install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # $1 must exist and be a dir
  32 # $2 may exist but must be a dir
  33 # $3 must not exist
  34 # After call $2 will be renamed to $3 (if $2 existed)
  35 # And $1 will be renamed to $2
  36 quick_move() {
  37         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  38         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  39         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  40         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  41         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  42                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  43                 echo "fatal: quick_move: rename failed" >&2
  44                 exit 1
  45         }
  46         ! [ -d "$1" ] && [ -d "$2" ] || {
  47                 echo "fatal: quick_move: rename failed" >&2
  48                 exit 1
  49         }
  50 }
  51
  52 check_sh_builtin() (
  53         "unset" -f command
  54         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  55 ) 2>/dev/null
  56
  57 owngroup=
  58 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  59 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  60         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  61         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  62         exit 1
  63 fi
  64
  65
  66 # Check for extra required tools
  67 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  68         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  69         exit 1
  70 fi
  71
  72
  73 echo "*** Checking for compiled utilities..."
  74 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  75         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  76         echo "ERROR: perhaps you forgot to run make?" >&2
  77         exit 1
  78 fi
  79 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  80         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  81         echo "ERROR: perhaps you forgot to run make?" >&2
  82         exit 1
  83 fi
  84 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  85         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  86         echo "ERROR: perhaps you forgot to run make?" >&2
  87         exit 1
  88 fi
  89 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  90         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
  91         echo "ERROR: perhaps you forgot to run make?" >&2
  92         exit 1
  93 fi
  94 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
  95         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
  96         echo "ERROR: perhaps you forgot to run make?" >&2
  97         exit 1
  98 fi
  99 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 100         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 101         echo "ERROR: perhaps you forgot to run make?" >&2
 102         exit 1
 103 fi
 104 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 105         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 106         echo "ERROR: perhaps you forgot to run make?" >&2
 107         exit 1
 108 fi
 109 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 110         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 111         echo "ERROR: perhaps you forgot to run make?" >&2
 112         exit 1
 113 fi
 114 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 115         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 116         echo "ERROR: perhaps you forgot to run make?" >&2
 117         exit 1
 118 fi
 119
 120
 121 echo "*** Checking for ezcert..."
 122 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 123         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 124         exit 1
 125 fi
 126
 127
 128 echo "*** Checking for git..."
 129 case "$cfg_git_bin" in /*) :;; *)
 130         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 131         exit 1
 132 esac
 133 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 134         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 135         exit 1
 136 fi
 137 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 138         echo "ERROR: $cfg_git_bin version failed" >&2
 139         exit 1
 140 fi
 141 case "$git_version" in
 142         [Gg]"it version "*) :;;
 143         *)
 144                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 145                 exit 1
 146 esac
 147 echo "Found $cfg_git_bin $git_version"
 148 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 149 echo "*** Checking Git $git_vernum for compatibility..."
 150 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 151         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 152         exit 1
 153 fi
 154 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 155         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 156 fi
 157 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 158         cat <<'EOT'
 159
 160 ***
 161 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 162 ***
 163
 164 Some Girocco functionality will be gracefully disabled and other things will
 165 just not work at all such as race condition protection against simultaneous
 166 client pushes and server garbage collections.
 167
 168 EOT
 169 fi
 170 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 171         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 172 fi
 173 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 174         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 175 fi
 176 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ]; then
 177         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 178         echo 'WARNING: See http://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 179 fi
 180 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 181         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 182         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 183 fi
 184 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 189 fi
 190 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 192 fi
 193 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 194         cat <<'EOT'
 195
 196 ***
 197 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 198 ***
 199
 200 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 201 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 202 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 203
 204 In order to bypass this check you will have to modify install.sh in which case
 205 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 206
 207 EOT
 208         exit 1
 209 fi
 210 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 211         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 212 fi
 213 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 214         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 215 fi
 216 secmsg=
 217 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 218         secmsg='prior to 2.4.11'
 219 fi
 220 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 221         secmsg='2.5.x prior to 2.5.5'
 222 fi
 223 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 224         secmsg='2.6.x prior to 2.6.6'
 225 fi
 226 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 227         secmsg='2.7.x prior to 2.7.4'
 228 fi
 229 if [ -n "$secmsg" ]; then
 230         cat <<EOT
 231
 232 ***
 233 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 234 ***
 235
 236 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 237 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 238
 239 Besides the security fixes included in later versions, versions prior to
 240 2.2.0 may accidentally prune unreachable loose objects earlier than
 241 intended.  Since Git version 2.4.11 is the minimum version to include all
 242 security fixes to date, it should be considered the absolute minimum
 243 version of Git to use when running Girocco.
 244
 245 This is not enforced, but Git is easy to build from the git.git submodule
 246 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 247
 248 We will now pause for a moment so you can reflect on this warning.
 249
 250 EOT
 251         sleep 60
 252 fi
 253 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 254         cat <<'EOT'
 255
 256 ***
 257 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 258 ***
 259
 260 You appear to have enabled mirroring and the Git binary you have selected
 261 appears to contain an experimental patch that cannot be disabled.  This
 262 patch can generate invalid network DNS traffic and/or cause long delays
 263 when fetching using the "git:" protocol when no port number is specified.
 264 It may also end up retrieving repsitory contents from a host other than
 265 the one specified in the "git:" URL when the port is omitted.
 266
 267 You are advised to either build your own version of Git (the problem patch
 268 is not part of the official Git repository) or disable mirroring (via the
 269 $Girocco::Config:mirror setting) to avoid these potential problems.
 270
 271 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 272
 273 EOT
 274         sleep 5
 275 fi
 276
 277 test_nc_U() {
 278         [ -n "$1" ] || return 1
 279         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 280         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 281         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 282         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 283         >"$_tmpdir/output"
 284         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 285         _bgpid="$!"
 286         sleep 1
 287         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 288         sleep 1
 289         kill "$_bgpid" >/dev/null 2>&1 || :
 290         read -r _result <"$_tmpdir/output" || :
 291         _bad=
 292         ! [ -e "$_tmpdir/failed" ] || _bad=1
 293         rm -rf "$_tmpdir"
 294         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 295 } >/dev/null 2>&1
 296
 297 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 298 test_nc_U "$var_nc_openbsd_bin" || {
 299         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 300         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 301         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 302                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 303         fi
 304         exit 1
 305 }
 306
 307 echo "*** Verifying selected POSIX sh is sane..."
 308 shbin="$var_sh_bin"
 309 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 310         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 311         exit 1
 312 }
 313 [ "$(check_sh_builtin command)" = "command" ] || {
 314         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 315         exit 1
 316 }
 317 sh_not_builtin=
 318 sh_extra_chroot_installs=
 319 badsh=
 320 for sbi in cd pwd read umask unset unalias; do
 321         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 322                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 323                 badsh=1
 324         fi
 325 done
 326 [ -z "$badsh" ] || exit 1
 327 for sbi in '[' echo printf test; do
 328         if ! extra="$(check_sh_builtin "$sbi")"; then
 329                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 330                 badsh=1
 331                 continue
 332         fi
 333         if [ "$extra" != "$sbi" ]; then
 334                 case "$extra" in /*) :;; *)
 335                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 336                         badsh=1
 337                         continue
 338                 esac
 339                 withspc=
 340                 case "$extra" in *" "*) withspc=1; esac
 341                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 342                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 343                         badsh=1
 344                         continue
 345                 }
 346                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 347                 sh_not_builtin="$sh_not_builtin $sbi"
 348                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 349         fi
 350 done
 351 [ -z "$badsh" ] || exit 1
 352 [ -z "$sh_extra_chroot_installs" ] || {
 353         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 354         echo "WARNING: as a result it will run slower than necessary" >&2
 355         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 356         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 357         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 358         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 359         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 360 }
 361
 362 echo "*** Verifying xargs is sane..."
 363 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 364 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 365 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 366 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 367         echo 'ERROR: xargs is unusable' >&2
 368         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 369         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 370         echo 'ERROR: must be true, but neither is' >&2
 371         exit 1
 372 }
 373
 374 echo "*** Verifying selected perl is sane..."
 375 perlbin="$var_perl_bin"
 376 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 377         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 378         exit 1
 379 }
 380
 381 echo "*** Verifying selected gzip is sane..."
 382 gzipbin="$var_gzip_bin"
 383 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 384     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 385         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 386         exit 1
 387 }
 388
 389 echo "*** Verifying basedir, webroot and cgiroot paths..."
 390 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 391 case "$cfg_basedir" in /*) :;; *)
 392         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 393         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 394         exit 1
 395 esac
 396 case "$cfg_webroot" in /*) :;; *)
 397         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 398         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 399         exit 1
 400 esac
 401 case "$cfg_cgiroot" in /*) :;; *)
 402         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 403         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 404         exit 1
 405 esac
 406
 407 # return the input with trailing slashes stripped but return "/" for all "/"s
 408 striptrsl() {
 409         [ -n "$1" ] || return 0
 410         _s="${1##*[!/]}"
 411         [ "$_s" != "$1" ] || _s="${_s#?}"
 412         printf "%s\n" "${1%$_s}"
 413 }
 414
 415 # a combination of realpath + dirname where the realpath of the deepest existing
 416 # directory is returned with the rest of the non-existing components appended
 417 # and trailing slashes and multiple slashes are removed
 418 realdir() {
 419         _d="$(striptrsl "$1")"
 420         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 421                 echo "$_d"
 422                 return 0
 423         fi
 424         _c=""
 425         while ! [ -d "$_d" ]; do
 426                 _c="/$(basename "$_d")$_c"
 427                 _d="$(dirname "$_d")"
 428                 [ "$_d" != "/" ] || _c="${_c#/}"
 429         done
 430         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 431 }
 432
 433 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 434 # Wherever we are writing/copying/installing files we use these, but where we
 435 # are editing, adding config settings or printing advice we always stick to the
 436 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 437 # Only the file system directories that could be asynchronously accessed (by
 438 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 439 # The chroot is handled specially and does not need one of these.
 440 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 441 # case the prior contents of cgiroot and/or webroot are discarded.
 442 rbasedir="$(realdir "$cfg_basedir")"
 443 rwebroot="$(realdir "$cfg_webroot")"
 444 rcgiroot="$(realdir "$cfg_cgiroot")"
 445 case "$rbasedir" in "$rwebroot"/?*)
 446         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 447         exit 1
 448 esac
 449 case "$rbasedir" in "$rcgiroot"/?*)
 450         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 451         exit 1
 452 esac
 453 if [ "$rwebroot" = "$rcgiroot" ]; then
 454         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 455         exit 1
 456 fi
 457 case "$rcgiroot" in "$rwebroot"/?*)
 458         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 459         exit 1
 460 esac
 461 case "$rwebroot" in "$rcgiroot"/?*)
 462         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 463         exit 1
 464 esac
 465 basedir="$rbasedir-new"
 466 case "$rwebroot" in
 467         "$rbasedir"/?*)
 468                 webroot="$basedir${rwebroot#$rbasedir}"
 469                 webrootsub=1
 470                 ;;
 471         *)
 472                 webroot="$rwebroot-new"
 473                 webrootsub=
 474                 ;;
 475 esac
 476 case "$rcgiroot" in
 477         "$rbasedir"/?*)
 478                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 479                 cgirootsub=1
 480                 ;;
 481         *)
 482                 cgiroot="$rcgiroot-new"
 483                 cgirootsub=
 484                 ;;
 485 esac
 486
 487 echo "*** Setting up basedir..."
 488
 489 chown_make() {
 490         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 491                 find "$@" -user root -print0 2>/dev/null |
 492                 xargs -0 chown "$SUDO_USER:$(id -gn "$SUDO_USER")"
 493         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 494                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 495         fi
 496 }
 497
 498 "$MAKE" --no-print-directory --silent apache.conf
 499 chown_make apache.conf
 500 "$MAKE" --no-print-directory --silent -C src
 501 chown_make src
 502 rm -fr "$basedir"
 503 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 504 cp cgi/*.cgi "$basedir/cgi"
 505 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 506 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 507         src/rangecgi src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 508         cgi/snapshot.cgi "$basedir/bin"
 509 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 510 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 511 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 512
 513 # Put the correct Config in place
 514 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 515
 516 # Create symbolic links to selected binaries
 517 ln -s "$cfg_git_bin" "$basedir/bin/git"
 518 ln -s "$shbin" "$basedir/bin/sh"
 519 ln -s "$perlbin" "$basedir/bin/perl"
 520 ln -s "$gzipbin" "$basedir/bin/gzip"
 521
 522 echo "*** Preprocessing scripts..."
 523 SHBIN="$shbin" && export SHBIN
 524 PERLBIN="$perlbin" && export PERLBIN
 525 perl -I. -M$GIROCCO_CONF -i -p \
 526         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 527         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 528         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 529         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 530         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 531         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 532         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 533         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 534         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 535         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 536         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 537         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 538         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 539         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 540         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 541         -e 's/\@var_xargs_r\@/"'"$var_xargs_r"'"/g;' \
 542         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 543         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 544         -e 'close ARGV if eof;' \
 545         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 546         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 547         "$basedir"/shlib.sh "$basedir"/hooks/* \
 548         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 549         "$basedir"/toolbox/reports/*.sh \
 550         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 551         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 552         "$basedir"/bin/*.cgi "$basedir"/screen/*
 553 perl -i -p \
 554         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 555         -e 'close ARGV if eof;' \
 556         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 557         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 558 perl -i -p \
 559         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 560         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 561         -e 'close ARGV if eof;' \
 562         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 563 unset PERLBIN
 564 unset SHBIN
 565
 566 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 567 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 568
 569 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 570 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 571    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 572         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 573         exit 1
 574 fi
 575 mkdir -p "$basedir"/bin
 576 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 577
 578 echo "*** Setting up hg-fast-export from fast-export.git..."
 579 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 580         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 581         exit 1
 582 fi
 583 mkdir -p "$basedir"/bin
 584 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 585
 586 echo "*** Setting up markdown from markdown.git..."
 587 if ! [ -f markdown.git/Markdown.pl ]; then
 588         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 589         exit 1
 590 fi
 591 mkdir -p "$basedir"/bin
 592 (PERLBIN="$perlbin" && export PERLBIN &&
 593         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 594                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 595         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 596         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 597 test $? -eq 0
 598
 599 # Some permission sanity on basedir/bin just in case
 600 find "$basedir"/bin -type f -print0 | xargs -0 chmod go-w
 601 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 602
 603 if [ -n "$cfg_mirror" ]; then
 604         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 605 fi
 606 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.sh, or add this"
 607 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 608 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.sh -q --all-once"
 609
 610
 611 echo "*** Setting up repository root..."
 612 mkdir -p "$cfg_reporoot" "$cfg_reporoot/_recyclebin"
 613 if [ "$cfg_owning_group" ]; then
 614         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 615         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 616 fi
 617 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 618 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 619
 620
 621 if [ -n "$cfg_chrooted" ]; then
 622         echo "*** Setting up chroot jail for pushing..."
 623         if [ "$(id -u)" -eq 0 ]; then
 624                 # jailsetup may install things from $cfg_basedir/bin into the
 625                 # chroot so we do a mini-update of just that portion now
 626                 mkdir -p "$cfg_basedir"
 627                 rm -rf "$cfg_basedir/bin-new"
 628                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 629                 rm -rf "$cfg_basedir/bin-old"
 630                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 631                 rm -rf "$cfg_basedir/bin-old"
 632                 if [ -n "$sh_extra_chroot_installs" ]; then
 633                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 634                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 635                 fi
 636                 ./jailsetup.sh
 637                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 638         else
 639                 echo "WARNING: Skipping jail setup, not root"
 640         fi
 641 fi
 642
 643
 644 echo "*** Setting up jail configuration (project database)..."
 645 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 646 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 647 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 648 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 649         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 650 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 651         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 652 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 653         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 654 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 655
 656
 657 echo "*** Setting up gitweb from git.git..."
 658 if ! [ -f git.git/Makefile ]; then
 659         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 660         exit 1
 661 fi
 662
 663 # We do not wholesale replace either webroot or cgiroot unless they are under
 664 # basedir so if they exist and are not we make a copy to start working on them.
 665 # We make a copy using -p which can result in some warnings so we suppress
 666 # error output as it's of no consequence in this case.
 667 rm -rf "$webroot" "$cgiroot"
 668 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 669 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 670 mkdir -p "$webroot" "$cgiroot"
 671
 672 (
 673         cd git.git &&
 674         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 675                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 676         chown_make gitweb &&
 677         PERLBIN="$perlbin" && export PERLBIN &&
 678         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 679                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 680         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 681         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 682         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 683         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 684 )
 685 test $? -eq 0
 686
 687
 688 echo "*** Setting up git-browser from git-browser.git..."
 689 if ! [ -f git-browser.git/git-browser.cgi ]; then
 690         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 691         exit 1
 692 fi
 693 mkdir -p "$webroot"/git-browser "$cgiroot"
 694 (
 695         cd git-browser.git &&
 696         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 697         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 698                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 699                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 700         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 701         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 702         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 703         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 704         cp -r JSON "$cgiroot"
 705 )
 706 test $? -eq 0
 707 rm -f "$webroot"/git-browser/index.html
 708 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 709         gitbin: $cfg_git_bin
 710         warehouse: $cfg_reporoot
 711         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 712 EOT
 713 chown_make "$basedir/gitweb"/git-browser.conf.$$
 714 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 715 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 716         cfg_gitweb_url="$cfg_gitweburl/"
 717         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 718 EOT
 719 chown_make "$webroot"/git-browser/GitConfig.js.$$
 720 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 721
 722
 723 echo "*** Setting up our part of the website..."
 724 mkdir -p "$webroot" "$cgiroot"
 725 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 726 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 727 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 728 cp "$basedir/cgi"/*.cgi "$cgiroot"
 729 rm -rf "$basedir/cgi"
 730 ln -fs "$cfg_basedir"/Girocco "$cgiroot"
 731 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 732 if [ -z "$cfg_httpspushurl" ]; then
 733         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 734 else
 735         cp gitweb/indextext.html "$basedir/gitweb"
 736 fi
 737 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 738 cp mootools.js "$webroot"
 739 cp htaccess "$webroot/.htaccess"
 740 cp cgi/htaccess "$cgiroot/.htaccess"
 741 cp git-favicon.ico "$webroot/favicon.ico"
 742 cp robots.txt "$webroot"
 743 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 744
 745
 746 if [ -n "$cfg_httpspushurl" ]; then
 747         echo "*** Setting up SSL certificates..."
 748         bits=2048
 749         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 750             bits="$cfg_rsakeylength"
 751         fi
 752         mkdir -p "$cfg_certsdir"
 753         [ -d "$cfg_certsdir" ]
 754         wwwcertcn=
 755         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 756                 wwwcertcn="$(
 757                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 758                         sed -e 's,[^/]*,,'
 759                 )"
 760         fi
 761         wwwcertdns=
 762         if [ -n "$cfg_wwwcertaltnames" ]; then
 763                 for dnsopt in $cfg_wwwcertaltnames; do
 764                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 765                 done
 766         fi
 767         wwwcertdnsfile=
 768         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 769                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 770         fi
 771         needroot=
 772         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 773         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 774         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 775         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 776         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 777         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 778                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 779                 umask 0077
 780                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 781                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 782                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 783                 umask 0022
 784                 echo "Created new root key"
 785         fi
 786         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 787                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 788                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 789                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 790                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 791                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 792                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 793                 echo "Created new root certificate"
 794         fi
 795         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 796                 umask 0077
 797                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 798                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 799                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 800                 umask 0022
 801                 echo "Created new www key"
 802         fi
 803         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 804                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 805                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 806                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 807                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 808                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 809                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 810                 echo "Created www certificate"
 811         fi
 812         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 813                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 814                 echo "Created www certificate chain file"
 815         fi
 816         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 817                 umask 0037
 818                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 819                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 820                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 821                 umask 0022
 822                 echo "Created new client key"
 823         fi
 824         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 825                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 826                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 827                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 828                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 829                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 830                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 831                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 832                 echo "Created client certificate"
 833         fi
 834         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 835                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 836                 echo "Created client certificate suffix file"
 837         fi
 838         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 839         if [ -n "$cfg_mob" ]; then
 840                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 841                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 842                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 843                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 844                         echo "Created new mob user key"
 845                 fi
 846                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 847                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 848                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 849                                 --cert "$cfg_clientcert" \
 850                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 851                         echo "Created mob user client certificate"
 852                 fi
 853                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 854                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 855         else
 856                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 857         fi
 858 else
 859         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 860         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 861 fi
 862
 863
 864 echo "*** Finalizing permissions and moving into place..."
 865 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 866 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 867
 868 # This should always be the very last thing install.sh does
 869 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 870 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 871 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 872 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 873 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 874 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 875         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 876         touch "$cfg_chroot/etc/taskd.restart"
 877         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 878 }