install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_reporoot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_reporoot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::reporoot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 # $1 must exist and be a dir
  41 # $2 may exist but must be a dir
  42 # $3 must not exist
  43 # After call $2 will be renamed to $3 (if $2 existed)
  44 # And $1 will be renamed to $2
  45 quick_move() {
  46         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  47         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  48         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  49         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  50         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  51                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  52                 echo "fatal: quick_move: rename failed" >&2
  53                 exit 1
  54         }
  55         ! [ -d "$1" ] && [ -d "$2" ] || {
  56                 echo "fatal: quick_move: rename failed" >&2
  57                 exit 1
  58         }
  59 }
  60
  61 check_sh_builtin() (
  62         "unset" -f command
  63         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  64 ) 2>/dev/null
  65
  66 owngroup=
  67 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  68 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  69         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  70         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  71         exit 1
  72 fi
  73
  74
  75 # Check for extra required tools
  76 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  77         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  78         exit 1
  79 fi
  80
  81
  82 echo "*** Checking for compiled utilities..."
  83 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  84         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  85         echo "ERROR: perhaps you forgot to run make?" >&2
  86         exit 1
  87 fi
  88 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  89         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  90         echo "ERROR: perhaps you forgot to run make?" >&2
  91         exit 1
  92 fi
  93 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  94         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  95         echo "ERROR: perhaps you forgot to run make?" >&2
  96         exit 1
  97 fi
  98 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  99         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 100         echo "ERROR: perhaps you forgot to run make?" >&2
 101         exit 1
 102 fi
 103 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 104         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 105         echo "ERROR: perhaps you forgot to run make?" >&2
 106         exit 1
 107 fi
 108 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 109         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 110         echo "ERROR: perhaps you forgot to run make?" >&2
 111         exit 1
 112 fi
 113 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 114         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 115         echo "ERROR: perhaps you forgot to run make?" >&2
 116         exit 1
 117 fi
 118 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 119         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 120         echo "ERROR: perhaps you forgot to run make?" >&2
 121         exit 1
 122 fi
 123 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 124         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 125         echo "ERROR: perhaps you forgot to run make?" >&2
 126         exit 1
 127 fi
 128 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 129         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 130         echo "ERROR: perhaps you forgot to run make?" >&2
 131         exit 1
 132 fi
 133
 134
 135 echo "*** Checking for ezcert..."
 136 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 137         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 138         exit 1
 139 fi
 140
 141
 142 echo "*** Checking for git..."
 143 case "$cfg_git_bin" in /*) :;; *)
 144         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 145         exit 1
 146 esac
 147 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 148         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 149         exit 1
 150 fi
 151 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 152         echo "ERROR: $cfg_git_bin version failed" >&2
 153         exit 1
 154 fi
 155 case "$git_version" in
 156         [Gg]"it version "*) :;;
 157         *)
 158                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 159                 exit 1
 160 esac
 161 echo "Found $cfg_git_bin $git_version"
 162 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 163 echo "*** Checking Git $git_vernum for compatibility..."
 164 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 165         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 166         exit 1
 167 fi
 168 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 169         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 170 fi
 171 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 172         cat <<'EOT'
 173
 174 ***
 175 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 176 ***
 177
 178 Some Girocco functionality will be gracefully disabled and other things will
 179 just not work at all such as race condition protection against simultaneous
 180 client pushes and server garbage collections.
 181
 182 EOT
 183 fi
 184 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 189 fi
 190 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 192         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 193 fi
 194 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 195         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 196         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 197 fi
 198 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 199         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 200 fi
 201 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 202         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 203 fi
 204 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 205         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 206 fi
 207 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 208         cat <<'EOT'
 209
 210 ***
 211 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 212 ***
 213
 214 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 215 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 216 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 217
 218 In order to bypass this check you will have to modify install.sh in which case
 219 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 220
 221 EOT
 222         exit 1
 223 fi
 224 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 225         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 226 fi
 227 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 228         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 229 fi
 230 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 231         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 232         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 233         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 234         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 235         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 236 fi
 237 secmsg=
 238 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 239         secmsg='prior to 2.4.11'
 240 fi
 241 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 242         secmsg='2.5.x prior to 2.5.5'
 243 fi
 244 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 245         secmsg='2.6.x prior to 2.6.6'
 246 fi
 247 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 248         secmsg='2.7.x prior to 2.7.4'
 249 fi
 250 if [ -n "$secmsg" ]; then
 251         cat <<EOT
 252
 253 ***
 254 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 255 ***
 256
 257 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 258 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 259
 260 Besides the security fixes included in later versions, versions prior to
 261 2.2.0 may accidentally prune unreachable loose objects earlier than
 262 intended.  Since Git version 2.4.11 is the minimum version to include all
 263 security fixes to date, it should be considered the absolute minimum
 264 version of Git to use when running Girocco.
 265
 266 This is not enforced, but Git is easy to build from the git.git submodule
 267 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 268
 269 We will now pause for a moment so you can reflect on this warning.
 270
 271 EOT
 272         sleep 60
 273 fi
 274 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 275         cat <<'EOT'
 276
 277 ***
 278 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 279 ***
 280
 281 You appear to have enabled mirroring and the Git binary you have selected
 282 appears to contain an experimental patch that cannot be disabled.  This
 283 patch can generate invalid network DNS traffic and/or cause long delays
 284 when fetching using the "git:" protocol when no port number is specified.
 285 It may also end up retrieving repsitory contents from a host other than
 286 the one specified in the "git:" URL when the port is omitted.
 287
 288 You are advised to either build your own version of Git (the problem patch
 289 is not part of the official Git repository) or disable mirroring (via the
 290 $Girocco::Config:mirror setting) to avoid these potential problems.
 291
 292 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 293
 294 EOT
 295         sleep 5
 296 fi
 297
 298 test_nc_U() {
 299         [ -n "$1" ] || return 1
 300         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 301         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 302         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 303         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 304         >"$_tmpdir/output"
 305         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 306         _bgpid="$!"
 307         sleep 1
 308         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 309         sleep 1
 310         kill "$_bgpid" >/dev/null 2>&1 || :
 311         read -r _result <"$_tmpdir/output" || :
 312         _bad=
 313         ! [ -e "$_tmpdir/failed" ] || _bad=1
 314         rm -rf "$_tmpdir"
 315         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 316 } >/dev/null 2>&1
 317
 318 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 319 test_nc_U "$var_nc_openbsd_bin" || {
 320         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 321         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 322         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 323                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 324         fi
 325         exit 1
 326 }
 327
 328 echo "*** Verifying selected POSIX sh is sane..."
 329 shbin="$var_sh_bin"
 330 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 331         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 332         exit 1
 333 }
 334 [ "$(check_sh_builtin command)" = "command" ] || {
 335         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 336         exit 1
 337 }
 338 sh_not_builtin=
 339 sh_extra_chroot_installs=
 340 badsh=
 341 for sbi in cd pwd read umask unset unalias; do
 342         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 343                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 344                 badsh=1
 345         fi
 346 done
 347 [ -z "$badsh" ] || exit 1
 348 for sbi in '[' echo printf test; do
 349         if ! extra="$(check_sh_builtin "$sbi")"; then
 350                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 351                 badsh=1
 352                 continue
 353         fi
 354         if [ "$extra" != "$sbi" ]; then
 355                 case "$extra" in /*) :;; *)
 356                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 357                         badsh=1
 358                         continue
 359                 esac
 360                 withspc=
 361                 case "$extra" in *" "*) withspc=1; esac
 362                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 363                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 364                         badsh=1
 365                         continue
 366                 }
 367                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 368                 sh_not_builtin="$sh_not_builtin $sbi"
 369                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 370         fi
 371 done
 372 [ -z "$badsh" ] || exit 1
 373 [ -z "$sh_extra_chroot_installs" ] || {
 374         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 375         echo "WARNING: as a result it will run slower than necessary" >&2
 376         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 377         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 378         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 379         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 380         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 381 }
 382
 383 echo "*** Verifying xargs is sane..."
 384 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 385 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 386 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 387 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 388         echo 'ERROR: xargs is unusable' >&2
 389         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 390         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 391         echo 'ERROR: must be true, but neither is' >&2
 392         exit 1
 393 }
 394
 395 echo "*** Verifying selected perl is sane..."
 396 perlbin="$var_perl_bin"
 397 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 398         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 399         exit 1
 400 }
 401
 402 echo "*** Verifying selected gzip is sane..."
 403 gzipbin="$var_gzip_bin"
 404 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 405     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 406         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 407         exit 1
 408 }
 409
 410 echo "*** Verifying basedir, webroot and cgiroot paths..."
 411 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 412 case "$cfg_basedir" in /*) :;; *)
 413         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 414         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 415         exit 1
 416 esac
 417 case "$cfg_webroot" in /*) :;; *)
 418         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 419         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 420         exit 1
 421 esac
 422 case "$cfg_cgiroot" in /*) :;; *)
 423         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 424         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 425         exit 1
 426 esac
 427
 428 # return the input with trailing slashes stripped but return "/" for all "/"s
 429 striptrsl() {
 430         [ -n "$1" ] || return 0
 431         _s="${1##*[!/]}"
 432         [ "$_s" != "$1" ] || _s="${_s#?}"
 433         printf "%s\n" "${1%$_s}"
 434 }
 435
 436 # a combination of realpath + dirname where the realpath of the deepest existing
 437 # directory is returned with the rest of the non-existing components appended
 438 # and trailing slashes and multiple slashes are removed
 439 realdir() {
 440         _d="$(striptrsl "$1")"
 441         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 442                 echo "$_d"
 443                 return 0
 444         fi
 445         _c=""
 446         while ! [ -d "$_d" ]; do
 447                 _c="/$(basename "$_d")$_c"
 448                 _d="$(dirname "$_d")"
 449                 [ "$_d" != "/" ] || _c="${_c#/}"
 450         done
 451         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 452 }
 453
 454 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 455 # Wherever we are writing/copying/installing files we use these, but where we
 456 # are editing, adding config settings or printing advice we always stick to the
 457 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 458 # Only the file system directories that could be asynchronously accessed (by
 459 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 460 # The chroot is handled specially and does not need one of these.
 461 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 462 # case the prior contents of cgiroot and/or webroot are discarded.
 463 rbasedir="$(realdir "$cfg_basedir")"
 464 rwebroot="$(realdir "$cfg_webroot")"
 465 rcgiroot="$(realdir "$cfg_cgiroot")"
 466 case "$rbasedir" in "$rwebroot"/?*)
 467         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 468         exit 1
 469 esac
 470 case "$rbasedir" in "$rcgiroot"/?*)
 471         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 472         exit 1
 473 esac
 474 if [ "$rwebroot" = "$rcgiroot" ]; then
 475         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 476         exit 1
 477 fi
 478 case "$rcgiroot" in "$rwebroot"/?*)
 479         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 480         exit 1
 481 esac
 482 case "$rwebroot" in "$rcgiroot"/?*)
 483         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 484         exit 1
 485 esac
 486 basedir="$rbasedir-new"
 487 case "$rwebroot" in
 488         "$rbasedir"/?*)
 489                 webroot="$basedir${rwebroot#$rbasedir}"
 490                 webrootsub=1
 491                 ;;
 492         *)
 493                 webroot="$rwebroot-new"
 494                 webrootsub=
 495                 ;;
 496 esac
 497 case "$rcgiroot" in
 498         "$rbasedir"/?*)
 499                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 500                 cgirootsub=1
 501                 ;;
 502         *)
 503                 cgiroot="$rcgiroot-new"
 504                 cgirootsub=
 505                 ;;
 506 esac
 507
 508 echo "*** Setting up basedir..."
 509
 510 chown_make() {
 511         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 512                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 513         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 514                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 515         fi
 516 }
 517
 518 "$MAKE" --no-print-directory --silent apache.conf
 519 chown_make apache.conf
 520 "$MAKE" --no-print-directory --silent -C src
 521 chown_make src
 522 rm -fr "$basedir"
 523 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 524 cp cgi/*.cgi "$basedir/cgi"
 525 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 526 find -H "$basedir" -type l -exec rm -f '{}' +
 527 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 528         src/rangecgi src/readlink src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 529         cgi/snapshot.cgi "$basedir/bin"
 530 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 531 if [ -n "$cfg_httpspushurl" ]; then
 532         [ -z "$cfg_pretrustedroot" ] || rm -f "$basedir"/html/rootcert.html
 533 else
 534         rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 535 fi
 536 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 537
 538 # Put the correct Config in place
 539 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 540
 541 # Create symbolic links to selected binaries
 542 ln -s "$cfg_git_bin" "$basedir/bin/git"
 543 ln -s "$shbin" "$basedir/bin/sh"
 544 ln -s "$perlbin" "$basedir/bin/perl"
 545 ln -s "$gzipbin" "$basedir/bin/gzip"
 546
 547 echo "*** Preprocessing scripts..."
 548 SHBIN="$shbin" && export SHBIN
 549 PERLBIN="$perlbin" && export PERLBIN
 550 perl -I. -M$GIROCCO_CONF -i -p \
 551         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 552         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 553         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 554         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 555         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 556         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 557         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 558         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 559         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 560         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 561         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 562         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 563         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 564         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 565         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 566         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 567         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 568         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 569         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 570         -e 's/\@fetch_stash_refs\@/"$Girocco::Config::fetch_stash_refs"/g;' \
 571         -e 'close ARGV if eof;' \
 572         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 573         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 574         "$basedir"/shlib.sh "$basedir"/hooks/* \
 575         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 576         "$basedir"/toolbox/reports/*.sh \
 577         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 578         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 579         "$basedir"/bin/*.cgi "$basedir"/screen/*
 580 perl -I. -M$GIROCCO_CONF -i -p \
 581         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 582         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 583         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 584 perl -i -p \
 585         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 586         -e 'close ARGV if eof;' \
 587         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 588         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 589 perl -i -p \
 590         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 591         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 592         -e 'close ARGV if eof;' \
 593         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 594 unset PERLBIN
 595 unset SHBIN
 596
 597 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 598 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 599
 600 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 601 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 602    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 603         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 604         exit 1
 605 fi
 606 mkdir -p "$basedir"/bin
 607 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 608
 609 echo "*** Setting up hg-fast-export from fast-export.git..."
 610 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 611         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 612         exit 1
 613 fi
 614 mkdir -p "$basedir"/bin
 615 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 616
 617 echo "*** Setting up markdown from markdown.git..."
 618 if ! [ -f markdown.git/Markdown.pl ]; then
 619         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 620         exit 1
 621 fi
 622 mkdir -p "$basedir"/bin
 623 (PERLBIN="$perlbin" && export PERLBIN &&
 624         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 625                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 626         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 627         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 628 test $? -eq 0
 629
 630 # Some permission sanity on basedir/bin just in case
 631 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 632 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 633
 634 if [ -n "$cfg_mirror" ]; then
 635         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 636 fi
 637 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 638 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 639 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 640
 641
 642 echo "*** Setting up repository root..."
 643 [ -d "$cfg_reporoot" ] || {
 644         mkdir -p "$cfg_reporoot"
 645         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 646         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 647 }
 648 [ -z "$cfg_owning_group" ] ||
 649         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 650 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 651 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks"
 652 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" ||
 653         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 654 if [ "$cfg_owning_group" ]; then
 655         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 656         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 657 fi
 658 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 659 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 660
 661
 662 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 663         echo "*** Setting up chroot jail for pushing..."
 664         if [ "$(id -u)" -eq 0 ]; then
 665                 # jailsetup may install things from $cfg_basedir/bin into the
 666                 # chroot so we do a mini-update of just that portion now
 667                 mkdir -p "$cfg_basedir"
 668                 rm -rf "$cfg_basedir/bin-new"
 669                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 670                 rm -rf "$cfg_basedir/bin-old"
 671                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 672                 rm -rf "$cfg_basedir/bin-old"
 673                 if [ -n "$sh_extra_chroot_installs" ]; then
 674                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 675                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 676                 fi
 677                 ./jailsetup.sh
 678                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 679         else
 680                 echo "WARNING: Skipping jail setup, not root"
 681         fi
 682 fi
 683
 684
 685 echo "*** Setting up jail configuration (project database)..."
 686 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 687 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 688 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 689 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 690         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 691 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 692         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 693 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 694         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 695 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 696
 697
 698 echo "*** Setting up global hook scripts..."
 699 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 700 # Otherwise an incoming push might slip in and fail to run the hook script!
 701 # The underlying rename(2) function call provides this and mv will use it.
 702 # First add hook scripts
 703 hooks="pre-auto-gc pre-receive post-commit post-receive update"
 704 for hook in $hooks; do
 705         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 706         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 707                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 708         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 709         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 710 done
 711 # Then remove any hook scripts that do not belong
 712 for hook in "$cfg_reporoot/_global/hooks"/*; do
 713         hook="${hook##*/}"
 714         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 715         case " $hooks " in *" $hook "*);;*)
 716                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 717                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 718         esac
 719 done
 720
 721
 722 echo "*** Setting up gitweb from git.git..."
 723 if ! [ -f git.git/Makefile ]; then
 724         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 725         exit 1
 726 fi
 727
 728 # We do not wholesale replace either webroot or cgiroot unless they are under
 729 # basedir so if they exist and are not we make a copy to start working on them.
 730 # We make a copy using -p which can result in some warnings so we suppress
 731 # error output as it's of no consequence in this case.
 732 rm -rf "$webroot" "$cgiroot"
 733 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 734 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 735 mkdir -p "$webroot" "$cgiroot"
 736
 737 (
 738         cd git.git &&
 739         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 740                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 741         chown_make gitweb &&
 742         PERLBIN="$perlbin" && export PERLBIN &&
 743         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 744                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 745         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 746         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 747         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 748         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 749 )
 750 test $? -eq 0
 751
 752
 753 echo "*** Setting up git-browser from git-browser.git..."
 754 if ! [ -f git-browser.git/git-browser.cgi ]; then
 755         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 756         exit 1
 757 fi
 758 mkdir -p "$webroot"/git-browser "$cgiroot"
 759 (
 760         cd git-browser.git &&
 761         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 762         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 763                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 764                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 765         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 766         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 767         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 768         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 769         cp -r JSON "$cgiroot"
 770 )
 771 test $? -eq 0
 772 rm -f "$webroot"/git-browser/index.html
 773 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 774         gitbin: $cfg_git_bin
 775         warehouse: $cfg_reporoot
 776         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 777 EOT
 778 chown_make "$basedir/gitweb"/git-browser.conf.$$
 779 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 780 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 781         cfg_gitweb_url="$cfg_gitweburl/"
 782         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 783 EOT
 784 chown_make "$webroot"/git-browser/GitConfig.js.$$
 785 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 786
 787
 788 echo "*** Setting up our part of the website..."
 789 mkdir -p "$webroot" "$cgiroot"
 790 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 791 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 792 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 793 cp "$basedir/cgi"/*.cgi "$cgiroot"
 794 rm -rf "$basedir/cgi"
 795 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 796 if [ -z "$cfg_httpspushurl" ] || [ -n "$cfg_pretrustedroot" ]; then
 797         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 798 else
 799         cp gitweb/indextext.html "$basedir/gitweb"
 800 fi
 801 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 802 cp mootools.js "$webroot"
 803 cp htaccess "$webroot/.htaccess"
 804 cp cgi/htaccess "$cgiroot/.htaccess"
 805 cp git-favicon.ico "$webroot/favicon.ico"
 806 cp robots.txt "$webroot"
 807 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 808
 809
 810 if [ -n "$cfg_httpspushurl" ]; then
 811         echo "*** Setting up SSL certificates..."
 812         bits=2048
 813         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 814             bits="$cfg_rsakeylength"
 815         fi
 816         mkdir -p "$cfg_certsdir"
 817         [ -d "$cfg_certsdir" ]
 818         wwwcertcn=
 819         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 820                 wwwcertcn="$(
 821                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 822                         sed -e 's,[^/]*,,'
 823                 )"
 824         fi
 825         wwwcertdns=
 826         if [ -n "$cfg_wwwcertaltnames" ]; then
 827                 for dnsopt in $cfg_wwwcertaltnames; do
 828                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 829                 done
 830         fi
 831         wwwcertdnsfile=
 832         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 833                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 834         fi
 835         needroot=
 836         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 837         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 838         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 839         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 840         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 841         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 842                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 843                 umask 0077
 844                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 845                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 846                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 847                 umask 0022
 848                 echo "Created new root key"
 849         fi
 850         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 851                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 852                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 853                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 854                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 855                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 856                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 857                 echo "Created new root certificate"
 858         fi
 859         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 860                 umask 0077
 861                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 862                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 863                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 864                 umask 0022
 865                 echo "Created new www key"
 866         fi
 867         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 868                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 869                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 870                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 871                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 872                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 873                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 874                 echo "Created www certificate"
 875         fi
 876         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 877                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 878                 echo "Created www certificate chain file"
 879         fi
 880         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 881                 umask 0037
 882                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 883                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 884                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 885                 umask 0022
 886                 echo "Created new client key"
 887         fi
 888         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 889                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 890                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 891                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 892                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 893                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 894                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 895                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 896                 echo "Created client certificate"
 897         fi
 898         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 899                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 900                 echo "Created client certificate suffix file"
 901         fi
 902         if [ -z "$cfg_pretrustedroot" ]; then
 903                 cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 904         else
 905                 rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 906         fi
 907         if [ -n "$cfg_mob" ]; then
 908                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 909                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 910                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 911                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 912                         echo "Created new mob user key"
 913                 fi
 914                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 915                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 916                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 917                                 --cert "$cfg_clientcert" \
 918                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 919                         echo "Created mob user client certificate"
 920                 fi
 921                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 922                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 923         else
 924                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 925         fi
 926 else
 927         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 928         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 929 fi
 930
 931
 932 echo "*** Finalizing permissions and moving into place..."
 933 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 934 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 935
 936 # This should always be the very last thing install.sh does
 937 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 938 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 939 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 940 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 941 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 942 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
 943 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 944         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 945         touch "$cfg_chroot/etc/taskd.restart"
 946         chown_make "$cfg_chroot/etc/taskd.restart"
 947         trap ':' PIPE
 948         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 949         trap - PIPE
 950 }