Portable install: the binary installs itself; static builds on five architectures; root via sudo, doas or uid 0; every package manager; older systemd; no lsblk

- hamlab install / uninstall (internal/setup): systemd or OpenRC, elevates through
  sudo or doas, runs as the invoking user, sets or generates the password, names only
  journal groups that exist, waits for /healthz, reports an active firewalld/ufw.
  --purge and the data chown never touch a directory that isn't Ham Lab's alone.
- install.sh: curl-able bootstrap (arch detection, SHA256SUMS, offline beside the
  binaries, noexec /tmp fallback). make release builds dist/ for amd64, arm64, arm
  (ARMv6), 386, riscv64. Every build is CGO_ENABLED=0; the native one used to link glibc.
- internal/priv replaces every literal `sudo -n`: uid 0, sudo or doas.
- Updates acts on dnf, zypper, pacman and apk as well as apt; dnf shows installed versions.
- Services falls back to the plain systemctl table before systemd 246 and says so on
  hosts without systemd. Disks falls back to /sys/block without lsblk.
- Listener binds with IP_FREEBIND, so a LAN address that isn't up at boot is no failure.
- Self-update: the new build must pass `check` against the live config, is put in
  place by atomic rename, and the daemon re-execs itself (same under any supervisor).
- State and config writes are fsynced; a corrupt state.json is set aside, not fatal.
- Terminal shutdown no longer empties the saved list, so names come back after a
  restart by design rather than by winning a race.
- Config default is ~/.config/hamlab; an existing ~/apps/hamlab is still found.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/storage/storage.go

@@ -19,6 +19,8 @@ import (
 	"sync"
 	"syscall"
 	"time"
+
+	"hamlab/internal/priv"
 )
 
 // ---- block devices ----
@@ -75,15 +77,14 @@ func str(p *string) string {
 func Devices(ctx context.Context) ([]Device, error) {
 	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
 	defer cancel()
-	out, err := exec.CommandContext(ctx, "lsblk", "-J", "-b", "-o", "NAME,TYPE,SIZE,MODEL,SERIAL,VENDOR,ROTA,TRAN,FSTYPE,MOUNTPOINT,LABEL,RM").Output()
-	if err != nil {
-		return nil, errors.New("lsblk: " + err.Error())
-	}
 	var root struct {
 		Blockdevices []lsblkNode `json:"blockdevices"`
 	}
-	if err := json.Unmarshal(out, &root); err != nil {
-		return nil, err
+	// lsblk knows labels and stacked devices (LVM, LUKS, md); without it (Alpine and other
+	// busybox systems don't ship it) or with one too old for JSON, /sys has the essentials.
+	out, err := exec.CommandContext(ctx, "lsblk", "-J", "-b", "-o", "NAME,TYPE,SIZE,MODEL,SERIAL,VENDOR,ROTA,TRAN,FSTYPE,MOUNTPOINT,LABEL,RM").Output()
+	if err != nil || json.Unmarshal(out, &root) != nil {
+		root.Blockdevices = sysBlockDevices()
 	}
 	devs := []Device{}
 	for _, n := range root.Blockdevices {
@@ -127,6 +128,77 @@ func Devices(ctx context.Context) ([]Device, error) {
 	return devs, nil
 }
 
+// sysBlockDevices builds the same tree lsblk would from /sys/block and /proc/mounts.
+func sysBlockDevices() []lsblkNode {
+	type mnt struct{ point, fstype string }
+	mounts := map[string]mnt{}
+	if b, err := os.ReadFile("/proc/mounts"); err == nil {
+		for _, line := range strings.Split(string(b), "\n") {
+			if f := strings.Fields(line); len(f) >= 3 && strings.HasPrefix(f[0], "/dev/") {
+				dev := f[0]
+				if real, err := filepath.EvalSymlinks(dev); err == nil { // /dev/disk/by-uuid/…, /dev/mapper/…
+					dev = real
+				}
+				if _, seen := mounts[filepath.Base(dev)]; !seen {
+					mounts[filepath.Base(dev)] = mnt{strings.ReplaceAll(f[1], `\040`, " "), f[2]}
+				}
+			}
+		}
+	}
+	if b, err := os.ReadFile("/proc/swaps"); err == nil {
+		for _, line := range strings.Split(string(b), "\n") {
+			if f := strings.Fields(line); len(f) > 0 && strings.HasPrefix(f[0], "/dev/") {
+				mounts[filepath.Base(f[0])] = mnt{"[SWAP]", "swap"}
+			}
+		}
+	}
+	sp := func(v string) *string {
+		if v = strings.TrimSpace(v); v == "" {
+			return nil
+		}
+		return &v
+	}
+	node := func(dir, name, typ string) lsblkNode {
+		n := lsblkNode{Name: name, Type: typ, Size: u64(strings.TrimSpace(readStrFile(dir+"/size"))) * 512}
+		if m, ok := mounts[name]; ok {
+			n.Mountpoint, n.FSType = sp(m.point), sp(m.fstype)
+		}
+		return n
+	}
+	var out []lsblkNode
+	ents, _ := os.ReadDir("/sys/block")
+	for _, e := range ents {
+		name := e.Name()
+		dir := "/sys/block/" + name
+		if strings.HasPrefix(name, "loop") || strings.HasPrefix(name, "ram") || strings.HasPrefix(name, "zram") ||
+			strings.HasPrefix(name, "dm-") || strings.HasPrefix(name, "md") || strings.HasPrefix(name, "sr") || strings.HasPrefix(name, "nbd") {
+			continue
+		}
+		n := node(dir, name, "disk")
+		n.Model, n.Vendor = sp(readStrFile(dir+"/device/model")), sp(readStrFile(dir+"/device/vendor"))
+		n.Serial = sp(readStrFile(dir + "/device/serial"))
+		n.Rota = strings.TrimSpace(readStrFile(dir+"/queue/rotational")) == "1"
+		n.RM = strings.TrimSpace(readStrFile(dir+"/removable")) == "1"
+		real, _ := filepath.EvalSymlinks(dir)
+		switch {
+		case strings.HasPrefix(name, "nvme"):
+			n.Tran = sp("nvme")
+		case strings.Contains(real, "/usb"):
+			n.Tran = sp("usb")
+		case strings.Contains(real, "/ata"):
+			n.Tran = sp("sata")
+		}
+		subs, _ := os.ReadDir(dir)
+		for _, sub := range subs {
+			if _, err := os.Stat(dir + "/" + sub.Name() + "/partition"); err == nil {
+				n.Children = append(n.Children, node(dir+"/"+sub.Name(), sub.Name(), "part"))
+			}
+		}
+		out = append(out, n)
+	}
+	return out
+}
+
 var nsRe = regexp.MustCompile(`^(nvme\d+)n\d+$`)
 
 // foldNVMe merges nvme0n1, nvme0n2, … into one physical device "nvme0": one SSD, one
@@ -319,7 +391,7 @@ func (m *Manager) run(ctx context.Context, args ...string) ([]byte, int, error)
 		args[0] = p
 	}
 	if m.sudo {
-		args = append([]string{"sudo", "-n"}, args...)
+		args = priv.Wrap(args...)
 	}
 	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
 	defer cancel()

internal/storage/sys_test.go

@@ -0,0 +1,22 @@
+package storage
+
+import (
+	"os"
+	"testing"
+)
+
+// The /sys fallback must find the same disks and partitions lsblk does.
+func TestSysBlockDevices(t *testing.T) {
+	if _, err := os.Stat("/sys/block"); err != nil {
+		t.Skip("no /sys/block")
+	}
+	for _, d := range sysBlockDevices() {
+		if d.Name == "" || d.Type != "disk" {
+			t.Fatalf("bad node %+v", d)
+		}
+		t.Logf("%s size=%d tran=%s rota=%v parts=%d", d.Name, d.Size, str(d.Tran), d.Rota, len(d.Children))
+		for _, c := range d.Children {
+			t.Logf("  %s size=%d fs=%s mount=%s", c.Name, c.Size, str(c.FSType), str(c.Mountpoint))
+		}
+	}
+}