mirror of
https://github.com/home-assistant/operating-system.git
synced 2026-07-10 00:13:44 +01:00
Stefan Agner
54efae9c13
* Make Supervisor startup resilient to transient network failures When the Supervisor image is missing and no local updater information is available (e.g. on first boot after a factory reset/data wipe), the start script fetches the current stable version from version.home-assistant.io. This fetch can fail transiently: since #3669 the boot waits at most 15s for time synchronization, so the script may run with an unsynced clock (making TLS validation fail), or before the network is fully functional. Today such a failure makes the script exit within ~400ms (via jq -e exit code 4 under set -e). Combined with RestartSec=5s and StartLimitBurst=3, three quick failures trip the start rate limit within ~15 seconds and the unit stays failed until reboot - even if NTP syncs moments later, leaving the device at the emergency console (as seen in #4863). Make this path more robust: - Let curl retry the version fetch (5 retries, 10s apart). Use --retry-all-errors so DNS/TLS failures are retried as well, not just transient HTTP errors. - Increase the service start rate limit from 3 to 5 attempts per 30 minutes, so a slightly longer network/time-sync hiccup at boot doesn't permanently disable the unit. - Skip "docker image rm" in the startup-marker recovery path when there are no Supervisor images at all, avoiding a spurious usage error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix AppArmor profile download never retried after first failure The haos-apparmor script only downloads the Supervisor AppArmor profile when the profile directory is missing - but it creates the directory before attempting the download. If the first download fails (e.g. no DNS/network on first boot after a data wipe), every subsequent boot skips the download because the directory exists, and the unit exits successfully without loading any profile. The Supervisor container is then created with --security-opt apparmor=hassio-supervisor and fails to start forever with: apparmor failed to apply profile: write .../attr/apparmor/exec: no such file or directory (observed in #4863 after the reporter fixed their DNS setup). Key the download on the profile file instead of the directory, download to a temporary file that is moved into place only on success, and let curl retry transient failures like in the Supervisor version fetch. Also fail the unit loudly when the download does not succeed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Use upper case for STABLE_JSON variable Match the naming convention of the other variables in the script. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>