install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if [ ! -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19 toolbox/check-perl-modules.pl
  20
  21 # What Config should we use?
  22 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  23 echo "*** Initializing using $GIROCCO_CONF..."
  24
  25 # First run Girocco::Config consistency checks
  26 perl -I. -M$GIROCCO_CONF -e ''
  27
  28 . ./shlib.sh
  29
  30 owngroup=""
  31 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  32 if [ -n "$cfg_httpspushurl" -a -z "$cfg_certsdir" ]; then
  33         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  34         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  35         exit 1
  36 fi
  37
  38
  39 echo "*** Checking for compiled utilities..."
  40 if [ ! -x src/can_user_push ]; then
  41         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  42         echo "ERROR: perhaps you forgot to run make?" >&2
  43         exit 1
  44 fi
  45 if [ ! -x src/can_user_push_http ]; then
  46         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  47         echo "ERROR: perhaps you forgot to run make?" >&2
  48         exit 1
  49 fi
  50 if [ ! -x src/getent ]; then
  51         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  52         echo "ERROR: perhaps you forgot to run make?" >&2
  53         exit 1
  54 fi
  55 if [ ! -x src/get_user_uuid ]; then
  56         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
  57         echo "ERROR: perhaps you forgot to run make?" >&2
  58         exit 1
  59 fi
  60 if [ ! -x src/peek_packet ]; then
  61         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
  62         echo "ERROR: perhaps you forgot to run make?" >&2
  63         exit 1
  64 fi
  65 if [ ! -x src/rangecgi ]; then
  66         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
  67         echo "ERROR: perhaps you forgot to run make?" >&2
  68         exit 1
  69 fi
  70
  71
  72 echo "*** Checking for ezcert..."
  73 if [ ! -f ezcert.git/CACreateCert ]; then
  74         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
  75         exit 1
  76 fi
  77
  78
  79 echo "*** Checking for git..."
  80 case "$cfg_git_bin" in /*) :;; *)
  81         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
  82         exit 1
  83 esac
  84 if [ ! -x "$cfg_git_bin" ]; then
  85         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
  86         exit 1
  87 fi
  88 if ! git_version="$("$cfg_git_bin" version)"; then
  89         echo "ERROR: $cfg_git_bin version failed" >&2
  90         exit 1
  91 fi
  92 case "$git_version" in
  93         [Gg]"it version "*) :;;
  94         *)
  95                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
  96                 exit 1
  97 esac
  98 echo "Found $cfg_git_bin $git_version"
  99 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 100 echo "*** Checking Git $git_vernum for compatibility..."
 101 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 102         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 103         exit 1
 104 fi
 105 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 106         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 107 fi
 108 if [ "$(vcmp "$git_vernum" 1.7.2)" -lt 0 ]; then
 109         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.2, some Girocco functionality will be disabled'
 110 fi
 111 if [ -n "$cfg_mirror" -a "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 112         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 113 fi
 114 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 115         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 116 fi
 117 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ]; then
 118         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 119         echo 'WARNING: See http://thread.gmane.org/gmane.comp.version-control.git/261638 for details'
 120 fi
 121 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" -a "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 122         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 123         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 124 fi
 125 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 126         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 127 fi
 128 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 129         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 130 fi
 131 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 132         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 133 fi
 134 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 135         cat <<'EOT'
 136
 137 ***
 138 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 139 ***
 140
 141 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 142 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 143 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.3.10) or later.
 144
 145 In order to bypass this check you will have to modify install.sh in which case
 146 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 147
 148 EOT
 149         exit 1
 150 fi
 151 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 152         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 153 fi
 154 if [ "$(vcmp "$git_vernum" 2.3.10)" -lt 0 ]; then
 155         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.10, security issues exist'
 156         cat <<'EOT'
 157
 158 ***
 159 *** IMPORTANT: $Girocco::Config::git_bin is set to a version of Git prior to 2.3.10
 160 ***
 161
 162 Besides the security fixes included in 2.3.9 and 2.3.10, versions prior to
 163 2.2.0 may accidentally prune unreachable loose objects earlier than intended.
 164 Since Git versions 2.2.0 through 2.3.1 are incompatible with Girocco, 2.3.3
 165 includes a performance improvement and the only significant changes between
 166 2.3.3 and 2.3.10 are the inclusion of the security updates, Git version 2.3.10
 167 should be considered the absolute minimum version of Git to use when running
 168 Girocco.
 169
 170 This is not enforced, but Git is easy to build from the git.git submodule and
 171 upgrading to GIT VERSION 2.3.10 OR LATER IS HIGHLY RECOMMENDED.
 172
 173 EOT
 174 fi
 175 if [ -n "$cfg_mirror" -a "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 176         cat <<'EOT'
 177
 178 ***
 179 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 180 ***
 181
 182 You appear to have enabled mirroring and the Git binary you have selected
 183 appears to contain an experimental patch that cannot be disabled.  This
 184 patch can generate invalid network DNS traffic and/or cause long delays
 185 when fetching using the "git:" protocol when no port number is specified.
 186 It may also end up retrieving repsitory contents from a host other than
 187 the one specified in the "git:" URL when the port is omitted.
 188
 189 You are advised to either build your own version of Git (the problem patch
 190 is not part of the official Git repository) or disable mirroring (via the
 191 $Girocco::Config:mirror setting) to avoid these potential problems.
 192
 193 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 194
 195 EOT
 196 fi
 197
 198
 199 chown_make() {
 200         if [ "$LOGNAME" = root -a -n "$SUDO_USER" -a "$SUDO_USER" != root ]; then
 201                 find "$@" -user root -print0 2>/dev/null | \
 202                 xargs -0 chown "$SUDO_USER:$(id -gn "$SUDO_USER")"
 203         elif [ "$LOGNAME" = root -a -z "$SUDO_USER" -o "$SUDO_USER" = root ]; then
 204                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 205         fi
 206 }
 207
 208 echo "*** Setting up basedir..."
 209 "$MAKE" --no-print-directory --silent apache.conf
 210 chown_make apache.conf
 211 "$MAKE" --no-print-directory --silent -C src
 212 chown_make src
 213 rm -fr "$cfg_basedir"
 214 mkdir -p "$cfg_basedir" "$cfg_basedir/gitweb"
 215 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$cfg_basedir"
 216 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/peek_packet src/rangecgi \
 217         ezcert.git/CACreateCert cgi/authrequired.cgi "$cfg_basedir/bin"
 218 cp -p gitweb/*.sh gitweb/*.perl "$cfg_basedir/gitweb"
 219 [ -n "$cfg_httpspushurl" ] || rm -f "$cfg_basedir"/html/rootcert.html "$cfg_basedir"/html/httpspush.html
 220 [ -n "$cfg_mob" ] || rm -f "$cfg_basedir"/html/mob.html
 221
 222 # Put the correct Config in place
 223 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$cfg_basedir/Girocco/Config.pm"
 224
 225
 226 echo "*** Preprocessing scripts..."
 227 perl -I. -M$GIROCCO_CONF -i -p \
 228         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 229         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 230         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 231         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 232         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 233         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 234         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 235         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 236         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 237         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 238         "$cfg_basedir"/jobs/*.sh "$cfg_basedir"/jobd/*.sh \
 239         "$cfg_basedir"/taskd/*.sh "$cfg_basedir"/gitweb/*.sh \
 240         "$cfg_basedir"/shlib.sh "$cfg_basedir"/hooks/* \
 241         "$cfg_basedir"/toolbox/*.sh "$cfg_basedir"/toolbox/*.pl \
 242         "$cfg_basedir"/toolbox/reports/*.sh \
 243         "$cfg_basedir"/bin/git-* "$cfg_basedir"/bin/*.sh \
 244         "$cfg_basedir"/bin/create-* "$cfg_basedir"/bin/update-* \
 245         "$cfg_basedir"/bin/authrequired.cgi "$cfg_basedir"/screen/*
 246
 247 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 248 get_girocco_config_var_list > "$cfg_basedir"/shlib_vars.sh
 249
 250 if [ -n "$cfg_mirror" ]; then
 251         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 252 fi
 253 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.sh, or add this"
 254 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 255 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.sh -q --all-once"
 256
 257
 258 echo "*** Setting up repository root..."
 259 mkdir -p "$cfg_reporoot" "$cfg_reporoot/_recyclebin"
 260 if [ "$cfg_owning_group" ]; then
 261         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 262         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 263 fi
 264 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 265 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 266
 267
 268 if [ -n "$cfg_chrooted" ]; then
 269         echo "*** Setting up chroot jail for pushing..."
 270         if [ "$(id -u)" -eq 0 ]; then
 271                 ./jailsetup.sh
 272         else
 273                 echo "WARNING: Skipping jail setup, not root"
 274         fi
 275 fi
 276
 277
 278 echo "*** Setting up jail configuration (project database)..."
 279 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 280 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 281 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 282 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 283         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 284 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 285         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the files"
 286 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 287         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 288 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 289
 290 echo "*** Setting up gitweb from git.git..."
 291 if [ ! -f git.git/Makefile ]; then
 292         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 293         exit 1
 294 fi
 295 mkdir -p "$cfg_webroot" "$cfg_cgiroot"
 296 (cd git.git && "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 297         GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" gitweb && \
 298         chown_make gitweb && \
 299         perl -pe 's/^(\s*use\s+warnings\s*;.*)$/#$1/' gitweb/gitweb.cgi > "$cfg_cgiroot"/gitweb.cgi.$$ && \
 300         chmod a+x "$cfg_cgiroot"/gitweb.cgi.$$ && \
 301         chown_make "$cfg_cgiroot"/gitweb.cgi.$$ && \
 302         mv -f "$cfg_cgiroot"/gitweb.cgi.$$ "$cfg_cgiroot"/gitweb.cgi && \
 303         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$cfg_webroot")
 304
 305
 306 echo "*** Setting up git-browser from git-browser.git..."
 307 if [ ! -f git-browser.git/git-browser.cgi ]; then
 308         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 309         exit 1
 310 fi
 311 mkdir -p "$cfg_webroot"/git-browser "$cfg_cgiroot"
 312 (cd git-browser.git && \
 313         CFG="$cfg_basedir/gitweb/git-browser.conf" perl -pe \
 314         's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi > "$cfg_cgiroot"/git-browser.cgi.$$ && \
 315         chmod a+x "$cfg_cgiroot"/git-browser.cgi.$$ && \
 316         chown_make "$cfg_cgiroot"/git-browser.cgi.$$ && \
 317         mv -f "$cfg_cgiroot"/git-browser.cgi.$$ "$cfg_cgiroot"/git-browser.cgi && \
 318         cp -r *.html *.js *.css js.lib "$cfg_webroot"/git-browser && \
 319         cp -r JSON "$cfg_cgiroot")
 320 rm -f "$cfg_webroot"/git-browser/index.html
 321 cat >"$cfg_basedir/gitweb"/git-browser.conf.$$ <<EOT
 322 gitbin: $cfg_git_bin
 323 warehouse: $cfg_reporoot
 324 EOT
 325 chown_make "$cfg_basedir/gitweb"/git-browser.conf.$$
 326 mv -f "$cfg_basedir/gitweb"/git-browser.conf.$$ "$cfg_basedir/gitweb"/git-browser.conf
 327 cat >"$cfg_webroot"/git-browser/GitConfig.js.$$ <<EOT
 328 cfg_gitweb_url="$cfg_gitweburl/"
 329 cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 330 EOT
 331 chown_make "$cfg_webroot"/git-browser/GitConfig.js.$$
 332 mv -f "$cfg_webroot"/git-browser/GitConfig.js.$$ "$cfg_webroot"/git-browser/GitConfig.js
 333
 334
 335 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 336 if [ ! -d bzr-fastimport.git/exporters/darcs/ ]; then
 337         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 338         exit 1
 339 fi
 340 mkdir -p "$cfg_basedir"/bin
 341 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$cfg_basedir"/bin
 342
 343
 344 echo "*** Setting up hg-fast-export from fast-export.git..."
 345 if [ ! -f fast-export.git/hg-fast-export.py -o ! -f fast-export.git/hg2git.py ]; then
 346         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 347         exit 1
 348 fi
 349 mkdir -p "$cfg_basedir"/bin
 350 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$cfg_basedir"/bin
 351
 352
 353 echo "*** Setting up markdown from markdown.git..."
 354 if [ ! -f markdown.git/Markdown.pl ]; then
 355         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 356         exit 1
 357 fi
 358 mkdir -p "$cfg_basedir"/bin
 359 cp markdown.git/Markdown.pl "$cfg_basedir"/bin
 360
 361
 362 echo "*** Setting up our part of the website..."
 363 mkdir -p "$cfg_webroot" "$cfg_cgiroot"
 364 cp cgi/*.cgi "$cfg_cgiroot"
 365 rm -f "$cfg_cgiroot"/authrequired.cgi
 366 [ -z "$cfg_httpspushurl" ] || cp "$cfg_basedir"/bin/authrequired.cgi "$cfg_cgiroot"
 367 [ -n "$cfg_httpspushurl" ] || rm -f "$cfg_cgiroot"/usercert.cgi
 368 ln -fs "$cfg_basedir"/Girocco "$cfg_cgiroot"
 369 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 370 if [ -z "$cfg_httpspushurl" ]; then
 371         grep -v 'rootcert[.]html' gitweb/indextext.html > "$cfg_basedir/gitweb/indextext.html"
 372 else
 373         cp gitweb/indextext.html "$cfg_basedir/gitweb"
 374 fi
 375 mv "$cfg_basedir"/html/*.css "$cfg_basedir"/html/*.js "$cfg_webroot"
 376 cp mootools.js "$cfg_webroot"
 377 cp htaccess "$cfg_webroot/.htaccess"
 378 cp cgi/htaccess "$cfg_cgiroot/.htaccess"
 379 cp git-favicon.ico "$cfg_webroot/favicon.ico"
 380 cp robots.txt "$cfg_webroot"
 381 cat gitweb/gitweb.css >>"$cfg_webroot"/gitweb.css
 382
 383
 384 if [ -n "$cfg_httpspushurl" ]; then
 385         echo "*** Setting up SSL certificates..."
 386         bits=2048
 387         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 388             bits="$cfg_rsakeylength"
 389         fi
 390         mkdir -p "$cfg_certsdir"
 391         [ -d "$cfg_certsdir" ]
 392         wwwcertcn=
 393         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 394                 wwwcertcn="$( \
 395                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject | \
 396                         sed -e 's,[^/]*,,' \
 397                 )"
 398         fi
 399         wwwcertdns=
 400         if [ -n "$cfg_wwwcertaltnames" ]; then
 401                 for dnsopt in $cfg_wwwcertaltnames; do
 402                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 403                 done
 404         fi
 405         wwwcertdnsfile=
 406         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 407                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 408         fi
 409         needroot=
 410         [ -e "$cfg_certsdir/girocco_client_crt.pem" -a \
 411         -e "$cfg_certsdir/girocco_client_key.pem" -a \
 412         -e "$cfg_certsdir/girocco_www_key.pem" -a \
 413         -e "$cfg_certsdir/girocco_www_crt.pem" -a "$wwwcertcn" = "/CN=$cfg_httpsdnsname" -a \
 414         -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 415         if [ -n "$needroot" -a ! -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 416                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 417                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 418                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 419                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 420                 echo "Created new root key"
 421         fi
 422         if [ ! -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 423                 ezcert.git/CACreateCert --root --key "$cfg_certsdir/girocco_root_key.pem" \
 424                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 425                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 426                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 427                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 428                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 429                 echo "Created new root certificate"
 430         fi
 431         if [ ! -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 432                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 433                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 434                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 435                 echo "Created new www key"
 436         fi
 437         if [ ! -e "$cfg_certsdir/girocco_www_crt.pem" ] || \
 438                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 439                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 440                 ezcert.git/CACreateCert --server --key "$cfg_certsdir/girocco_root_key.pem" \
 441                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 442                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 443                 printf '%s\n' "$wwwcertdns" > "$cfg_certsdir/girocco_www_crt.dns"
 444                 echo "Created www certificate"
 445         fi
 446         if [ ! -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 447                 cat "$cfg_certsdir/girocco_root_crt.pem" > "$cfg_certsdir/girocco_www_chain.pem"
 448                 echo "Created www certificate chain file"
 449         fi
 450         if [ ! -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 451                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 452                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 453                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 454                 echo "Created new client key"
 455         fi
 456         if [ ! -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 457                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 458                 ezcert.git/CACreateCert --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 459                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 460                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 461                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 462                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 463                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 464                 echo "Created client certificate"
 465         fi
 466         if [ ! -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 467                 cat "$cfg_certsdir/girocco_client_crt.pem" > "$cfg_certsdir/girocco_client_suffix.pem"
 468                 echo "Created client certificate suffix file"
 469         fi
 470         cat "$cfg_rootcert" > "$cfg_webroot/${cfg_nickname}_root_cert.pem"
 471         if [ -n "$cfg_mob" ]; then
 472                 if [ ! -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 473                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 474                         chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 475                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 476                         echo "Created new mob user key"
 477                 fi
 478                 if [ ! -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 479                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 480                         ezcert.git/CACreateCert --client --key "$cfg_clientkey" \
 481                                 --cert "$cfg_clientcert" \
 482                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 483                         echo "Created mob user client certificate"
 484                 fi
 485                 cat "$cfg_mobuserkey" > "$cfg_webroot/${cfg_nickname}_mob_key.pem"
 486                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" > "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 487         else
 488                 rm -f "$cfg_webroot/${cfg_nickname}_mob_key.pem" "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 489         fi
 490 else
 491         rm -f "$cfg_webroot/${cfg_nickname}_root_cert.pem"
 492         rm -f "$cfg_webroot/${cfg_nickname}_mob_key.pem" "$cfg_webroot/${cfg_nickname}_mob_user.pem"
 493 fi
 494
 495
 496 echo "*** Finalizing permissions..."
 497 chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_basedir" "$cfg_webroot" "$cfg_cgiroot"
 498 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"