install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_chroot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_chroot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::chroot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 # $1 must exist and be a dir
  41 # $2 may exist but must be a dir
  42 # $3 must not exist
  43 # After call $2 will be renamed to $3 (if $2 existed)
  44 # And $1 will be renamed to $2
  45 quick_move() {
  46         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  47         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  48         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  49         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  50         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  51                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  52                 echo "fatal: quick_move: rename failed" >&2
  53                 exit 1
  54         }
  55         ! [ -d "$1" ] && [ -d "$2" ] || {
  56                 echo "fatal: quick_move: rename failed" >&2
  57                 exit 1
  58         }
  59 }
  60
  61 check_sh_builtin() (
  62         "unset" -f command
  63         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  64 ) 2>/dev/null
  65
  66 owngroup=
  67 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  68 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  69         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  70         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  71         exit 1
  72 fi
  73
  74
  75 # Check for extra required tools
  76 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  77         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  78         exit 1
  79 fi
  80
  81
  82 echo "*** Checking for compiled utilities..."
  83 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  84         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  85         echo "ERROR: perhaps you forgot to run make?" >&2
  86         exit 1
  87 fi
  88 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  89         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  90         echo "ERROR: perhaps you forgot to run make?" >&2
  91         exit 1
  92 fi
  93 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  94         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  95         echo "ERROR: perhaps you forgot to run make?" >&2
  96         exit 1
  97 fi
  98 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  99         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 100         echo "ERROR: perhaps you forgot to run make?" >&2
 101         exit 1
 102 fi
 103 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 104         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 105         echo "ERROR: perhaps you forgot to run make?" >&2
 106         exit 1
 107 fi
 108 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 109         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 110         echo "ERROR: perhaps you forgot to run make?" >&2
 111         exit 1
 112 fi
 113 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 114         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 115         echo "ERROR: perhaps you forgot to run make?" >&2
 116         exit 1
 117 fi
 118 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 119         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 120         echo "ERROR: perhaps you forgot to run make?" >&2
 121         exit 1
 122 fi
 123 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 124         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 125         echo "ERROR: perhaps you forgot to run make?" >&2
 126         exit 1
 127 fi
 128
 129
 130 echo "*** Checking for ezcert..."
 131 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 132         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 133         exit 1
 134 fi
 135
 136
 137 echo "*** Checking for git..."
 138 case "$cfg_git_bin" in /*) :;; *)
 139         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 140         exit 1
 141 esac
 142 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 143         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 144         exit 1
 145 fi
 146 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 147         echo "ERROR: $cfg_git_bin version failed" >&2
 148         exit 1
 149 fi
 150 case "$git_version" in
 151         [Gg]"it version "*) :;;
 152         *)
 153                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 154                 exit 1
 155 esac
 156 echo "Found $cfg_git_bin $git_version"
 157 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 158 echo "*** Checking Git $git_vernum for compatibility..."
 159 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 160         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 161         exit 1
 162 fi
 163 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 164         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 165 fi
 166 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 167         cat <<'EOT'
 168
 169 ***
 170 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 171 ***
 172
 173 Some Girocco functionality will be gracefully disabled and other things will
 174 just not work at all such as race condition protection against simultaneous
 175 client pushes and server garbage collections.
 176
 177 EOT
 178 fi
 179 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 180         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 181 fi
 182 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 183         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 184 fi
 185 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 186         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 187         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 188 fi
 189 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 190         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 192 fi
 193 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 194         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 195 fi
 196 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 197         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 198 fi
 199 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 200         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 201 fi
 202 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 203         cat <<'EOT'
 204
 205 ***
 206 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 207 ***
 208
 209 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 210 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 211 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 212
 213 In order to bypass this check you will have to modify install.sh in which case
 214 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 215
 216 EOT
 217         exit 1
 218 fi
 219 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 220         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 221 fi
 222 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 223         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 224 fi
 225 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 226         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 227         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 228         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 229         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 230         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 231 fi
 232 secmsg=
 233 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 234         secmsg='prior to 2.4.11'
 235 fi
 236 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 237         secmsg='2.5.x prior to 2.5.5'
 238 fi
 239 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 240         secmsg='2.6.x prior to 2.6.6'
 241 fi
 242 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 243         secmsg='2.7.x prior to 2.7.4'
 244 fi
 245 if [ -n "$secmsg" ]; then
 246         cat <<EOT
 247
 248 ***
 249 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 250 ***
 251
 252 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 253 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 254
 255 Besides the security fixes included in later versions, versions prior to
 256 2.2.0 may accidentally prune unreachable loose objects earlier than
 257 intended.  Since Git version 2.4.11 is the minimum version to include all
 258 security fixes to date, it should be considered the absolute minimum
 259 version of Git to use when running Girocco.
 260
 261 This is not enforced, but Git is easy to build from the git.git submodule
 262 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 263
 264 We will now pause for a moment so you can reflect on this warning.
 265
 266 EOT
 267         sleep 60
 268 fi
 269 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 270         cat <<'EOT'
 271
 272 ***
 273 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 274 ***
 275
 276 You appear to have enabled mirroring and the Git binary you have selected
 277 appears to contain an experimental patch that cannot be disabled.  This
 278 patch can generate invalid network DNS traffic and/or cause long delays
 279 when fetching using the "git:" protocol when no port number is specified.
 280 It may also end up retrieving repsitory contents from a host other than
 281 the one specified in the "git:" URL when the port is omitted.
 282
 283 You are advised to either build your own version of Git (the problem patch
 284 is not part of the official Git repository) or disable mirroring (via the
 285 $Girocco::Config:mirror setting) to avoid these potential problems.
 286
 287 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 288
 289 EOT
 290         sleep 5
 291 fi
 292
 293 test_nc_U() {
 294         [ -n "$1" ] || return 1
 295         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 296         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 297         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 298         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 299         >"$_tmpdir/output"
 300         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 301         _bgpid="$!"
 302         sleep 1
 303         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 304         sleep 1
 305         kill "$_bgpid" >/dev/null 2>&1 || :
 306         read -r _result <"$_tmpdir/output" || :
 307         _bad=
 308         ! [ -e "$_tmpdir/failed" ] || _bad=1
 309         rm -rf "$_tmpdir"
 310         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 311 } >/dev/null 2>&1
 312
 313 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 314 test_nc_U "$var_nc_openbsd_bin" || {
 315         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 316         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 317         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 318                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 319         fi
 320         exit 1
 321 }
 322
 323 echo "*** Verifying selected POSIX sh is sane..."
 324 shbin="$var_sh_bin"
 325 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 326         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 327         exit 1
 328 }
 329 [ "$(check_sh_builtin command)" = "command" ] || {
 330         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 331         exit 1
 332 }
 333 sh_not_builtin=
 334 sh_extra_chroot_installs=
 335 badsh=
 336 for sbi in cd pwd read umask unset unalias; do
 337         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 338                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 339                 badsh=1
 340         fi
 341 done
 342 [ -z "$badsh" ] || exit 1
 343 for sbi in '[' echo printf test; do
 344         if ! extra="$(check_sh_builtin "$sbi")"; then
 345                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 346                 badsh=1
 347                 continue
 348         fi
 349         if [ "$extra" != "$sbi" ]; then
 350                 case "$extra" in /*) :;; *)
 351                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 352                         badsh=1
 353                         continue
 354                 esac
 355                 withspc=
 356                 case "$extra" in *" "*) withspc=1; esac
 357                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 358                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 359                         badsh=1
 360                         continue
 361                 }
 362                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 363                 sh_not_builtin="$sh_not_builtin $sbi"
 364                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 365         fi
 366 done
 367 [ -z "$badsh" ] || exit 1
 368 [ -z "$sh_extra_chroot_installs" ] || {
 369         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 370         echo "WARNING: as a result it will run slower than necessary" >&2
 371         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 372         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 373         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 374         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 375         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 376 }
 377
 378 echo "*** Verifying xargs is sane..."
 379 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 380 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 381 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 382 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 383         echo 'ERROR: xargs is unusable' >&2
 384         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 385         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 386         echo 'ERROR: must be true, but neither is' >&2
 387         exit 1
 388 }
 389
 390 echo "*** Verifying selected perl is sane..."
 391 perlbin="$var_perl_bin"
 392 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 393         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 394         exit 1
 395 }
 396
 397 echo "*** Verifying selected gzip is sane..."
 398 gzipbin="$var_gzip_bin"
 399 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 400     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 401         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 402         exit 1
 403 }
 404
 405 echo "*** Verifying basedir, webroot and cgiroot paths..."
 406 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 407 case "$cfg_basedir" in /*) :;; *)
 408         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 409         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 410         exit 1
 411 esac
 412 case "$cfg_webroot" in /*) :;; *)
 413         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 414         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 415         exit 1
 416 esac
 417 case "$cfg_cgiroot" in /*) :;; *)
 418         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 419         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 420         exit 1
 421 esac
 422
 423 # return the input with trailing slashes stripped but return "/" for all "/"s
 424 striptrsl() {
 425         [ -n "$1" ] || return 0
 426         _s="${1##*[!/]}"
 427         [ "$_s" != "$1" ] || _s="${_s#?}"
 428         printf "%s\n" "${1%$_s}"
 429 }
 430
 431 # a combination of realpath + dirname where the realpath of the deepest existing
 432 # directory is returned with the rest of the non-existing components appended
 433 # and trailing slashes and multiple slashes are removed
 434 realdir() {
 435         _d="$(striptrsl "$1")"
 436         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 437                 echo "$_d"
 438                 return 0
 439         fi
 440         _c=""
 441         while ! [ -d "$_d" ]; do
 442                 _c="/$(basename "$_d")$_c"
 443                 _d="$(dirname "$_d")"
 444                 [ "$_d" != "/" ] || _c="${_c#/}"
 445         done
 446         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 447 }
 448
 449 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 450 # Wherever we are writing/copying/installing files we use these, but where we
 451 # are editing, adding config settings or printing advice we always stick to the
 452 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 453 # Only the file system directories that could be asynchronously accessed (by
 454 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 455 # The chroot is handled specially and does not need one of these.
 456 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 457 # case the prior contents of cgiroot and/or webroot are discarded.
 458 rbasedir="$(realdir "$cfg_basedir")"
 459 rwebroot="$(realdir "$cfg_webroot")"
 460 rcgiroot="$(realdir "$cfg_cgiroot")"
 461 case "$rbasedir" in "$rwebroot"/?*)
 462         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 463         exit 1
 464 esac
 465 case "$rbasedir" in "$rcgiroot"/?*)
 466         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 467         exit 1
 468 esac
 469 if [ "$rwebroot" = "$rcgiroot" ]; then
 470         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 471         exit 1
 472 fi
 473 case "$rcgiroot" in "$rwebroot"/?*)
 474         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 475         exit 1
 476 esac
 477 case "$rwebroot" in "$rcgiroot"/?*)
 478         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 479         exit 1
 480 esac
 481 basedir="$rbasedir-new"
 482 case "$rwebroot" in
 483         "$rbasedir"/?*)
 484                 webroot="$basedir${rwebroot#$rbasedir}"
 485                 webrootsub=1
 486                 ;;
 487         *)
 488                 webroot="$rwebroot-new"
 489                 webrootsub=
 490                 ;;
 491 esac
 492 case "$rcgiroot" in
 493         "$rbasedir"/?*)
 494                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 495                 cgirootsub=1
 496                 ;;
 497         *)
 498                 cgiroot="$rcgiroot-new"
 499                 cgirootsub=
 500                 ;;
 501 esac
 502
 503 echo "*** Setting up basedir..."
 504
 505 chown_make() {
 506         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 507                 find "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 508         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 509                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 510         fi
 511 }
 512
 513 "$MAKE" --no-print-directory --silent apache.conf
 514 chown_make apache.conf
 515 "$MAKE" --no-print-directory --silent -C src
 516 chown_make src
 517 rm -fr "$basedir"
 518 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 519 cp cgi/*.cgi "$basedir/cgi"
 520 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 521 find "$basedir" -type l -exec rm -f '{}' +
 522 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 523         src/rangecgi src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 524         cgi/snapshot.cgi "$basedir/bin"
 525 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 526 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 527 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 528
 529 # Put the correct Config in place
 530 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 531
 532 # Create symbolic links to selected binaries
 533 ln -s "$cfg_git_bin" "$basedir/bin/git"
 534 ln -s "$shbin" "$basedir/bin/sh"
 535 ln -s "$perlbin" "$basedir/bin/perl"
 536 ln -s "$gzipbin" "$basedir/bin/gzip"
 537
 538 echo "*** Preprocessing scripts..."
 539 SHBIN="$shbin" && export SHBIN
 540 PERLBIN="$perlbin" && export PERLBIN
 541 perl -I. -M$GIROCCO_CONF -i -p \
 542         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 543         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 544         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 545         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 546         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 547         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 548         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 549         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 550         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 551         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 552         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 553         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 554         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 555         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 556         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 557         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 558         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 559         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 560         -e 'close ARGV if eof;' \
 561         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 562         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 563         "$basedir"/shlib.sh "$basedir"/hooks/* \
 564         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 565         "$basedir"/toolbox/reports/*.sh \
 566         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 567         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 568         "$basedir"/bin/*.cgi "$basedir"/screen/*
 569 perl -I. -M$GIROCCO_CONF -i -p \
 570         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 571         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 572         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 573 perl -i -p \
 574         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 575         -e 'close ARGV if eof;' \
 576         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 577         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 578 perl -i -p \
 579         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 580         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 581         -e 'close ARGV if eof;' \
 582         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 583 unset PERLBIN
 584 unset SHBIN
 585
 586 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 587 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 588
 589 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 590 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 591    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 592         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 593         exit 1
 594 fi
 595 mkdir -p "$basedir"/bin
 596 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 597
 598 echo "*** Setting up hg-fast-export from fast-export.git..."
 599 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 600         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 601         exit 1
 602 fi
 603 mkdir -p "$basedir"/bin
 604 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 605
 606 echo "*** Setting up markdown from markdown.git..."
 607 if ! [ -f markdown.git/Markdown.pl ]; then
 608         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 609         exit 1
 610 fi
 611 mkdir -p "$basedir"/bin
 612 (PERLBIN="$perlbin" && export PERLBIN &&
 613         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 614                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 615         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 616         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 617 test $? -eq 0
 618
 619 # Some permission sanity on basedir/bin just in case
 620 find "$basedir"/bin -type f -exec chmod go-w '{}' +
 621 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 622
 623 if [ -n "$cfg_mirror" ]; then
 624         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 625 fi
 626 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 627 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 628 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 629
 630
 631 echo "*** Setting up repository root..."
 632 mkdir -p "$cfg_reporoot" "$cfg_reporoot/_recyclebin"
 633 if [ "$cfg_owning_group" ]; then
 634         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 635         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 636 fi
 637 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 638 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 639
 640
 641 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 642         echo "*** Setting up chroot jail for pushing..."
 643         if [ "$(id -u)" -eq 0 ]; then
 644                 # jailsetup may install things from $cfg_basedir/bin into the
 645                 # chroot so we do a mini-update of just that portion now
 646                 mkdir -p "$cfg_basedir"
 647                 rm -rf "$cfg_basedir/bin-new"
 648                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 649                 rm -rf "$cfg_basedir/bin-old"
 650                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 651                 rm -rf "$cfg_basedir/bin-old"
 652                 if [ -n "$sh_extra_chroot_installs" ]; then
 653                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 654                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 655                 fi
 656                 ./jailsetup.sh
 657                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 658         else
 659                 echo "WARNING: Skipping jail setup, not root"
 660         fi
 661 fi
 662
 663
 664 echo "*** Setting up jail configuration (project database)..."
 665 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 666 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 667 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 668 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 669         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 670 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 671         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 672 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 673         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 674 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 675
 676
 677 echo "*** Setting up gitweb from git.git..."
 678 if ! [ -f git.git/Makefile ]; then
 679         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 680         exit 1
 681 fi
 682
 683 # We do not wholesale replace either webroot or cgiroot unless they are under
 684 # basedir so if they exist and are not we make a copy to start working on them.
 685 # We make a copy using -p which can result in some warnings so we suppress
 686 # error output as it's of no consequence in this case.
 687 rm -rf "$webroot" "$cgiroot"
 688 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 689 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 690 mkdir -p "$webroot" "$cgiroot"
 691
 692 (
 693         cd git.git &&
 694         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 695                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 696         chown_make gitweb &&
 697         PERLBIN="$perlbin" && export PERLBIN &&
 698         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 699                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 700         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 701         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 702         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 703         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 704 )
 705 test $? -eq 0
 706
 707
 708 echo "*** Setting up git-browser from git-browser.git..."
 709 if ! [ -f git-browser.git/git-browser.cgi ]; then
 710         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 711         exit 1
 712 fi
 713 mkdir -p "$webroot"/git-browser "$cgiroot"
 714 (
 715         cd git-browser.git &&
 716         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 717         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 718                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 719                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 720         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 721         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 722         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 723         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 724         cp -r JSON "$cgiroot"
 725 )
 726 test $? -eq 0
 727 rm -f "$webroot"/git-browser/index.html
 728 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 729         gitbin: $cfg_git_bin
 730         warehouse: $cfg_reporoot
 731         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 732 EOT
 733 chown_make "$basedir/gitweb"/git-browser.conf.$$
 734 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 735 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 736         cfg_gitweb_url="$cfg_gitweburl/"
 737         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 738 EOT
 739 chown_make "$webroot"/git-browser/GitConfig.js.$$
 740 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 741
 742
 743 echo "*** Setting up our part of the website..."
 744 mkdir -p "$webroot" "$cgiroot"
 745 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 746 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 747 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 748 cp "$basedir/cgi"/*.cgi "$cgiroot"
 749 rm -rf "$basedir/cgi"
 750 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 751 if [ -z "$cfg_httpspushurl" ]; then
 752         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 753 else
 754         cp gitweb/indextext.html "$basedir/gitweb"
 755 fi
 756 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 757 cp mootools.js "$webroot"
 758 cp htaccess "$webroot/.htaccess"
 759 cp cgi/htaccess "$cgiroot/.htaccess"
 760 cp git-favicon.ico "$webroot/favicon.ico"
 761 cp robots.txt "$webroot"
 762 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 763
 764
 765 if [ -n "$cfg_httpspushurl" ]; then
 766         echo "*** Setting up SSL certificates..."
 767         bits=2048
 768         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 769             bits="$cfg_rsakeylength"
 770         fi
 771         mkdir -p "$cfg_certsdir"
 772         [ -d "$cfg_certsdir" ]
 773         wwwcertcn=
 774         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 775                 wwwcertcn="$(
 776                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 777                         sed -e 's,[^/]*,,'
 778                 )"
 779         fi
 780         wwwcertdns=
 781         if [ -n "$cfg_wwwcertaltnames" ]; then
 782                 for dnsopt in $cfg_wwwcertaltnames; do
 783                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 784                 done
 785         fi
 786         wwwcertdnsfile=
 787         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 788                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 789         fi
 790         needroot=
 791         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 792         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 793         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 794         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 795         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 796         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 797                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 798                 umask 0077
 799                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 800                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 801                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 802                 umask 0022
 803                 echo "Created new root key"
 804         fi
 805         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 806                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 807                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 808                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 809                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 810                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 811                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 812                 echo "Created new root certificate"
 813         fi
 814         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 815                 umask 0077
 816                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 817                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 818                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 819                 umask 0022
 820                 echo "Created new www key"
 821         fi
 822         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 823                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 824                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 825                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 826                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 827                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 828                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 829                 echo "Created www certificate"
 830         fi
 831         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 832                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 833                 echo "Created www certificate chain file"
 834         fi
 835         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 836                 umask 0037
 837                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 838                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 839                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 840                 umask 0022
 841                 echo "Created new client key"
 842         fi
 843         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 844                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 845                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 846                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 847                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 848                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 849                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 850                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 851                 echo "Created client certificate"
 852         fi
 853         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 854                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 855                 echo "Created client certificate suffix file"
 856         fi
 857         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 858         if [ -n "$cfg_mob" ]; then
 859                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 860                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 861                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 862                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 863                         echo "Created new mob user key"
 864                 fi
 865                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 866                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 867                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 868                                 --cert "$cfg_clientcert" \
 869                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 870                         echo "Created mob user client certificate"
 871                 fi
 872                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 873                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 874         else
 875                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 876         fi
 877 else
 878         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 879         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 880 fi
 881
 882
 883 echo "*** Finalizing permissions and moving into place..."
 884 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 885 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 886
 887 # This should always be the very last thing install.sh does
 888 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 889 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 890 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 891 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 892 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 893 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
 894 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 895         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 896         touch "$cfg_chroot/etc/taskd.restart"
 897         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 898 }