install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I"$PWD" -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_reporoot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_reporoot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::reporoot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 warn() { printf >&2 '%s\n' "$*"; }
  41 die() { warn "$@"; exit 1; }
  42
  43 # Either we must run as root (but preferably not if disable_jailsetup is true)
  44 # or the mirror_user (preferred choice for disable_jailsetup).
  45 if [ "$(id -u)" -eq 0 ]; then
  46         if [ "${cfg_disable_jailsetup:-0}" != "0" ]; then
  47                 cat <<'EOT'
  48
  49 ***
  50 *** WARNING: $Girocco::Config::disable_jailsetup has been enabled
  51 *** WARNING: but installation is being performed as the superuser
  52 ***
  53
  54 You appear to have disabled jailsetup which is perfectly fine for installations
  55 that will not be using an ssh jail.  However, in that case, running the install
  56 process as the superuser is highly discouraged.
  57
  58 Instead, running it as the configured $Girocco::Config::mirror_user is much
  59 preferred.
  60
  61 The install process will now pause for 10 seconds to give you a chance to abort
  62 it before continuing to install a disable_jailsetup config as the superuser.
  63
  64 EOT
  65                 sleep 10 || die "install aborted"
  66         fi
  67 else
  68         [ -n "$cfg_mirror_user" ] || die 'Girocco::Config.pm $mirror_user must be set'
  69         curuname="$(id -un)"
  70         [ -n "$curuname" ] || die "Cannot determine name of current user"
  71         if [ "$cfg_mirror_user" != "$curuname" ]; then
  72                 warn "ERROR: install must run as superuser or Config.pm's \$mirror_user ($cfg_mirror_user)"
  73                 die  "ERROR: install is currently running as $curuname"
  74         fi
  75 fi
  76
  77 # $1 must exist and be a dir
  78 # $2 may exist but must be a dir
  79 # $3 must not exist
  80 # After call $2 will be renamed to $3 (if $2 existed)
  81 # And $1 will be renamed to $2
  82 quick_move() {
  83         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  84         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  85         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  86         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  87         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  88                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  89                 echo "fatal: quick_move: rename failed" >&2
  90                 exit 1
  91         }
  92         ! [ -d "$1" ] && [ -d "$2" ] || {
  93                 echo "fatal: quick_move: rename failed" >&2
  94                 exit 1
  95         }
  96 }
  97
  98 check_sh_builtin() (
  99         "unset" -f command
 100         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
 101 ) 2>/dev/null
 102
 103 owngroup=
 104 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
 105 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
 106         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
 107         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
 108         exit 1
 109 fi
 110
 111
 112 # Check for extra required tools
 113 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
 114         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
 115         exit 1
 116 fi
 117
 118
 119 echo "*** Checking for compiled utilities..."
 120 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
 121         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
 122         echo "ERROR: perhaps you forgot to run make?" >&2
 123         exit 1
 124 fi
 125 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
 126         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
 127         echo "ERROR: perhaps you forgot to run make?" >&2
 128         exit 1
 129 fi
 130 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
 131         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
 132         echo "ERROR: perhaps you forgot to run make?" >&2
 133         exit 1
 134 fi
 135 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
 136         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 137         echo "ERROR: perhaps you forgot to run make?" >&2
 138         exit 1
 139 fi
 140 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 141         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 142         echo "ERROR: perhaps you forgot to run make?" >&2
 143         exit 1
 144 fi
 145 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 146         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 147         echo "ERROR: perhaps you forgot to run make?" >&2
 148         exit 1
 149 fi
 150 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 151         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 152         echo "ERROR: perhaps you forgot to run make?" >&2
 153         exit 1
 154 fi
 155 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 156         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 157         echo "ERROR: perhaps you forgot to run make?" >&2
 158         exit 1
 159 fi
 160 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 161         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 162         echo "ERROR: perhaps you forgot to run make?" >&2
 163         exit 1
 164 fi
 165 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 166         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 167         echo "ERROR: perhaps you forgot to run make?" >&2
 168         exit 1
 169 fi
 170 if ! [ -f src/ulimit512 ] || ! [ -x src/ulimit512 ]; then
 171         echo "ERROR: src/ulimit512 is not built! Did you _REALLY_ read INSTALL?" >&2
 172         echo "ERROR: perhaps you forgot to run make?" >&2
 173         exit 1
 174 fi
 175
 176
 177 echo "*** Checking for ezcert..."
 178 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 179         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 180         exit 1
 181 fi
 182
 183
 184 echo "*** Checking for git..."
 185 case "$cfg_git_bin" in /*) :;; *)
 186         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 187         exit 1
 188 esac
 189 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 190         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 191         exit 1
 192 fi
 193 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 194         echo "ERROR: $cfg_git_bin version failed" >&2
 195         exit 1
 196 fi
 197 case "$git_version" in
 198         [Gg]"it version "*) :;;
 199         *)
 200                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 201                 exit 1
 202 esac
 203 echo "Found $cfg_git_bin $git_version"
 204 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 205 echo "*** Checking Git $git_vernum for compatibility..."
 206 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 207         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 208         exit 1
 209 fi
 210 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 211         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 212 fi
 213 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 214         cat <<'EOT'
 215
 216 ***
 217 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 218 ***
 219
 220 Some Girocco functionality will be gracefully disabled and other things will
 221 just not work at all such as race condition protection against simultaneous
 222 client pushes and server garbage collections.
 223
 224 EOT
 225 fi
 226 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 227         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 228 fi
 229 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 230         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 231 fi
 232 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 233         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 234         echo 'WARNING: See https://lore.kernel.org/git/20141222041944.GA441@peff.net/ for details'
 235 fi
 236 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 237         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 238         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 239 fi
 240 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 241         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 242 fi
 243 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 244         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 245 fi
 246 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 247         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 248 fi
 249 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 250         cat <<'EOT'
 251
 252 ***
 253 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 254 ***
 255
 256 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 257 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 258 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 259
 260 In order to bypass this check you will have to modify install.sh in which case
 261 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 262
 263 EOT
 264         exit 1
 265 fi
 266 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 267         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 268 fi
 269 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 270         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 271 fi
 272 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 273         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 274         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 275         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 276         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 277         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 278 fi
 279 secmsg=
 280 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 281         secmsg='prior to 2.4.11'
 282 fi
 283 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 284         secmsg='2.5.x prior to 2.5.5'
 285 fi
 286 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 287         secmsg='2.6.x prior to 2.6.6'
 288 fi
 289 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 290         secmsg='2.7.x prior to 2.7.4'
 291 fi
 292 if [ -n "$secmsg" ]; then
 293         cat <<EOT
 294
 295 ***
 296 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 297 ***
 298
 299 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 300 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 301
 302 Besides the security fixes included in later versions, versions prior to
 303 2.2.0 may accidentally prune unreachable loose objects earlier than
 304 intended.  Since Git version 2.4.11 is the minimum version to include all
 305 security fixes to date, it should be considered the absolute minimum
 306 version of Git to use when running Girocco.
 307
 308 This is not enforced, but Git is easy to build from the git.git submodule
 309 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 310
 311 We will now pause for a moment so you can reflect on this warning.
 312
 313 EOT
 314         sleep 60
 315 fi
 316 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 317         cat <<'EOT'
 318
 319 ***
 320 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 321 ***
 322
 323 You appear to have enabled mirroring and the Git binary you have selected
 324 appears to contain an experimental patch that cannot be disabled.  This
 325 patch can generate invalid network DNS traffic and/or cause long delays
 326 when fetching using the "git:" protocol when no port number is specified.
 327 It may also end up retrieving repsitory contents from a host other than
 328 the one specified in the "git:" URL when the port is omitted.
 329
 330 You are advised to either build your own version of Git (the problem patch
 331 is not part of the official Git repository) or disable mirroring (via the
 332 $Girocco::Config:mirror setting) to avoid these potential problems.
 333
 334 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 335
 336 EOT
 337         sleep 5
 338 fi
 339
 340 test_nc_U() {
 341         [ -n "$1" ] || return 1
 342         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 343         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 344         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 345         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 346         >"$_tmpdir/output"
 347         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 348         _bgpid="$!"
 349         sleep 1
 350         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 351         sleep 1
 352         kill "$_bgpid" >/dev/null 2>&1 || :
 353         read -r _result <"$_tmpdir/output" || :
 354         _bad=
 355         ! [ -e "$_tmpdir/failed" ] || _bad=1
 356         rm -rf "$_tmpdir"
 357         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 358 } >/dev/null 2>&1
 359
 360 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 361 test_nc_U "$var_nc_openbsd_bin" || {
 362         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 363         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 364         uname_s="$(uname -s 2>/dev/null | tr A-Z a-z 2>/dev/null)" || :
 365         case "$uname_s" in
 366         *dragonfly*)
 367                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2;;
 368         *kfreebsd*|*linux*)
 369                 echo "ERROR: try installing the package named 'netcat-openbsd'" >&2;;
 370         esac
 371         exit 1
 372 }
 373
 374 echo "*** Verifying selected POSIX sh is sane..."
 375 shbin="$var_sh_bin"
 376 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 377         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 378         exit 1
 379 }
 380 [ "$(check_sh_builtin command)" = "command" ] || {
 381         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 382         exit 1
 383 }
 384 sh_not_builtin=
 385 sh_extra_chroot_installs=
 386 badsh=
 387 for sbi in cd pwd read umask unset unalias; do
 388         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 389                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 390                 badsh=1
 391         fi
 392 done
 393 [ -z "$badsh" ] || exit 1
 394 for sbi in '[' echo printf test; do
 395         if ! extra="$(check_sh_builtin "$sbi")"; then
 396                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 397                 badsh=1
 398                 continue
 399         fi
 400         if [ "$extra" != "$sbi" ]; then
 401                 case "$extra" in /*) :;; *)
 402                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 403                         badsh=1
 404                         continue
 405                 esac
 406                 withspc=
 407                 case "$extra" in *" "*) withspc=1; esac
 408                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 409                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 410                         badsh=1
 411                         continue
 412                 }
 413                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 414                 sh_not_builtin="$sh_not_builtin $sbi"
 415                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 416         fi
 417 done
 418 [ -z "$badsh" ] || exit 1
 419 [ -z "$sh_extra_chroot_installs" ] || {
 420         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 421         echo "WARNING: as a result it will run slower than necessary" >&2
 422         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 423         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 424         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 425         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 426         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 427 }
 428
 429 echo "*** Verifying xargs is sane..."
 430 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 431 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 432 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 433 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 434         echo 'ERROR: xargs is unusable' >&2
 435         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 436         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 437         echo 'ERROR: must be true, but neither is' >&2
 438         exit 1
 439 }
 440
 441 echo "*** Verifying selected perl is sane..."
 442 perlbin="$var_perl_bin"
 443 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 444         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 445         exit 1
 446 }
 447
 448 echo "*** Verifying selected gzip is sane..."
 449 gzipbin="$var_gzip_bin"
 450 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 451     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 452         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 453         exit 1
 454 }
 455
 456 echo "*** Verifying basedir, webroot and cgiroot paths..."
 457 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 458 case "$cfg_basedir" in /*) :;; *)
 459         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 460         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 461         exit 1
 462 esac
 463 case "$cfg_webroot" in /*) :;; *)
 464         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 465         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 466         exit 1
 467 esac
 468 case "$cfg_cgiroot" in /*) :;; *)
 469         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 470         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 471         exit 1
 472 esac
 473
 474 # return the input with trailing slashes stripped but return "/" for all "/"s
 475 striptrsl() {
 476         [ -n "$1" ] || return 0
 477         _s="${1##*[!/]}"
 478         [ "$_s" != "$1" ] || _s="${_s#?}"
 479         printf "%s\n" "${1%$_s}"
 480 }
 481
 482 # a combination of realpath + dirname where the realpath of the deepest existing
 483 # directory is returned with the rest of the non-existing components appended
 484 # and trailing slashes and multiple slashes are removed
 485 realdir() {
 486         _d="$(striptrsl "$1")"
 487         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 488                 echo "$_d"
 489                 return 0
 490         fi
 491         _c=""
 492         while ! [ -d "$_d" ]; do
 493                 _c="/$(basename "$_d")$_c"
 494                 _d="$(dirname "$_d")"
 495                 [ "$_d" != "/" ] || _c="${_c#/}"
 496         done
 497         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 498 }
 499
 500 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 501 # Wherever we are writing/copying/installing files we use these, but where we
 502 # are editing, adding config settings or printing advice we always stick to the
 503 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 504 # Only the file system directories that could be asynchronously accessed (by
 505 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 506 # The chroot is handled specially and does not need one of these.
 507 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 508 # case the prior contents of cgiroot and/or webroot are discarded.
 509 rbasedir="$(realdir "$cfg_basedir")"
 510 rwebroot="$(realdir "$cfg_webroot")"
 511 rcgiroot="$(realdir "$cfg_cgiroot")"
 512 case "$rbasedir" in "$rwebroot"/?*)
 513         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 514         exit 1
 515 esac
 516 case "$rbasedir" in "$rcgiroot"/?*)
 517         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 518         exit 1
 519 esac
 520 if [ "$rwebroot" = "$rcgiroot" ]; then
 521         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 522         exit 1
 523 fi
 524 case "$rcgiroot" in "$rwebroot"/?*)
 525         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 526         exit 1
 527 esac
 528 case "$rwebroot" in "$rcgiroot"/?*)
 529         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 530         exit 1
 531 esac
 532 basedir="$rbasedir-new"
 533 case "$rwebroot" in
 534         "$rbasedir"/?*)
 535                 webroot="$basedir${rwebroot#$rbasedir}"
 536                 webrootsub=1
 537                 ;;
 538         *)
 539                 webroot="$rwebroot-new"
 540                 webrootsub=
 541                 ;;
 542 esac
 543 case "$rcgiroot" in
 544         "$rbasedir"/?*)
 545                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 546                 cgirootsub=1
 547                 ;;
 548         *)
 549                 cgiroot="$rcgiroot-new"
 550                 cgirootsub=
 551                 ;;
 552 esac
 553
 554 echo "*** Setting up basedir..."
 555
 556 chown_make() {
 557         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 558                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 559         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 560                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 561         fi
 562 }
 563
 564 "$MAKE" --no-print-directory --silent apache.conf
 565 chown_make apache.conf
 566 "$MAKE" --no-print-directory --silent -C src
 567 chown_make src
 568 rm -fr "$basedir"
 569 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 570 cp cgi/*.cgi "$basedir/cgi"
 571 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 572 find -H "$basedir" -type l -exec rm -f '{}' +
 573 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 574         src/rangecgi src/readlink src/strftime src/throttle src/ulimit512 \
 575         ezcert.git/CACreateCert cgi/authrequired.cgi cgi/snapshot.cgi \
 576         "$basedir/bin"
 577 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 578 if [ -n "$cfg_httpspushurl" ]; then
 579         [ -z "$cfg_pretrustedroot" ] || rm -f "$basedir"/html/rootcert.html
 580 else
 581         rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 582 fi
 583 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 584
 585 # Put the correct Config in place
 586 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 587
 588 # Create symbolic links to selected binaries
 589 ln -s "$cfg_git_bin" "$basedir/bin/git"
 590 ln -s "$shbin" "$basedir/bin/sh"
 591 ln -s "$perlbin" "$basedir/bin/perl"
 592 ln -s "$gzipbin" "$basedir/bin/gzip"
 593
 594 echo "*** Preprocessing scripts..."
 595 SHBIN="$shbin" && export SHBIN
 596 PERLBIN="$perlbin" && export PERLBIN
 597 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 598         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 599         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 600         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 601         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 602         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 603         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 604         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 605         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 606         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 607         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 608         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 609         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 610         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 611         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 612         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 613         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 614         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 615         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 616         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 617         -e 's/\@fetch_stash_refs\@/"$Girocco::Config::fetch_stash_refs"/g;' \
 618         -e 's/\@suppress_git_ssh_logging\@/"$Girocco::Config::suppress_git_ssh_logging"/g;' \
 619         -e 'close ARGV if eof;' \
 620         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 621         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 622         "$basedir"/shlib.sh "$basedir"/hooks/* \
 623         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 624         "$basedir"/toolbox/reports/*.sh \
 625         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 626         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 627         "$basedir"/bin/*.cgi "$basedir"/screen/*
 628 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 629         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 630         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 631         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 632 perl -i -p \
 633         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 634         -e 'close ARGV if eof;' \
 635         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 636         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 637 perl -i -p \
 638         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 639         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 640         -e 'close ARGV if eof;' \
 641         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 642 unset PERLBIN
 643 unset SHBIN
 644
 645 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 646 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 647
 648 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 649 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 650    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 651         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 652         exit 1
 653 fi
 654 mkdir -p "$basedir"/bin
 655 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 656
 657 echo "*** Setting up hg-fast-export from fast-export.git..."
 658 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 659         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 660         exit 1
 661 fi
 662 mkdir -p "$basedir"/bin
 663 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 664
 665 echo "*** Setting up markdown from markdown.git..."
 666 if ! [ -f markdown.git/Markdown.pl ]; then
 667         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 668         exit 1
 669 fi
 670 mkdir -p "$basedir"/bin
 671 (PERLBIN="$perlbin" && export PERLBIN &&
 672         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 673                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 674         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 675         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 676 test $? -eq 0
 677
 678 # Some permission sanity on basedir/bin just in case
 679 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 680 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 681
 682 if [ -n "$cfg_mirror" ]; then
 683         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 684 fi
 685 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 686 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 687 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 688
 689
 690 echo "*** Setting up repository root..."
 691 [ -d "$cfg_reporoot" ] || {
 692         mkdir -p "$cfg_reporoot"
 693         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 694         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 695 }
 696 [ -z "$cfg_owning_group" ] ||
 697         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 698 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 699 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty"
 700 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" ||
 701         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 702 if [ "$cfg_owning_group" ]; then
 703         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 704         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 705 fi
 706 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 707 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 708
 709
 710 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 711         echo "*** Setting up chroot jail for pushing..."
 712         if [ "$(id -u)" -eq 0 ]; then
 713                 # jailsetup may install things from $cfg_basedir/bin into the
 714                 # chroot so we do a mini-update of just that portion now
 715                 mkdir -p "$cfg_basedir"
 716                 rm -rf "$cfg_basedir/bin-new"
 717                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 718                 rm -rf "$cfg_basedir/bin-old"
 719                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 720                 rm -rf "$cfg_basedir/bin-old"
 721                 if [ -n "$sh_extra_chroot_installs" ]; then
 722                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 723                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 724                 fi
 725                 ./jailsetup.sh
 726                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 727         else
 728                 echo "WARNING: Skipping jail setup, not root"
 729         fi
 730 fi
 731
 732
 733 echo "*** Setting up jail configuration (project database)..."
 734 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 735 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 736 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 737 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 738         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 739 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 740         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 741 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 742         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 743 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 744
 745
 746 echo "*** Setting up global hook scripts..."
 747 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 748 # Otherwise an incoming push might slip in and fail to run the hook script!
 749 # The underlying rename(2) function call provides this and mv will use it.
 750 # First add hook scripts
 751 hooks="pre-auto-gc pre-receive post-commit post-receive update"
 752 for hook in $hooks; do
 753         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 754         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 755                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 756         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 757         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 758 done
 759 # Then remove any hook scripts that do not belong
 760 for hook in "$cfg_reporoot/_global/hooks"/*; do
 761         hook="${hook##*/}"
 762         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 763         case " $hooks " in *" $hook "*);;*)
 764                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 765                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 766         esac
 767 done
 768
 769
 770 echo "*** Setting up gitweb from git.git..."
 771 if ! [ -f git.git/Makefile ]; then
 772         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 773         exit 1
 774 fi
 775
 776 # We do not wholesale replace either webroot or cgiroot unless they are under
 777 # basedir so if they exist and are not we make a copy to start working on them.
 778 # We make a copy using -p which can result in some warnings so we suppress
 779 # error output as it's of no consequence in this case.
 780 rm -rf "$webroot" "$cgiroot"
 781 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 782 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 783 mkdir -p "$webroot" "$cgiroot"
 784
 785 (
 786         cd git.git &&
 787         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 788                 GITWEB_CONFIG_COMMON="" GITWEB_CONFIG_SYSTEM="" \
 789                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 790         chown_make gitweb &&
 791         PERLBIN="$perlbin" && export PERLBIN &&
 792         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 793                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 794         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 795         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 796         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 797         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 798 )
 799 test $? -eq 0
 800
 801
 802 echo "*** Setting up git-browser from git-browser.git..."
 803 if ! [ -f git-browser.git/git-browser.cgi ]; then
 804         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 805         exit 1
 806 fi
 807 mkdir -p "$webroot"/git-browser "$cgiroot"
 808 (
 809         cd git-browser.git &&
 810         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 811         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 812                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 813                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 814         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 815         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 816         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 817         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 818         cp -r JSON "$cgiroot"
 819 )
 820 test $? -eq 0
 821 rm -f "$webroot"/git-browser/index.html
 822 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 823         gitbin: $cfg_git_bin
 824         warehouse: $cfg_reporoot
 825         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 826 EOT
 827 chown_make "$basedir/gitweb"/git-browser.conf.$$
 828 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 829 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 830         cfg_gitweb_url="$cfg_gitweburl/"
 831         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 832 EOT
 833 chown_make "$webroot"/git-browser/GitConfig.js.$$
 834 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 835
 836
 837 echo "*** Setting up our part of the website..."
 838 mkdir -p "$webroot" "$cgiroot"
 839 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 840 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 841 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 842 cp "$basedir/cgi"/*.cgi "$cgiroot"
 843 rm -rf "$basedir/cgi"
 844 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 845 if [ -z "$cfg_httpspushurl" ] || [ -n "$cfg_pretrustedroot" ]; then
 846         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 847 else
 848         cp gitweb/indextext.html "$basedir/gitweb"
 849 fi
 850 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 851 cp mootools.js "$webroot"
 852 cp htaccess "$webroot/.htaccess"
 853 cp cgi/htaccess "$cgiroot/.htaccess"
 854 cp git-favicon.ico "$webroot/favicon.ico"
 855 cp robots.txt "$webroot"
 856 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 857
 858
 859 if [ -n "$cfg_httpspushurl" ]; then
 860         echo "*** Setting up SSL certificates..."
 861         bits=2048
 862         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 863             bits="$cfg_rsakeylength"
 864         fi
 865         mkdir -p "$cfg_certsdir"
 866         [ -d "$cfg_certsdir" ]
 867         wwwcertcn=
 868         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 869                 wwwcertcn="$(
 870                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 871                         sed -e 's,[^/]*,,'
 872                 )"
 873         fi
 874         wwwcertdns=
 875         if [ -n "$cfg_wwwcertaltnames" ]; then
 876                 for dnsopt in $cfg_wwwcertaltnames; do
 877                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 878                 done
 879         fi
 880         wwwcertdnsfile=
 881         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 882                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 883         fi
 884         needroot=
 885         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 886         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 887         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 888         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 889         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 890         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 891                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 892                 umask 0077
 893                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 894                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 895                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 896                 umask 0022
 897                 echo "Created new root key"
 898         fi
 899         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 900                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 901                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 902                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 903                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 904                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 905                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 906                 echo "Created new root certificate"
 907         fi
 908         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 909                 umask 0077
 910                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 911                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 912                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 913                 umask 0022
 914                 echo "Created new www key"
 915         fi
 916         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 917                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 918                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 919                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 920                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 921                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 922                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 923                 echo "Created www certificate"
 924         fi
 925         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 926                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 927                 echo "Created www certificate chain file"
 928         fi
 929         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 930                 umask 0037
 931                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 932                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 933                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 934                 umask 0022
 935                 echo "Created new client key"
 936         fi
 937         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 938                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 939                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 940                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 941                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 942                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 943                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 944                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 945                 echo "Created client certificate"
 946         fi
 947         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 948                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 949                 echo "Created client certificate suffix file"
 950         fi
 951         if [ -z "$cfg_pretrustedroot" ]; then
 952                 cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 953         else
 954                 rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 955         fi
 956         if [ -n "$cfg_mob" ]; then
 957                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 958                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 959                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 960                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 961                         echo "Created new mob user key"
 962                 fi
 963                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 964                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 965                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 966                                 --cert "$cfg_clientcert" \
 967                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 968                         echo "Created mob user client certificate"
 969                 fi
 970                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 971                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 972         else
 973                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 974         fi
 975 else
 976         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 977         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 978 fi
 979
 980
 981 echo "*** Finalizing permissions and moving into place..."
 982 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 983 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 984
 985 # This should always be the very last thing install.sh does
 986 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 987 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 988 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 989 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 990 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 991 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
 992 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 993         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 994         touch "$cfg_chroot/etc/taskd.restart"
 995         chown_make "$cfg_chroot/etc/taskd.restart"
 996         trap ':' PIPE
 997         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 998         trap - PIPE
 999 }