install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 if [ -z "$MAKE" ]; then
   8         echo "ERROR: MAKE not set" >&2
   9         echo "Please run install.sh using 'make install'" >&2
  10         echo "or set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if [ ! -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19 toolbox/check-perl-modules.pl
  20
  21 # What Config should we use?
  22 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  23 echo "*** Initializing using $GIROCCO_CONF..."
  24
  25 # First run Girocco::Config consistency checks
  26 perl -I. -M$GIROCCO_CONF -e ''
  27
  28 . ./shlib.sh
  29
  30 owngroup=""
  31 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  32 if [ -n "$cfg_httpspushurl" -a -z "$cfg_certsdir" ]; then
  33         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  34         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  35         exit 1
  36 fi
  37
  38
  39 echo "*** Checking for compiled utilities..."
  40 if [ ! -x src/can_user_push ]; then
  41         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  42         echo "ERROR: perhaps you forgot to run make?" >&2
  43         exit 1
  44 fi
  45 if [ ! -x src/getent ]; then
  46         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  47         echo "ERROR: perhaps you forgot to run make?" >&2
  48         exit 1
  49 fi
  50
  51
  52 echo "*** Checking for ezcert..."
  53 if [ ! -f ezcert.git/CACreateCert ]; then
  54         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
  55         exit 1
  56 fi
  57
  58
  59 echo "*** Checking for git..."
  60 if [ ! -x "$cfg_git_bin" ]; then
  61         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
  62         exit 1
  63 fi
  64 if ! git_version="$("$cfg_git_bin" --version)"; then
  65         echo "ERROR: $cfg_git_bin --version failed" >&2
  66         exit 1
  67 fi
  68 case "$git_version" in
  69         "git version "*) :;;
  70         *)
  71                 echo "ERROR: '$cfg_git_bin --version' output does not start with 'git version '" >&2
  72                 exit 1
  73 esac
  74
  75
  76 echo "*** Setting up basedir..."
  77 rm -fr "$cfg_basedir"
  78 mkdir -p "$cfg_basedir"
  79 cp -pR Girocco jobd taskd gitweb html jobs toolbox hooks apache.conf shlib.sh bin screen "$cfg_basedir"
  80 cp -p src/can_user_push ezcert.git/CACreateCert "$cfg_basedir/bin"
  81 [ -n "$cfg_httpspushurl" ] || rm -f "$cfg_basedir"/html/rootcert.html "$cfg_basedir"/html/httpspush.html
  82 [ -n "$cfg_mob" ] || rm -f "$cfg_basedir"/html/mob.html
  83
  84 # Put the correct Config in place
  85 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$cfg_basedir/Girocco/Config.pm"
  86
  87
  88 echo "*** Preprocessing scripts..."
  89 perl -I. -M$GIROCCO_CONF -i -p \
  90         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
  91         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
  92         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
  93         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' "$cfg_basedir"/jobs/*.sh "$cfg_basedir"/jobd/*.sh \
  94         "$cfg_basedir"/taskd/*.sh "$cfg_basedir"/gitweb/*.sh "$cfg_basedir"/shlib.sh "$cfg_basedir"/hooks/* \
  95         "$cfg_basedir"/toolbox/* "$cfg_basedir"/bin/git-* "$cfg_basedir"/bin/create-* "$cfg_basedir"/screen/*
  96
  97
  98 if [ -n "$cfg_mirror" ]; then
  99         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 100 fi
 101 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.sh, or add this"
 102 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 103 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.sh -q --all-once"
 104
 105
 106 echo "*** Setting up repository root..."
 107 mkdir -p "$cfg_reporoot" "$cfg_reporoot-recyclebin"
 108 if [ "$cfg_owning_group" ]; then
 109         chown :"$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 110         chown :"$cfg_owning_group" "$cfg_reporoot-recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot-recyclebin"
 111 fi
 112 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 113 chmod 02775 "$cfg_reporoot-recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot-recyclebin properly"
 114
 115
 116 if [ -n "$cfg_chrooted" ]; then
 117         echo "*** Setting up chroot jail for pushing..."
 118         if [ "$(id -u)" -eq 0 ]; then
 119                 ./jailsetup.sh
 120         else
 121                 echo "WARNING: Skipping jail setup, not root"
 122         fi
 123 fi
 124
 125
 126 echo "*** Setting up jail configuration (project database)..."
 127 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 128 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 129 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 130 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 131         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 132 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 133         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the files"
 134 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 135         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 136 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 137
 138
 139 echo "*** Setting up gitweb from git.git..."
 140 if [ ! -f git.git/Makefile ]; then
 141         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 142         exit 1
 143 fi
 144 mkdir -p "$cfg_webroot" "$cfg_cgiroot"
 145 (cd git.git && "$MAKE" --quiet gitweb && cp gitweb/gitweb.cgi "$cfg_cgiroot" \
 146         && cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$cfg_webroot")
 147
 148
 149 echo "*** Setting up git-browser from git-browser.git..."
 150 if [ ! -f git-browser.git/git-browser.cgi ]; then
 151         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 152         exit 1
 153 fi
 154 mkdir -p "$cfg_webroot"/git-browser "$cfg_cgiroot"
 155 (cd git-browser.git && cp git-browser.cgi "$cfg_cgiroot" \
 156         && cp -r *.html *.js *.css js.lib/ JSON/ "$cfg_webroot"/git-browser)
 157 ln -sf "$cfg_webroot/git-browser/JSON" "$cfg_cgiroot"
 158 cat >"$cfg_cgiroot"/git-browser.conf <<EOT
 159 gitbin: $cfg_git_bin
 160 warehouse: $cfg_reporoot
 161 EOT
 162 cat >"$cfg_webroot"/git-browser/GitConfig.js <<EOT
 163 cfg_gitweb_url="$cfg_gitweburl/"
 164 cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 165 EOT
 166
 167
 168 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 169 if [ ! -d bzr-fastimport.git/exporters/darcs/ ]; then
 170         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 171         exit 1
 172 fi
 173 mkdir -p "$cfg_basedir"/bin
 174 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$cfg_basedir"/bin
 175
 176
 177 echo "*** Setting up our part of the website..."
 178 mkdir -p "$cfg_webroot" "$cfg_cgiroot"
 179 cp cgi/*.cgi gitweb/gitweb_config.perl "$cfg_cgiroot"
 180 [ -n "$cfg_httpspushurl" ] || rm -f "$cfg_cgiroot/usercert.cgi"
 181 ln -fs "$cfg_basedir"/Girocco "$cfg_cgiroot"
 182 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 183 if [ -z "$cfg_httpspushurl" ]; then
 184         grep -v 'rootcert[.]html' gitweb/indextext.html > "$cfg_webroot/indextext.html"
 185 else
 186         cp gitweb/indextext.html "$cfg_webroot"
 187 fi
 188 mv "$cfg_basedir"/html/*.css "$cfg_basedir"/html/*.js "$cfg_webroot"
 189 cp mootools.js "$cfg_webroot"
 190 cp htaccess "$cfg_webroot/.htaccess"
 191 cp git-favicon.ico "$cfg_webroot/favicon.ico"
 192 cp robots.txt "$cfg_webroot"
 193 cat gitweb/gitweb.css >>"$cfg_webroot"/gitweb.css
 194
 195
 196 if [ -n "$cfg_httpspushurl" ]; then
 197         echo "*** Setting up SSL certificates..."
 198         bits=2048
 199         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 200             bits="$cfg_rsakeylength"
 201         fi
 202         mkdir -p "$cfg_certsdir"
 203         [ -d "$cfg_certsdir" ]
 204         wwwcertcn=
 205         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 206                 wwwcertcn="$( \
 207                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject | \
 208                         sed -e 's,[^/]*,,' \
 209                 )"
 210         fi
 211         needroot=
 212         [ -e "$cfg_certsdir/girocco_client_crt.pem" -a \
 213         -e "$cfg_certsdir/girocco_client_key.pem" -a \
 214         -e "$cfg_certsdir/girocco_www_key.pem" -a \
 215         -e "$cfg_certsdir/girocco_www_crt.pem" -a "$wwwcertcn" = "/CN=$cfg_httpsdnsname" -a \
 216         -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 217         if [ -n "$needroot" -a ! -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 218                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 219                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 220                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 221                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 222                 echo "Created new root key"
 223         fi
 224         if [ ! -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 225                 ezcert.git/CACreateCert --root --key "$cfg_certsdir/girocco_root_key.pem" \
 226                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 227                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 228                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 229                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 230                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 231                 echo "Created new root certificate"
 232         fi
 233         if [ ! -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 234                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 235                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 236                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 237                 echo "Created new www key"
 238         fi
 239         if [ ! -e "$cfg_certsdir/girocco_www_crt.pem" -o "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ]; then
 240                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 241                 ezcert.git/CACreateCert --server --key "$cfg_certsdir/girocco_root_key.pem" \
 242                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 243                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 244                 echo "Created www certificate"
 245         fi
 246         if [ ! -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 247                 cat "$cfg_certsdir/girocco_root_crt.pem" > "$cfg_certsdir/girocco_www_chain.pem"
 248                 echo "Created www certificate chain file"
 249         fi
 250         if [ ! -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 251                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 252                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 253                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 254                 echo "Created new client key"
 255         fi
 256         if [ ! -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 257                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 258                 ezcert.git/CACreateCert --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 259                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 260                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 261                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 262                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 263                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 264                 echo "Created client certificate"
 265         fi
 266         if [ ! -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 267                 cat "$cfg_certsdir/girocco_client_crt.pem" > "$cfg_certsdir/girocco_client_suffix.pem"
 268                 echo "Created client certificate suffix file"
 269         fi
 270         cat "$cfg_rootcert" > "$cfg_webroot/${cfg_nickname}_root_cert.pem"
 271         if [ -n "$cfg_mob" ]; then
 272                 if [ ! -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 273                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 274                         chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 275                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 276                         echo "Created new mob user key"
 277                 fi
 278                 if [ ! -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 279                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 280                         ezcert.git/CACreateCert --client --key "$cfg_clientkey" \
 281                                 --cert "$cfg_clientcert" \
 282                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 283                         echo "Created mob user client certificate"
 284                 fi
 285                 cat "$cfg_mobuserkey" > "$cfg_webroot/${cfg_nickname}_mob_key.pem"
 286                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" > "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 287         else
 288                 rm -f "$cfg_webroot/${cfg_nickname}_mob_key.pem" "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 289         fi
 290 else
 291         rm -f "$cfg_webroot/${cfg_nickname}_root_cert.pem"
 292         rm -f "$cfg_webroot/${cfg_nickname}_mob_key.pem" "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 293 fi
 294
 295
 296 echo "*** Finalizing permissions..."
 297 chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_basedir" "$cfg_webroot" "$cfg_cgiroot"
 298 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"