😡 GPT Sol 5.6 傻逼吧，我一个 6 行的脚本让它修个 BUG 给我改到了 178 行

^-^ 无语了整个脚本就只是复制新 tls 证书检查是否有更新，有更新就覆盖本地 tls 证书

我自己写的老版本：

        set -e

        rclone --config=/etc/rclone.conf copyto r2:tls/key.pem key.pem.new

        if ! cmp -s out/nahida.im/key.pem key.pem.new; then

          rm -rf out/nahida.im

          rclone --config=/etc/rclone.conf copy r2:tls out/nahida.im

        fi



    

  

ChatGPT 给我的修复版（贼长而且还啥问题都没修复）：

        set -euo pipefail



        certRoot="/var/lib/acme"

        active="$certRoot/${certName}"

        generationRoot="$certRoot/.${certName}.generations"



        staging="/run/${serviceName}/staging"

        validation="/run/${serviceName}/validation"



        mkdir -p "$generationRoot"



        download_and_validate() {

          rm -rf "$staging" "$validation"



          mkdir -m 0700 "$staging"

          mkdir -m 0700 "$validation"



          echo "Downloading certificate files from R2..."



          rclone \

            --config=/etc/rclone.conf \

            --contimeout=30s \

            --timeout=2min \

            --retries=3 \

            --low-level-retries=10 \

            --retries-sleep=10s \

            --log-level=INFO \

            copy \

            "r2:tls" \

            "$staging" \

            || return 1



          for file in key.pem cert.pem chain.pem fullchain.pem; do

            if [ ! -s "$staging/$file" ]; then

              echo "Missing or empty certificate file: $file" >&2

              return 1

            fi

          done



          cat \

            "$staging/key.pem" \

            "$staging/fullchain.pem" \

            > "$staging/full.pem" \

            || return 1



          chmod 0640 \

            "$staging/key.pem" \

            "$staging/cert.pem" \

            "$staging/chain.pem" \

            "$staging/fullchain.pem" \

            "$staging/full.pem"



          if ! openssl pkey \

            -in "$staging/key.pem" \

            -noout

          then

            echo "Unable to parse key.pem" >&2

            return 1

          fi



          for file in cert.pem chain.pem fullchain.pem; do

            if ! openssl x509 \

              -in "$staging/$file" \

              -noout

            then

              echo "Unable to parse $file" >&2

              return 1

            fi

          done



          if ! openssl x509 \

            -in "$staging/cert.pem" \

            -noout \

            -checkend 86400

          then

            echo "Downloaded certificate expires in less than 24 hours" >&2

            return 1

          fi



          openssl x509 \

            -in "$staging/cert.pem" \

            -outform DER \

            > "$validation/cert.der" \

            || return 1



          openssl x509 \

            -in "$staging/fullchain.pem" \

            -outform DER \

            > "$validation/fullchain-leaf.der" \

            || return 1



          if ! cmp -s \

            "$validation/cert.der" \

            "$validation/fullchain-leaf.der"

          then

            echo "cert.pem does not match the leaf certificate in fullchain.pem" >&2

            return 1

          fi



          openssl pkey \

            -in "$staging/key.pem" \

            -pubout \

            -outform DER \

            > "$validation/key-public.der" \

            || return 1



          openssl x509 \

            -in "$staging/cert.pem" \

            -pubkey \

            -noout \

            | openssl pkey \

              -pubin \

              -outform DER \

              > "$validation/cert-public.der" \

            || return 1



          if ! cmp -s \

            "$validation/key-public.der" \

            "$validation/cert-public.der"

          then

            echo "Downloaded private key does not match the certificate" >&2

            return 1

          fi

        }



        downloadSucceeded=false



        for attempt in 1 2 3; do

          echo "Download and validation attempt $attempt/3"



          if download_and_validate; then

            downloadSucceeded=true

            break

          fi



          if [ "$attempt" -lt 3 ]; then

            echo "Download or validation failed; retrying in 15 seconds..." >&2

            sleep 15

          fi

        done



        if [ "$downloadSucceeded" != true ]; then

          echo "Unable to download a complete and valid certificate set" >&2

          exit 1

        fi



        unchanged=true



        for file in key.pem cert.pem chain.pem fullchain.pem; do

          if \

            [ ! -s "$active/$file" ] \

            || ! cmp -s "$active/$file" "$staging/$file"

          then

            unchanged=false

            break

          fi

        done



        if [ "$unchanged" = true ]; then

          echo "Certificate files are unchanged"

          exit 0

        fi



        digest="$(

          sha256sum \

            "$staging/key.pem" \

            "$staging/cert.pem" \

            "$staging/chain.pem" \

            "$staging/fullchain.pem" \

            | sha256sum \

            | cut -d ' ' -f 1

        )"



        generation="$generationRoot/$digest"



        if [ ! -d "$generation" ]; then

          temporaryGeneration="$generationRoot/.new-$digest"



          rm -rf "$temporaryGeneration"

          mkdir -m 0750 "$temporaryGeneration"



          for file in key.pem cert.pem chain.pem fullchain.pem full.pem; do

            install \

              -m 0640 \

              "$staging/$file" \

              "$temporaryGeneration/$file"

          done



          mv -T "$temporaryGeneration" "$generation"

        fi



        temporaryLink="$certRoot/.${certName}.new"

        legacyPath=""



        rm -f "$temporaryLink"



        ln -s \

          ".${certName}.generations/$digest" \

          "$temporaryLink"



        if [ -e "$active" ] && [ ! -L "$active" ]; then

          legacyPath="$generationRoot/legacy-$(date +%s)-$$"



          echo "Preserving existing certificate directory as $legacyPath"



          mv -T "$active" "$legacyPath"

        fi



        if ! mv -Tf "$temporaryLink" "$active"; then

          echo "Unable to activate the new certificate generation" >&2



          rm -f "$temporaryLink"



          if [ -n "$legacyPath" ] && [ -e "$legacyPath" ]; then

            mv -T "$legacyPath" "$active"

          fi



          exit 1

        fi



        echo "Activated certificate generation: $generation"



    

  

事实证明还是自己写的好，后面我直接自己修了：

        set -euo pipefail

        rclone \

          --config=/etc/rclone.conf \

          --contimeout=30s \

          --timeout=2m \

          --retries=5 \

          --low-level-retries=10 \

          --retries-sleep=15s \

          copy "r2:tls" new

        for file in chain.pem fullchain.pem full.pem key.pem; do

          if [ ! -s "new/$file" ]; then

            echo "Missing or empty certificate file: $file" >&2

            rm -rf new

            exit 1

          fi

        done



        mkdir -p /var/lib/acme/generations

        gen="/var/lib/acme/generations/$(sha256sum new/full.pem | cut -d ' ' -f 1)"

        if [ -d "$gen" ]; then

          rm -rf new

        else

          mv new "$gen"

          ln -sfT "$gen" "/var/lib/acme/${cert}"

          for g in /var/lib/acme/generations/*; do

            [ -e "$g" ] || continue

            [ "$g" = "$gen" ] || rm -rf -- "$g"

          done

        fi



        echo "Certificate for ${cert} updated successfully"