install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 if [ -z "$MAKE" ]; then
   8         echo "ERROR: MAKE not set" >&2
   9         echo "Please run install.sh using 'make install'" >&2
  10         echo "or set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if [ ! -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19 toolbox/check-perl-modules.pl
  20
  21 # What Config should we use?
  22 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  23 echo "*** Initializing using $GIROCCO_CONF..."
  24
  25 # First run Girocco::Config consistency checks
  26 perl -I. -M$GIROCCO_CONF -e ''
  27
  28 . ./shlib.sh
  29
  30 owngroup=""
  31 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  32 if [ -n "$cfg_httpspushurl" -a -z "$cfg_certsdir" ]; then
  33         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  34         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  35         exit 1
  36 fi
  37
  38
  39 echo "*** Checking for compiled utilities..."
  40 if [ ! -x src/can_user_push ]; then
  41         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  42         echo "ERROR: perhaps you forgot to run make?" >&2
  43         exit 1
  44 fi
  45 if [ ! -x src/can_user_push_http ]; then
  46         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  47         echo "ERROR: perhaps you forgot to run make?" >&2
  48         exit 1
  49 fi
  50 if [ ! -x src/getent ]; then
  51         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  52         echo "ERROR: perhaps you forgot to run make?" >&2
  53         exit 1
  54 fi
  55 if [ ! -x src/get_user_uuid ]; then
  56         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
  57         echo "ERROR: perhaps you forgot to run make?" >&2
  58         exit 1
  59 fi
  60 if [ ! -x src/peek_packet ]; then
  61         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
  62         echo "ERROR: perhaps you forgot to run make?" >&2
  63         exit 1
  64 fi
  65
  66
  67 echo "*** Checking for ezcert..."
  68 if [ ! -f ezcert.git/CACreateCert ]; then
  69         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
  70         exit 1
  71 fi
  72
  73
  74 echo "*** Checking for git..."
  75 if [ ! -x "$cfg_git_bin" ]; then
  76         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
  77         exit 1
  78 fi
  79 if ! git_version="$("$cfg_git_bin" --version)"; then
  80         echo "ERROR: $cfg_git_bin --version failed" >&2
  81         exit 1
  82 fi
  83 case "$git_version" in
  84         "git version "*) :;;
  85         *)
  86                 echo "ERROR: '$cfg_git_bin --version' output does not start with 'git version '" >&2
  87                 exit 1
  88 esac
  89 case "$cfg_git_bin" in /*) :;; *)
  90         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
  91         exit 1
  92 esac
  93 if [ -n "$cfg_mirror" -a "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
  94         cat <<'EOT'
  95
  96 ***
  97 *** WARNING: $Girocco::Config:git_bin is set to a questionable Git binary
  98 ***
  99
 100 You appear to have enabled mirroring and the Git binary you have selected
 101 appears to contain an experimental patch that cannot be disabled.  This
 102 patch can generate invalid network DNS traffic and/or cause long delays
 103 when fetching using the "git:" protocol when no port number is specified.
 104 It may also end up retrieving repsitory contents from a host other than
 105 the one specified in the "git:" URL when the port is omitted.
 106
 107 You are advised to either build your own version of Git (the problem patch
 108 is not part of the official Git repository) or disable mirroring (via the
 109 $Girocco::Config:mirror setting) to avoid these potential problems.
 110
 111 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 112
 113 EOT
 114 fi
 115
 116
 117 chown_make() {
 118         if [ "$LOGNAME" = root -a -n "$SUDO_USER" -a "$SUDO_USER" != root ]; then
 119                 find "$@" -user root -print0 2>/dev/null | \
 120                 xargs $(: | xargs echo -r) -0 chown "$SUDO_USER:$(id -gn "$SUDO_USER")"
 121         elif [ "$LOGNAME" = root -a -z "$SUDO_USER" -o "$SUDO_USER" = root ]; then
 122                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 123         fi
 124 }
 125
 126 echo "*** Setting up basedir..."
 127 "$MAKE" --no-print-directory --quiet apache.conf
 128 chown_make apache.conf
 129 "$MAKE" --no-print-directory --quiet -C src
 130 chown_make src
 131 rm -fr "$cfg_basedir"
 132 mkdir -p "$cfg_basedir"
 133 cp -pR Girocco jobd taskd gitweb html jobs toolbox hooks apache.conf shlib.sh bin screen "$cfg_basedir"
 134 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/peek_packet \
 135         ezcert.git/CACreateCert cgi/authrequired.cgi "$cfg_basedir/bin"
 136 [ -n "$cfg_httpspushurl" ] || rm -f "$cfg_basedir"/html/rootcert.html "$cfg_basedir"/html/httpspush.html
 137 [ -n "$cfg_mob" ] || rm -f "$cfg_basedir"/html/mob.html
 138
 139 # Put the correct Config in place
 140 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$cfg_basedir/Girocco/Config.pm"
 141
 142
 143 echo "*** Preprocessing scripts..."
 144 perl -I. -M$GIROCCO_CONF -i -p \
 145         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 146         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 147         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 148         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 149         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 150         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 151         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 152         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 153         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 154         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 155         "$cfg_basedir"/jobs/*.sh "$cfg_basedir"/jobd/*.sh \
 156         "$cfg_basedir"/taskd/*.sh "$cfg_basedir"/gitweb/*.sh \
 157         "$cfg_basedir"/shlib.sh "$cfg_basedir"/hooks/* \
 158         "$cfg_basedir"/toolbox/*.sh "$cfg_basedir"/toolbox/*.pl \
 159         "$cfg_basedir"/toolbox/reports/*.sh \
 160         "$cfg_basedir"/bin/git-* \
 161         "$cfg_basedir"/bin/create-* "$cfg_basedir"/bin/update-* \
 162         "$cfg_basedir"/bin/authrequired.cgi "$cfg_basedir"/screen/*
 163
 164 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 165 get_girocco_config_var_list > "$cfg_basedir"/shlib_vars.sh
 166
 167 if [ -n "$cfg_mirror" ]; then
 168         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 169 fi
 170 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.sh, or add this"
 171 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 172 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.sh -q --all-once"
 173
 174
 175 echo "*** Setting up repository root..."
 176 mkdir -p "$cfg_reporoot" "$cfg_reporoot-recyclebin"
 177 if [ "$cfg_owning_group" ]; then
 178         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 179         chgrp "$cfg_owning_group" "$cfg_reporoot-recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot-recyclebin"
 180 fi
 181 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 182 chmod 02775 "$cfg_reporoot-recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot-recyclebin properly"
 183
 184
 185 if [ -n "$cfg_chrooted" ]; then
 186         echo "*** Setting up chroot jail for pushing..."
 187         if [ "$(id -u)" -eq 0 ]; then
 188                 ./jailsetup.sh
 189         else
 190                 echo "WARNING: Skipping jail setup, not root"
 191         fi
 192 fi
 193
 194
 195 echo "*** Setting up jail configuration (project database)..."
 196 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 197 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 198 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 199 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 200         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 201 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 202         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the files"
 203 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 204         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 205 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 206
 207 echo "*** Setting up gitweb from git.git..."
 208 if [ ! -f git.git/Makefile ]; then
 209         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 210         exit 1
 211 fi
 212 mkdir -p "$cfg_webroot" "$cfg_cgiroot"
 213 (cd git.git && "$MAKE" --no-print-directory --quiet NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" gitweb && \
 214         chown_make gitweb && \
 215         cp gitweb/gitweb.cgi "$cfg_cgiroot" && \
 216         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$cfg_webroot")
 217
 218
 219 echo "*** Setting up git-browser from git-browser.git..."
 220 if [ ! -f git-browser.git/git-browser.cgi ]; then
 221         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 222         exit 1
 223 fi
 224 mkdir -p "$cfg_webroot"/git-browser "$cfg_cgiroot"
 225 (cd git-browser.git && cp git-browser.cgi "$cfg_cgiroot" \
 226         && cp -r *.html *.js *.css js.lib JSON "$cfg_webroot"/git-browser)
 227 rm -f "$cfg_webroot"/git-browser/index.html
 228 ln -sf "$cfg_webroot/git-browser/JSON" "$cfg_cgiroot"
 229 cat >"$cfg_cgiroot"/git-browser.conf <<EOT
 230 gitbin: $cfg_git_bin
 231 warehouse: $cfg_reporoot
 232 EOT
 233 cat >"$cfg_webroot"/git-browser/GitConfig.js <<EOT
 234 cfg_gitweb_url="$cfg_gitweburl/"
 235 cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 236 EOT
 237
 238
 239 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 240 if [ ! -d bzr-fastimport.git/exporters/darcs/ ]; then
 241         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 242         exit 1
 243 fi
 244 mkdir -p "$cfg_basedir"/bin
 245 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$cfg_basedir"/bin
 246
 247
 248 echo "*** Setting up hg-fast-export from fast-export.git..."
 249 if [ ! -f fast-export.git/hg-fast-export.py -o ! -f fast-export.git/hg2git.py ]; then
 250         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 251         exit 1
 252 fi
 253 mkdir -p "$cfg_basedir"/bin
 254 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$cfg_basedir"/bin
 255
 256
 257 echo "*** Setting up our part of the website..."
 258 mkdir -p "$cfg_webroot" "$cfg_cgiroot"
 259 cp cgi/*.cgi gitweb/gitweb_config.perl "$cfg_cgiroot"
 260 rm -f "$cfg_cgiroot"/authrequired.cgi
 261 [ -z "$cfg_httpspushurl" ] || cp "$cfg_basedir"/bin/authrequired.cgi "$cfg_cgiroot"
 262 [ -n "$cfg_httpspushurl" ] || rm -f "$cfg_cgiroot"/usercert.cgi
 263 ln -fs "$cfg_basedir"/Girocco "$cfg_cgiroot"
 264 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 265 if [ -z "$cfg_httpspushurl" ]; then
 266         grep -v 'rootcert[.]html' gitweb/indextext.html > "$cfg_webroot/indextext.html"
 267 else
 268         cp gitweb/indextext.html "$cfg_webroot"
 269 fi
 270 mv "$cfg_basedir"/html/*.css "$cfg_basedir"/html/*.js "$cfg_webroot"
 271 cp mootools.js "$cfg_webroot"
 272 cp htaccess "$cfg_webroot/.htaccess"
 273 cp git-favicon.ico "$cfg_webroot/favicon.ico"
 274 cp robots.txt "$cfg_webroot"
 275 cat gitweb/gitweb.css >>"$cfg_webroot"/gitweb.css
 276
 277
 278 if [ -n "$cfg_httpspushurl" ]; then
 279         echo "*** Setting up SSL certificates..."
 280         bits=2048
 281         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 282             bits="$cfg_rsakeylength"
 283         fi
 284         mkdir -p "$cfg_certsdir"
 285         [ -d "$cfg_certsdir" ]
 286         wwwcertcn=
 287         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 288                 wwwcertcn="$( \
 289                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject | \
 290                         sed -e 's,[^/]*,,' \
 291                 )"
 292         fi
 293         needroot=
 294         [ -e "$cfg_certsdir/girocco_client_crt.pem" -a \
 295         -e "$cfg_certsdir/girocco_client_key.pem" -a \
 296         -e "$cfg_certsdir/girocco_www_key.pem" -a \
 297         -e "$cfg_certsdir/girocco_www_crt.pem" -a "$wwwcertcn" = "/CN=$cfg_httpsdnsname" -a \
 298         -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 299         if [ -n "$needroot" -a ! -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 300                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 301                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 302                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 303                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 304                 echo "Created new root key"
 305         fi
 306         if [ ! -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 307                 ezcert.git/CACreateCert --root --key "$cfg_certsdir/girocco_root_key.pem" \
 308                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 309                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 310                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 311                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 312                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 313                 echo "Created new root certificate"
 314         fi
 315         if [ ! -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 316                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 317                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 318                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 319                 echo "Created new www key"
 320         fi
 321         if [ ! -e "$cfg_certsdir/girocco_www_crt.pem" -o "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ]; then
 322                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 323                 ezcert.git/CACreateCert --server --key "$cfg_certsdir/girocco_root_key.pem" \
 324                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 325                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 326                 echo "Created www certificate"
 327         fi
 328         if [ ! -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 329                 cat "$cfg_certsdir/girocco_root_crt.pem" > "$cfg_certsdir/girocco_www_chain.pem"
 330                 echo "Created www certificate chain file"
 331         fi
 332         if [ ! -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 333                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 334                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 335                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 336                 echo "Created new client key"
 337         fi
 338         if [ ! -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 339                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 340                 ezcert.git/CACreateCert --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 341                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 342                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 343                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 344                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 345                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 346                 echo "Created client certificate"
 347         fi
 348         if [ ! -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 349                 cat "$cfg_certsdir/girocco_client_crt.pem" > "$cfg_certsdir/girocco_client_suffix.pem"
 350                 echo "Created client certificate suffix file"
 351         fi
 352         cat "$cfg_rootcert" > "$cfg_webroot/${cfg_nickname}_root_cert.pem"
 353         if [ -n "$cfg_mob" ]; then
 354                 if [ ! -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 355                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 356                         chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 357                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 358                         echo "Created new mob user key"
 359                 fi
 360                 if [ ! -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 361                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 362                         ezcert.git/CACreateCert --client --key "$cfg_clientkey" \
 363                                 --cert "$cfg_clientcert" \
 364                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 365                         echo "Created mob user client certificate"
 366                 fi
 367                 cat "$cfg_mobuserkey" > "$cfg_webroot/${cfg_nickname}_mob_key.pem"
 368                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" > "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 369         else
 370                 rm -f "$cfg_webroot/${cfg_nickname}_mob_key.pem" "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 371         fi
 372 else
 373         rm -f "$cfg_webroot/${cfg_nickname}_root_cert.pem"
 374         rm -f "$cfg_webroot/${cfg_nickname}_mob_key.pem" "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 375 fi
 376
 377
 378 echo "*** Finalizing permissions..."
 379 chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_basedir" "$cfg_webroot" "$cfg_cgiroot"
 380 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"