeg-$version.tar.gz"
+        local url_cached="http://ci-files01-hki.ci.qt.io/input/ffmpeg/ffmpeg-$version.tar.gz"
        local app_prefix=""

+        local temp_dir
+        temp_dir=$(mktemp -d)
+        trap 'rm -rf "$temp_dir"' EXIT
+
        source "${BASH_SOURCE%/*}/../unix/InstallFromCompressedFileFromURL.sh"
-        InstallFromCompressedFileFromURL "$url_cached" "$url_public" "$sha1" "$target_dir" "$app_prefix" > /dev/null
+        InstallFromCompressedFileFromURL "$url_cached" "$url_public" "$sha1" "$temp_dir" "$app_prefix" > /dev/null
+
+        local extracted_dirs=("$temp_dir"/*/)
+        if [ "${#extracted_dirs[@]}" -ne 1 ] || [ ! -d "${extracted_dirs[0]}" ]; then
+            >&2 echo "Expected exactly one directory in the FFmpeg archive, got: ${extracted_dirs[*]}"
+            exit 1
+        fi
+
+        mkdir -p "$target_dir"
+        mv "${extracted_dirs[0]%/}" "$ffmpeg_source_dir"
    fi

    echo "$ffmpeg_source_dir"
-}
+)

 get_ffmpeg_config_options() {
    local build_type="$1"
@@ -7,21 +7,38 @@
 # This script will install FFmpeg
 $msys = "C:\Utils\msys64\usr\bin\bash"

-$version="n8.1.2"
-$url_public="https://github.com/FFmpeg/FFmpeg/archive/refs/tags/$version.tar.gz"
-$sha1="a7f4ce77209afdadca9f371db261e8d69903dc85"
-$url_cached="http://ci-files01-hki.ci.qt.io/input/ffmpeg/FFmpeg-$version.tar.gz"
-$ffmpeg_name="FFmpeg-$version"
+$version="9.0.1"
+$url_public="https://ffmpeg.org/releases/ffmpeg-$version.tar.gz"
+$sha1="89c318905212e6b67e10e42ab10ab8007e0aefda"
+$url_cached="http://ci-files01-hki.ci.qt.io/input/ffmpeg/ffmpeg-$version.tar.gz"
+$ffmpeg_name="FFmpeg-n$version"

 $download_location = "C:\Windows\Temp\$ffmpeg_name.tar.gz"
 $unzip_location = "C:\"
+$ffmpeg_source_dir = "C:\$ffmpeg_name"

 Write-Host "Fetching FFmpeg $version..."

-Download $url_public $url_cached $download_location
-Verify-Checksum $download_location $sha1
-Extract-tar_gz $download_location $unzip_location
-Remove $download_location
+$extract_temp_dir = "C:\Windows\Temp\FFmpeg-extract-$([System.Guid]::NewGuid().ToString('N'))"
+
+try {
+    New-Item -ItemType Directory -Path $extract_temp_dir -Force | Out-Null
+
+    Download $url_public $url_cached $download_location
+    Verify-Checksum $download_location $sha1
+    Extract-tar_gz $download_location $extract_temp_dir
+
+    $extracted_dirs = @(Get-ChildItem -Path $extract_temp_dir -Directory)
+    if ($extracted_dirs.Count -ne 1) {
+        throw "Expected exactly one directory in the FFmpeg archive, got: $($extracted_dirs.Name -join ', ')"
+    }
+
+    Remove $ffmpeg_source_dir
+    Move-Item -Path $extracted_dirs[0].FullName -Destination $ffmpeg_source_dir
+} finally {
+    Remove $download_location
+    Remove $extract_temp_dir
+}

 function GetFfmpegDefaultConfiguration {
    $defaultConfiguration = Get-Content "$PSScriptRoot\..\shared\ffmpeg_config_options.txt"
@@ -7,6 +7,11 @@ set -ex
 BASEDIR=$(dirname "$0")
 # shellcheck source=../common/shared/network_test_server_ip.txt
 source "$BASEDIR/../common/shared/network_test_server_ip.txt"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 echo "Set Network Test Server address to $network_test_server_ip in /etc/hosts"
 echo "$network_test_server_ip    qt-test-server qt-test-server.qt-test-net" | sudo tee -a /etc/hosts
@@ -8,6 +8,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 # shellcheck disable=SC2129
 source "${BASH_SOURCE%/*}/../common/linux/verify-release-packages.sh"

@@ -8,6 +8,11 @@ set -ex
 BASEDIR=$(dirname "$0")
 # shellcheck source=../common/shared/network_test_server_ip.txt
 source "$BASEDIR/../common/shared/network_test_server_ip.txt"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 echo "Set Network Test Server address to $network_test_server_ip in /etc/hosts"
 echo "$network_test_server_ip    qt-test-server qt-test-server.qt-test-net" | sudo tee -a /etc/hosts
@@ -9,6 +9,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt
@@ -7,6 +7,11 @@ set -ex
 BASEDIR=$(dirname "$0")
 # shellcheck source=../common/shared/network_test_server_ip.txt
 source "$BASEDIR/../common/shared/network_test_server_ip.txt"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 echo "Set Network Test Server address to $network_test_server_ip in /etc/hosts"
 echo "$network_test_server_ip    qt-test-server qt-test-server.qt-test-net" | sudo tee -a /etc/hosts
@@ -8,6 +8,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt
@@ -7,6 +7,11 @@ set -ex
 BASEDIR=$(dirname "$0")
 # shellcheck source=../common/shared/network_test_server_ip.txt
 source "$BASEDIR/../common/shared/network_test_server_ip.txt"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 echo "Set Network Test Server address to $network_test_server_ip in /etc/hosts"
 echo "$network_test_server_ip    qt-test-server qt-test-server.qt-test-net" | sudo tee -a /etc/hosts
@@ -8,6 +8,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt
@@ -9,6 +9,11 @@ BASEDIR=$(dirname "$0")
 source "$BASEDIR/../common/shared/network_test_server_ip.txt"
 # shellcheck source=../common/unix/check_and_set_proxy.sh
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 echo "Set timezone to UTC."
 sudo timedatectl set-timezone Etc/UTC
@@ -8,6 +8,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt
@@ -11,6 +11,11 @@ source "$BASEDIR/../common/shared/network_test_server_ip.txt"
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
 # shellcheck source=../common/unix/SetEnvVar.sh
 source "${BASH_SOURCE%/*}/../common/unix/SetEnvVar.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 echo "Set timezone to UTC."
 sudo timedatectl set-timezone Etc/UTC
@@ -8,6 +8,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt
@@ -9,6 +9,11 @@ set -ex
 BASEDIR=$(dirname "$0")
 # shellcheck source=../common/unix/check_and_set_proxy.sh
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 NTS_IP=10.212.2.216

@@ -2,5 +2,12 @@
 #Copyright (C) 2023 The Qt Company Ltd
 #SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 BASEDIR=$(dirname "$0")
 "$BASEDIR/../common/linux/ubuntu-version.sh"
@@ -9,6 +9,11 @@ set -ex
 BASEDIR=$(dirname "$0")
 # shellcheck source=../common/unix/check_and_set_proxy.sh
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 NTS_IP=10.212.2.216

@@ -2,5 +2,12 @@
 #Copyright (C) 2023 The Qt Company Ltd
 #SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 BASEDIR=$(dirname "$0")
 "$BASEDIR/../common/linux/ubuntu-version.sh"
@@ -9,6 +9,11 @@ set -ex
 BASEDIR=$(dirname "$0")
 # shellcheck source=../common/unix/check_and_set_proxy.sh
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 NTS_IP=10.212.2.216

@@ -2,5 +2,12 @@
 #Copyright (C) 2023 The Qt Company Ltd
 #SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 BASEDIR=$(dirname "$0")
 "$BASEDIR/../common/linux/ubuntu-version.sh"
@@ -8,6 +8,11 @@ BASEDIR=$(dirname "$0")
 source "$BASEDIR/../common/shared/network_test_server_ip.txt"
 # shellcheck source=../common/unix/check_and_set_proxy.sh
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 # https://bugzilla.opensuse.org/show_bug.cgi?id=1032027
 sudo btrfs quota disable /
@@ -8,6 +8,12 @@

 set -ex

+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt
@@ -10,6 +10,11 @@ source "$BASEDIR/../common/shared/network_test_server_ip.txt"
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
 # shellcheck source=../common/unix/SetEnvVar.sh
 source "${BASH_SOURCE%/*}/../common/unix/SetEnvVar.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 # https://bugzilla.opensuse.org/show_bug.cgi?id=1032027
 sudo btrfs quota disable /
@@ -8,6 +8,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt
@@ -10,6 +10,11 @@ source "$BASEDIR/../common/shared/network_test_server_ip.txt"
 source "${BASH_SOURCE%/*}/../common/unix/check_and_set_proxy.sh"
 # shellcheck source=../common/unix/SetEnvVar.sh
 source "${BASH_SOURCE%/*}/../common/unix/SetEnvVar.sh"
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Get distro version to later check if version has changed at the end of the provisioning
+record_os_version

 # https://bugzilla.opensuse.org/show_bug.cgi?id=1032027
 sudo btrfs quota disable /
@@ -8,6 +8,13 @@

 set -ex

+BASEDIR=$(dirname "$0")
+# shellcheck source=../common/linux/distro_version_check.sh
+source "$BASEDIR/../common/linux/distro_version_check.sh"
+
+# Check distro version if it has changed
+verify_os_version_unchanged
+
 # shellcheck disable=SC2129
 echo "*********************************************" >> ~/versions.txt
 echo "***** All installed RPM packages *****" >> ~/versions.txt