install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # $1 must exist and be a dir
  32 # $2 may exist but must be a dir
  33 # $3 must not exist
  34 # After call $2 will be renamed to $3 (if $2 existed)
  35 # And $1 will be renamed to $2
  36 quick_move() {
  37         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  38         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  39         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  40         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  41         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  42                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  43                 echo "fatal: quick_move: rename failed" >&2
  44                 exit 1
  45         }
  46         ! [ -d "$1" ] && [ -d "$2" ] || {
  47                 echo "fatal: quick_move: rename failed" >&2
  48                 exit 1
  49         }
  50 }
  51
  52 check_sh_builtin() (
  53         "unset" -f command
  54         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  55 ) 2>/dev/null
  56
  57 owngroup=
  58 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  59 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  60         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  61         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  62         exit 1
  63 fi
  64
  65
  66 # Check for extra required tools
  67 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  68         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  69         exit 1
  70 fi
  71
  72
  73 echo "*** Checking for compiled utilities..."
  74 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  75         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  76         echo "ERROR: perhaps you forgot to run make?" >&2
  77         exit 1
  78 fi
  79 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  80         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  81         echo "ERROR: perhaps you forgot to run make?" >&2
  82         exit 1
  83 fi
  84 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  85         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  86         echo "ERROR: perhaps you forgot to run make?" >&2
  87         exit 1
  88 fi
  89 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  90         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
  91         echo "ERROR: perhaps you forgot to run make?" >&2
  92         exit 1
  93 fi
  94 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
  95         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
  96         echo "ERROR: perhaps you forgot to run make?" >&2
  97         exit 1
  98 fi
  99 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 100         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 101         echo "ERROR: perhaps you forgot to run make?" >&2
 102         exit 1
 103 fi
 104 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 105         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 106         echo "ERROR: perhaps you forgot to run make?" >&2
 107         exit 1
 108 fi
 109 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 110         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 111         echo "ERROR: perhaps you forgot to run make?" >&2
 112         exit 1
 113 fi
 114 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 115         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 116         echo "ERROR: perhaps you forgot to run make?" >&2
 117         exit 1
 118 fi
 119
 120
 121 echo "*** Checking for ezcert..."
 122 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 123         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 124         exit 1
 125 fi
 126
 127
 128 echo "*** Checking for git..."
 129 case "$cfg_git_bin" in /*) :;; *)
 130         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 131         exit 1
 132 esac
 133 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 134         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 135         exit 1
 136 fi
 137 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 138         echo "ERROR: $cfg_git_bin version failed" >&2
 139         exit 1
 140 fi
 141 case "$git_version" in
 142         [Gg]"it version "*) :;;
 143         *)
 144                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 145                 exit 1
 146 esac
 147 echo "Found $cfg_git_bin $git_version"
 148 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 149 echo "*** Checking Git $git_vernum for compatibility..."
 150 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 151         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 152         exit 1
 153 fi
 154 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 155         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 156 fi
 157 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 158         cat <<'EOT'
 159
 160 ***
 161 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 162 ***
 163
 164 Some Girocco functionality will be gracefully disabled and other things will
 165 just not work at all such as race condition protection against simultaneous
 166 client pushes and server garbage collections.
 167
 168 EOT
 169 fi
 170 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 171         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 172 fi
 173 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 174         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 175 fi
 176 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 177         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 178         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 179 fi
 180 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 181         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 182         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 183 fi
 184 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 189 fi
 190 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 192 fi
 193 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 194         cat <<'EOT'
 195
 196 ***
 197 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 198 ***
 199
 200 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 201 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 202 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 203
 204 In order to bypass this check you will have to modify install.sh in which case
 205 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 206
 207 EOT
 208         exit 1
 209 fi
 210 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 211         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 212 fi
 213 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 214         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 215 fi
 216 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 217         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 218         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 219         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 220         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 221         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 222 fi
 223 secmsg=
 224 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 225         secmsg='prior to 2.4.11'
 226 fi
 227 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 228         secmsg='2.5.x prior to 2.5.5'
 229 fi
 230 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 231         secmsg='2.6.x prior to 2.6.6'
 232 fi
 233 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 234         secmsg='2.7.x prior to 2.7.4'
 235 fi
 236 if [ -n "$secmsg" ]; then
 237         cat <<EOT
 238
 239 ***
 240 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 241 ***
 242
 243 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 244 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 245
 246 Besides the security fixes included in later versions, versions prior to
 247 2.2.0 may accidentally prune unreachable loose objects earlier than
 248 intended.  Since Git version 2.4.11 is the minimum version to include all
 249 security fixes to date, it should be considered the absolute minimum
 250 version of Git to use when running Girocco.
 251
 252 This is not enforced, but Git is easy to build from the git.git submodule
 253 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 254
 255 We will now pause for a moment so you can reflect on this warning.
 256
 257 EOT
 258         sleep 60
 259 fi
 260 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 261         cat <<'EOT'
 262
 263 ***
 264 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 265 ***
 266
 267 You appear to have enabled mirroring and the Git binary you have selected
 268 appears to contain an experimental patch that cannot be disabled.  This
 269 patch can generate invalid network DNS traffic and/or cause long delays
 270 when fetching using the "git:" protocol when no port number is specified.
 271 It may also end up retrieving repsitory contents from a host other than
 272 the one specified in the "git:" URL when the port is omitted.
 273
 274 You are advised to either build your own version of Git (the problem patch
 275 is not part of the official Git repository) or disable mirroring (via the
 276 $Girocco::Config:mirror setting) to avoid these potential problems.
 277
 278 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 279
 280 EOT
 281         sleep 5
 282 fi
 283
 284 test_nc_U() {
 285         [ -n "$1" ] || return 1
 286         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 287         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 288         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 289         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 290         >"$_tmpdir/output"
 291         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 292         _bgpid="$!"
 293         sleep 1
 294         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 295         sleep 1
 296         kill "$_bgpid" >/dev/null 2>&1 || :
 297         read -r _result <"$_tmpdir/output" || :
 298         _bad=
 299         ! [ -e "$_tmpdir/failed" ] || _bad=1
 300         rm -rf "$_tmpdir"
 301         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 302 } >/dev/null 2>&1
 303
 304 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 305 test_nc_U "$var_nc_openbsd_bin" || {
 306         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 307         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 308         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 309                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 310         fi
 311         exit 1
 312 }
 313
 314 echo "*** Verifying selected POSIX sh is sane..."
 315 shbin="$var_sh_bin"
 316 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 317         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 318         exit 1
 319 }
 320 [ "$(check_sh_builtin command)" = "command" ] || {
 321         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 322         exit 1
 323 }
 324 sh_not_builtin=
 325 sh_extra_chroot_installs=
 326 badsh=
 327 for sbi in cd pwd read umask unset unalias; do
 328         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 329                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 330                 badsh=1
 331         fi
 332 done
 333 [ -z "$badsh" ] || exit 1
 334 for sbi in '[' echo printf test; do
 335         if ! extra="$(check_sh_builtin "$sbi")"; then
 336                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 337                 badsh=1
 338                 continue
 339         fi
 340         if [ "$extra" != "$sbi" ]; then
 341                 case "$extra" in /*) :;; *)
 342                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 343                         badsh=1
 344                         continue
 345                 esac
 346                 withspc=
 347                 case "$extra" in *" "*) withspc=1; esac
 348                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 349                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 350                         badsh=1
 351                         continue
 352                 }
 353                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 354                 sh_not_builtin="$sh_not_builtin $sbi"
 355                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 356         fi
 357 done
 358 [ -z "$badsh" ] || exit 1
 359 [ -z "$sh_extra_chroot_installs" ] || {
 360         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 361         echo "WARNING: as a result it will run slower than necessary" >&2
 362         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 363         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 364         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 365         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 366         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 367 }
 368
 369 echo "*** Verifying xargs is sane..."
 370 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 371 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 372 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 373 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 374         echo 'ERROR: xargs is unusable' >&2
 375         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 376         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 377         echo 'ERROR: must be true, but neither is' >&2
 378         exit 1
 379 }
 380
 381 echo "*** Verifying selected perl is sane..."
 382 perlbin="$var_perl_bin"
 383 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 384         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 385         exit 1
 386 }
 387
 388 echo "*** Verifying selected gzip is sane..."
 389 gzipbin="$var_gzip_bin"
 390 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 391     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 392         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 393         exit 1
 394 }
 395
 396 echo "*** Verifying basedir, webroot and cgiroot paths..."
 397 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 398 case "$cfg_basedir" in /*) :;; *)
 399         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 400         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 401         exit 1
 402 esac
 403 case "$cfg_webroot" in /*) :;; *)
 404         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 405         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 406         exit 1
 407 esac
 408 case "$cfg_cgiroot" in /*) :;; *)
 409         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 410         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 411         exit 1
 412 esac
 413
 414 # return the input with trailing slashes stripped but return "/" for all "/"s
 415 striptrsl() {
 416         [ -n "$1" ] || return 0
 417         _s="${1##*[!/]}"
 418         [ "$_s" != "$1" ] || _s="${_s#?}"
 419         printf "%s\n" "${1%$_s}"
 420 }
 421
 422 # a combination of realpath + dirname where the realpath of the deepest existing
 423 # directory is returned with the rest of the non-existing components appended
 424 # and trailing slashes and multiple slashes are removed
 425 realdir() {
 426         _d="$(striptrsl "$1")"
 427         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 428                 echo "$_d"
 429                 return 0
 430         fi
 431         _c=""
 432         while ! [ -d "$_d" ]; do
 433                 _c="/$(basename "$_d")$_c"
 434                 _d="$(dirname "$_d")"
 435                 [ "$_d" != "/" ] || _c="${_c#/}"
 436         done
 437         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 438 }
 439
 440 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 441 # Wherever we are writing/copying/installing files we use these, but where we
 442 # are editing, adding config settings or printing advice we always stick to the
 443 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 444 # Only the file system directories that could be asynchronously accessed (by
 445 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 446 # The chroot is handled specially and does not need one of these.
 447 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 448 # case the prior contents of cgiroot and/or webroot are discarded.
 449 rbasedir="$(realdir "$cfg_basedir")"
 450 rwebroot="$(realdir "$cfg_webroot")"
 451 rcgiroot="$(realdir "$cfg_cgiroot")"
 452 case "$rbasedir" in "$rwebroot"/?*)
 453         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 454         exit 1
 455 esac
 456 case "$rbasedir" in "$rcgiroot"/?*)
 457         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 458         exit 1
 459 esac
 460 if [ "$rwebroot" = "$rcgiroot" ]; then
 461         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 462         exit 1
 463 fi
 464 case "$rcgiroot" in "$rwebroot"/?*)
 465         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 466         exit 1
 467 esac
 468 case "$rwebroot" in "$rcgiroot"/?*)
 469         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 470         exit 1
 471 esac
 472 basedir="$rbasedir-new"
 473 case "$rwebroot" in
 474         "$rbasedir"/?*)
 475                 webroot="$basedir${rwebroot#$rbasedir}"
 476                 webrootsub=1
 477                 ;;
 478         *)
 479                 webroot="$rwebroot-new"
 480                 webrootsub=
 481                 ;;
 482 esac
 483 case "$rcgiroot" in
 484         "$rbasedir"/?*)
 485                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 486                 cgirootsub=1
 487                 ;;
 488         *)
 489                 cgiroot="$rcgiroot-new"
 490                 cgirootsub=
 491                 ;;
 492 esac
 493
 494 echo "*** Setting up basedir..."
 495
 496 chown_make() {
 497         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 498                 find "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 499         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 500                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 501         fi
 502 }
 503
 504 "$MAKE" --no-print-directory --silent apache.conf
 505 chown_make apache.conf
 506 "$MAKE" --no-print-directory --silent -C src
 507 chown_make src
 508 rm -fr "$basedir"
 509 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 510 cp cgi/*.cgi "$basedir/cgi"
 511 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 512 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 513         src/rangecgi src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 514         cgi/snapshot.cgi "$basedir/bin"
 515 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 516 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 517 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 518
 519 # Put the correct Config in place
 520 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 521
 522 # Create symbolic links to selected binaries
 523 ln -s "$cfg_git_bin" "$basedir/bin/git"
 524 ln -s "$shbin" "$basedir/bin/sh"
 525 ln -s "$perlbin" "$basedir/bin/perl"
 526 ln -s "$gzipbin" "$basedir/bin/gzip"
 527
 528 echo "*** Preprocessing scripts..."
 529 SHBIN="$shbin" && export SHBIN
 530 PERLBIN="$perlbin" && export PERLBIN
 531 perl -I. -M$GIROCCO_CONF -i -p \
 532         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 533         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 534         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 535         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 536         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 537         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 538         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 539         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 540         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 541         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 542         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 543         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 544         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 545         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 546         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 547         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 548         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 549         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 550         -e 'close ARGV if eof;' \
 551         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 552         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 553         "$basedir"/shlib.sh "$basedir"/hooks/* \
 554         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 555         "$basedir"/toolbox/reports/*.sh \
 556         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 557         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 558         "$basedir"/bin/*.cgi "$basedir"/screen/*
 559 perl -I. -M$GIROCCO_CONF -i -p \
 560         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 561         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 562         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 563 perl -i -p \
 564         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 565         -e 'close ARGV if eof;' \
 566         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 567         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 568 perl -i -p \
 569         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 570         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 571         -e 'close ARGV if eof;' \
 572         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 573 unset PERLBIN
 574 unset SHBIN
 575
 576 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 577 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 578
 579 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 580 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 581    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 582         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 583         exit 1
 584 fi
 585 mkdir -p "$basedir"/bin
 586 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 587
 588 echo "*** Setting up hg-fast-export from fast-export.git..."
 589 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 590         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 591         exit 1
 592 fi
 593 mkdir -p "$basedir"/bin
 594 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 595
 596 echo "*** Setting up markdown from markdown.git..."
 597 if ! [ -f markdown.git/Markdown.pl ]; then
 598         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 599         exit 1
 600 fi
 601 mkdir -p "$basedir"/bin
 602 (PERLBIN="$perlbin" && export PERLBIN &&
 603         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 604                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 605         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 606         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 607 test $? -eq 0
 608
 609 # Some permission sanity on basedir/bin just in case
 610 find "$basedir"/bin -type f -exec chmod go-w '{}' +
 611 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 612
 613 if [ -n "$cfg_mirror" ]; then
 614         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 615 fi
 616 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.sh, or add this"
 617 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 618 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.sh -q --all-once"
 619
 620
 621 echo "*** Setting up repository root..."
 622 mkdir -p "$cfg_reporoot" "$cfg_reporoot/_recyclebin"
 623 if [ "$cfg_owning_group" ]; then
 624         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 625         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 626 fi
 627 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 628 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 629
 630
 631 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 632         echo "*** Setting up chroot jail for pushing..."
 633         if [ "$(id -u)" -eq 0 ]; then
 634                 # jailsetup may install things from $cfg_basedir/bin into the
 635                 # chroot so we do a mini-update of just that portion now
 636                 mkdir -p "$cfg_basedir"
 637                 rm -rf "$cfg_basedir/bin-new"
 638                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 639                 rm -rf "$cfg_basedir/bin-old"
 640                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 641                 rm -rf "$cfg_basedir/bin-old"
 642                 if [ -n "$sh_extra_chroot_installs" ]; then
 643                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 644                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 645                 fi
 646                 ./jailsetup.sh
 647                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 648         else
 649                 echo "WARNING: Skipping jail setup, not root"
 650         fi
 651 fi
 652
 653
 654 echo "*** Setting up jail configuration (project database)..."
 655 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 656 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 657 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 658 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 659         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 660 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 661         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 662 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 663         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 664 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 665
 666
 667 echo "*** Setting up gitweb from git.git..."
 668 if ! [ -f git.git/Makefile ]; then
 669         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 670         exit 1
 671 fi
 672
 673 # We do not wholesale replace either webroot or cgiroot unless they are under
 674 # basedir so if they exist and are not we make a copy to start working on them.
 675 # We make a copy using -p which can result in some warnings so we suppress
 676 # error output as it's of no consequence in this case.
 677 rm -rf "$webroot" "$cgiroot"
 678 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 679 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 680 mkdir -p "$webroot" "$cgiroot"
 681
 682 (
 683         cd git.git &&
 684         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 685                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 686         chown_make gitweb &&
 687         PERLBIN="$perlbin" && export PERLBIN &&
 688         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 689                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 690         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 691         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 692         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 693         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 694 )
 695 test $? -eq 0
 696
 697
 698 echo "*** Setting up git-browser from git-browser.git..."
 699 if ! [ -f git-browser.git/git-browser.cgi ]; then
 700         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 701         exit 1
 702 fi
 703 mkdir -p "$webroot"/git-browser "$cgiroot"
 704 (
 705         cd git-browser.git &&
 706         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 707         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 708                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 709                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 710         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 711         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 712         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 713         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 714         cp -r JSON "$cgiroot"
 715 )
 716 test $? -eq 0
 717 rm -f "$webroot"/git-browser/index.html
 718 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 719         gitbin: $cfg_git_bin
 720         warehouse: $cfg_reporoot
 721         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 722 EOT
 723 chown_make "$basedir/gitweb"/git-browser.conf.$$
 724 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 725 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 726         cfg_gitweb_url="$cfg_gitweburl/"
 727         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 728 EOT
 729 chown_make "$webroot"/git-browser/GitConfig.js.$$
 730 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 731
 732
 733 echo "*** Setting up our part of the website..."
 734 mkdir -p "$webroot" "$cgiroot"
 735 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 736 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 737 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 738 cp "$basedir/cgi"/*.cgi "$cgiroot"
 739 rm -rf "$basedir/cgi"
 740 ln -fs "$cfg_basedir"/Girocco "$cgiroot"
 741 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 742 if [ -z "$cfg_httpspushurl" ]; then
 743         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 744 else
 745         cp gitweb/indextext.html "$basedir/gitweb"
 746 fi
 747 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 748 cp mootools.js "$webroot"
 749 cp htaccess "$webroot/.htaccess"
 750 cp cgi/htaccess "$cgiroot/.htaccess"
 751 cp git-favicon.ico "$webroot/favicon.ico"
 752 cp robots.txt "$webroot"
 753 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 754
 755
 756 if [ -n "$cfg_httpspushurl" ]; then
 757         echo "*** Setting up SSL certificates..."
 758         bits=2048
 759         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 760             bits="$cfg_rsakeylength"
 761         fi
 762         mkdir -p "$cfg_certsdir"
 763         [ -d "$cfg_certsdir" ]
 764         wwwcertcn=
 765         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 766                 wwwcertcn="$(
 767                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 768                         sed -e 's,[^/]*,,'
 769                 )"
 770         fi
 771         wwwcertdns=
 772         if [ -n "$cfg_wwwcertaltnames" ]; then
 773                 for dnsopt in $cfg_wwwcertaltnames; do
 774                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 775                 done
 776         fi
 777         wwwcertdnsfile=
 778         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 779                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 780         fi
 781         needroot=
 782         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 783         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 784         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 785         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 786         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 787         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 788                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 789                 umask 0077
 790                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 791                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 792                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 793                 umask 0022
 794                 echo "Created new root key"
 795         fi
 796         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 797                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 798                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 799                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 800                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 801                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 802                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 803                 echo "Created new root certificate"
 804         fi
 805         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 806                 umask 0077
 807                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 808                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 809                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 810                 umask 0022
 811                 echo "Created new www key"
 812         fi
 813         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 814                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 815                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 816                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 817                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 818                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 819                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 820                 echo "Created www certificate"
 821         fi
 822         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 823                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 824                 echo "Created www certificate chain file"
 825         fi
 826         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 827                 umask 0037
 828                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 829                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 830                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 831                 umask 0022
 832                 echo "Created new client key"
 833         fi
 834         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 835                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 836                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 837                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 838                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 839                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 840                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 841                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 842                 echo "Created client certificate"
 843         fi
 844         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 845                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 846                 echo "Created client certificate suffix file"
 847         fi
 848         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 849         if [ -n "$cfg_mob" ]; then
 850                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 851                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 852                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 853                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 854                         echo "Created new mob user key"
 855                 fi
 856                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 857                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 858                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 859                                 --cert "$cfg_clientcert" \
 860                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 861                         echo "Created mob user client certificate"
 862                 fi
 863                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 864                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 865         else
 866                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 867         fi
 868 else
 869         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 870         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 871 fi
 872
 873
 874 echo "*** Finalizing permissions and moving into place..."
 875 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 876 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 877
 878 # This should always be the very last thing install.sh does
 879 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 880 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 881 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 882 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 883 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 884 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 885         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 886         touch "$cfg_chroot/etc/taskd.restart"
 887         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 888 }