preinst: bare jq + exit 1 blocks upgrades and opkg orphan-cleanup strips nodogsplash+jq on abort #93

Found during QEMU v0.5.0→v0.6.0 upgrade emulation (PRTA campaign OpenTollGate#113, bench in physical-router-test-automation@40d1b56 / scripts/upgrade-emulation/).

Summary

packaging/preinst hard-fails (exit 1) when it cannot update the cosmetic install_time field via bare jq — and when the upgrade aborts, opkg's orphan cleanup removes nodogsplash and jq (autoinstalled deps of the old package), leaving the captive portal broken after a "failed safe" upgrade.

Reproduction (OpenWrt 24.10.1 x86_64 VM, opkg 2024-10-16)

1. Install v0.5.0 (deps auto-resolve: nodogsplash, jq, ...)
2. Attempt opkg install tollgate-wrt_v0.6.0…ipk in a state where jq is absent at preinst time (in our run: a concurrent/duplicate opkg transaction's aborted cleanup had removed it):

Upgrading tollgate-wrt on root from v0.5.0 to v0.6.0-alpha2...
/tmp/opkg-XXXX/tollgate-wrt-YYYY/preinst: line 5: jq: not found
Error: Failed to update install_time using jq
Collected errors:
 * pkg_run_script: package "tollgate-wrt" preinst script returned status 1.
 * preinst_configure: Aborting installation of tollgate-wrt.
...
nodogsplash was autoinstalled and is now orphaned, removing.
jq was autoinstalled and is now orphaned, removing.

3. Result: still v0.5.0, portal (nodogsplash) gone, jq gone.

Facts pinned by forensics

• Maintainer-script env probe (repacked ipk with env-logging preinst): opkg passes the caller's env through; PATH=/usr/sbin:/usr/bin:/sbin:/bin, and with jq present it IS found — the abort requires jq to actually be missing at that moment (any failed earlier transaction's orphan cleanup produces exactly that state).
• The initial install never hits the jq path (fresh /etc/tollgate/install.json is created by the echo ELSE-branch, no jq) — only upgrades with existing install.json run the jq branch.
• With jq present, the identical artifact upgrades cleanly (verified end-to-end: config/wallet/identities sha-preserved, payments work).

Recommended fix (two independent layers)

1. preinst should never exit 1 for an install_time cosmetic — warn and continue (exit 0).
2. Don't rely on bare jq: use /usr/bin/jq absolute path, or replace with a BusyBox-only JSON write (the field is a single integer; sed/awk suffices), or drop preinst entirely and let the binary own install_time.

Optional hardening: postinst could opkg-flag have_installed nodogsplash jq (or list them in a metapackage) so aborted transactions can't orphan the portal.

Evidence

• physical-router-test-automation/results/upgrade-emulation/ (local, not in git): install/upgrade logs, preinst env capture, sha snapshots across upgrade→rollback→upgrade.