Add self-contained automated server upgrade package

lib/locking.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# The upgrade coordinator holds FD 9 for the complete install/check/backup cycle.
+# Child tools may reuse that SAME open file description, never bypass the lock.
+acquire_backup_lock() {
+  [[ $LOCKFILE == /* && ! -L $LOCKFILE ]] || { echo 'Unsafe lock path' >&2; return 1; }
+  if [[ -e $LOCKFILE ]]; then
+    [[ -f $LOCKFILE && ! -s $LOCKFILE && $(stat -c %u "$LOCKFILE") == 0 ]] || { echo 'Unsafe existing lock file' >&2; return 1; }
+  fi
+  if [[ ${APP_BACKUP_INHERIT_LOCK:-0} == 1 ]]; then
+    [[ -e /proc/self/fd/9 && $(stat -Lc '%d:%i' /proc/self/fd/9) == "$(stat -Lc '%d:%i' "$LOCKFILE")" ]] || {
+      echo 'Inherited lock descriptor does not match configured lock' >&2; return 1;
+    }
+  else
+    exec 9>"$LOCKFILE"
+  fi
+  flock -n 9 || { echo "Another backup/restore/update holds $LOCKFILE" >&2; return 1; }
+}