install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_chroot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_chroot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::chroot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 # $1 must exist and be a dir
  41 # $2 may exist but must be a dir
  42 # $3 must not exist
  43 # After call $2 will be renamed to $3 (if $2 existed)
  44 # And $1 will be renamed to $2
  45 quick_move() {
  46         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  47         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  48         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  49         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  50         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  51                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  52                 echo "fatal: quick_move: rename failed" >&2
  53                 exit 1
  54         }
  55         ! [ -d "$1" ] && [ -d "$2" ] || {
  56                 echo "fatal: quick_move: rename failed" >&2
  57                 exit 1
  58         }
  59 }
  60
  61 check_sh_builtin() (
  62         "unset" -f command
  63         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  64 ) 2>/dev/null
  65
  66 owngroup=
  67 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  68 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  69         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  70         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  71         exit 1
  72 fi
  73
  74
  75 # Check for extra required tools
  76 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  77         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  78         exit 1
  79 fi
  80
  81
  82 echo "*** Checking for compiled utilities..."
  83 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  84         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  85         echo "ERROR: perhaps you forgot to run make?" >&2
  86         exit 1
  87 fi
  88 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  89         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  90         echo "ERROR: perhaps you forgot to run make?" >&2
  91         exit 1
  92 fi
  93 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  94         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  95         echo "ERROR: perhaps you forgot to run make?" >&2
  96         exit 1
  97 fi
  98 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  99         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 100         echo "ERROR: perhaps you forgot to run make?" >&2
 101         exit 1
 102 fi
 103 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 104         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 105         echo "ERROR: perhaps you forgot to run make?" >&2
 106         exit 1
 107 fi
 108 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 109         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 110         echo "ERROR: perhaps you forgot to run make?" >&2
 111         exit 1
 112 fi
 113 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 114         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 115         echo "ERROR: perhaps you forgot to run make?" >&2
 116         exit 1
 117 fi
 118 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 119         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 120         echo "ERROR: perhaps you forgot to run make?" >&2
 121         exit 1
 122 fi
 123 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 124         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 125         echo "ERROR: perhaps you forgot to run make?" >&2
 126         exit 1
 127 fi
 128 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 129         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 130         echo "ERROR: perhaps you forgot to run make?" >&2
 131         exit 1
 132 fi
 133
 134
 135 echo "*** Checking for ezcert..."
 136 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 137         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 138         exit 1
 139 fi
 140
 141
 142 echo "*** Checking for git..."
 143 case "$cfg_git_bin" in /*) :;; *)
 144         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 145         exit 1
 146 esac
 147 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 148         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 149         exit 1
 150 fi
 151 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 152         echo "ERROR: $cfg_git_bin version failed" >&2
 153         exit 1
 154 fi
 155 case "$git_version" in
 156         [Gg]"it version "*) :;;
 157         *)
 158                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 159                 exit 1
 160 esac
 161 echo "Found $cfg_git_bin $git_version"
 162 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 163 echo "*** Checking Git $git_vernum for compatibility..."
 164 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 165         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 166         exit 1
 167 fi
 168 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 169         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 170 fi
 171 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 172         cat <<'EOT'
 173
 174 ***
 175 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 176 ***
 177
 178 Some Girocco functionality will be gracefully disabled and other things will
 179 just not work at all such as race condition protection against simultaneous
 180 client pushes and server garbage collections.
 181
 182 EOT
 183 fi
 184 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 189 fi
 190 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 192         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 193 fi
 194 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 195         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 196         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 197 fi
 198 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 199         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 200 fi
 201 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 202         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 203 fi
 204 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 205         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 206 fi
 207 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 208         cat <<'EOT'
 209
 210 ***
 211 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 212 ***
 213
 214 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 215 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 216 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 217
 218 In order to bypass this check you will have to modify install.sh in which case
 219 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 220
 221 EOT
 222         exit 1
 223 fi
 224 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 225         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 226 fi
 227 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 228         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 229 fi
 230 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 231         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 232         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 233         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 234         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 235         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 236 fi
 237 secmsg=
 238 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 239         secmsg='prior to 2.4.11'
 240 fi
 241 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 242         secmsg='2.5.x prior to 2.5.5'
 243 fi
 244 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 245         secmsg='2.6.x prior to 2.6.6'
 246 fi
 247 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 248         secmsg='2.7.x prior to 2.7.4'
 249 fi
 250 if [ -n "$secmsg" ]; then
 251         cat <<EOT
 252
 253 ***
 254 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 255 ***
 256
 257 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 258 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 259
 260 Besides the security fixes included in later versions, versions prior to
 261 2.2.0 may accidentally prune unreachable loose objects earlier than
 262 intended.  Since Git version 2.4.11 is the minimum version to include all
 263 security fixes to date, it should be considered the absolute minimum
 264 version of Git to use when running Girocco.
 265
 266 This is not enforced, but Git is easy to build from the git.git submodule
 267 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 268
 269 We will now pause for a moment so you can reflect on this warning.
 270
 271 EOT
 272         sleep 60
 273 fi
 274 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 275         cat <<'EOT'
 276
 277 ***
 278 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 279 ***
 280
 281 You appear to have enabled mirroring and the Git binary you have selected
 282 appears to contain an experimental patch that cannot be disabled.  This
 283 patch can generate invalid network DNS traffic and/or cause long delays
 284 when fetching using the "git:" protocol when no port number is specified.
 285 It may also end up retrieving repsitory contents from a host other than
 286 the one specified in the "git:" URL when the port is omitted.
 287
 288 You are advised to either build your own version of Git (the problem patch
 289 is not part of the official Git repository) or disable mirroring (via the
 290 $Girocco::Config:mirror setting) to avoid these potential problems.
 291
 292 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 293
 294 EOT
 295         sleep 5
 296 fi
 297
 298 test_nc_U() {
 299         [ -n "$1" ] || return 1
 300         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 301         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 302         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 303         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 304         >"$_tmpdir/output"
 305         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 306         _bgpid="$!"
 307         sleep 1
 308         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 309         sleep 1
 310         kill "$_bgpid" >/dev/null 2>&1 || :
 311         read -r _result <"$_tmpdir/output" || :
 312         _bad=
 313         ! [ -e "$_tmpdir/failed" ] || _bad=1
 314         rm -rf "$_tmpdir"
 315         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 316 } >/dev/null 2>&1
 317
 318 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 319 test_nc_U "$var_nc_openbsd_bin" || {
 320         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 321         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 322         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 323                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 324         fi
 325         exit 1
 326 }
 327
 328 echo "*** Verifying selected POSIX sh is sane..."
 329 shbin="$var_sh_bin"
 330 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 331         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 332         exit 1
 333 }
 334 [ "$(check_sh_builtin command)" = "command" ] || {
 335         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 336         exit 1
 337 }
 338 sh_not_builtin=
 339 sh_extra_chroot_installs=
 340 badsh=
 341 for sbi in cd pwd read umask unset unalias; do
 342         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 343                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 344                 badsh=1
 345         fi
 346 done
 347 [ -z "$badsh" ] || exit 1
 348 for sbi in '[' echo printf test; do
 349         if ! extra="$(check_sh_builtin "$sbi")"; then
 350                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 351                 badsh=1
 352                 continue
 353         fi
 354         if [ "$extra" != "$sbi" ]; then
 355                 case "$extra" in /*) :;; *)
 356                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 357                         badsh=1
 358                         continue
 359                 esac
 360                 withspc=
 361                 case "$extra" in *" "*) withspc=1; esac
 362                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 363                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 364                         badsh=1
 365                         continue
 366                 }
 367                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 368                 sh_not_builtin="$sh_not_builtin $sbi"
 369                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 370         fi
 371 done
 372 [ -z "$badsh" ] || exit 1
 373 [ -z "$sh_extra_chroot_installs" ] || {
 374         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 375         echo "WARNING: as a result it will run slower than necessary" >&2
 376         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 377         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 378         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 379         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 380         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 381 }
 382
 383 echo "*** Verifying xargs is sane..."
 384 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 385 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 386 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 387 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 388         echo 'ERROR: xargs is unusable' >&2
 389         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 390         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 391         echo 'ERROR: must be true, but neither is' >&2
 392         exit 1
 393 }
 394
 395 echo "*** Verifying selected perl is sane..."
 396 perlbin="$var_perl_bin"
 397 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 398         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 399         exit 1
 400 }
 401
 402 echo "*** Verifying selected gzip is sane..."
 403 gzipbin="$var_gzip_bin"
 404 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 405     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 406         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 407         exit 1
 408 }
 409
 410 echo "*** Verifying basedir, webroot and cgiroot paths..."
 411 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 412 case "$cfg_basedir" in /*) :;; *)
 413         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 414         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 415         exit 1
 416 esac
 417 case "$cfg_webroot" in /*) :;; *)
 418         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 419         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 420         exit 1
 421 esac
 422 case "$cfg_cgiroot" in /*) :;; *)
 423         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 424         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 425         exit 1
 426 esac
 427
 428 # return the input with trailing slashes stripped but return "/" for all "/"s
 429 striptrsl() {
 430         [ -n "$1" ] || return 0
 431         _s="${1##*[!/]}"
 432         [ "$_s" != "$1" ] || _s="${_s#?}"
 433         printf "%s\n" "${1%$_s}"
 434 }
 435
 436 # a combination of realpath + dirname where the realpath of the deepest existing
 437 # directory is returned with the rest of the non-existing components appended
 438 # and trailing slashes and multiple slashes are removed
 439 realdir() {
 440         _d="$(striptrsl "$1")"
 441         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 442                 echo "$_d"
 443                 return 0
 444         fi
 445         _c=""
 446         while ! [ -d "$_d" ]; do
 447                 _c="/$(basename "$_d")$_c"
 448                 _d="$(dirname "$_d")"
 449                 [ "$_d" != "/" ] || _c="${_c#/}"
 450         done
 451         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 452 }
 453
 454 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 455 # Wherever we are writing/copying/installing files we use these, but where we
 456 # are editing, adding config settings or printing advice we always stick to the
 457 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 458 # Only the file system directories that could be asynchronously accessed (by
 459 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 460 # The chroot is handled specially and does not need one of these.
 461 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 462 # case the prior contents of cgiroot and/or webroot are discarded.
 463 rbasedir="$(realdir "$cfg_basedir")"
 464 rwebroot="$(realdir "$cfg_webroot")"
 465 rcgiroot="$(realdir "$cfg_cgiroot")"
 466 case "$rbasedir" in "$rwebroot"/?*)
 467         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 468         exit 1
 469 esac
 470 case "$rbasedir" in "$rcgiroot"/?*)
 471         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 472         exit 1
 473 esac
 474 if [ "$rwebroot" = "$rcgiroot" ]; then
 475         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 476         exit 1
 477 fi
 478 case "$rcgiroot" in "$rwebroot"/?*)
 479         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 480         exit 1
 481 esac
 482 case "$rwebroot" in "$rcgiroot"/?*)
 483         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 484         exit 1
 485 esac
 486 basedir="$rbasedir-new"
 487 case "$rwebroot" in
 488         "$rbasedir"/?*)
 489                 webroot="$basedir${rwebroot#$rbasedir}"
 490                 webrootsub=1
 491                 ;;
 492         *)
 493                 webroot="$rwebroot-new"
 494                 webrootsub=
 495                 ;;
 496 esac
 497 case "$rcgiroot" in
 498         "$rbasedir"/?*)
 499                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 500                 cgirootsub=1
 501                 ;;
 502         *)
 503                 cgiroot="$rcgiroot-new"
 504                 cgirootsub=
 505                 ;;
 506 esac
 507
 508 echo "*** Setting up basedir..."
 509
 510 chown_make() {
 511         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 512                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 513         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 514                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 515         fi
 516 }
 517
 518 "$MAKE" --no-print-directory --silent apache.conf
 519 chown_make apache.conf
 520 "$MAKE" --no-print-directory --silent -C src
 521 chown_make src
 522 rm -fr "$basedir"
 523 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 524 cp cgi/*.cgi "$basedir/cgi"
 525 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 526 find -H "$basedir" -type l -exec rm -f '{}' +
 527 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 528         src/rangecgi src/readlink src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 529         cgi/snapshot.cgi "$basedir/bin"
 530 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 531 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 532 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 533
 534 # Put the correct Config in place
 535 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 536
 537 # Create symbolic links to selected binaries
 538 ln -s "$cfg_git_bin" "$basedir/bin/git"
 539 ln -s "$shbin" "$basedir/bin/sh"
 540 ln -s "$perlbin" "$basedir/bin/perl"
 541 ln -s "$gzipbin" "$basedir/bin/gzip"
 542
 543 echo "*** Preprocessing scripts..."
 544 SHBIN="$shbin" && export SHBIN
 545 PERLBIN="$perlbin" && export PERLBIN
 546 perl -I. -M$GIROCCO_CONF -i -p \
 547         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 548         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 549         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 550         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 551         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 552         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 553         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 554         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 555         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 556         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 557         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 558         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 559         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 560         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 561         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 562         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 563         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 564         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 565         -e 'close ARGV if eof;' \
 566         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 567         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 568         "$basedir"/shlib.sh "$basedir"/hooks/* \
 569         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 570         "$basedir"/toolbox/reports/*.sh \
 571         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 572         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 573         "$basedir"/bin/*.cgi "$basedir"/screen/*
 574 perl -I. -M$GIROCCO_CONF -i -p \
 575         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 576         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 577         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 578 perl -i -p \
 579         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 580         -e 'close ARGV if eof;' \
 581         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 582         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 583 perl -i -p \
 584         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 585         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 586         -e 'close ARGV if eof;' \
 587         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 588 unset PERLBIN
 589 unset SHBIN
 590
 591 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 592 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 593
 594 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 595 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 596    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 597         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 598         exit 1
 599 fi
 600 mkdir -p "$basedir"/bin
 601 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 602
 603 echo "*** Setting up hg-fast-export from fast-export.git..."
 604 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 605         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 606         exit 1
 607 fi
 608 mkdir -p "$basedir"/bin
 609 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 610
 611 echo "*** Setting up markdown from markdown.git..."
 612 if ! [ -f markdown.git/Markdown.pl ]; then
 613         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 614         exit 1
 615 fi
 616 mkdir -p "$basedir"/bin
 617 (PERLBIN="$perlbin" && export PERLBIN &&
 618         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 619                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 620         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 621         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 622 test $? -eq 0
 623
 624 # Some permission sanity on basedir/bin just in case
 625 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 626 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 627
 628 if [ -n "$cfg_mirror" ]; then
 629         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 630 fi
 631 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 632 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 633 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 634
 635
 636 echo "*** Setting up repository root..."
 637 mkdir -p "$cfg_reporoot" "$cfg_reporoot/_recyclebin"
 638 if [ "$cfg_owning_group" ]; then
 639         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 640         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 641 fi
 642 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 643 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 644
 645
 646 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 647         echo "*** Setting up chroot jail for pushing..."
 648         if [ "$(id -u)" -eq 0 ]; then
 649                 # jailsetup may install things from $cfg_basedir/bin into the
 650                 # chroot so we do a mini-update of just that portion now
 651                 mkdir -p "$cfg_basedir"
 652                 rm -rf "$cfg_basedir/bin-new"
 653                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 654                 rm -rf "$cfg_basedir/bin-old"
 655                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 656                 rm -rf "$cfg_basedir/bin-old"
 657                 if [ -n "$sh_extra_chroot_installs" ]; then
 658                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 659                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 660                 fi
 661                 ./jailsetup.sh
 662                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 663         else
 664                 echo "WARNING: Skipping jail setup, not root"
 665         fi
 666 fi
 667
 668
 669 echo "*** Setting up jail configuration (project database)..."
 670 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 671 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 672 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 673 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 674         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 675 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 676         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 677 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 678         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 679 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 680
 681
 682 echo "*** Setting up gitweb from git.git..."
 683 if ! [ -f git.git/Makefile ]; then
 684         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 685         exit 1
 686 fi
 687
 688 # We do not wholesale replace either webroot or cgiroot unless they are under
 689 # basedir so if they exist and are not we make a copy to start working on them.
 690 # We make a copy using -p which can result in some warnings so we suppress
 691 # error output as it's of no consequence in this case.
 692 rm -rf "$webroot" "$cgiroot"
 693 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 694 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 695 mkdir -p "$webroot" "$cgiroot"
 696
 697 (
 698         cd git.git &&
 699         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 700                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 701         chown_make gitweb &&
 702         PERLBIN="$perlbin" && export PERLBIN &&
 703         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 704                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 705         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 706         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 707         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 708         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 709 )
 710 test $? -eq 0
 711
 712
 713 echo "*** Setting up git-browser from git-browser.git..."
 714 if ! [ -f git-browser.git/git-browser.cgi ]; then
 715         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 716         exit 1
 717 fi
 718 mkdir -p "$webroot"/git-browser "$cgiroot"
 719 (
 720         cd git-browser.git &&
 721         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 722         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 723                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 724                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 725         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 726         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 727         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 728         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 729         cp -r JSON "$cgiroot"
 730 )
 731 test $? -eq 0
 732 rm -f "$webroot"/git-browser/index.html
 733 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 734         gitbin: $cfg_git_bin
 735         warehouse: $cfg_reporoot
 736         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 737 EOT
 738 chown_make "$basedir/gitweb"/git-browser.conf.$$
 739 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 740 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 741         cfg_gitweb_url="$cfg_gitweburl/"
 742         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 743 EOT
 744 chown_make "$webroot"/git-browser/GitConfig.js.$$
 745 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 746
 747
 748 echo "*** Setting up our part of the website..."
 749 mkdir -p "$webroot" "$cgiroot"
 750 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 751 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 752 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 753 cp "$basedir/cgi"/*.cgi "$cgiroot"
 754 rm -rf "$basedir/cgi"
 755 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 756 if [ -z "$cfg_httpspushurl" ]; then
 757         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 758 else
 759         cp gitweb/indextext.html "$basedir/gitweb"
 760 fi
 761 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 762 cp mootools.js "$webroot"
 763 cp htaccess "$webroot/.htaccess"
 764 cp cgi/htaccess "$cgiroot/.htaccess"
 765 cp git-favicon.ico "$webroot/favicon.ico"
 766 cp robots.txt "$webroot"
 767 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 768
 769
 770 if [ -n "$cfg_httpspushurl" ]; then
 771         echo "*** Setting up SSL certificates..."
 772         bits=2048
 773         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 774             bits="$cfg_rsakeylength"
 775         fi
 776         mkdir -p "$cfg_certsdir"
 777         [ -d "$cfg_certsdir" ]
 778         wwwcertcn=
 779         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 780                 wwwcertcn="$(
 781                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 782                         sed -e 's,[^/]*,,'
 783                 )"
 784         fi
 785         wwwcertdns=
 786         if [ -n "$cfg_wwwcertaltnames" ]; then
 787                 for dnsopt in $cfg_wwwcertaltnames; do
 788                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 789                 done
 790         fi
 791         wwwcertdnsfile=
 792         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 793                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 794         fi
 795         needroot=
 796         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 797         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 798         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 799         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 800         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 801         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 802                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 803                 umask 0077
 804                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 805                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 806                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 807                 umask 0022
 808                 echo "Created new root key"
 809         fi
 810         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 811                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 812                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 813                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 814                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 815                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 816                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 817                 echo "Created new root certificate"
 818         fi
 819         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 820                 umask 0077
 821                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 822                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 823                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 824                 umask 0022
 825                 echo "Created new www key"
 826         fi
 827         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 828                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 829                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 830                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 831                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 832                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 833                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 834                 echo "Created www certificate"
 835         fi
 836         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 837                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 838                 echo "Created www certificate chain file"
 839         fi
 840         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 841                 umask 0037
 842                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 843                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 844                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 845                 umask 0022
 846                 echo "Created new client key"
 847         fi
 848         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 849                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 850                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 851                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 852                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 853                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 854                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 855                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 856                 echo "Created client certificate"
 857         fi
 858         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 859                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 860                 echo "Created client certificate suffix file"
 861         fi
 862         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 863         if [ -n "$cfg_mob" ]; then
 864                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 865                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 866                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 867                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 868                         echo "Created new mob user key"
 869                 fi
 870                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 871                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 872                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 873                                 --cert "$cfg_clientcert" \
 874                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 875                         echo "Created mob user client certificate"
 876                 fi
 877                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 878                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 879         else
 880                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 881         fi
 882 else
 883         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 884         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 885 fi
 886
 887
 888 echo "*** Finalizing permissions and moving into place..."
 889 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 890 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 891
 892 # This should always be the very last thing install.sh does
 893 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 894 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 895 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 896 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 897 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 898 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
 899 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 900         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 901         touch "$cfg_chroot/etc/taskd.restart"
 902         chown_make "$cfg_chroot/etc/taskd.restart"
 903         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 904 }