install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_reporoot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_reporoot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::reporoot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 # $1 must exist and be a dir
  41 # $2 may exist but must be a dir
  42 # $3 must not exist
  43 # After call $2 will be renamed to $3 (if $2 existed)
  44 # And $1 will be renamed to $2
  45 quick_move() {
  46         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  47         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  48         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  49         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  50         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  51                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  52                 echo "fatal: quick_move: rename failed" >&2
  53                 exit 1
  54         }
  55         ! [ -d "$1" ] && [ -d "$2" ] || {
  56                 echo "fatal: quick_move: rename failed" >&2
  57                 exit 1
  58         }
  59 }
  60
  61 check_sh_builtin() (
  62         "unset" -f command
  63         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  64 ) 2>/dev/null
  65
  66 owngroup=
  67 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  68 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  69         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  70         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  71         exit 1
  72 fi
  73
  74
  75 # Check for extra required tools
  76 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  77         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  78         exit 1
  79 fi
  80
  81
  82 echo "*** Checking for compiled utilities..."
  83 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  84         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  85         echo "ERROR: perhaps you forgot to run make?" >&2
  86         exit 1
  87 fi
  88 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  89         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  90         echo "ERROR: perhaps you forgot to run make?" >&2
  91         exit 1
  92 fi
  93 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  94         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  95         echo "ERROR: perhaps you forgot to run make?" >&2
  96         exit 1
  97 fi
  98 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  99         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 100         echo "ERROR: perhaps you forgot to run make?" >&2
 101         exit 1
 102 fi
 103 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 104         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 105         echo "ERROR: perhaps you forgot to run make?" >&2
 106         exit 1
 107 fi
 108 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 109         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 110         echo "ERROR: perhaps you forgot to run make?" >&2
 111         exit 1
 112 fi
 113 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 114         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 115         echo "ERROR: perhaps you forgot to run make?" >&2
 116         exit 1
 117 fi
 118 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 119         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 120         echo "ERROR: perhaps you forgot to run make?" >&2
 121         exit 1
 122 fi
 123 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 124         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 125         echo "ERROR: perhaps you forgot to run make?" >&2
 126         exit 1
 127 fi
 128 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 129         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 130         echo "ERROR: perhaps you forgot to run make?" >&2
 131         exit 1
 132 fi
 133
 134
 135 echo "*** Checking for ezcert..."
 136 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 137         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 138         exit 1
 139 fi
 140
 141
 142 echo "*** Checking for git..."
 143 case "$cfg_git_bin" in /*) :;; *)
 144         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 145         exit 1
 146 esac
 147 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 148         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 149         exit 1
 150 fi
 151 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 152         echo "ERROR: $cfg_git_bin version failed" >&2
 153         exit 1
 154 fi
 155 case "$git_version" in
 156         [Gg]"it version "*) :;;
 157         *)
 158                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 159                 exit 1
 160 esac
 161 echo "Found $cfg_git_bin $git_version"
 162 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 163 echo "*** Checking Git $git_vernum for compatibility..."
 164 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 165         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 166         exit 1
 167 fi
 168 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 169         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 170 fi
 171 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 172         cat <<'EOT'
 173
 174 ***
 175 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 176 ***
 177
 178 Some Girocco functionality will be gracefully disabled and other things will
 179 just not work at all such as race condition protection against simultaneous
 180 client pushes and server garbage collections.
 181
 182 EOT
 183 fi
 184 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 189 fi
 190 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 192         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 193 fi
 194 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 195         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 196         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 197 fi
 198 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 199         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 200 fi
 201 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 202         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 203 fi
 204 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 205         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 206 fi
 207 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 208         cat <<'EOT'
 209
 210 ***
 211 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 212 ***
 213
 214 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 215 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 216 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 217
 218 In order to bypass this check you will have to modify install.sh in which case
 219 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 220
 221 EOT
 222         exit 1
 223 fi
 224 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 225         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 226 fi
 227 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 228         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 229 fi
 230 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 231         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 232         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 233         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 234         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 235         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 236 fi
 237 secmsg=
 238 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 239         secmsg='prior to 2.4.11'
 240 fi
 241 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 242         secmsg='2.5.x prior to 2.5.5'
 243 fi
 244 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 245         secmsg='2.6.x prior to 2.6.6'
 246 fi
 247 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 248         secmsg='2.7.x prior to 2.7.4'
 249 fi
 250 if [ -n "$secmsg" ]; then
 251         cat <<EOT
 252
 253 ***
 254 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 255 ***
 256
 257 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 258 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 259
 260 Besides the security fixes included in later versions, versions prior to
 261 2.2.0 may accidentally prune unreachable loose objects earlier than
 262 intended.  Since Git version 2.4.11 is the minimum version to include all
 263 security fixes to date, it should be considered the absolute minimum
 264 version of Git to use when running Girocco.
 265
 266 This is not enforced, but Git is easy to build from the git.git submodule
 267 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 268
 269 We will now pause for a moment so you can reflect on this warning.
 270
 271 EOT
 272         sleep 60
 273 fi
 274 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 275         cat <<'EOT'
 276
 277 ***
 278 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 279 ***
 280
 281 You appear to have enabled mirroring and the Git binary you have selected
 282 appears to contain an experimental patch that cannot be disabled.  This
 283 patch can generate invalid network DNS traffic and/or cause long delays
 284 when fetching using the "git:" protocol when no port number is specified.
 285 It may also end up retrieving repsitory contents from a host other than
 286 the one specified in the "git:" URL when the port is omitted.
 287
 288 You are advised to either build your own version of Git (the problem patch
 289 is not part of the official Git repository) or disable mirroring (via the
 290 $Girocco::Config:mirror setting) to avoid these potential problems.
 291
 292 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 293
 294 EOT
 295         sleep 5
 296 fi
 297
 298 test_nc_U() {
 299         [ -n "$1" ] || return 1
 300         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 301         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 302         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 303         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 304         >"$_tmpdir/output"
 305         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 306         _bgpid="$!"
 307         sleep 1
 308         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 309         sleep 1
 310         kill "$_bgpid" >/dev/null 2>&1 || :
 311         read -r _result <"$_tmpdir/output" || :
 312         _bad=
 313         ! [ -e "$_tmpdir/failed" ] || _bad=1
 314         rm -rf "$_tmpdir"
 315         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 316 } >/dev/null 2>&1
 317
 318 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 319 test_nc_U "$var_nc_openbsd_bin" || {
 320         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 321         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 322         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 323                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 324         fi
 325         exit 1
 326 }
 327
 328 echo "*** Verifying selected POSIX sh is sane..."
 329 shbin="$var_sh_bin"
 330 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 331         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 332         exit 1
 333 }
 334 [ "$(check_sh_builtin command)" = "command" ] || {
 335         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 336         exit 1
 337 }
 338 sh_not_builtin=
 339 sh_extra_chroot_installs=
 340 badsh=
 341 for sbi in cd pwd read umask unset unalias; do
 342         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 343                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 344                 badsh=1
 345         fi
 346 done
 347 [ -z "$badsh" ] || exit 1
 348 for sbi in '[' echo printf test; do
 349         if ! extra="$(check_sh_builtin "$sbi")"; then
 350                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 351                 badsh=1
 352                 continue
 353         fi
 354         if [ "$extra" != "$sbi" ]; then
 355                 case "$extra" in /*) :;; *)
 356                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 357                         badsh=1
 358                         continue
 359                 esac
 360                 withspc=
 361                 case "$extra" in *" "*) withspc=1; esac
 362                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 363                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 364                         badsh=1
 365                         continue
 366                 }
 367                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 368                 sh_not_builtin="$sh_not_builtin $sbi"
 369                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 370         fi
 371 done
 372 [ -z "$badsh" ] || exit 1
 373 [ -z "$sh_extra_chroot_installs" ] || {
 374         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 375         echo "WARNING: as a result it will run slower than necessary" >&2
 376         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 377         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 378         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 379         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 380         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 381 }
 382
 383 echo "*** Verifying xargs is sane..."
 384 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 385 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 386 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 387 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 388         echo 'ERROR: xargs is unusable' >&2
 389         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 390         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 391         echo 'ERROR: must be true, but neither is' >&2
 392         exit 1
 393 }
 394
 395 echo "*** Verifying selected perl is sane..."
 396 perlbin="$var_perl_bin"
 397 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 398         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 399         exit 1
 400 }
 401
 402 echo "*** Verifying selected gzip is sane..."
 403 gzipbin="$var_gzip_bin"
 404 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 405     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 406         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 407         exit 1
 408 }
 409
 410 echo "*** Verifying basedir, webroot and cgiroot paths..."
 411 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 412 case "$cfg_basedir" in /*) :;; *)
 413         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 414         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 415         exit 1
 416 esac
 417 case "$cfg_webroot" in /*) :;; *)
 418         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 419         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 420         exit 1
 421 esac
 422 case "$cfg_cgiroot" in /*) :;; *)
 423         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 424         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 425         exit 1
 426 esac
 427
 428 # return the input with trailing slashes stripped but return "/" for all "/"s
 429 striptrsl() {
 430         [ -n "$1" ] || return 0
 431         _s="${1##*[!/]}"
 432         [ "$_s" != "$1" ] || _s="${_s#?}"
 433         printf "%s\n" "${1%$_s}"
 434 }
 435
 436 # a combination of realpath + dirname where the realpath of the deepest existing
 437 # directory is returned with the rest of the non-existing components appended
 438 # and trailing slashes and multiple slashes are removed
 439 realdir() {
 440         _d="$(striptrsl "$1")"
 441         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 442                 echo "$_d"
 443                 return 0
 444         fi
 445         _c=""
 446         while ! [ -d "$_d" ]; do
 447                 _c="/$(basename "$_d")$_c"
 448                 _d="$(dirname "$_d")"
 449                 [ "$_d" != "/" ] || _c="${_c#/}"
 450         done
 451         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 452 }
 453
 454 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 455 # Wherever we are writing/copying/installing files we use these, but where we
 456 # are editing, adding config settings or printing advice we always stick to the
 457 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 458 # Only the file system directories that could be asynchronously accessed (by
 459 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 460 # The chroot is handled specially and does not need one of these.
 461 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 462 # case the prior contents of cgiroot and/or webroot are discarded.
 463 rbasedir="$(realdir "$cfg_basedir")"
 464 rwebroot="$(realdir "$cfg_webroot")"
 465 rcgiroot="$(realdir "$cfg_cgiroot")"
 466 case "$rbasedir" in "$rwebroot"/?*)
 467         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 468         exit 1
 469 esac
 470 case "$rbasedir" in "$rcgiroot"/?*)
 471         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 472         exit 1
 473 esac
 474 if [ "$rwebroot" = "$rcgiroot" ]; then
 475         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 476         exit 1
 477 fi
 478 case "$rcgiroot" in "$rwebroot"/?*)
 479         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 480         exit 1
 481 esac
 482 case "$rwebroot" in "$rcgiroot"/?*)
 483         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 484         exit 1
 485 esac
 486 basedir="$rbasedir-new"
 487 case "$rwebroot" in
 488         "$rbasedir"/?*)
 489                 webroot="$basedir${rwebroot#$rbasedir}"
 490                 webrootsub=1
 491                 ;;
 492         *)
 493                 webroot="$rwebroot-new"
 494                 webrootsub=
 495                 ;;
 496 esac
 497 case "$rcgiroot" in
 498         "$rbasedir"/?*)
 499                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 500                 cgirootsub=1
 501                 ;;
 502         *)
 503                 cgiroot="$rcgiroot-new"
 504                 cgirootsub=
 505                 ;;
 506 esac
 507
 508 echo "*** Setting up basedir..."
 509
 510 chown_make() {
 511         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 512                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 513         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 514                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 515         fi
 516 }
 517
 518 "$MAKE" --no-print-directory --silent apache.conf
 519 chown_make apache.conf
 520 "$MAKE" --no-print-directory --silent -C src
 521 chown_make src
 522 rm -fr "$basedir"
 523 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 524 cp cgi/*.cgi "$basedir/cgi"
 525 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 526 find -H "$basedir" -type l -exec rm -f '{}' +
 527 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 528         src/rangecgi src/readlink src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 529         cgi/snapshot.cgi "$basedir/bin"
 530 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 531 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 532 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 533
 534 # Put the correct Config in place
 535 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 536
 537 # Create symbolic links to selected binaries
 538 ln -s "$cfg_git_bin" "$basedir/bin/git"
 539 ln -s "$shbin" "$basedir/bin/sh"
 540 ln -s "$perlbin" "$basedir/bin/perl"
 541 ln -s "$gzipbin" "$basedir/bin/gzip"
 542
 543 echo "*** Preprocessing scripts..."
 544 SHBIN="$shbin" && export SHBIN
 545 PERLBIN="$perlbin" && export PERLBIN
 546 perl -I. -M$GIROCCO_CONF -i -p \
 547         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 548         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 549         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 550         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 551         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 552         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 553         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 554         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 555         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 556         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 557         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 558         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 559         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 560         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 561         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 562         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 563         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 564         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 565         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 566         -e 's/\@fetch_stash_refs\@/"$Girocco::Config::fetch_stash_refs"/g;' \
 567         -e 'close ARGV if eof;' \
 568         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 569         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 570         "$basedir"/shlib.sh "$basedir"/hooks/* \
 571         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 572         "$basedir"/toolbox/reports/*.sh \
 573         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 574         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 575         "$basedir"/bin/*.cgi "$basedir"/screen/*
 576 perl -I. -M$GIROCCO_CONF -i -p \
 577         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 578         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 579         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 580 perl -i -p \
 581         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 582         -e 'close ARGV if eof;' \
 583         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 584         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 585 perl -i -p \
 586         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 587         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 588         -e 'close ARGV if eof;' \
 589         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 590 unset PERLBIN
 591 unset SHBIN
 592
 593 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 594 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 595
 596 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 597 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 598    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 599         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 600         exit 1
 601 fi
 602 mkdir -p "$basedir"/bin
 603 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 604
 605 echo "*** Setting up hg-fast-export from fast-export.git..."
 606 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 607         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 608         exit 1
 609 fi
 610 mkdir -p "$basedir"/bin
 611 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 612
 613 echo "*** Setting up markdown from markdown.git..."
 614 if ! [ -f markdown.git/Markdown.pl ]; then
 615         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 616         exit 1
 617 fi
 618 mkdir -p "$basedir"/bin
 619 (PERLBIN="$perlbin" && export PERLBIN &&
 620         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 621                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 622         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 623         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 624 test $? -eq 0
 625
 626 # Some permission sanity on basedir/bin just in case
 627 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 628 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 629
 630 if [ -n "$cfg_mirror" ]; then
 631         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 632 fi
 633 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 634 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 635 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 636
 637
 638 echo "*** Setting up repository root..."
 639 [ -d "$cfg_reporoot" ] || {
 640         mkdir -p "$cfg_reporoot"
 641         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 642         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 643 }
 644 [ -z "$cfg_owning_group" ] ||
 645         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 646 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 647 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks"
 648 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" ||
 649         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 650 if [ "$cfg_owning_group" ]; then
 651         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 652         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 653 fi
 654 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 655 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 656
 657
 658 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 659         echo "*** Setting up chroot jail for pushing..."
 660         if [ "$(id -u)" -eq 0 ]; then
 661                 # jailsetup may install things from $cfg_basedir/bin into the
 662                 # chroot so we do a mini-update of just that portion now
 663                 mkdir -p "$cfg_basedir"
 664                 rm -rf "$cfg_basedir/bin-new"
 665                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 666                 rm -rf "$cfg_basedir/bin-old"
 667                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 668                 rm -rf "$cfg_basedir/bin-old"
 669                 if [ -n "$sh_extra_chroot_installs" ]; then
 670                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 671                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 672                 fi
 673                 ./jailsetup.sh
 674                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 675         else
 676                 echo "WARNING: Skipping jail setup, not root"
 677         fi
 678 fi
 679
 680
 681 echo "*** Setting up jail configuration (project database)..."
 682 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 683 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 684 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 685 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 686         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 687 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 688         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 689 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 690         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 691 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 692
 693
 694 echo "*** Setting up global hook scripts..."
 695 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 696 # Otherwise an incoming push might slip in and fail to run the hook script!
 697 # The underlying rename(2) function call provides this and mv will use it.
 698 # First add hook scripts
 699 hooks="pre-auto-gc pre-receive post-commit post-receive update"
 700 for hook in $hooks; do
 701         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 702         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 703                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 704         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 705         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 706 done
 707 # Then remove any hook scripts that do not belong
 708 for hook in "$cfg_reporoot/_global/hooks"/*; do
 709         hook="${hook##*/}"
 710         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 711         case " $hooks " in *" $hook "*);;*)
 712                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 713                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 714         esac
 715 done
 716
 717
 718 echo "*** Setting up gitweb from git.git..."
 719 if ! [ -f git.git/Makefile ]; then
 720         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 721         exit 1
 722 fi
 723
 724 # We do not wholesale replace either webroot or cgiroot unless they are under
 725 # basedir so if they exist and are not we make a copy to start working on them.
 726 # We make a copy using -p which can result in some warnings so we suppress
 727 # error output as it's of no consequence in this case.
 728 rm -rf "$webroot" "$cgiroot"
 729 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 730 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 731 mkdir -p "$webroot" "$cgiroot"
 732
 733 (
 734         cd git.git &&
 735         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 736                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 737         chown_make gitweb &&
 738         PERLBIN="$perlbin" && export PERLBIN &&
 739         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 740                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 741         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 742         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 743         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 744         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 745 )
 746 test $? -eq 0
 747
 748
 749 echo "*** Setting up git-browser from git-browser.git..."
 750 if ! [ -f git-browser.git/git-browser.cgi ]; then
 751         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 752         exit 1
 753 fi
 754 mkdir -p "$webroot"/git-browser "$cgiroot"
 755 (
 756         cd git-browser.git &&
 757         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 758         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 759                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 760                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 761         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 762         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 763         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 764         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 765         cp -r JSON "$cgiroot"
 766 )
 767 test $? -eq 0
 768 rm -f "$webroot"/git-browser/index.html
 769 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 770         gitbin: $cfg_git_bin
 771         warehouse: $cfg_reporoot
 772         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 773 EOT
 774 chown_make "$basedir/gitweb"/git-browser.conf.$$
 775 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 776 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 777         cfg_gitweb_url="$cfg_gitweburl/"
 778         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 779 EOT
 780 chown_make "$webroot"/git-browser/GitConfig.js.$$
 781 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 782
 783
 784 echo "*** Setting up our part of the website..."
 785 mkdir -p "$webroot" "$cgiroot"
 786 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 787 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 788 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 789 cp "$basedir/cgi"/*.cgi "$cgiroot"
 790 rm -rf "$basedir/cgi"
 791 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 792 if [ -z "$cfg_httpspushurl" ]; then
 793         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 794 else
 795         cp gitweb/indextext.html "$basedir/gitweb"
 796 fi
 797 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 798 cp mootools.js "$webroot"
 799 cp htaccess "$webroot/.htaccess"
 800 cp cgi/htaccess "$cgiroot/.htaccess"
 801 cp git-favicon.ico "$webroot/favicon.ico"
 802 cp robots.txt "$webroot"
 803 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 804
 805
 806 if [ -n "$cfg_httpspushurl" ]; then
 807         echo "*** Setting up SSL certificates..."
 808         bits=2048
 809         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 810             bits="$cfg_rsakeylength"
 811         fi
 812         mkdir -p "$cfg_certsdir"
 813         [ -d "$cfg_certsdir" ]
 814         wwwcertcn=
 815         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 816                 wwwcertcn="$(
 817                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 818                         sed -e 's,[^/]*,,'
 819                 )"
 820         fi
 821         wwwcertdns=
 822         if [ -n "$cfg_wwwcertaltnames" ]; then
 823                 for dnsopt in $cfg_wwwcertaltnames; do
 824                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 825                 done
 826         fi
 827         wwwcertdnsfile=
 828         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 829                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 830         fi
 831         needroot=
 832         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 833         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 834         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 835         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 836         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 837         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 838                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 839                 umask 0077
 840                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 841                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 842                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 843                 umask 0022
 844                 echo "Created new root key"
 845         fi
 846         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 847                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 848                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 849                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 850                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 851                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 852                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 853                 echo "Created new root certificate"
 854         fi
 855         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 856                 umask 0077
 857                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 858                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 859                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 860                 umask 0022
 861                 echo "Created new www key"
 862         fi
 863         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 864                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 865                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 866                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 867                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 868                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 869                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 870                 echo "Created www certificate"
 871         fi
 872         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 873                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 874                 echo "Created www certificate chain file"
 875         fi
 876         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 877                 umask 0037
 878                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 879                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 880                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 881                 umask 0022
 882                 echo "Created new client key"
 883         fi
 884         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 885                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 886                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 887                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 888                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 889                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 890                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 891                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 892                 echo "Created client certificate"
 893         fi
 894         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 895                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 896                 echo "Created client certificate suffix file"
 897         fi
 898         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 899         if [ -n "$cfg_mob" ]; then
 900                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 901                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 902                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 903                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 904                         echo "Created new mob user key"
 905                 fi
 906                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 907                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 908                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 909                                 --cert "$cfg_clientcert" \
 910                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 911                         echo "Created mob user client certificate"
 912                 fi
 913                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 914                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 915         else
 916                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 917         fi
 918 else
 919         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 920         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 921 fi
 922
 923
 924 echo "*** Finalizing permissions and moving into place..."
 925 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 926 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 927
 928 # This should always be the very last thing install.sh does
 929 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 930 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 931 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 932 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 933 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 934 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
 935 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 936         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 937         touch "$cfg_chroot/etc/taskd.restart"
 938         chown_make "$cfg_chroot/etc/taskd.restart"
 939         trap ':' PIPE
 940         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 941         trap - PIPE
 942 }