fix

src/main/java/com/cisd/tms/integration/crypto/pcie/service/JnaPcieCryptoService.java

@@ -13,12 +13,18 @@ import java.io.ByteArrayOutputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.List;
+import java.util.concurrent.CompletableFuture;
 import java.util.function.Supplier;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 public class JnaPcieCryptoService implements PcieCryptoService {
 
+    private static final Logger log = LoggerFactory.getLogger(JnaPcieCryptoService.class);
+
     private static final int ECC_KEY_BITS = 256;
     private static final int LMK_SEED_MAC_LENGTH = 8;
+    private static final long RECOVER_USER_KEY_ASYNC_DELAY_MILLIS = 10_000L;
     private static final int SDFE_INIT_STATUS_LOW_BYTE = 0x25;
     private static final int IK_KEY_TYPE_DEVICE = 1;
     private static final int IK_KEY_TYPE_AUTH = 2;
@@ -31,10 +37,20 @@ public class JnaPcieCryptoService implements PcieCryptoService {
 
     private final PcieSessionTemplate sessionTemplate;
     private final boolean strictAlgIdValidation;
+    private final long recoverUserKeyAsyncDelayMillis;
 
     public JnaPcieCryptoService(PcieSessionTemplate sessionTemplate, CryptoCardProperties properties) {
+        this(sessionTemplate, properties, RECOVER_USER_KEY_ASYNC_DELAY_MILLIS);
+    }
+
+    JnaPcieCryptoService(
+            PcieSessionTemplate sessionTemplate,
+            CryptoCardProperties properties,
+            long recoverUserKeyAsyncDelayMillis
+    ) {
         this.sessionTemplate = sessionTemplate;
         this.strictAlgIdValidation = properties.isStrictAlgIdValidation();
+        this.recoverUserKeyAsyncDelayMillis = Math.max(0L, recoverUserKeyAsyncDelayMillis);
     }
 
     @Override
@@ -1931,7 +1947,7 @@ public class JnaPcieCryptoService implements PcieCryptoService {
         List<RecoverUserKeyRequest> userKeyRequests = requireUserKeyRequests(req.getUserKeyRequests());
 
         try {
-            DeviceStatusResult deviceStatus = sessionTemplate.withSession("SDFE_RecoverMasterKeyMaterial", (lib, deviceHandle, sessionHandle) -> {
+            MasterKeyRecoveryResult result = sessionTemplate.withSession("SDFE_RecoverMasterKeyMaterial", (lib, deviceHandle, sessionHandle) -> {
                 sessionTemplate.ensureSuccess(
                         "SDFE_InitIdentify",
                         lib.SDFE_InitIdentify(sessionHandle, oldPin, oldPin.length, newPin, newPin.length)
@@ -1946,22 +1962,17 @@ public class JnaPcieCryptoService implements PcieCryptoService {
                         "SDFE_RecoverIK_EX",
                         lib.SDFE_RecoverIK_EX(sessionHandle, IK_KEY_TYPE_DEVICE, deviceIkComponent)
                 );
-                return readDeviceStatus(lib, sessionHandle);
-            });
-
-            byte[] seedMac = sessionTemplate.withSession("SDFE_RecoverUserKey", (lib, deviceHandle, sessionHandle) -> {
-                for (RecoverUserKeyRequest userKeyRequest : userKeyRequests) {
-                    recoverUserKeyInCurrentSession(lib, sessionHandle, userKeyRequest);
-                }
+                DeviceStatusResult deviceStatus = readDeviceStatus(lib, sessionHandle);
                 sessionTemplate.ensureSuccess("SDFE_CheckLMK", lib.SDFE_CheckLMK(sessionHandle));
                 byte[] mac = new byte[LMK_SEED_MAC_LENGTH];
                 sessionTemplate.ensureSuccess("SDFE_ExportLMKSeedMAC", lib.SDFE_ExportLMKSeedMAC(sessionHandle, mac));
-                return Arrays.copyOf(mac, mac.length);
+                MasterKeyRecoveryResult recoveryResult = new MasterKeyRecoveryResult();
+                recoveryResult.setDeviceStatus(deviceStatus);
+                recoveryResult.setLmkSeedMac(Arrays.copyOf(mac, mac.length));
+                return recoveryResult;
             });
 
-            MasterKeyRecoveryResult result = new MasterKeyRecoveryResult();
-            result.setDeviceStatus(deviceStatus);
-            result.setLmkSeedMac(seedMac);
+            scheduleRecoverUserKeys(copyRecoverUserKeyRequests(userKeyRequests));
             return result;
         } finally {
             wipe(oldPin);
@@ -1975,6 +1986,35 @@ public class JnaPcieCryptoService implements PcieCryptoService {
         }
     }
 
+    private void scheduleRecoverUserKeys(List<RecoverUserKeyRequest> userKeyRequests) {
+        CompletableFuture.runAsync(() -> {
+            try {
+                sleepBeforeRecoverUserKeys();
+                sessionTemplate.withSession("SDFE_RecoverUserKey", (lib, deviceHandle, sessionHandle) -> {
+                    for (RecoverUserKeyRequest userKeyRequest : userKeyRequests) {
+                        recoverUserKeyInCurrentSession(lib, sessionHandle, userKeyRequest);
+                    }
+                    return null;
+                });
+            } catch (InterruptedException ex) {
+                Thread.currentThread().interrupt();
+                log.warn("异步恢复用户密钥被中断");
+            } catch (RuntimeException ex) {
+                log.error("异步恢复用户密钥失败", ex);
+            } finally {
+                for (RecoverUserKeyRequest userKeyRequest : userKeyRequests) {
+                    wipe(userKeyRequest.getEncryptedKey());
+                }
+            }
+        });
+    }
+
+    private void sleepBeforeRecoverUserKeys() throws InterruptedException {
+        if (recoverUserKeyAsyncDelayMillis > 0L) {
+            Thread.sleep(recoverUserKeyAsyncDelayMillis);
+        }
+    }
+
     @Override
     public void generateIk(int keyType) {
         int safeKeyType = requireNonNegative("keyType", keyType);
@@ -2134,6 +2174,21 @@ public class JnaPcieCryptoService implements PcieCryptoService {
         return List.copyOf(requests);
     }
 
+    private static List<RecoverUserKeyRequest> copyRecoverUserKeyRequests(List<RecoverUserKeyRequest> requests) {
+        return requests.stream()
+                .map(JnaPcieCryptoService::copyRecoverUserKeyRequest)
+                .toList();
+    }
+
+    private static RecoverUserKeyRequest copyRecoverUserKeyRequest(RecoverUserKeyRequest request) {
+        RecoverUserKeyRequest copy = new RecoverUserKeyRequest();
+        copy.setKeyIndex(request.getKeyIndex());
+        copy.setKeyType(request.getKeyType());
+        copy.setStoreFlag(request.getStoreFlag());
+        copy.setEncryptedKey(Arrays.copyOf(request.getEncryptedKey(), request.getEncryptedKey().length));
+        return copy;
+    }
+
     private void recoverUserKeyInCurrentSession(
             PcieNativeLibrary lib,
             Pointer sessionHandle,
@@ -2624,4 +2679,4 @@ public class JnaPcieCryptoService implements PcieCryptoService {
         }
         return Arrays.copyOf(userId, userId.length);
     }
-}
+}

src/main/java/com/cisd/tms/modules/cert/repository/KeyEntityRepository.java

@@ -9,6 +9,7 @@ import java.util.Optional;
 public interface KeyEntityRepository {
     KeyEntity save(KeyEntity entity);
     void deleteById(Long id);
+    void deleteAll();
     Optional<KeyEntity> findById(Long id);
     Optional<KeyEntity> findByKeyIdx(Integer keyIdx);
     List<KeyEntity> findAll();

src/main/java/com/cisd/tms/modules/cert/repository/impl/KeyEntityRepositoryImpl.java

@@ -38,6 +38,12 @@ public class KeyEntityRepositoryImpl implements KeyEntityRepository {
         mapper.deleteById(id);
     }
 
+    @Override
+    public void deleteAll() {
+        mapper.delete(new LambdaQueryWrapper<KeyEntity>()
+                .isNotNull(KeyEntity::getId));
+    }
+
     @Override
     public Optional<KeyEntity> findById(Long id) {
         return Optional.ofNullable(mapper.selectById(id));

src/main/java/com/cisd/tms/modules/init/config/InitCommandProfileService.java

@@ -14,6 +14,7 @@ public class InitCommandProfileService {
 
     private static final String PROFILE_RESOURCE = "initplan/step-command-profiles.json";
     private static final String STANDARD_HOME_DIR_PLACEHOLDER = "{{STANDARD_HOME_DIR}}";
+    private static final String STANDARD_VENDOR_STEP_RUNNER_PLACEHOLDER = "{{STANDARD_VENDOR_STEP_RUNNER}}";
 
     private final Map<String, Map<String, Map<String, String>>> profileMap;
     private final InitExecutorProperties initExecutorProperties;
@@ -65,7 +66,10 @@ public class InitCommandProfileService {
 
     private String interpolate(String rawCommand) {
         String standardHomeDir = normalize(initExecutorProperties.getStandardHomeDir());
-        return rawCommand.replace(STANDARD_HOME_DIR_PLACEHOLDER, standardHomeDir);
+        String standardVendorStepRunner = normalize(initExecutorProperties.getStandardVendorStepRunnerCommand());
+        return rawCommand
+                .replace(STANDARD_HOME_DIR_PLACEHOLDER, standardHomeDir)
+                .replace(STANDARD_VENDOR_STEP_RUNNER_PLACEHOLDER, standardVendorStepRunner);
     }
 
     private static String normalize(String value) {

src/main/java/com/cisd/tms/modules/init/config/InitExecutorProperties.java

@@ -11,8 +11,10 @@ public class InitExecutorProperties {
         LOCAL
     }
 
-    private static final String DEFAULT_STANDARD_HOME_DIR = "/home/cemp4i";
+    private static final String DEFAULT_STANDARD_HOME_DIR = "/home/cmep4i";
     private static final String DEFAULT_STANDARD_RUN_USER = "cmep4i";
+    private static final String DEFAULT_STANDARD_VENDOR_STEP_RUNNER_COMMAND =
+            "/usr/local/sbin/tms-run-standard-vendor-step";
 
     private Mode mode = Mode.SIMULATE;
     private int timeoutSec = 600;
@@ -50,6 +52,8 @@ public class InitExecutorProperties {
     private String standardWebOrganizationJsonPath = "/usr/local/nginx/html/organization.json";
     // 标准版 CMSP/CMTP 启动用户
     private String standardRunUser = DEFAULT_STANDARD_RUN_USER;
+    // 标准版 vendor 客户化脚本受控执行入口；应部署为 root:root 且不允许 tms 写入
+    private String standardVendorStepRunnerCommand = DEFAULT_STANDARD_VENDOR_STEP_RUNNER_COMMAND;
     // 标准版 CMSP/CMTP 启动命令
     private String standardAppStartCommand = "";
     // 标准版 CMSP/CMTP 停止命令
@@ -117,11 +121,7 @@ public class InitExecutorProperties {
     // 加密密钥，默认与官方 encrypt-decrypt.jar 保持一致
     private String standardRabbitCredentialSecretKey = "ABCDEFGHIJKLMN1234567890";
     // LOCAL 模式命令白名单前缀；仅命中前缀的命令允许执行
-    private List<String> whitelistPrefixes = List.of(
-            "bash /opt/CAE_Install_",
-            "systemctl ",
-            "echo "
-    );
+    private List<String> whitelistPrefixes = List.of();
 
     public Mode getMode() {
         return mode;
@@ -166,22 +166,13 @@ public class InitExecutorProperties {
     public List<String> getWhitelistPrefixes() {
         if (whitelistPrefixes == null || whitelistPrefixes.isEmpty()) {
             return List.of(
-                    "bash " + getStandardHomeDir() + "/cpackage/",
+                    "sudo -n " + getStandardVendorStepRunnerCommand() + " ",
                     "bash /opt/CAE_Install_",
                     "systemctl ",
                     "echo "
             );
         }
-        boolean hasStandardPrefix = whitelistPrefixes.stream()
-                .filter(item -> item != null && !item.isBlank())
-                .anyMatch(item -> item.startsWith("bash ") && item.contains("/cpackage/"));
-        if (hasStandardPrefix) {
-            return whitelistPrefixes;
-        }
-        java.util.ArrayList<String> merged = new java.util.ArrayList<>();
-        merged.add("bash " + getStandardHomeDir() + "/cpackage/");
-        merged.addAll(whitelistPrefixes);
-        return merged;
+        return whitelistPrefixes;
     }
 
     public void setWhitelistPrefixes(List<String> whitelistPrefixes) {
@@ -308,6 +299,16 @@ public class InitExecutorProperties {
         this.standardRunUser = standardRunUser;
     }
 
+    public String getStandardVendorStepRunnerCommand() {
+        return isBlank(standardVendorStepRunnerCommand)
+                ? DEFAULT_STANDARD_VENDOR_STEP_RUNNER_COMMAND
+                : standardVendorStepRunnerCommand.trim();
+    }
+
+    public void setStandardVendorStepRunnerCommand(String standardVendorStepRunnerCommand) {
+        this.standardVendorStepRunnerCommand = standardVendorStepRunnerCommand;
+    }
+
     public String getStandardAppStartCommand() {
         return standardAppStartCommand;
     }

src/main/java/com/cisd/tms/modules/init/executor/ConfigurableInitStepExecutor.java

@@ -262,26 +262,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
             return InitStepExecutionResult.failure("mq_user_apply 执行失败：通道账号为空", -1, logPath);
         }
 
-        try {
-            Path logFile = prepareLogPath(task, step);
-            StandardRabbitSetupScriptContext scriptContext = prepareStandardRabbitSetupScriptContext(task, context);
-            appendLog(logFile, "rendered staged rabbit setup script with channel user: " + context.channelUsername());
-
-            int code = runCommand(
-                    logFile,
-                    Arrays.asList("bash", scriptContext.stagedSetupScript().toString()),
-                    false,
-                    scriptContext.stagingScriptDir()
-            );
-            if (code != 0) {
-                return InitStepExecutionResult.failure("mq_user_apply 执行失败：setuprabq.sh执行失败", code, logFile.toString());
-            }
-            return InitStepExecutionResult.success("MQ用户已通过setuprabq.sh应用", 0, logFile.toString());
-        } catch (InterruptedException ex) {
-            Thread.currentThread().interrupt();
-            String logPath = writeInternalLog(task, step, "mq_user_apply 被中断");
-            return InitStepExecutionResult.failure("mq_user_apply 被中断", -1, logPath);
-        }
+        return executeDirectMqUserApply(task, step, context);
     }
 
     private InitStepExecutionResult executeMqQueueApply(InitTaskEntity task, InitTaskStepEntity step) throws IOException {
@@ -348,16 +329,16 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
                 appendLog(logFile, "rabbitmqctl状态检查失败，继续执行应用流程");
             }
 
-            runCommandAllowAlreadyExists(logFile, Arrays.asList(ctl, "add_vhost", vhost), "vhost");
-            int addUserCode = runCommand(logFile, Arrays.asList(ctl, "add_user", user, pass), true);
+            runRabbitmqCommandAllowAlreadyExists(logFile, Arrays.asList(ctl, "add_vhost", vhost), "vhost");
+            int addUserCode = runRabbitmqCommand(logFile, Arrays.asList(ctl, "add_user", user, pass), true);
             if (addUserCode != 0) {
-                int changeCode = runCommand(logFile, Arrays.asList(ctl, "change_password", user, pass), false);
+                int changeCode = runRabbitmqCommand(logFile, Arrays.asList(ctl, "change_password", user, pass), false);
                 if (changeCode != 0) {
                     return applyMqUserByRabbitmqAdminFallback(logFile, user, pass, vhost, addUserCode, changeCode);
                 }
             }
 
-            int permissionCode = runCommand(
+            int permissionCode = runRabbitmqCommand(
                     logFile,
                     Arrays.asList(ctl, "set_permissions", "-p", vhost, user, ".*", ".*", ".*"),
                     false
@@ -592,7 +573,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
 
     private boolean waitRabbitmqReady(Path logFile, String ctl) throws IOException, InterruptedException {
         for (int i = 1; i <= 3; i++) {
-            int code = runCommand(logFile, Arrays.asList(ctl, "status"), true);
+            int code = runRabbitmqCommand(logFile, Arrays.asList(ctl, "status"), true);
             if (code == 0) {
                 return true;
             }
@@ -1110,13 +1091,13 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
             }
 
             for (String queue : buildStandardCustomerDefaultVhostQueues(normalize(context.orgCode()))) {
-                runCommand(logFile, Arrays.asList(ctl, "delete_queue", queue), true);
+                runRabbitmqCommand(logFile, Arrays.asList(ctl, "delete_queue", queue), true);
             }
             for (String queue : buildStandardRqVhostQueues(normalize(context.orgCode()))) {
-                runCommand(logFile, Arrays.asList(ctl, "delete_queue", "-p", vhost, queue), true);
+                runRabbitmqCommand(logFile, Arrays.asList(ctl, "delete_queue", "-p", vhost, queue), true);
             }
-            runCommand(logFile, Arrays.asList(ctl, "clear_permissions", "-p", vhost, user), true);
-            runCommand(logFile, Arrays.asList(ctl, "delete_user", user), true);
+            runRabbitmqCommand(logFile, Arrays.asList(ctl, "clear_permissions", "-p", vhost, user), true);
+            runRabbitmqCommand(logFile, Arrays.asList(ctl, "delete_user", user), true);
             return InitStepExecutionResult.success("mq cleanup 已应用", 0, logFile.toString());
         } catch (InterruptedException ex) {
             Thread.currentThread().interrupt();
@@ -1931,6 +1912,17 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
         }
     }
 
+    private void runRabbitmqCommandAllowAlreadyExists(Path logFile, List<String> command, String scene) throws IOException, InterruptedException {
+        int code = runRabbitmqCommand(logFile, command, true);
+        if (code != 0) {
+            appendLog(logFile, scene + " already exists or RabbitMQ 命令执行失败 with exit code=" + code + ", ignored");
+        }
+    }
+
+    private int runRabbitmqCommand(Path logFile, List<String> command, boolean ignoreFailure) throws IOException, InterruptedException {
+        return runCommand(logFile, command, ignoreFailure, null, buildRabbitmqEnvironment());
+    }
+
     private int runCommand(Path logFile, List<String> command, boolean ignoreFailure) throws IOException, InterruptedException {
         return runCommand(logFile, command, ignoreFailure, null);
     }
@@ -1971,6 +1963,19 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
         return exitCode;
     }
 
+    private Map<String, String> buildRabbitmqEnvironment() {
+        Map<String, String> environment = new LinkedHashMap<>();
+        String existingPath = normalize(System.getenv("PATH"));
+        String path = "/usr/local/erlang/bin:/usr/local/rabbitmq/sbin:/usr/local/rabbitmq-server/sbin:"
+                + "/usr/lib/rabbitmq/bin:/usr/sbin:/usr/bin:/bin";
+        if (!isBlank(existingPath)) {
+            path = path + ":" + existingPath;
+        }
+        environment.put("ERLANG_HOME", "/usr/local/erlang");
+        environment.put("PATH", path);
+        return environment;
+    }
+
     private Map<String, String> buildStandardDbApplyEnvironment(Path loadDir, PlanContext context) {
         Map<String, String> environment = new LinkedHashMap<>();
         JdbcEndpoint endpoint = resolveStandardDbEndpoint();
@@ -2244,12 +2249,26 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
 
     private void verifyProcessAbsent(Path logFile, String pattern, String label, List<String> failures) throws IOException {
         try {
-            int code = runCommand(
-                    logFile,
-                    Arrays.asList("/bin/bash", "-lc", "pgrep -f " + quoteShellValue(pattern) + " >/dev/null"),
-                    true
-            );
-            if (code == 0) {
+            ProcessBuilder processBuilder = new ProcessBuilder("ps", "-eo", "args=");
+            processBuilder.redirectErrorStream(true);
+            Process process = processBuilder.start();
+            boolean finished = process.waitFor(properties.getTimeoutSec(), TimeUnit.SECONDS);
+            if (!finished) {
+                process.destroyForcibly();
+                failures.add(label + " process verification 超时");
+                return;
+            }
+            String output = new String(process.getInputStream().readAllBytes());
+            if (process.exitValue() != 0) {
+                appendLog(logFile, "process verification command failed for " + label + ", exitCode=" + process.exitValue());
+                failures.add(label + " process verification failed");
+                return;
+            }
+            boolean running = output.lines()
+                    .map(ConfigurableInitStepExecutor::normalize)
+                    .anyMatch(line -> !isBlank(line) && line.contains(pattern));
+            appendLog(logFile, "process verification " + label + ": pattern=" + pattern + ", running=" + running);
+            if (running) {
                 failures.add(label + " process still running");
             }
         } catch (InterruptedException ex) {
@@ -2301,7 +2320,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
 
     private void verifyRabbitObjectAbsent(Path logFile, String shellCommand, String message, List<String> failures) throws IOException {
         try {
-            int code = runCommand(logFile, Arrays.asList("/bin/bash", "-lc", shellCommand), true);
+            int code = runCommand(logFile, Arrays.asList("/bin/bash", "-lc", shellCommand), true, null, buildRabbitmqEnvironment());
             if (code == 0) {
                 failures.add(message);
             }

src/main/java/com/cisd/tms/modules/mk/service/impl/LmkServiceImpl.java

@@ -8,6 +8,7 @@ import com.cisd.tms.integration.crypto.pcie.jna.EccRefPublicKey;
 import com.cisd.tms.integration.crypto.pcie.model.*;
 import com.cisd.tms.integration.crypto.pcie.service.PcieCryptoService;
 import com.cisd.tms.modules.auth.service.AuthSecurityResetService;
+import com.cisd.tms.modules.cert.repository.KeyEntityRepository;
 import com.cisd.tms.modules.mk.common.LMKConstant;
 import com.cisd.tms.modules.mk.config.MasterKeyInitProperties;
 import com.cisd.tms.modules.mk.dto.*;
@@ -23,6 +24,8 @@ import org.springframework.stereotype.Service;
 
 import java.nio.charset.StandardCharsets;
 import java.util.*;
+import java.util.concurrent.Executor;
+import java.util.concurrent.Executors;
 
 /**
  * 主密钥生命周期服务实现。
@@ -58,22 +61,54 @@ public class LmkServiceImpl implements LmkService {
     private final Object backupRoundLock = new Object();
     private CachedBackupRound cachedBackupRound;
     private final MasterKeyActivateRepository masterKeyActivateRepository;
+    private final KeyEntityRepository keyEntityRepository;
+    private final Executor masterKeyPostInitExecutor;
 
     @Autowired
     public LmkServiceImpl(
             PcieCryptoService pcieCryptoService,
             MasterKeyInitProperties masterKeyInitProperties,
             AuthSecurityResetService authSecurityResetService,
-            MasterKeyActivateRepository masterKeyActivateRepository
+            MasterKeyActivateRepository masterKeyActivateRepository,
+            KeyEntityRepository keyEntityRepository
+    ) {
+        this(
+                pcieCryptoService,
+                masterKeyInitProperties,
+                authSecurityResetService,
+                masterKeyActivateRepository,
+                keyEntityRepository,
+                newMasterKeyPostInitExecutor()
+        );
+    }
+
+    public LmkServiceImpl(
+            PcieCryptoService pcieCryptoService,
+            MasterKeyInitProperties masterKeyInitProperties,
+            AuthSecurityResetService authSecurityResetService,
+            MasterKeyActivateRepository masterKeyActivateRepository,
+            KeyEntityRepository keyEntityRepository,
+            Executor masterKeyPostInitExecutor
     ) {
         this.pcieCryptoService = pcieCryptoService;
         this.masterKeyInitProperties = masterKeyInitProperties;
         this.authSecurityResetService = authSecurityResetService;
         this.masterKeyActivateRepository = masterKeyActivateRepository;
+        this.keyEntityRepository = keyEntityRepository;
+        this.masterKeyPostInitExecutor = masterKeyPostInitExecutor == null ? Runnable::run : masterKeyPostInitExecutor;
+    }
+
+    public LmkServiceImpl(
+            PcieCryptoService pcieCryptoService,
+            MasterKeyInitProperties masterKeyInitProperties,
+            AuthSecurityResetService authSecurityResetService,
+            MasterKeyActivateRepository masterKeyActivateRepository
+    ) {
+        this(pcieCryptoService, masterKeyInitProperties, authSecurityResetService, masterKeyActivateRepository, null, Runnable::run);
     }
 
     public LmkServiceImpl(PcieCryptoService pcieCryptoService, MasterKeyInitProperties masterKeyInitProperties, MasterKeyActivateRepository masterKeyActivateRepository) {
-        this(pcieCryptoService, masterKeyInitProperties, () -> { }, masterKeyActivateRepository);
+        this(pcieCryptoService, masterKeyInitProperties, () -> { }, masterKeyActivateRepository, null, Runnable::run);
     }
 
     @Override
@@ -100,11 +135,7 @@ public class LmkServiceImpl implements LmkService {
         MasterKeyStateResult result = new MasterKeyStateResult();
         result.setStatus(true);
         result.setSeedMac(Hex.toHexString(pcieCryptoService.initializeMasterKey(oldPin, newPin)));
-        authSecurityResetService.resetAfterMasterKeyInitialized();
-
-        masterKeyActivateEntity.setActivationStatus(false);
-        masterKeyActivateEntity.setEverInitialized(false);
-        masterKeyActivateRepository.update(masterKeyActivateEntity);
+        schedulePostMasterKeyInitMaintenance(masterKeyActivateEntity);
         return result;
     }
 
@@ -118,6 +149,7 @@ public class LmkServiceImpl implements LmkService {
         pcieCryptoService.destroyLmk();
         pcieCryptoService.destroyIk(IKEnums.KEY_TYPE_AUTH.getCode());
         pcieCryptoService.destroyIk(IKEnums.KEY_TYPE_DEVICE.getCode());
+        clearKeyEntityRegistry();
     }
 
     @Override
@@ -221,8 +253,9 @@ public class LmkServiceImpl implements LmkService {
         MasterKeyRecoveryResult recoveryResult = pcieCryptoService.recoverMasterKeyMaterial(recoveryRequest);
         DeviceStatusResult deviceStatus = recoveryResult.getDeviceStatus();
         if (deviceStatus != null) {
-            log.info("device status:{}", deviceStatus.getFsmState());
+            log.info("device status:{}/lmk seed mac:{}", deviceStatus.getFsmState(), recoveryResult.getLmkSeedMac());
         }
+        clearKeyEntityRegistry();
         MasterKeyStateResult result = new MasterKeyStateResult();
         result.setStatus(true);
         result.setSeedMac(Hex.toHexString(recoveryResult.getLmkSeedMac()));
@@ -239,6 +272,7 @@ public class LmkServiceImpl implements LmkService {
         pcieCryptoService.initIdentify(oldPin, newPin);
         pcieCryptoService.recoverLmkEx(Hex.decode(fullLmkHex));
         pcieCryptoService.loadLmk();
+        clearKeyEntityRegistry();
     }
 
     @Override
@@ -585,6 +619,48 @@ public class LmkServiceImpl implements LmkService {
         }
     }
 
+    private void schedulePostMasterKeyInitMaintenance(MasterKeyActivateEntity masterKeyActivateEntity) {
+        try {
+            masterKeyPostInitExecutor.execute(() -> runPostMasterKeyInitMaintenance(masterKeyActivateEntity));
+        } catch (RuntimeException ex) {
+            log.error("提交主密钥初始化后置维护任务失败", ex);
+        }
+    }
+
+    private void runPostMasterKeyInitMaintenance(MasterKeyActivateEntity masterKeyActivateEntity) {
+        try {
+            clearKeyEntityRegistry();
+        } catch (RuntimeException ex) {
+            log.error("主密钥初始化后清理实体密钥登记表失败", ex);
+        }
+        try {
+            authSecurityResetService.resetAfterMasterKeyInitialized();
+        } catch (RuntimeException ex) {
+            log.error("主密钥初始化后重置认证状态失败", ex);
+        }
+        try {
+            masterKeyActivateEntity.setActivationStatus(false);
+            masterKeyActivateEntity.setEverInitialized(false);
+            masterKeyActivateRepository.update(masterKeyActivateEntity);
+        } catch (RuntimeException ex) {
+            log.error("主密钥初始化后更新激活记录失败", ex);
+        }
+    }
+
+    private void clearKeyEntityRegistry() {
+        if (keyEntityRepository != null) {
+            keyEntityRepository.deleteAll();
+        }
+    }
+
+    private static Executor newMasterKeyPostInitExecutor() {
+        return Executors.newSingleThreadExecutor(runnable -> {
+            Thread thread = new Thread(runnable, "tms-master-key-post-init");
+            thread.setDaemon(true);
+            return thread;
+        });
+    }
+
     private record ParsedMasterKeyBackup(String lmkMacHex, Map<Integer, String> componentMap) {
     }
 

src/main/java/com/cisd/tms/modules/mk/service/impl/MasterKeyActivateServiceImpl.java

@@ -17,8 +17,8 @@ import com.cisd.tms.modules.mk.repository.MasterKeyActivateRepository;
 import com.cisd.tms.modules.mk.service.MasterKeyActivateService;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.sunyard.cisd.DeviceFingerprint;
-import com.sunyard.cisd.DeviceFingerprintService;
+import com.sunyard.cisd.device.tool.DeviceFingerprint;
+import com.sunyard.cisd.device.tool.DeviceFingerprintService;
 import lombok.Data;
 import lombok.RequiredArgsConstructor;
 import org.bouncycastle.crypto.CipherParameters;

src/main/resources/application.yml

@@ -102,9 +102,9 @@ tms:
       # 标准版 CMSP/CMTP 停止命令。
       standard-app-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_APP_STOP_COMMAND:/home/tms/bin/stop_standard_apps.sh}
       # 标准版 nginx 启动命令。
-      standard-nginx-start-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_START_COMMAND:/home/tms/bin/start_standard_nginx.sh}
+      standard-nginx-start-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_START_COMMAND:sudo -n /usr/local/sbin/tms-start-standard-nginx}
       # 标准版 nginx 停止命令。
-      standard-nginx-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_STOP_COMMAND:/home/tms/bin/stop_standard_nginx.sh}
+      standard-nginx-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_NGINX_STOP_COMMAND:sudo -n /usr/local/sbin/tms-stop-standard-nginx}
       # 标准版 RabbitMQ 停止命令。
       standard-rabbit-stop-command: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_STOP_COMMAND:/home/tms/bin/stop_standard_rabbitmq.sh}
       # 标准版启动后检查命令。
@@ -114,7 +114,7 @@ tms:
       # 上传文件根目录；所有 fileId 均从该目录解析。
       upload-base-dir: ${TMS_INIT_EXECUTOR_UPLOAD_BASE_DIR:/home/tms/uploads}
       # 初始化过程临时暂存目录（用于复制上传文件后再处理）。
-      staging-root-dir: ${TMS_INIT_EXECUTOR_STAGING_ROOT_DIR:/home/tmp/tms-init-staging}
+      staging-root-dir: ${TMS_INIT_EXECUTOR_STAGING_ROOT_DIR:/home/tms/tmp/tms-init-staging}
       # 标准版收发器 license 固定落位路径。
       standard-receiver-license-target-path: ${TMS_INIT_EXECUTOR_STANDARD_RECEIVER_LICENSE_TARGET_PATH:${tms.init.executor.standard-home-dir}/cmep/license/cmep.license}
       # 直参版收发器 license 固定落位路径。
@@ -137,10 +137,10 @@ tms:
       rabbit-admin-password: ${TMS_INIT_EXECUTOR_RABBIT_ADMIN_PASSWORD:admin}
       # RabbitMQ 控制命令（用于新增用户、授权等）。
       # 建议线上配置为绝对路径，例如 /usr/local/rabbitmq/sbin/rabbitmqctl。
-      rabbitmq-ctl-command: ${TMS_INIT_EXECUTOR_RABBITMQ_CTL_COMMAND:rabbitmqctl}
+      rabbitmq-ctl-command: ${TMS_INIT_EXECUTOR_RABBITMQ_CTL_COMMAND:/usr/local/rabbitmq/sbin/rabbitmqctl}
       # RabbitMQ Admin CLI 命令路径（用于创建队列等）。
       rabbitmq-admin-command: ${TMS_INIT_EXECUTOR_RABBITMQ_ADMIN_COMMAND:/usr/sbin/rabbitmqadmin}
-      # 标准版 RabbitMQ 初始化脚本（会按前端输入替换 rConn/rConn 后执行）。
+      # 标准版 RabbitMQ 初始化脚本路径（保留兼容；MQ_USER_APPLY 当前优先直接调用 rabbitmqctl/rabbitmqadmin）。
       standard-rabbit-setup-script-path: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_SETUP_SCRIPT_PATH:${tms.init.executor.standard-home-dir}/cpackage/rabq/setuprabq.sh}
       # 标准版 RabbitMQ 队列初始化脚本（默认执行 01 节点脚本）。
       standard-rabbit-queue-script-path: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_QUEUE_SCRIPT_PATH:${tms.init.executor.standard-home-dir}/cpackage/rabq/addrabq_R_01.sh}
@@ -152,13 +152,15 @@ tms:
       standard-rabbit-app-config-patterns:
         - ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_1:${tms.init.executor.standard-home-dir}/cmsp/application-prd*.properties}
         - ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_2:${tms.init.executor.standard-home-dir}/cmtp/application-prd*.properties}
+      # 标准版 vendor 客户化脚本受控执行入口；该文件应由 root 部署到 /usr/local/sbin 且不可由 tms 写入。
+      standard-vendor-step-runner-command: ${TMS_INIT_EXECUTOR_STANDARD_VENDOR_STEP_RUNNER_COMMAND:/usr/local/sbin/tms-run-standard-vendor-step}
       # 回写应用配置时，是否对 RabbitMQ 账号密码进行 3DES 加密。
       standard-rabbit-credential-encrypt-enabled: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_ENCRYPT_ENABLED:true}
       # 3DES 加密密钥（需与收发器解密逻辑保持一致）。
       standard-rabbit-credential-secret-key: ${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_SECRET_KEY:ABCDEFGHIJKLMN1234567890}
       # LOCAL 模式命令白名单前缀；非白名单命令会被拒绝执行。
       whitelist-prefixes:
-        - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_1:bash ${tms.init.executor.standard-home-dir}/cpackage/}
+        - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_1:sudo -n ${tms.init.executor.standard-vendor-step-runner-command} }
         - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_2:bash /opt/CAE_Install_}
         - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_3:systemctl }
         - ${TMS_INIT_EXECUTOR_WHITELIST_PREFIX_4:echo }
@@ -191,7 +193,7 @@ tms:
     # 升级任务统一日志目录。
     log-dir: ${TMS_UPGRADE_LOG_DIR:/home/tms/tmp/tms-upgrade-logs}
     # 升级包验签使用的公钥 PEM 文件路径；为空时升级预检会拒绝通过。
-    signature-public-key-pem-path: ${TMS_UPGRADE_SIGNATURE_PUBLIC_KEY_PEM_PATH:/home/tms/cert/public_key.pem}
+    signature-public-key-pem-path: ${TMS_UPGRADE_SIGNATURE_PUBLIC_KEY_PEM_PATH:/home/tms/device/dev.mac.pub}
   backup:
     # 资源备份包输出目录；第一版先在本机生成可见的 .tmsbak 文件。
     output-dir: ${TMS_BACKUP_OUTPUT_DIR:/home/tms/tmp/resource-backup-packages}
@@ -315,8 +317,6 @@ tms:
       - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_ROLE_UKEY:tms_role_ukey_binding}
       - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_FULL:tms_auth_full_account}
       - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_SESSION:tms_auth_session}
-      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_CHALLENGE:tms_auth_challenge}
-      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_AUDIT:tms_auth_audit_log}
       - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_RESOURCE_BACKUP_TASK:tms_resource_backup_task}
       - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_RESOURCE_RESTORE_TASK:tms_resource_restore_task}
     # 备份/恢复标准收发器业务库名；第一版默认使用 CMEP。
@@ -340,7 +340,7 @@ tms:
     internal-token: ${TMS_INTERNAL_TOKEN:change-me-internal-token}
     internal-auth:
       # 是否启用 /api/** 的内部登录鉴权；开发联调时可临时关闭。
-      enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:true}
+      enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:false}
       # 关闭内部鉴权后，注入请求上下文的调试角色。
       debug-role-code: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_ROLE_CODE:OPS_ADMIN}
       # 关闭内部鉴权后，注入请求上下文的调试认证等级。
@@ -349,7 +349,7 @@ tms:
       debug-session-token: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_SESSION_TOKEN:DEBUG-BYPASS}
     replay:
       # 是否启用防重放校验；本地 Postman/联调可临时设为 false，生产环境应保持 true。
-      enabled: ${TMS_SECURITY_REPLAY_ENABLED:true}
+      enabled: ${TMS_SECURITY_REPLAY_ENABLED:false}
     openapi:
       # 外部签名服务接口允许的时间戳偏差（秒），防重放。
       timestamp-skew-seconds: 300

src/main/resources/db/migration/V1__tms_schema_full.sql

@@ -33,7 +33,7 @@ CREATE TABLE IF NOT EXISTS tms_init_task (
     create_time DATETIME(3) NOT NULL,
     update_time DATETIME(3) NOT NULL,
     UNIQUE KEY uk_tms_init_task_task_id (task_id)
-);
+) COMMENT='初始化任务表';
 
 CREATE TABLE IF NOT EXISTS tms_init_task_step (
     id BIGINT PRIMARY KEY,
@@ -49,7 +49,7 @@ CREATE TABLE IF NOT EXISTS tms_init_task_step (
     update_time DATETIME(3) NOT NULL,
     UNIQUE KEY uk_tms_init_task_step_task_no (task_id, step_no),
     KEY idx_tms_init_task_step_task_id (task_id)
-);
+) COMMENT='初始化任务步骤表';
 
 -- -----------------------------------------------------------------------------
 -- 资源备份与恢复
@@ -83,7 +83,7 @@ CREATE TABLE IF NOT EXISTS tms_resource_backup_task (
     UNIQUE KEY uk_tms_resource_backup_task_backup_id (backup_id),
     KEY idx_tms_resource_backup_task_status (status),
     KEY idx_tms_resource_backup_task_create_time (create_time)
-);
+) COMMENT='资源备份任务表';
 
 CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
     id BIGINT PRIMARY KEY,
@@ -114,7 +114,7 @@ CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
     UNIQUE KEY uk_tms_resource_restore_task_precheck_id (precheck_id),
     KEY idx_tms_resource_restore_task_status (status),
     KEY idx_tms_resource_restore_task_create_time (create_time)
-);
+) COMMENT='资源恢复任务表';
 -- -----------------------------------------------------------------------------
 -- 认证与设备基础表
 -- -----------------------------------------------------------------------------
@@ -127,7 +127,7 @@ CREATE TABLE IF NOT EXISTS tms_device_node (
     create_time DATETIME(3) NOT NULL,
     update_time DATETIME(3) NOT NULL,
     UNIQUE KEY uk_tms_device_node_node_id (node_id)
-);
+) COMMENT='设备节点表';
 
 CREATE TABLE IF NOT EXISTS tms_file_record (
     id BIGINT PRIMARY KEY,
@@ -138,7 +138,7 @@ CREATE TABLE IF NOT EXISTS tms_file_record (
     create_time DATETIME(3) NOT NULL,
     update_time DATETIME(3) NOT NULL,
     UNIQUE KEY uk_tms_file_record_file_id (file_id)
-);
+) COMMENT='文件记录表';
 
 -- -----------------------------------------------------------------------------
 -- 设备软件版本
@@ -155,7 +155,7 @@ CREATE TABLE IF NOT EXISTS tms_device_software_version (
     create_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     update_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
     UNIQUE KEY uk_tms_device_software_version_component_code (component_code)
-);
+) COMMENT='设备软件版本表';
 
 INSERT INTO tms_device_software_version
 (id, component_code, component_name, current_version, source_type, detected_at, remarks)
@@ -204,7 +204,7 @@ CREATE TABLE IF NOT EXISTS tms_upgrade_task (
     KEY idx_tms_upgrade_task_status (status),
     KEY idx_tms_upgrade_task_task_type (task_type),
     KEY idx_tms_upgrade_task_create_time (create_time)
-);
+) COMMENT='升级任务表';
 
 -- -----------------------------------------------------------------------------
 -- 新认证体系
@@ -219,7 +219,7 @@ CREATE TABLE IF NOT EXISTS tms_role_account (
     create_time DATETIME(3) NOT NULL,
     update_time DATETIME(3) NOT NULL,
     UNIQUE KEY uk_tms_role_account_role_code (role_code)
-);
+) COMMENT='角色账号表';
 
 CREATE TABLE IF NOT EXISTS tms_role_ukey_binding (
     id BIGINT PRIMARY KEY,
@@ -236,7 +236,7 @@ CREATE TABLE IF NOT EXISTS tms_role_ukey_binding (
     UNIQUE KEY uk_tms_role_ukey_binding_role_uid_serial (role_code, uid, ukey_serial),
     KEY idx_tms_role_ukey_binding_role_uid_status (role_code, uid, status),
     KEY idx_tms_role_ukey_binding_role_status (role_code, status)
-);
+) COMMENT='角色UKey绑定表';
 
 CREATE TABLE IF NOT EXISTS tms_auth_full_account (
     id BIGINT PRIMARY KEY,
@@ -258,7 +258,7 @@ CREATE TABLE IF NOT EXISTS tms_auth_full_account (
     UNIQUE KEY uk_tms_auth_full_account_role_uid (role_code, uid),
     UNIQUE KEY uk_tms_auth_full_account_name (account_name),
     KEY idx_tms_auth_full_account_role_code (role_code)
-);
+) COMMENT='完整认证账号表';
 
 CREATE TABLE IF NOT EXISTS tms_auth_session (
     id BIGINT PRIMARY KEY,
@@ -275,7 +275,7 @@ CREATE TABLE IF NOT EXISTS tms_auth_session (
     update_time DATETIME(3) NOT NULL,
     UNIQUE KEY uk_tms_auth_session_token (session_token),
     KEY idx_tms_auth_session_role_code (role_code)
-);
+) COMMENT='认证会话表';
 
 -- -----------------------------------------------------------------------------
 -- 防重放与安全事件
@@ -298,7 +298,7 @@ CREATE TABLE IF NOT EXISTS tms_replay_nonce (
     UNIQUE KEY uk_tms_replay_nonce_scope_principal_nonce (scope, principal_id, nonce),
     KEY idx_tms_replay_nonce_expires_at (expires_at),
     KEY idx_tms_replay_nonce_principal_time (principal_id, create_time)
-);
+) COMMENT='防重放nonce表';
 
 CREATE TABLE IF NOT EXISTS tms_security_event (
     id BIGINT PRIMARY KEY,
@@ -314,7 +314,7 @@ CREATE TABLE IF NOT EXISTS tms_security_event (
     update_time DATETIME(3) NOT NULL,
     KEY idx_tms_security_event_event_type (event_type),
     KEY idx_tms_security_event_scope_principal (scope, principal_id)
-);
+) COMMENT='安全事件表';
 
 INSERT IGNORE INTO tms_role_account (
     id,
@@ -483,7 +483,7 @@ CREATE TABLE IF NOT EXISTS tms_access_whitelist (
     mask VARCHAR(10) NOT NULL,
     create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
     update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
-    );
+) COMMENT='访问白名单表';
 
 
 -- -----------------------------------------------------------------------------
@@ -512,7 +512,7 @@ CREATE TABLE IF NOT EXISTS tms_key_entity (
     KEY idx_tms_key_entity_algo (algo_type),
     KEY idx_tms_key_entity_status (status),
     KEY idx_tms_key_entity_create_time (create_time)
-);
+) COMMENT='密钥实体表';
 
 CREATE TABLE IF NOT EXISTS tms_certificate (
     id BIGINT PRIMARY KEY,
@@ -537,7 +537,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate (
     KEY idx_tms_certificate_issuer_dn (issuer_dn(512)),
     KEY idx_tms_certificate_valid_to (valid_to),
     KEY idx_tms_certificate_import_time (import_time)
-);
+) COMMENT='证书表';
 
 CREATE TABLE IF NOT EXISTS tms_trusted_cert (
     id BIGINT PRIMARY KEY,
@@ -560,7 +560,7 @@ CREATE TABLE IF NOT EXISTS tms_trusted_cert (
     KEY idx_tms_trusted_cert_subject_dn (subject_dn(512)),
     KEY idx_tms_trusted_cert_issuer_dn (issuer_dn(512)),
     KEY idx_tms_trusted_cert_valid_to (valid_to)
-);
+) COMMENT='可信证书表';
 
 CREATE TABLE IF NOT EXISTS tms_certificate_crl (
     id BIGINT PRIMARY KEY,
@@ -580,7 +580,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate_crl (
     KEY idx_tms_certificate_crl_issuer_dn (issuer_dn(512)),
     KEY idx_tms_certificate_crl_this_update (this_update),
     KEY idx_tms_certificate_crl_next_update (next_update)
-);
+) COMMENT='证书CRL表';
 
 CREATE TABLE IF NOT EXISTS tms_certificate_crl_revoked (
     id BIGINT PRIMARY KEY,
@@ -598,7 +598,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate_crl_revoked (
     KEY idx_tms_certificate_crl_revoked_issuer_serial (issuer_dn(512), serial_number),
     KEY idx_tms_certificate_crl_revoked_subject_dn (subject_dn(512)),
     KEY idx_tms_certificate_crl_revoked_revocation_time (revocation_time)
-);
+) COMMENT='证书CRL吊销明细表';
 
 CREATE TABLE IF NOT EXISTS tms_certificate_crl_import_task (
     id BIGINT PRIMARY KEY,
@@ -617,7 +617,7 @@ CREATE TABLE IF NOT EXISTS tms_certificate_crl_import_task (
     UNIQUE KEY uk_tms_certificate_crl_import_task_task_id (task_id),
     KEY idx_tms_certificate_crl_import_task_status (status),
     KEY idx_tms_certificate_crl_import_task_create_time (create_time)
-);
+) COMMENT='证书CRL导入任务表';
 
 
 -- -----------------------------------------------------------------------------
@@ -650,7 +650,7 @@ CREATE TABLE IF NOT EXISTS tms_operation_audit_log (
     KEY idx_tms_operation_audit_log_result (operation_result),
     KEY idx_tms_operation_audit_log_audit_status (audit_status),
     KEY idx_tms_operation_audit_log_occurred_at (occurred_at)
-);
+) COMMENT='操作审计日志表';
 
 
 
@@ -672,7 +672,7 @@ CREATE TABLE IF NOT EXISTS tms_log_backup_record (
      UNIQUE KEY `uk_record_id` (`record_id`),
      KEY `idx_create_time` (`create_time`),
      KEY `idx_backup_type` (`backup_type`)
-);
+) COMMENT='日志备份记录表';
 
 
 
@@ -687,7 +687,7 @@ CREATE TABLE IF NOT EXISTS tms_backup_config (
      last_backup_time datetime DEFAULT NULL COMMENT '上次执行时间',
      sign_data varchar(255) NOT NULL COMMENT '其他字段的签名值',
      PRIMARY KEY (`id`)
-);
+) COMMENT='日志备份配置表';
 
 
 CREATE TABLE IF NOT EXISTS tms_master_key_activate (
@@ -699,7 +699,7 @@ CREATE TABLE IF NOT EXISTS tms_master_key_activate (
 
      create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
      update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
-);
+) COMMENT='主密钥激活状态表';
 
 INSERT IGNORE INTO tms_master_key_activate (
     id,

src/main/resources/initplan/step-command-profiles.json

@@ -3,12 +3,12 @@
     "RABBITMQ": {
       "RENDER_CONFIG": "internal::render_config",
       "FILE_PREPARE": "internal::file_prepare",
-      "SET_RABBITMQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setfraq.sh",
+      "SET_RABBITMQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setfraq",
       "MQ_USER_APPLY": "internal::mq_user_apply",
       "MQ_QUEUE_APPLY": "internal::mq_queue_apply",
       "DB_RENDER": "internal::db_render",
       "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
       "APP_MQ_CREDENTIALS_APPLY": "internal::app_mq_credentials_apply",
       "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
       "WEB_CONFIG_APPLY": "internal::web_config_apply",
@@ -20,11 +20,11 @@
     "TLQ": {
       "RENDER_CONFIG": "internal::render_config",
       "FILE_PREPARE": "internal::file_prepare",
-      "SET_TLQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setftq.sh",
-      "TLQ_CONF_APPLY": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/settlq.sh",
+      "SET_TLQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setftq",
+      "TLQ_CONF_APPLY": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} settlq",
       "DB_RENDER": "internal::db_render",
       "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
       "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
       "WEB_CONFIG_APPLY": "internal::web_config_apply",
       "START_CMSP_CMTP": "internal::start_cmsp_cmtp",
@@ -37,12 +37,12 @@
     "RABBITMQ": {
       "RENDER_CONFIG": "internal::render_config",
       "FILE_PREPARE": "internal::file_prepare",
-      "SET_RABBITMQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setfraq.sh",
+      "SET_RABBITMQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setfraq",
       "MQ_USER_APPLY": "internal::mq_user_apply",
       "MQ_QUEUE_APPLY": "internal::mq_queue_apply",
       "DB_RENDER": "internal::db_render",
       "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
       "APP_MQ_CREDENTIALS_APPLY": "internal::app_mq_credentials_apply",
       "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
       "WEB_CONFIG_APPLY": "internal::web_config_apply",
@@ -54,13 +54,13 @@
     "RABBITMQ_TLQ": {
       "RENDER_CONFIG": "internal::render_config",
       "FILE_PREPARE": "internal::file_prepare",
-      "SET_TLQ": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setftq.sh",
-      "TLQ_CONF_APPLY": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/settlq.sh",
+      "SET_TLQ": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setftq",
+      "TLQ_CONF_APPLY": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} settlq",
       "MQ_USER_APPLY": "internal::mq_user_apply",
       "MQ_QUEUE_APPLY": "internal::mq_queue_apply",
       "DB_RENDER": "internal::db_render",
       "DB_APPLY": "internal::db_apply",
-      "DEPLOY_RECEIVER": "bash {{STANDARD_HOME_DIR}}/cpackage/toolsh/setsptp.sh",
+      "DEPLOY_RECEIVER": "sudo -n {{STANDARD_VENDOR_STEP_RUNNER}} setsptp",
       "APP_MQ_CREDENTIALS_APPLY": "internal::app_mq_credentials_apply",
       "NGINX_CONFIG_APPLY": "internal::nginx_config_apply",
       "WEB_CONFIG_APPLY": "internal::web_config_apply",