install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_chroot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_chroot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::chroot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 # $1 must exist and be a dir
  41 # $2 may exist but must be a dir
  42 # $3 must not exist
  43 # After call $2 will be renamed to $3 (if $2 existed)
  44 # And $1 will be renamed to $2
  45 quick_move() {
  46         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  47         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  48         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  49         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  50         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  51                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  52                 echo "fatal: quick_move: rename failed" >&2
  53                 exit 1
  54         }
  55         ! [ -d "$1" ] && [ -d "$2" ] || {
  56                 echo "fatal: quick_move: rename failed" >&2
  57                 exit 1
  58         }
  59 }
  60
  61 check_sh_builtin() (
  62         "unset" -f command
  63         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  64 ) 2>/dev/null
  65
  66 owngroup=
  67 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  68 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  69         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  70         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  71         exit 1
  72 fi
  73
  74
  75 # Check for extra required tools
  76 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  77         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  78         exit 1
  79 fi
  80
  81
  82 echo "*** Checking for compiled utilities..."
  83 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  84         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  85         echo "ERROR: perhaps you forgot to run make?" >&2
  86         exit 1
  87 fi
  88 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  89         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  90         echo "ERROR: perhaps you forgot to run make?" >&2
  91         exit 1
  92 fi
  93 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  94         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  95         echo "ERROR: perhaps you forgot to run make?" >&2
  96         exit 1
  97 fi
  98 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  99         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 100         echo "ERROR: perhaps you forgot to run make?" >&2
 101         exit 1
 102 fi
 103 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 104         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 105         echo "ERROR: perhaps you forgot to run make?" >&2
 106         exit 1
 107 fi
 108 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 109         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 110         echo "ERROR: perhaps you forgot to run make?" >&2
 111         exit 1
 112 fi
 113 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 114         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 115         echo "ERROR: perhaps you forgot to run make?" >&2
 116         exit 1
 117 fi
 118 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 119         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 120         echo "ERROR: perhaps you forgot to run make?" >&2
 121         exit 1
 122 fi
 123 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 124         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 125         echo "ERROR: perhaps you forgot to run make?" >&2
 126         exit 1
 127 fi
 128 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 129         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 130         echo "ERROR: perhaps you forgot to run make?" >&2
 131         exit 1
 132 fi
 133
 134
 135 echo "*** Checking for ezcert..."
 136 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 137         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 138         exit 1
 139 fi
 140
 141
 142 echo "*** Checking for git..."
 143 case "$cfg_git_bin" in /*) :;; *)
 144         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 145         exit 1
 146 esac
 147 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 148         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 149         exit 1
 150 fi
 151 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 152         echo "ERROR: $cfg_git_bin version failed" >&2
 153         exit 1
 154 fi
 155 case "$git_version" in
 156         [Gg]"it version "*) :;;
 157         *)
 158                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 159                 exit 1
 160 esac
 161 echo "Found $cfg_git_bin $git_version"
 162 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 163 echo "*** Checking Git $git_vernum for compatibility..."
 164 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 165         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 166         exit 1
 167 fi
 168 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 169         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 170 fi
 171 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 172         cat <<'EOT'
 173
 174 ***
 175 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 176 ***
 177
 178 Some Girocco functionality will be gracefully disabled and other things will
 179 just not work at all such as race condition protection against simultaneous
 180 client pushes and server garbage collections.
 181
 182 EOT
 183 fi
 184 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 189 fi
 190 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 192         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 193 fi
 194 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 195         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 196         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 197 fi
 198 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 199         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 200 fi
 201 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 202         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 203 fi
 204 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 205         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 206 fi
 207 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 208         cat <<'EOT'
 209
 210 ***
 211 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 212 ***
 213
 214 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 215 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 216 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 217
 218 In order to bypass this check you will have to modify install.sh in which case
 219 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 220
 221 EOT
 222         exit 1
 223 fi
 224 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 225         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 226 fi
 227 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 228         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 229 fi
 230 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 231         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 232         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 233         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 234         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 235         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 236 fi
 237 secmsg=
 238 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 239         secmsg='prior to 2.4.11'
 240 fi
 241 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 242         secmsg='2.5.x prior to 2.5.5'
 243 fi
 244 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 245         secmsg='2.6.x prior to 2.6.6'
 246 fi
 247 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 248         secmsg='2.7.x prior to 2.7.4'
 249 fi
 250 if [ -n "$secmsg" ]; then
 251         cat <<EOT
 252
 253 ***
 254 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 255 ***
 256
 257 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 258 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 259
 260 Besides the security fixes included in later versions, versions prior to
 261 2.2.0 may accidentally prune unreachable loose objects earlier than
 262 intended.  Since Git version 2.4.11 is the minimum version to include all
 263 security fixes to date, it should be considered the absolute minimum
 264 version of Git to use when running Girocco.
 265
 266 This is not enforced, but Git is easy to build from the git.git submodule
 267 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 268
 269 We will now pause for a moment so you can reflect on this warning.
 270
 271 EOT
 272         sleep 60
 273 fi
 274 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 275         cat <<'EOT'
 276
 277 ***
 278 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 279 ***
 280
 281 You appear to have enabled mirroring and the Git binary you have selected
 282 appears to contain an experimental patch that cannot be disabled.  This
 283 patch can generate invalid network DNS traffic and/or cause long delays
 284 when fetching using the "git:" protocol when no port number is specified.
 285 It may also end up retrieving repsitory contents from a host other than
 286 the one specified in the "git:" URL when the port is omitted.
 287
 288 You are advised to either build your own version of Git (the problem patch
 289 is not part of the official Git repository) or disable mirroring (via the
 290 $Girocco::Config:mirror setting) to avoid these potential problems.
 291
 292 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 293
 294 EOT
 295         sleep 5
 296 fi
 297
 298 test_nc_U() {
 299         [ -n "$1" ] || return 1
 300         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 301         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 302         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 303         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 304         >"$_tmpdir/output"
 305         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 306         _bgpid="$!"
 307         sleep 1
 308         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 309         sleep 1
 310         kill "$_bgpid" >/dev/null 2>&1 || :
 311         read -r _result <"$_tmpdir/output" || :
 312         _bad=
 313         ! [ -e "$_tmpdir/failed" ] || _bad=1
 314         rm -rf "$_tmpdir"
 315         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 316 } >/dev/null 2>&1
 317
 318 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 319 test_nc_U "$var_nc_openbsd_bin" || {
 320         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 321         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 322         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 323                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 324         fi
 325         exit 1
 326 }
 327
 328 echo "*** Verifying selected POSIX sh is sane..."
 329 shbin="$var_sh_bin"
 330 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 331         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 332         exit 1
 333 }
 334 [ "$(check_sh_builtin command)" = "command" ] || {
 335         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 336         exit 1
 337 }
 338 sh_not_builtin=
 339 sh_extra_chroot_installs=
 340 badsh=
 341 for sbi in cd pwd read umask unset unalias; do
 342         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 343                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 344                 badsh=1
 345         fi
 346 done
 347 [ -z "$badsh" ] || exit 1
 348 for sbi in '[' echo printf test; do
 349         if ! extra="$(check_sh_builtin "$sbi")"; then
 350                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 351                 badsh=1
 352                 continue
 353         fi
 354         if [ "$extra" != "$sbi" ]; then
 355                 case "$extra" in /*) :;; *)
 356                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 357                         badsh=1
 358                         continue
 359                 esac
 360                 withspc=
 361                 case "$extra" in *" "*) withspc=1; esac
 362                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 363                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 364                         badsh=1
 365                         continue
 366                 }
 367                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 368                 sh_not_builtin="$sh_not_builtin $sbi"
 369                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 370         fi
 371 done
 372 [ -z "$badsh" ] || exit 1
 373 [ -z "$sh_extra_chroot_installs" ] || {
 374         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 375         echo "WARNING: as a result it will run slower than necessary" >&2
 376         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 377         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 378         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 379         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 380         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 381 }
 382
 383 echo "*** Verifying xargs is sane..."
 384 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 385 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 386 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 387 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 388         echo 'ERROR: xargs is unusable' >&2
 389         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 390         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 391         echo 'ERROR: must be true, but neither is' >&2
 392         exit 1
 393 }
 394
 395 echo "*** Verifying selected perl is sane..."
 396 perlbin="$var_perl_bin"
 397 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 398         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 399         exit 1
 400 }
 401
 402 echo "*** Verifying selected gzip is sane..."
 403 gzipbin="$var_gzip_bin"
 404 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 405     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 406         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 407         exit 1
 408 }
 409
 410 echo "*** Verifying basedir, webroot and cgiroot paths..."
 411 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 412 case "$cfg_basedir" in /*) :;; *)
 413         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 414         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 415         exit 1
 416 esac
 417 case "$cfg_webroot" in /*) :;; *)
 418         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 419         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 420         exit 1
 421 esac
 422 case "$cfg_cgiroot" in /*) :;; *)
 423         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 424         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 425         exit 1
 426 esac
 427
 428 # return the input with trailing slashes stripped but return "/" for all "/"s
 429 striptrsl() {
 430         [ -n "$1" ] || return 0
 431         _s="${1##*[!/]}"
 432         [ "$_s" != "$1" ] || _s="${_s#?}"
 433         printf "%s\n" "${1%$_s}"
 434 }
 435
 436 # a combination of realpath + dirname where the realpath of the deepest existing
 437 # directory is returned with the rest of the non-existing components appended
 438 # and trailing slashes and multiple slashes are removed
 439 realdir() {
 440         _d="$(striptrsl "$1")"
 441         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 442                 echo "$_d"
 443                 return 0
 444         fi
 445         _c=""
 446         while ! [ -d "$_d" ]; do
 447                 _c="/$(basename "$_d")$_c"
 448                 _d="$(dirname "$_d")"
 449                 [ "$_d" != "/" ] || _c="${_c#/}"
 450         done
 451         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 452 }
 453
 454 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 455 # Wherever we are writing/copying/installing files we use these, but where we
 456 # are editing, adding config settings or printing advice we always stick to the
 457 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 458 # Only the file system directories that could be asynchronously accessed (by
 459 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 460 # The chroot is handled specially and does not need one of these.
 461 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 462 # case the prior contents of cgiroot and/or webroot are discarded.
 463 rbasedir="$(realdir "$cfg_basedir")"
 464 rwebroot="$(realdir "$cfg_webroot")"
 465 rcgiroot="$(realdir "$cfg_cgiroot")"
 466 case "$rbasedir" in "$rwebroot"/?*)
 467         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 468         exit 1
 469 esac
 470 case "$rbasedir" in "$rcgiroot"/?*)
 471         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 472         exit 1
 473 esac
 474 if [ "$rwebroot" = "$rcgiroot" ]; then
 475         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 476         exit 1
 477 fi
 478 case "$rcgiroot" in "$rwebroot"/?*)
 479         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 480         exit 1
 481 esac
 482 case "$rwebroot" in "$rcgiroot"/?*)
 483         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 484         exit 1
 485 esac
 486 basedir="$rbasedir-new"
 487 case "$rwebroot" in
 488         "$rbasedir"/?*)
 489                 webroot="$basedir${rwebroot#$rbasedir}"
 490                 webrootsub=1
 491                 ;;
 492         *)
 493                 webroot="$rwebroot-new"
 494                 webrootsub=
 495                 ;;
 496 esac
 497 case "$rcgiroot" in
 498         "$rbasedir"/?*)
 499                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 500                 cgirootsub=1
 501                 ;;
 502         *)
 503                 cgiroot="$rcgiroot-new"
 504                 cgirootsub=
 505                 ;;
 506 esac
 507
 508 echo "*** Setting up basedir..."
 509
 510 chown_make() {
 511         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 512                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 513         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 514                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 515         fi
 516 }
 517
 518 "$MAKE" --no-print-directory --silent apache.conf
 519 chown_make apache.conf
 520 "$MAKE" --no-print-directory --silent -C src
 521 chown_make src
 522 rm -fr "$basedir"
 523 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 524 cp cgi/*.cgi "$basedir/cgi"
 525 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 526 find -H "$basedir" -type l -exec rm -f '{}' +
 527 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 528         src/rangecgi src/readlink src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 529         cgi/snapshot.cgi "$basedir/bin"
 530 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 531 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 532 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 533
 534 # Put the correct Config in place
 535 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 536
 537 # Create symbolic links to selected binaries
 538 ln -s "$cfg_git_bin" "$basedir/bin/git"
 539 ln -s "$shbin" "$basedir/bin/sh"
 540 ln -s "$perlbin" "$basedir/bin/perl"
 541 ln -s "$gzipbin" "$basedir/bin/gzip"
 542
 543 echo "*** Preprocessing scripts..."
 544 SHBIN="$shbin" && export SHBIN
 545 PERLBIN="$perlbin" && export PERLBIN
 546 perl -I. -M$GIROCCO_CONF -i -p \
 547         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 548         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 549         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 550         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 551         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 552         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 553         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 554         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 555         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 556         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 557         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 558         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 559         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 560         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 561         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 562         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 563         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 564         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 565         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 566         -e 'close ARGV if eof;' \
 567         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 568         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 569         "$basedir"/shlib.sh "$basedir"/hooks/* \
 570         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 571         "$basedir"/toolbox/reports/*.sh \
 572         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 573         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 574         "$basedir"/bin/*.cgi "$basedir"/screen/*
 575 perl -I. -M$GIROCCO_CONF -i -p \
 576         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 577         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 578         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 579 perl -i -p \
 580         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 581         -e 'close ARGV if eof;' \
 582         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 583         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 584 perl -i -p \
 585         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 586         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 587         -e 'close ARGV if eof;' \
 588         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 589 unset PERLBIN
 590 unset SHBIN
 591
 592 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 593 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 594
 595 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 596 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 597    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 598         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 599         exit 1
 600 fi
 601 mkdir -p "$basedir"/bin
 602 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 603
 604 echo "*** Setting up hg-fast-export from fast-export.git..."
 605 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 606         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 607         exit 1
 608 fi
 609 mkdir -p "$basedir"/bin
 610 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 611
 612 echo "*** Setting up markdown from markdown.git..."
 613 if ! [ -f markdown.git/Markdown.pl ]; then
 614         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 615         exit 1
 616 fi
 617 mkdir -p "$basedir"/bin
 618 (PERLBIN="$perlbin" && export PERLBIN &&
 619         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 620                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 621         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 622         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 623 test $? -eq 0
 624
 625 # Some permission sanity on basedir/bin just in case
 626 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 627 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 628
 629 if [ -n "$cfg_mirror" ]; then
 630         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 631 fi
 632 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 633 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 634 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 635
 636
 637 echo "*** Setting up repository root..."
 638 [ -d "$cfg_reporoot" ] || {
 639         mkdir -p "$cfg_reporoot"
 640         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 641         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 642 }
 643 [ -z "$cfg_owning_group" ] ||
 644         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 645 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 646 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks"
 647 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" ||
 648         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 649 if [ "$cfg_owning_group" ]; then
 650         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 651         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 652 fi
 653 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 654 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 655
 656
 657 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 658         echo "*** Setting up chroot jail for pushing..."
 659         if [ "$(id -u)" -eq 0 ]; then
 660                 # jailsetup may install things from $cfg_basedir/bin into the
 661                 # chroot so we do a mini-update of just that portion now
 662                 mkdir -p "$cfg_basedir"
 663                 rm -rf "$cfg_basedir/bin-new"
 664                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 665                 rm -rf "$cfg_basedir/bin-old"
 666                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 667                 rm -rf "$cfg_basedir/bin-old"
 668                 if [ -n "$sh_extra_chroot_installs" ]; then
 669                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 670                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 671                 fi
 672                 ./jailsetup.sh
 673                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 674         else
 675                 echo "WARNING: Skipping jail setup, not root"
 676         fi
 677 fi
 678
 679
 680 echo "*** Setting up jail configuration (project database)..."
 681 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 682 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 683 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 684 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 685         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 686 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 687         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 688 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 689         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 690 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 691
 692
 693 echo "*** Setting up global hook scripts..."
 694 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 695 # Otherwise an incoming push might slip in and fail to run the hook script!
 696 # The underlying rename(2) function call provides this and mv will use it.
 697 # First add hook scripts
 698 hooks="pre-auto-gc pre-receive post-receive update"
 699 for hook in $hooks; do
 700         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 701         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 702                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 703         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 704         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 705 done
 706 # Then remove any hook scripts that do not belong
 707 for hook in "$cfg_reporoot/_global/hooks"/*; do
 708         hook="${hook##*/}"
 709         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 710         case " $hooks " in *" $hook "*);;*)
 711                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 712                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 713         esac
 714 done
 715
 716
 717 echo "*** Setting up gitweb from git.git..."
 718 if ! [ -f git.git/Makefile ]; then
 719         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 720         exit 1
 721 fi
 722
 723 # We do not wholesale replace either webroot or cgiroot unless they are under
 724 # basedir so if they exist and are not we make a copy to start working on them.
 725 # We make a copy using -p which can result in some warnings so we suppress
 726 # error output as it's of no consequence in this case.
 727 rm -rf "$webroot" "$cgiroot"
 728 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 729 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 730 mkdir -p "$webroot" "$cgiroot"
 731
 732 (
 733         cd git.git &&
 734         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 735                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 736         chown_make gitweb &&
 737         PERLBIN="$perlbin" && export PERLBIN &&
 738         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 739                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 740         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 741         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 742         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 743         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 744 )
 745 test $? -eq 0
 746
 747
 748 echo "*** Setting up git-browser from git-browser.git..."
 749 if ! [ -f git-browser.git/git-browser.cgi ]; then
 750         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 751         exit 1
 752 fi
 753 mkdir -p "$webroot"/git-browser "$cgiroot"
 754 (
 755         cd git-browser.git &&
 756         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 757         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 758                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 759                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 760         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 761         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 762         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 763         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 764         cp -r JSON "$cgiroot"
 765 )
 766 test $? -eq 0
 767 rm -f "$webroot"/git-browser/index.html
 768 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 769         gitbin: $cfg_git_bin
 770         warehouse: $cfg_reporoot
 771         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 772 EOT
 773 chown_make "$basedir/gitweb"/git-browser.conf.$$
 774 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 775 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 776         cfg_gitweb_url="$cfg_gitweburl/"
 777         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 778 EOT
 779 chown_make "$webroot"/git-browser/GitConfig.js.$$
 780 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 781
 782
 783 echo "*** Setting up our part of the website..."
 784 mkdir -p "$webroot" "$cgiroot"
 785 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 786 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 787 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 788 cp "$basedir/cgi"/*.cgi "$cgiroot"
 789 rm -rf "$basedir/cgi"
 790 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 791 if [ -z "$cfg_httpspushurl" ]; then
 792         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 793 else
 794         cp gitweb/indextext.html "$basedir/gitweb"
 795 fi
 796 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 797 cp mootools.js "$webroot"
 798 cp htaccess "$webroot/.htaccess"
 799 cp cgi/htaccess "$cgiroot/.htaccess"
 800 cp git-favicon.ico "$webroot/favicon.ico"
 801 cp robots.txt "$webroot"
 802 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 803
 804
 805 if [ -n "$cfg_httpspushurl" ]; then
 806         echo "*** Setting up SSL certificates..."
 807         bits=2048
 808         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 809             bits="$cfg_rsakeylength"
 810         fi
 811         mkdir -p "$cfg_certsdir"
 812         [ -d "$cfg_certsdir" ]
 813         wwwcertcn=
 814         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 815                 wwwcertcn="$(
 816                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 817                         sed -e 's,[^/]*,,'
 818                 )"
 819         fi
 820         wwwcertdns=
 821         if [ -n "$cfg_wwwcertaltnames" ]; then
 822                 for dnsopt in $cfg_wwwcertaltnames; do
 823                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 824                 done
 825         fi
 826         wwwcertdnsfile=
 827         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 828                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 829         fi
 830         needroot=
 831         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 832         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 833         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 834         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 835         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 836         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 837                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 838                 umask 0077
 839                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 840                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 841                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 842                 umask 0022
 843                 echo "Created new root key"
 844         fi
 845         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 846                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 847                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 848                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 849                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 850                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 851                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 852                 echo "Created new root certificate"
 853         fi
 854         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 855                 umask 0077
 856                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 857                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 858                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 859                 umask 0022
 860                 echo "Created new www key"
 861         fi
 862         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 863                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 864                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 865                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 866                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 867                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 868                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 869                 echo "Created www certificate"
 870         fi
 871         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 872                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 873                 echo "Created www certificate chain file"
 874         fi
 875         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 876                 umask 0037
 877                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 878                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 879                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 880                 umask 0022
 881                 echo "Created new client key"
 882         fi
 883         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 884                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 885                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 886                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 887                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 888                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 889                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 890                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 891                 echo "Created client certificate"
 892         fi
 893         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 894                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 895                 echo "Created client certificate suffix file"
 896         fi
 897         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 898         if [ -n "$cfg_mob" ]; then
 899                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 900                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 901                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 902                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 903                         echo "Created new mob user key"
 904                 fi
 905                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 906                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 907                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 908                                 --cert "$cfg_clientcert" \
 909                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 910                         echo "Created mob user client certificate"
 911                 fi
 912                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 913                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 914         else
 915                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 916         fi
 917 else
 918         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 919         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 920 fi
 921
 922
 923 echo "*** Finalizing permissions and moving into place..."
 924 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 925 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 926
 927 # This should always be the very last thing install.sh does
 928 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 929 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 930 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 931 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 932 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 933 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
 934 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 935         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 936         touch "$cfg_chroot/etc/taskd.restart"
 937         chown_make "$cfg_chroot/etc/taskd.restart"
 938         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 939 }