install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_chroot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_chroot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::chroot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 # $1 must exist and be a dir
  41 # $2 may exist but must be a dir
  42 # $3 must not exist
  43 # After call $2 will be renamed to $3 (if $2 existed)
  44 # And $1 will be renamed to $2
  45 quick_move() {
  46         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  47         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  48         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  49         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  50         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  51                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  52                 echo "fatal: quick_move: rename failed" >&2
  53                 exit 1
  54         }
  55         ! [ -d "$1" ] && [ -d "$2" ] || {
  56                 echo "fatal: quick_move: rename failed" >&2
  57                 exit 1
  58         }
  59 }
  60
  61 check_sh_builtin() (
  62         "unset" -f command
  63         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  64 ) 2>/dev/null
  65
  66 owngroup=
  67 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  68 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  69         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  70         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  71         exit 1
  72 fi
  73
  74
  75 # Check for extra required tools
  76 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  77         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  78         exit 1
  79 fi
  80
  81
  82 echo "*** Checking for compiled utilities..."
  83 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  84         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  85         echo "ERROR: perhaps you forgot to run make?" >&2
  86         exit 1
  87 fi
  88 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  89         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  90         echo "ERROR: perhaps you forgot to run make?" >&2
  91         exit 1
  92 fi
  93 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  94         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  95         echo "ERROR: perhaps you forgot to run make?" >&2
  96         exit 1
  97 fi
  98 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  99         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 100         echo "ERROR: perhaps you forgot to run make?" >&2
 101         exit 1
 102 fi
 103 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 104         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 105         echo "ERROR: perhaps you forgot to run make?" >&2
 106         exit 1
 107 fi
 108 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 109         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 110         echo "ERROR: perhaps you forgot to run make?" >&2
 111         exit 1
 112 fi
 113 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 114         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 115         echo "ERROR: perhaps you forgot to run make?" >&2
 116         exit 1
 117 fi
 118 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 119         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 120         echo "ERROR: perhaps you forgot to run make?" >&2
 121         exit 1
 122 fi
 123 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 124         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 125         echo "ERROR: perhaps you forgot to run make?" >&2
 126         exit 1
 127 fi
 128 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 129         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 130         echo "ERROR: perhaps you forgot to run make?" >&2
 131         exit 1
 132 fi
 133
 134
 135 echo "*** Checking for ezcert..."
 136 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 137         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 138         exit 1
 139 fi
 140
 141
 142 echo "*** Checking for git..."
 143 case "$cfg_git_bin" in /*) :;; *)
 144         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 145         exit 1
 146 esac
 147 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 148         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 149         exit 1
 150 fi
 151 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 152         echo "ERROR: $cfg_git_bin version failed" >&2
 153         exit 1
 154 fi
 155 case "$git_version" in
 156         [Gg]"it version "*) :;;
 157         *)
 158                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 159                 exit 1
 160 esac
 161 echo "Found $cfg_git_bin $git_version"
 162 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 163 echo "*** Checking Git $git_vernum for compatibility..."
 164 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 165         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 166         exit 1
 167 fi
 168 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 169         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 170 fi
 171 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 172         cat <<'EOT'
 173
 174 ***
 175 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 176 ***
 177
 178 Some Girocco functionality will be gracefully disabled and other things will
 179 just not work at all such as race condition protection against simultaneous
 180 client pushes and server garbage collections.
 181
 182 EOT
 183 fi
 184 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 189 fi
 190 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 192         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 193 fi
 194 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 195         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 196         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 197 fi
 198 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 199         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 200 fi
 201 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 202         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 203 fi
 204 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 205         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 206 fi
 207 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 208         cat <<'EOT'
 209
 210 ***
 211 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 212 ***
 213
 214 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 215 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 216 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 217
 218 In order to bypass this check you will have to modify install.sh in which case
 219 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 220
 221 EOT
 222         exit 1
 223 fi
 224 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 225         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 226 fi
 227 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 228         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 229 fi
 230 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 231         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 232         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 233         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 234         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 235         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 236 fi
 237 secmsg=
 238 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 239         secmsg='prior to 2.4.11'
 240 fi
 241 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 242         secmsg='2.5.x prior to 2.5.5'
 243 fi
 244 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 245         secmsg='2.6.x prior to 2.6.6'
 246 fi
 247 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 248         secmsg='2.7.x prior to 2.7.4'
 249 fi
 250 if [ -n "$secmsg" ]; then
 251         cat <<EOT
 252
 253 ***
 254 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 255 ***
 256
 257 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 258 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 259
 260 Besides the security fixes included in later versions, versions prior to
 261 2.2.0 may accidentally prune unreachable loose objects earlier than
 262 intended.  Since Git version 2.4.11 is the minimum version to include all
 263 security fixes to date, it should be considered the absolute minimum
 264 version of Git to use when running Girocco.
 265
 266 This is not enforced, but Git is easy to build from the git.git submodule
 267 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 268
 269 We will now pause for a moment so you can reflect on this warning.
 270
 271 EOT
 272         sleep 60
 273 fi
 274 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 275         cat <<'EOT'
 276
 277 ***
 278 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 279 ***
 280
 281 You appear to have enabled mirroring and the Git binary you have selected
 282 appears to contain an experimental patch that cannot be disabled.  This
 283 patch can generate invalid network DNS traffic and/or cause long delays
 284 when fetching using the "git:" protocol when no port number is specified.
 285 It may also end up retrieving repsitory contents from a host other than
 286 the one specified in the "git:" URL when the port is omitted.
 287
 288 You are advised to either build your own version of Git (the problem patch
 289 is not part of the official Git repository) or disable mirroring (via the
 290 $Girocco::Config:mirror setting) to avoid these potential problems.
 291
 292 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 293
 294 EOT
 295         sleep 5
 296 fi
 297
 298 test_nc_U() {
 299         [ -n "$1" ] || return 1
 300         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 301         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 302         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 303         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 304         >"$_tmpdir/output"
 305         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 306         _bgpid="$!"
 307         sleep 1
 308         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 309         sleep 1
 310         kill "$_bgpid" >/dev/null 2>&1 || :
 311         read -r _result <"$_tmpdir/output" || :
 312         _bad=
 313         ! [ -e "$_tmpdir/failed" ] || _bad=1
 314         rm -rf "$_tmpdir"
 315         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 316 } >/dev/null 2>&1
 317
 318 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 319 test_nc_U "$var_nc_openbsd_bin" || {
 320         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 321         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 322         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 323                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 324         fi
 325         exit 1
 326 }
 327
 328 echo "*** Verifying selected POSIX sh is sane..."
 329 shbin="$var_sh_bin"
 330 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 331         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 332         exit 1
 333 }
 334 [ "$(check_sh_builtin command)" = "command" ] || {
 335         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 336         exit 1
 337 }
 338 sh_not_builtin=
 339 sh_extra_chroot_installs=
 340 badsh=
 341 for sbi in cd pwd read umask unset unalias; do
 342         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 343                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 344                 badsh=1
 345         fi
 346 done
 347 [ -z "$badsh" ] || exit 1
 348 for sbi in '[' echo printf test; do
 349         if ! extra="$(check_sh_builtin "$sbi")"; then
 350                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 351                 badsh=1
 352                 continue
 353         fi
 354         if [ "$extra" != "$sbi" ]; then
 355                 case "$extra" in /*) :;; *)
 356                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 357                         badsh=1
 358                         continue
 359                 esac
 360                 withspc=
 361                 case "$extra" in *" "*) withspc=1; esac
 362                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 363                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 364                         badsh=1
 365                         continue
 366                 }
 367                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 368                 sh_not_builtin="$sh_not_builtin $sbi"
 369                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 370         fi
 371 done
 372 [ -z "$badsh" ] || exit 1
 373 [ -z "$sh_extra_chroot_installs" ] || {
 374         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 375         echo "WARNING: as a result it will run slower than necessary" >&2
 376         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 377         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 378         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 379         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 380         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 381 }
 382
 383 echo "*** Verifying xargs is sane..."
 384 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 385 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 386 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 387 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 388         echo 'ERROR: xargs is unusable' >&2
 389         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 390         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 391         echo 'ERROR: must be true, but neither is' >&2
 392         exit 1
 393 }
 394
 395 echo "*** Verifying selected perl is sane..."
 396 perlbin="$var_perl_bin"
 397 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 398         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 399         exit 1
 400 }
 401
 402 echo "*** Verifying selected gzip is sane..."
 403 gzipbin="$var_gzip_bin"
 404 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 405     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 406         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 407         exit 1
 408 }
 409
 410 echo "*** Verifying basedir, webroot and cgiroot paths..."
 411 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 412 case "$cfg_basedir" in /*) :;; *)
 413         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 414         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 415         exit 1
 416 esac
 417 case "$cfg_webroot" in /*) :;; *)
 418         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 419         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 420         exit 1
 421 esac
 422 case "$cfg_cgiroot" in /*) :;; *)
 423         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 424         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 425         exit 1
 426 esac
 427
 428 # return the input with trailing slashes stripped but return "/" for all "/"s
 429 striptrsl() {
 430         [ -n "$1" ] || return 0
 431         _s="${1##*[!/]}"
 432         [ "$_s" != "$1" ] || _s="${_s#?}"
 433         printf "%s\n" "${1%$_s}"
 434 }
 435
 436 # a combination of realpath + dirname where the realpath of the deepest existing
 437 # directory is returned with the rest of the non-existing components appended
 438 # and trailing slashes and multiple slashes are removed
 439 realdir() {
 440         _d="$(striptrsl "$1")"
 441         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 442                 echo "$_d"
 443                 return 0
 444         fi
 445         _c=""
 446         while ! [ -d "$_d" ]; do
 447                 _c="/$(basename "$_d")$_c"
 448                 _d="$(dirname "$_d")"
 449                 [ "$_d" != "/" ] || _c="${_c#/}"
 450         done
 451         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 452 }
 453
 454 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 455 # Wherever we are writing/copying/installing files we use these, but where we
 456 # are editing, adding config settings or printing advice we always stick to the
 457 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 458 # Only the file system directories that could be asynchronously accessed (by
 459 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 460 # The chroot is handled specially and does not need one of these.
 461 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 462 # case the prior contents of cgiroot and/or webroot are discarded.
 463 rbasedir="$(realdir "$cfg_basedir")"
 464 rwebroot="$(realdir "$cfg_webroot")"
 465 rcgiroot="$(realdir "$cfg_cgiroot")"
 466 case "$rbasedir" in "$rwebroot"/?*)
 467         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 468         exit 1
 469 esac
 470 case "$rbasedir" in "$rcgiroot"/?*)
 471         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 472         exit 1
 473 esac
 474 if [ "$rwebroot" = "$rcgiroot" ]; then
 475         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 476         exit 1
 477 fi
 478 case "$rcgiroot" in "$rwebroot"/?*)
 479         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 480         exit 1
 481 esac
 482 case "$rwebroot" in "$rcgiroot"/?*)
 483         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 484         exit 1
 485 esac
 486 basedir="$rbasedir-new"
 487 case "$rwebroot" in
 488         "$rbasedir"/?*)
 489                 webroot="$basedir${rwebroot#$rbasedir}"
 490                 webrootsub=1
 491                 ;;
 492         *)
 493                 webroot="$rwebroot-new"
 494                 webrootsub=
 495                 ;;
 496 esac
 497 case "$rcgiroot" in
 498         "$rbasedir"/?*)
 499                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 500                 cgirootsub=1
 501                 ;;
 502         *)
 503                 cgiroot="$rcgiroot-new"
 504                 cgirootsub=
 505                 ;;
 506 esac
 507
 508 echo "*** Setting up basedir..."
 509
 510 chown_make() {
 511         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 512                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 513         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 514                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 515         fi
 516 }
 517
 518 "$MAKE" --no-print-directory --silent apache.conf
 519 chown_make apache.conf
 520 "$MAKE" --no-print-directory --silent -C src
 521 chown_make src
 522 rm -fr "$basedir"
 523 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 524 cp cgi/*.cgi "$basedir/cgi"
 525 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 526 find -H "$basedir" -type l -exec rm -f '{}' +
 527 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 528         src/rangecgi src/readlink src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 529         cgi/snapshot.cgi "$basedir/bin"
 530 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 531 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 532 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 533
 534 # Put the correct Config in place
 535 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 536
 537 # Create symbolic links to selected binaries
 538 ln -s "$cfg_git_bin" "$basedir/bin/git"
 539 ln -s "$shbin" "$basedir/bin/sh"
 540 ln -s "$perlbin" "$basedir/bin/perl"
 541 ln -s "$gzipbin" "$basedir/bin/gzip"
 542
 543 echo "*** Preprocessing scripts..."
 544 SHBIN="$shbin" && export SHBIN
 545 PERLBIN="$perlbin" && export PERLBIN
 546 perl -I. -M$GIROCCO_CONF -i -p \
 547         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 548         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 549         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 550         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 551         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 552         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 553         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 554         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 555         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 556         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 557         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 558         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 559         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 560         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 561         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 562         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 563         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 564         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 565         -e 'close ARGV if eof;' \
 566         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 567         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 568         "$basedir"/shlib.sh "$basedir"/hooks/* \
 569         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 570         "$basedir"/toolbox/reports/*.sh \
 571         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 572         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 573         "$basedir"/bin/*.cgi "$basedir"/screen/*
 574 perl -I. -M$GIROCCO_CONF -i -p \
 575         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 576         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 577         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 578 perl -i -p \
 579         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 580         -e 'close ARGV if eof;' \
 581         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 582         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 583 perl -i -p \
 584         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 585         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 586         -e 'close ARGV if eof;' \
 587         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 588 unset PERLBIN
 589 unset SHBIN
 590
 591 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 592 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 593
 594 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 595 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 596    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 597         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 598         exit 1
 599 fi
 600 mkdir -p "$basedir"/bin
 601 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 602
 603 echo "*** Setting up hg-fast-export from fast-export.git..."
 604 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 605         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 606         exit 1
 607 fi
 608 mkdir -p "$basedir"/bin
 609 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 610
 611 echo "*** Setting up markdown from markdown.git..."
 612 if ! [ -f markdown.git/Markdown.pl ]; then
 613         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 614         exit 1
 615 fi
 616 mkdir -p "$basedir"/bin
 617 (PERLBIN="$perlbin" && export PERLBIN &&
 618         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 619                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 620         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 621         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 622 test $? -eq 0
 623
 624 # Some permission sanity on basedir/bin just in case
 625 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 626 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 627
 628 if [ -n "$cfg_mirror" ]; then
 629         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 630 fi
 631 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 632 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 633 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 634
 635
 636 echo "*** Setting up repository root..."
 637 [ -d "$cfg_reporoot" ] || {
 638         mkdir -p "$cfg_reporoot"
 639         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 640         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 641 }
 642 [ -z "$cfg_owning_group" ] ||
 643         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 644 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 645 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks"
 646 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" ||
 647         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 648 if [ "$cfg_owning_group" ]; then
 649         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 650         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 651 fi
 652 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 653 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 654
 655
 656 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 657         echo "*** Setting up chroot jail for pushing..."
 658         if [ "$(id -u)" -eq 0 ]; then
 659                 # jailsetup may install things from $cfg_basedir/bin into the
 660                 # chroot so we do a mini-update of just that portion now
 661                 mkdir -p "$cfg_basedir"
 662                 rm -rf "$cfg_basedir/bin-new"
 663                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 664                 rm -rf "$cfg_basedir/bin-old"
 665                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 666                 rm -rf "$cfg_basedir/bin-old"
 667                 if [ -n "$sh_extra_chroot_installs" ]; then
 668                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 669                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 670                 fi
 671                 ./jailsetup.sh
 672                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 673         else
 674                 echo "WARNING: Skipping jail setup, not root"
 675         fi
 676 fi
 677
 678
 679 echo "*** Setting up jail configuration (project database)..."
 680 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 681 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 682 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 683 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 684         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 685 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 686         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 687 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 688         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 689 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 690
 691
 692 echo "*** Setting up global hook scripts..."
 693 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 694 # Otherwise an incoming push might slip in and fail to run the hook script!
 695 # The underlying rename(2) function call provides this and mv will use it.
 696 # First add hook scripts
 697 hooks="pre-receive post-receive update"
 698 for hook in $hooks; do
 699         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 700         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 701                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 702         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 703         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 704 done
 705 # Then remove any hook scripts that do not belong
 706 for hook in "$cfg_reporoot/_global/hooks"/*; do
 707         hook="${hook##*/}"
 708         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 709         case " $hooks " in *" $hook "*);;*)
 710                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 711                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 712         esac
 713 done
 714
 715
 716 echo "*** Setting up gitweb from git.git..."
 717 if ! [ -f git.git/Makefile ]; then
 718         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 719         exit 1
 720 fi
 721
 722 # We do not wholesale replace either webroot or cgiroot unless they are under
 723 # basedir so if they exist and are not we make a copy to start working on them.
 724 # We make a copy using -p which can result in some warnings so we suppress
 725 # error output as it's of no consequence in this case.
 726 rm -rf "$webroot" "$cgiroot"
 727 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 728 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 729 mkdir -p "$webroot" "$cgiroot"
 730
 731 (
 732         cd git.git &&
 733         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 734                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 735         chown_make gitweb &&
 736         PERLBIN="$perlbin" && export PERLBIN &&
 737         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 738                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 739         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 740         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 741         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 742         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 743 )
 744 test $? -eq 0
 745
 746
 747 echo "*** Setting up git-browser from git-browser.git..."
 748 if ! [ -f git-browser.git/git-browser.cgi ]; then
 749         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 750         exit 1
 751 fi
 752 mkdir -p "$webroot"/git-browser "$cgiroot"
 753 (
 754         cd git-browser.git &&
 755         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 756         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 757                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 758                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 759         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 760         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 761         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 762         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 763         cp -r JSON "$cgiroot"
 764 )
 765 test $? -eq 0
 766 rm -f "$webroot"/git-browser/index.html
 767 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 768         gitbin: $cfg_git_bin
 769         warehouse: $cfg_reporoot
 770         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 771 EOT
 772 chown_make "$basedir/gitweb"/git-browser.conf.$$
 773 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 774 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 775         cfg_gitweb_url="$cfg_gitweburl/"
 776         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 777 EOT
 778 chown_make "$webroot"/git-browser/GitConfig.js.$$
 779 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 780
 781
 782 echo "*** Setting up our part of the website..."
 783 mkdir -p "$webroot" "$cgiroot"
 784 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 785 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 786 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 787 cp "$basedir/cgi"/*.cgi "$cgiroot"
 788 rm -rf "$basedir/cgi"
 789 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 790 if [ -z "$cfg_httpspushurl" ]; then
 791         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 792 else
 793         cp gitweb/indextext.html "$basedir/gitweb"
 794 fi
 795 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 796 cp mootools.js "$webroot"
 797 cp htaccess "$webroot/.htaccess"
 798 cp cgi/htaccess "$cgiroot/.htaccess"
 799 cp git-favicon.ico "$webroot/favicon.ico"
 800 cp robots.txt "$webroot"
 801 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 802
 803
 804 if [ -n "$cfg_httpspushurl" ]; then
 805         echo "*** Setting up SSL certificates..."
 806         bits=2048
 807         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 808             bits="$cfg_rsakeylength"
 809         fi
 810         mkdir -p "$cfg_certsdir"
 811         [ -d "$cfg_certsdir" ]
 812         wwwcertcn=
 813         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 814                 wwwcertcn="$(
 815                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 816                         sed -e 's,[^/]*,,'
 817                 )"
 818         fi
 819         wwwcertdns=
 820         if [ -n "$cfg_wwwcertaltnames" ]; then
 821                 for dnsopt in $cfg_wwwcertaltnames; do
 822                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 823                 done
 824         fi
 825         wwwcertdnsfile=
 826         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 827                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 828         fi
 829         needroot=
 830         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 831         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 832         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 833         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 834         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 835         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 836                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 837                 umask 0077
 838                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 839                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 840                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 841                 umask 0022
 842                 echo "Created new root key"
 843         fi
 844         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 845                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 846                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 847                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 848                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 849                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 850                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 851                 echo "Created new root certificate"
 852         fi
 853         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 854                 umask 0077
 855                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 856                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 857                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 858                 umask 0022
 859                 echo "Created new www key"
 860         fi
 861         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 862                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 863                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 864                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 865                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 866                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 867                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 868                 echo "Created www certificate"
 869         fi
 870         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 871                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 872                 echo "Created www certificate chain file"
 873         fi
 874         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 875                 umask 0037
 876                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 877                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 878                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 879                 umask 0022
 880                 echo "Created new client key"
 881         fi
 882         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 883                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 884                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 885                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 886                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 887                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 888                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 889                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 890                 echo "Created client certificate"
 891         fi
 892         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 893                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 894                 echo "Created client certificate suffix file"
 895         fi
 896         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 897         if [ -n "$cfg_mob" ]; then
 898                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 899                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 900                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 901                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 902                         echo "Created new mob user key"
 903                 fi
 904                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 905                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 906                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 907                                 --cert "$cfg_clientcert" \
 908                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 909                         echo "Created mob user client certificate"
 910                 fi
 911                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 912                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 913         else
 914                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 915         fi
 916 else
 917         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 918         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 919 fi
 920
 921
 922 echo "*** Finalizing permissions and moving into place..."
 923 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 924 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 925
 926 # This should always be the very last thing install.sh does
 927 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 928 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 929 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 930 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 931 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 932 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
 933 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 934         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 935         touch "$cfg_chroot/etc/taskd.restart"
 936         chown_make "$cfg_chroot/etc/taskd.restart"
 937         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 938 }