update

README.md

@@ -78,6 +78,11 @@ CPU compatibility detection previews cluster-wide QEMU VM and template
 changes before applying the ProxCLMC recommendation through the Proxmox CLI.
 Running VMs are not restarted automatically.
 
+VirtIO downloads are managed from a dedicated submenu. The stable release is
+checked only when that submenu is opened, and curated compatibility ISOs are
+available for Windows Server 2008, 2008 R2, 2012/R2, and 2016. Downloads are
+validated before atomically replacing a file with the same name.
+
 Maintenance evacuation leaves HA-managed guests under Proxmox HA control.
 Remaining shared-storage guests are routed to online, non-maintenance nodes
 with the required storage, while local-storage guests are gracefully shut

defaults.inc

@@ -3,7 +3,7 @@
 
 action="${1:-}"
 FOLDER='/opt/idssys/ta-proxmenu'
-VERS='2026.7.25-34'
+VERS='2026.7.25-35'
 
 noupdate=' '
 
@@ -15,15 +15,6 @@ else
 fi
 
 VIRTIO_STABLE_URL="https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso"
-VIRTIO_FALLBACK_URL="https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.285-1/virtio-win-0.1.285.iso"
-VIRTIO_DOWNLOAD_URL="$(curl --location --fail --silent --show-error --head \
-  --connect-timeout 3 --max-time 10 --output /dev/null \
-  --write-out '%{url_effective}' "$VIRTIO_STABLE_URL" 2>/dev/null)"
-
-if [[ -z "$VIRTIO_DOWNLOAD_URL" ]]; then
-  VIRTIO_DOWNLOAD_URL="$VIRTIO_FALLBACK_URL"
-fi
-VIRTIO_FILE="${VIRTIO_DOWNLOAD_URL##*/}"
 
 TAPM_BROKER_URL='https://tapm.scity.us'
 S1_BROKER_PACKAGE='sentinelone-linux'

proxmenu-scripts.sh

@@ -779,19 +779,298 @@ INSTALL_OMSA() {
 	FINISH_ACTION
 }
 
-DOWNLOAD_VIRTIO() {
+VIRTIO_STABLE_CHECKED=0
+VIRTIO_STABLE_STATUS='unknown'
+VIRTIO_STABLE_FILE=''
+VIRTIO_LAST_FILE=''
 
-  echo -e "\n${idsCL[LightCyan]}Current \"Stable\" version available for download: ${idsCL[White]}${VIRTIO_FILE}${idsCL[Default]}"
+TAPM_VIRTIO_FILENAME_FROM_URL() {
-  if [ -f "${DLDIR}/${VIRTIO_FILE}" ]; then
+	local url="${1%%\?*}"
-  	echo -en "\n${idsCL[LightRed]}Removing existing download ... "
+	local filename="${url##*/}"
-	rm -f "${DLDIR}/${VIRTIO_FILE}"
+
-  	echo -e "${idsCL[Red]}Done${idsCL[Default]}"
+	[[ "$filename" =~ ^virtio-win(-0\.1\.[0-9]+)?\.iso$ ]] || return 1
-  fi
+	printf '%s\n' "$filename"
-  wget -q -P "$DLDIR" "$VIRTIO_DOWNLOAD_URL" &
+}
-  echo -e "\n${idsCL[LightCyan]}Downloading will continue in the background\n"
+
+TAPM_REFRESH_VIRTIO_LOCAL_STATUS() {
+	[[ -n "$VIRTIO_STABLE_FILE" ]] || return
+
+	if [[ -f "${DLDIR}/${VIRTIO_STABLE_FILE}" ]]; then
+		VIRTIO_STABLE_STATUS='current'
+	elif compgen -G "${DLDIR}/virtio-win*.iso" >/dev/null; then
+		VIRTIO_STABLE_STATUS='update'
+	else
+		VIRTIO_STABLE_STATUS='available'
+	fi
+}
+
+TAPM_CHECK_VIRTIO_STABLE() {
+	local force="${1:-0}"
+	local effective_url
+
+	if (( VIRTIO_STABLE_CHECKED == 1 && force == 0 )); then
+		return
+	fi
+
+	VIRTIO_STABLE_CHECKED=1
+	VIRTIO_STABLE_STATUS='unavailable'
+	VIRTIO_STABLE_FILE=''
+
+	effective_url="$(
+		curl --fail --location --silent --show-error --head \
+			--proto '=https' --proto-redir '=https' \
+			--connect-timeout 5 --max-time 15 \
+			--output /dev/null --write-out '%{url_effective}' \
+			"$VIRTIO_STABLE_URL" 2>/dev/null
+	)" || return 1
+	VIRTIO_STABLE_FILE="$(TAPM_VIRTIO_FILENAME_FROM_URL "$effective_url")" ||
+		return 1
+	TAPM_REFRESH_VIRTIO_LOCAL_STATUS
+}
+
+TAPM_VALID_VIRTIO_ISO() {
+	local iso_file="$1"
+	local iso_signature
+	local size
+
+	size="$(stat -c '%s' "$iso_file" 2>/dev/null)" || return 1
+	(( size >= 10 * 1024 * 1024 )) || return 1
+	iso_signature="$(
+		dd if="$iso_file" bs=1 skip=32769 count=5 status=none 2>/dev/null
+	)"
+	[[ "$iso_signature" == 'CD001' ]]
+}
+
+TAPM_DOWNLOAD_VIRTIO_ISO() {
+	local url="$1"
+	local expected_filename="${2:-}"
+	local description="${3:-VirtIO driver ISO}"
+	local effective_url
+	local filename
+	local final_file
+	local partial_file
+	local size
+
+	VIRTIO_LAST_FILE=''
+	if ! TAPM_VALID_HTTPS_URL "$url" ||
+		[[ "$url" != https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/* ]]; then
+		echo -e "${idsCL[LightRed]}The VirtIO download URL is not an approved Fedora VirtIO-Win URL.${idsCL[Default]}"
+		return 1
+	fi
+
+	if [[ ! -d "$DLDIR" ]] && ! install -d -m 0755 "$DLDIR"; then
+		echo -e "${idsCL[LightRed]}Could not create the ISO destination: ${DLDIR}.${idsCL[Default]}"
+		return 1
+	fi
+	if [[ ! -w "$DLDIR" ]]; then
+		echo -e "${idsCL[LightRed]}The ISO destination is not writable: ${DLDIR}.${idsCL[Default]}"
+		return 1
+	fi
+
+	partial_file="$(mktemp "${DLDIR}/.tapm-virtio.part.XXXXXX")" || {
+		echo -e "${idsCL[LightRed]}Could not create a temporary file on ${DLDIR}.${idsCL[Default]}"
+		return 1
+	}
+	chmod 0600 "$partial_file"
+
+	echo -e "\n${idsCL[LightCyan]}Downloading ${description}...${idsCL[Default]}\n"
+	effective_url="$(
+		curl --fail --location --show-error --progress-bar \
+			--proto '=https' --proto-redir '=https' \
+			--connect-timeout 10 \
+			--output "$partial_file" --write-out '%{url_effective}' \
+			"$url"
+	)" || {
+		rm -f -- "$partial_file"
+		echo -e "\n${idsCL[LightRed]}The VirtIO ISO download failed. Existing ISOs were not changed.${idsCL[Default]}"
+		return 1
+	}
+
+	filename="$(TAPM_VIRTIO_FILENAME_FROM_URL "$effective_url")" || {
+		rm -f -- "$partial_file"
+		echo -e "${idsCL[LightRed]}The VirtIO source returned an unexpected filename.${idsCL[Default]}"
+		return 1
+	}
+	if [[ -n "$expected_filename" && "$filename" != "$expected_filename" ]]; then
+		rm -f -- "$partial_file"
+		echo -e "${idsCL[LightRed]}The VirtIO archive returned ${filename}; expected ${expected_filename}.${idsCL[Default]}"
+		return 1
+	fi
+
+	if ! TAPM_VALID_VIRTIO_ISO "$partial_file"; then
+		rm -f -- "$partial_file"
+		echo -e "${idsCL[LightRed]}The downloaded file did not pass ISO validation and was removed.${idsCL[Default]}"
+		return 1
+	fi
+
+	final_file="${DLDIR}/${filename}"
+	if ! chmod 0644 "$partial_file" ||
+		! mv -f -- "$partial_file" "$final_file"; then
+		rm -f -- "$partial_file"
+		echo -e "${idsCL[LightRed]}Could not install the validated VirtIO ISO in ${DLDIR}.${idsCL[Default]}"
+		return 1
+	fi
+
+	size="$(stat -c '%s' "$final_file")"
+	VIRTIO_LAST_FILE="$filename"
+	echo -e "\n${idsCL[Green]}VirtIO ISO downloaded and validated.${idsCL[Default]}"
+	printf ' File:        %s\n' "$filename"
+	printf ' Size:        %s\n' "$(numfmt --to=iec-i --suffix=B "$size")"
+	printf ' Destination: %s\n' "$DLDIR"
+}
+
+DOWNLOAD_VIRTIO_STABLE() {
+	if ! TAPM_DOWNLOAD_VIRTIO_ISO "$VIRTIO_STABLE_URL" '' \
+		'current stable VirtIO drivers'; then
+		FINISH_FAILED_ACTION
+		return
+	fi
+
+	VIRTIO_STABLE_FILE="$VIRTIO_LAST_FILE"
+	VIRTIO_STABLE_STATUS='current'
 	FINISH_ACTION
 }
 
+DOWNLOAD_VIRTIO_ARCHIVE() {
+	local release="$1"
+	local description="$2"
+	local iso_version="${release%-*}"
+	local filename="virtio-win-${iso_version}.iso"
+	local url="https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-${release}/${filename}"
+
+	if ! TAPM_DOWNLOAD_VIRTIO_ISO "$url" "$filename" "$description"; then
+		FINISH_FAILED_ACTION
+		return
+	fi
+	FINISH_ACTION
+}
+
+DOWNLOAD_CUSTOM_VIRTIO_ARCHIVE() {
+	local release
+
+	echo
+	read -r -p "Archived VirtIO release (example: 0.1.229-1; blank cancels): " release
+	[[ -n "$release" ]] || return
+	if [[ ! "$release" =~ ^0\.1\.[0-9]+-[0-9]+$ ]]; then
+		echo -e "${idsCL[LightRed]}Use a release in the form 0.1.229-1.${idsCL[Default]}"
+		ENTER2CONTINUE
+		return
+	fi
+
+	DOWNLOAD_VIRTIO_ARCHIVE "$release" "VirtIO archive ${release}"
+}
+
+SHOW_LOCAL_VIRTIO_ISOS() {
+	local file
+	local found=0
+
+	MENU_HEADER
+	echo
+	echo -e " ${idsCL[LightCyan]}Downloaded VirtIO ISOs${idsCL[Default]}"
+	echo
+	echo " Destination: ${DLDIR}"
+	echo
+	while IFS= read -r -d '' file; do
+		found=1
+		printf ' %-34s %10s  %s\n' \
+			"${file##*/}" \
+			"$(numfmt --to=iec-i --suffix=B "$(stat -c '%s' "$file")")" \
+			"$(date --date="@$(stat -c '%Y' "$file")" '+%F %R')"
+	done < <(
+		find "$DLDIR" -maxdepth 1 -type f -name 'virtio-win*.iso' \
+			-print0 2>/dev/null | sort -z
+	)
+	(( found == 1 )) || echo " No VirtIO ISOs are currently downloaded."
+	echo
+	read -r -p " Press ENTER to return..." _
+}
+
+VIRTIO_MENU() {
+	local stable_label
+	local -a labels
+	local -a values=(
+		"stable"
+		"server2016"
+		"server2012"
+		"server2008r2"
+		"server2008"
+		"archive"
+		"local"
+		"refresh"
+	)
+
+	echo -en "\n${idsCL[LightCyan]}Checking the current stable VirtIO release...${idsCL[Default]} "
+	TAPM_CHECK_VIRTIO_STABLE 1 || true
+	echo
+
+	while true; do
+		TAPM_REFRESH_VIRTIO_LOCAL_STATUS
+		case "$VIRTIO_STABLE_STATUS" in
+			current)
+				stable_label="Current stable drivers (${VIRTIO_STABLE_FILE} downloaded)"
+				;;
+			update)
+				stable_label="Current stable drivers (${VIRTIO_STABLE_FILE} update available)"
+				;;
+			available)
+				stable_label="Current stable drivers (${VIRTIO_STABLE_FILE})"
+				;;
+			*)
+				stable_label="Current stable drivers (version check unavailable)"
+				;;
+		esac
+
+		labels=(
+			"$stable_label"
+			"Windows Server 2016 compatibility ISO (0.1.240)"
+			"Windows Server 2012/R2 compatibility ISO (0.1.189)"
+			"Windows Server 2008 R2 compatibility ISO (0.1.172)"
+			"Windows Server 2008 compatibility ISO (0.1.141)"
+			"Download another archived VirtIO release"
+			"View downloaded VirtIO ISOs"
+			"Refresh stable-version check"
+		)
+		[[ -f "${DLDIR}/virtio-win-0.1.240.iso" ]] &&
+			labels[1]+=" (downloaded)"
+		[[ -f "${DLDIR}/virtio-win-0.1.189.iso" ]] &&
+			labels[2]+=" (downloaded)"
+		[[ -f "${DLDIR}/virtio-win-0.1.172.iso" ]] &&
+			labels[3]+=" (downloaded)"
+		[[ -f "${DLDIR}/virtio-win-0.1.141.iso" ]] &&
+			labels[4]+=" (downloaded)"
+
+		SELECT_MENU "VirtIO Driver Downloads" labels values
+		case "$MENU_SELECTION" in
+			stable) DOWNLOAD_VIRTIO_STABLE;;
+			server2016)
+				DOWNLOAD_VIRTIO_ARCHIVE 0.1.240-1 \
+					"Windows Server 2016 compatibility drivers"
+				;;
+			server2012)
+				DOWNLOAD_VIRTIO_ARCHIVE 0.1.189-1 \
+					"Windows Server 2012/R2 compatibility drivers"
+				;;
+			server2008r2)
+				DOWNLOAD_VIRTIO_ARCHIVE 0.1.172-1 \
+					"Windows Server 2008 R2 compatibility drivers"
+				;;
+			server2008)
+				DOWNLOAD_VIRTIO_ARCHIVE 0.1.141-1 \
+					"Windows Server 2008 compatibility drivers"
+				;;
+			archive) DOWNLOAD_CUSTOM_VIRTIO_ARCHIVE;;
+			local) SHOW_LOCAL_VIRTIO_ISOS;;
+			refresh)
+				echo -en "\n${idsCL[LightCyan]}Refreshing the stable VirtIO release...${idsCL[Default]} "
+				TAPM_CHECK_VIRTIO_STABLE 1 || true
+				echo
+				;;
+			back) return;;
+			quit) EXIT1; exit 0;;
+		esac
+	done
+}
+
 TAPM_INSTALL_PROXCLMC() {
 	local key_url='https://git.gyptazy.com/api/packages/gyptazy/debian/repository.key'
 	local keyring='/etc/apt/keyrings/gyptazy.asc'
@@ -1457,12 +1736,10 @@ HOST_SETUP_MENU() {
 		labels+=("Detect CPU model for live migrations")
 		values+=("cpu")
 
-		if [ -f "${DLDIR}/${VIRTIO_FILE}" ]; then
+		if compgen -G "${DLDIR}/virtio-win*.iso" >/dev/null; then
-			labels+=("VirtIO drivers (${VIRTIO_FILE} already downloaded)")
+			labels+=("VirtIO driver downloads (local ISOs available)")
-		elif compgen -G "${DLDIR}/virtio*.iso" >/dev/null; then
-			labels+=("Download updated VirtIO drivers")
 		else
-			labels+=("Download current VirtIO drivers")
+			labels+=("VirtIO driver downloads")
 		fi
 		values+=("virtio")
 
@@ -1482,7 +1759,7 @@ HOST_SETUP_MENU() {
 		case "$MENU_SELECTION" in
 			post_install) PROXMENUX_POST_INSTALL;;
 			cpu) DETECT_CPU;;
-			virtio) DOWNLOAD_VIRTIO;;
+			virtio) VIRTIO_MENU;;
 			glances) INSTALL_GLANCES;;
 			omsa) INSTALL_OMSA;;
 			back) return;;
@@ -1826,7 +2103,7 @@ if (( ACTION_REQUESTED == 1 )); then
 		acronis) INSTALL_ACRONIS;;
 		post-install|post_install) PROXMENUX_POST_INSTALL;;
 		proxmenux) [ ! -f /usr/local/bin/menu ] && INSTALL_PROXMENUX || /usr/local/bin/menu;;
-		virtio) DOWNLOAD_VIRTIO;;
+		virtio) VIRTIO_MENU;;
 		sentinelone|s1) INSTALL_S1;;
 		screenconnect) INSTALL_SCREENCONNECT;;
 		restart) RESTART_PVE_SERVICES "${2:-}";;