install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I. -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # $1 must exist and be a dir
  32 # $2 may exist but must be a dir
  33 # $3 must not exist
  34 # After call $2 will be renamed to $3 (if $2 existed)
  35 # And $1 will be renamed to $2
  36 quick_move() {
  37         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  38         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  39         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  40         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  41         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  42                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  43                 echo "fatal: quick_move: rename failed" >&2
  44                 exit 1
  45         }
  46         ! [ -d "$1" ] && [ -d "$2" ] || {
  47                 echo "fatal: quick_move: rename failed" >&2
  48                 exit 1
  49         }
  50 }
  51
  52 check_sh_builtin() (
  53         "unset" -f command
  54         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
  55 ) 2>/dev/null
  56
  57 owngroup=
  58 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
  59 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
  60         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
  61         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
  62         exit 1
  63 fi
  64
  65
  66 # Check for extra required tools
  67 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
  68         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
  69         exit 1
  70 fi
  71
  72
  73 echo "*** Checking for compiled utilities..."
  74 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
  75         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
  76         echo "ERROR: perhaps you forgot to run make?" >&2
  77         exit 1
  78 fi
  79 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
  80         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
  81         echo "ERROR: perhaps you forgot to run make?" >&2
  82         exit 1
  83 fi
  84 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
  85         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
  86         echo "ERROR: perhaps you forgot to run make?" >&2
  87         exit 1
  88 fi
  89 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
  90         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
  91         echo "ERROR: perhaps you forgot to run make?" >&2
  92         exit 1
  93 fi
  94 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
  95         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
  96         echo "ERROR: perhaps you forgot to run make?" >&2
  97         exit 1
  98 fi
  99 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 100         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 101         echo "ERROR: perhaps you forgot to run make?" >&2
 102         exit 1
 103 fi
 104 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 105         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 106         echo "ERROR: perhaps you forgot to run make?" >&2
 107         exit 1
 108 fi
 109 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 110         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 111         echo "ERROR: perhaps you forgot to run make?" >&2
 112         exit 1
 113 fi
 114 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 115         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 116         echo "ERROR: perhaps you forgot to run make?" >&2
 117         exit 1
 118 fi
 119
 120
 121 echo "*** Checking for ezcert..."
 122 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 123         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 124         exit 1
 125 fi
 126
 127
 128 echo "*** Checking for git..."
 129 case "$cfg_git_bin" in /*) :;; *)
 130         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 131         exit 1
 132 esac
 133 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 134         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 135         exit 1
 136 fi
 137 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 138         echo "ERROR: $cfg_git_bin version failed" >&2
 139         exit 1
 140 fi
 141 case "$git_version" in
 142         [Gg]"it version "*) :;;
 143         *)
 144                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 145                 exit 1
 146 esac
 147 echo "Found $cfg_git_bin $git_version"
 148 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 149 echo "*** Checking Git $git_vernum for compatibility..."
 150 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 151         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 152         exit 1
 153 fi
 154 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 155         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 156 fi
 157 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 158         cat <<'EOT'
 159
 160 ***
 161 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 162 ***
 163
 164 Some Girocco functionality will be gracefully disabled and other things will
 165 just not work at all such as race condition protection against simultaneous
 166 client pushes and server garbage collections.
 167
 168 EOT
 169 fi
 170 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 171         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 172 fi
 173 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 174         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 175 fi
 176 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 177         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 178         echo 'WARNING: See https://mid.mail-archive.com/20141222041944.GA441@peff.net for details'
 179 fi
 180 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 181         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 182         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 183 fi
 184 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 185         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 186 fi
 187 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 188         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 189 fi
 190 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 191         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 192 fi
 193 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 194         cat <<'EOT'
 195
 196 ***
 197 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 198 ***
 199
 200 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 201 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 202 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 203
 204 In order to bypass this check you will have to modify install.sh in which case
 205 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 206
 207 EOT
 208         exit 1
 209 fi
 210 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 211         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 212 fi
 213 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 214         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 215 fi
 216 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 217         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 218         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 219         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 220         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 221         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 222 fi
 223 secmsg=
 224 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 225         secmsg='prior to 2.4.11'
 226 fi
 227 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 228         secmsg='2.5.x prior to 2.5.5'
 229 fi
 230 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 231         secmsg='2.6.x prior to 2.6.6'
 232 fi
 233 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 234         secmsg='2.7.x prior to 2.7.4'
 235 fi
 236 if [ -n "$secmsg" ]; then
 237         cat <<EOT
 238
 239 ***
 240 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 241 ***
 242
 243 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 244 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 245
 246 Besides the security fixes included in later versions, versions prior to
 247 2.2.0 may accidentally prune unreachable loose objects earlier than
 248 intended.  Since Git version 2.4.11 is the minimum version to include all
 249 security fixes to date, it should be considered the absolute minimum
 250 version of Git to use when running Girocco.
 251
 252 This is not enforced, but Git is easy to build from the git.git submodule
 253 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 254
 255 We will now pause for a moment so you can reflect on this warning.
 256
 257 EOT
 258         sleep 60
 259 fi
 260 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 261         cat <<'EOT'
 262
 263 ***
 264 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 265 ***
 266
 267 You appear to have enabled mirroring and the Git binary you have selected
 268 appears to contain an experimental patch that cannot be disabled.  This
 269 patch can generate invalid network DNS traffic and/or cause long delays
 270 when fetching using the "git:" protocol when no port number is specified.
 271 It may also end up retrieving repsitory contents from a host other than
 272 the one specified in the "git:" URL when the port is omitted.
 273
 274 You are advised to either build your own version of Git (the problem patch
 275 is not part of the official Git repository) or disable mirroring (via the
 276 $Girocco::Config:mirror setting) to avoid these potential problems.
 277
 278 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 279
 280 EOT
 281         sleep 5
 282 fi
 283
 284 test_nc_U() {
 285         [ -n "$1" ] || return 1
 286         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 287         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 288         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 289         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 290         >"$_tmpdir/output"
 291         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 292         _bgpid="$!"
 293         sleep 1
 294         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 295         sleep 1
 296         kill "$_bgpid" >/dev/null 2>&1 || :
 297         read -r _result <"$_tmpdir/output" || :
 298         _bad=
 299         ! [ -e "$_tmpdir/failed" ] || _bad=1
 300         rm -rf "$_tmpdir"
 301         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 302 } >/dev/null 2>&1
 303
 304 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 305 test_nc_U "$var_nc_openbsd_bin" || {
 306         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 307         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 308         if [ "$(uname -s 2>/dev/null)" = "DragonFly" ]; then
 309                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2
 310         fi
 311         exit 1
 312 }
 313
 314 echo "*** Verifying selected POSIX sh is sane..."
 315 shbin="$var_sh_bin"
 316 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 317         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 318         exit 1
 319 }
 320 [ "$(check_sh_builtin command)" = "command" ] || {
 321         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 322         exit 1
 323 }
 324 sh_not_builtin=
 325 sh_extra_chroot_installs=
 326 badsh=
 327 for sbi in cd pwd read umask unset unalias; do
 328         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 329                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 330                 badsh=1
 331         fi
 332 done
 333 [ -z "$badsh" ] || exit 1
 334 for sbi in '[' echo printf test; do
 335         if ! extra="$(check_sh_builtin "$sbi")"; then
 336                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 337                 badsh=1
 338                 continue
 339         fi
 340         if [ "$extra" != "$sbi" ]; then
 341                 case "$extra" in /*) :;; *)
 342                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 343                         badsh=1
 344                         continue
 345                 esac
 346                 withspc=
 347                 case "$extra" in *" "*) withspc=1; esac
 348                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 349                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 350                         badsh=1
 351                         continue
 352                 }
 353                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 354                 sh_not_builtin="$sh_not_builtin $sbi"
 355                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 356         fi
 357 done
 358 [ -z "$badsh" ] || exit 1
 359 [ -z "$sh_extra_chroot_installs" ] || {
 360         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 361         echo "WARNING: as a result it will run slower than necessary" >&2
 362         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 363         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 364         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 365         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 366         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 367 }
 368
 369 echo "*** Verifying xargs is sane..."
 370 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 371 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 372 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>&1)" || :
 373 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 374         echo 'ERROR: xargs is unusable' >&2
 375         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>&1)"`' >&2
 376         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>&1)"`' >&2
 377         echo 'ERROR: must be true, but neither is' >&2
 378         exit 1
 379 }
 380
 381 echo "*** Verifying selected perl is sane..."
 382 perlbin="$var_perl_bin"
 383 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 384         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 385         exit 1
 386 }
 387
 388 echo "*** Verifying selected gzip is sane..."
 389 gzipbin="$var_gzip_bin"
 390 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 391     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 392         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 393         exit 1
 394 }
 395
 396 echo "*** Verifying basedir, webroot and cgiroot paths..."
 397 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 398 case "$cfg_basedir" in /*) :;; *)
 399         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 400         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 401         exit 1
 402 esac
 403 case "$cfg_webroot" in /*) :;; *)
 404         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 405         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 406         exit 1
 407 esac
 408 case "$cfg_cgiroot" in /*) :;; *)
 409         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 410         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 411         exit 1
 412 esac
 413
 414 # return the input with trailing slashes stripped but return "/" for all "/"s
 415 striptrsl() {
 416         [ -n "$1" ] || return 0
 417         _s="${1##*[!/]}"
 418         [ "$_s" != "$1" ] || _s="${_s#?}"
 419         printf "%s\n" "${1%$_s}"
 420 }
 421
 422 # a combination of realpath + dirname where the realpath of the deepest existing
 423 # directory is returned with the rest of the non-existing components appended
 424 # and trailing slashes and multiple slashes are removed
 425 realdir() {
 426         _d="$(striptrsl "$1")"
 427         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 428                 echo "$_d"
 429                 return 0
 430         fi
 431         _c=""
 432         while ! [ -d "$_d" ]; do
 433                 _c="/$(basename "$_d")$_c"
 434                 _d="$(dirname "$_d")"
 435                 [ "$_d" != "/" ] || _c="${_c#/}"
 436         done
 437         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 438 }
 439
 440 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 441 # Wherever we are writing/copying/installing files we use these, but where we
 442 # are editing, adding config settings or printing advice we always stick to the
 443 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 444 # Only the file system directories that could be asynchronously accessed (by
 445 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 446 # The chroot is handled specially and does not need one of these.
 447 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 448 # case the prior contents of cgiroot and/or webroot are discarded.
 449 rbasedir="$(realdir "$cfg_basedir")"
 450 rwebroot="$(realdir "$cfg_webroot")"
 451 rcgiroot="$(realdir "$cfg_cgiroot")"
 452 case "$rbasedir" in "$rwebroot"/?*)
 453         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 454         exit 1
 455 esac
 456 case "$rbasedir" in "$rcgiroot"/?*)
 457         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 458         exit 1
 459 esac
 460 if [ "$rwebroot" = "$rcgiroot" ]; then
 461         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 462         exit 1
 463 fi
 464 case "$rcgiroot" in "$rwebroot"/?*)
 465         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 466         exit 1
 467 esac
 468 case "$rwebroot" in "$rcgiroot"/?*)
 469         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 470         exit 1
 471 esac
 472 basedir="$rbasedir-new"
 473 case "$rwebroot" in
 474         "$rbasedir"/?*)
 475                 webroot="$basedir${rwebroot#$rbasedir}"
 476                 webrootsub=1
 477                 ;;
 478         *)
 479                 webroot="$rwebroot-new"
 480                 webrootsub=
 481                 ;;
 482 esac
 483 case "$rcgiroot" in
 484         "$rbasedir"/?*)
 485                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 486                 cgirootsub=1
 487                 ;;
 488         *)
 489                 cgiroot="$rcgiroot-new"
 490                 cgirootsub=
 491                 ;;
 492 esac
 493
 494 echo "*** Setting up basedir..."
 495
 496 chown_make() {
 497         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 498                 find "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 499         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 500                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 501         fi
 502 }
 503
 504 "$MAKE" --no-print-directory --silent apache.conf
 505 chown_make apache.conf
 506 "$MAKE" --no-print-directory --silent -C src
 507 chown_make src
 508 rm -fr "$basedir"
 509 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 510 cp cgi/*.cgi "$basedir/cgi"
 511 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 512 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 513         src/rangecgi src/strftime src/throttle ezcert.git/CACreateCert cgi/authrequired.cgi \
 514         cgi/snapshot.cgi "$basedir/bin"
 515 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 516 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 517 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 518
 519 # Put the correct Config in place
 520 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 521
 522 # Create symbolic links to selected binaries
 523 ln -s "$cfg_git_bin" "$basedir/bin/git"
 524 ln -s "$shbin" "$basedir/bin/sh"
 525 ln -s "$perlbin" "$basedir/bin/perl"
 526 ln -s "$gzipbin" "$basedir/bin/gzip"
 527
 528 echo "*** Preprocessing scripts..."
 529 SHBIN="$shbin" && export SHBIN
 530 PERLBIN="$perlbin" && export PERLBIN
 531 perl -I. -M$GIROCCO_CONF -i -p \
 532         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 533         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 534         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 535         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 536         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 537         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 538         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 539         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 540         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 541         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 542         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 543         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 544         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 545         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 546         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 547         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 548         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 549         -e 'close ARGV if eof;' \
 550         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 551         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 552         "$basedir"/shlib.sh "$basedir"/hooks/* \
 553         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 554         "$basedir"/toolbox/reports/*.sh \
 555         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 556         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 557         "$basedir"/bin/*.cgi "$basedir"/screen/*
 558 perl -i -p \
 559         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 560         -e 'close ARGV if eof;' \
 561         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 562         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 563 perl -i -p \
 564         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 565         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 566         -e 'close ARGV if eof;' \
 567         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 568 unset PERLBIN
 569 unset SHBIN
 570
 571 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 572 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 573
 574 echo "*** Setting up darcs-fast-export from bzr-fastimport.git..."
 575 if ! [ -f bzr-fastimport.git/exporters/darcs/darcs-fast-export ] ||
 576    ! [ -x bzr-fastimport.git/exporters/darcs/darcs-fast-export ]; then
 577         echo "ERROR: bzr-fastimport.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 578         exit 1
 579 fi
 580 mkdir -p "$basedir"/bin
 581 cp bzr-fastimport.git/exporters/darcs/darcs-fast-export "$basedir"/bin
 582
 583 echo "*** Setting up hg-fast-export from fast-export.git..."
 584 if ! [ -f fast-export.git/hg-fast-export.py ] || ! [ -f fast-export.git/hg2git.py ]; then
 585         echo "ERROR: fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 586         exit 1
 587 fi
 588 mkdir -p "$basedir"/bin
 589 cp fast-export.git/hg-fast-export.py fast-export.git/hg2git.py "$basedir"/bin
 590
 591 echo "*** Setting up markdown from markdown.git..."
 592 if ! [ -f markdown.git/Markdown.pl ]; then
 593         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 594         exit 1
 595 fi
 596 mkdir -p "$basedir"/bin
 597 (PERLBIN="$perlbin" && export PERLBIN &&
 598         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 599                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 600         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 601         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 602 test $? -eq 0
 603
 604 # Some permission sanity on basedir/bin just in case
 605 find "$basedir"/bin -type f -exec chmod go-w '{}' +
 606 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 607
 608 if [ -n "$cfg_mirror" ]; then
 609         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 610 fi
 611 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.sh, or add this"
 612 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 613 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.sh -q --all-once"
 614
 615
 616 echo "*** Setting up repository root..."
 617 mkdir -p "$cfg_reporoot" "$cfg_reporoot/_recyclebin"
 618 if [ "$cfg_owning_group" ]; then
 619         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 620         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 621 fi
 622 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 623 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 624
 625
 626 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 627         echo "*** Setting up chroot jail for pushing..."
 628         if [ "$(id -u)" -eq 0 ]; then
 629                 # jailsetup may install things from $cfg_basedir/bin into the
 630                 # chroot so we do a mini-update of just that portion now
 631                 mkdir -p "$cfg_basedir"
 632                 rm -rf "$cfg_basedir/bin-new"
 633                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 634                 rm -rf "$cfg_basedir/bin-old"
 635                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 636                 rm -rf "$cfg_basedir/bin-old"
 637                 if [ -n "$sh_extra_chroot_installs" ]; then
 638                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 639                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 640                 fi
 641                 ./jailsetup.sh
 642                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 643         else
 644                 echo "WARNING: Skipping jail setup, not root"
 645         fi
 646 fi
 647
 648
 649 echo "*** Setting up jail configuration (project database)..."
 650 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 651 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 652 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 653 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 654         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 655 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 656         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 657 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 658         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 659 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 660
 661
 662 echo "*** Setting up gitweb from git.git..."
 663 if ! [ -f git.git/Makefile ]; then
 664         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 665         exit 1
 666 fi
 667
 668 # We do not wholesale replace either webroot or cgiroot unless they are under
 669 # basedir so if they exist and are not we make a copy to start working on them.
 670 # We make a copy using -p which can result in some warnings so we suppress
 671 # error output as it's of no consequence in this case.
 672 rm -rf "$webroot" "$cgiroot"
 673 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 674 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 675 mkdir -p "$webroot" "$cgiroot"
 676
 677 (
 678         cd git.git &&
 679         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 680                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 681         chown_make gitweb &&
 682         PERLBIN="$perlbin" && export PERLBIN &&
 683         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 684                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 685         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 686         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 687         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 688         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 689 )
 690 test $? -eq 0
 691
 692
 693 echo "*** Setting up git-browser from git-browser.git..."
 694 if ! [ -f git-browser.git/git-browser.cgi ]; then
 695         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 696         exit 1
 697 fi
 698 mkdir -p "$webroot"/git-browser "$cgiroot"
 699 (
 700         cd git-browser.git &&
 701         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 702         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 703                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 704                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 705         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 706         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 707         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 708         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 709         cp -r JSON "$cgiroot"
 710 )
 711 test $? -eq 0
 712 rm -f "$webroot"/git-browser/index.html
 713 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 714         gitbin: $cfg_git_bin
 715         warehouse: $cfg_reporoot
 716         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 717 EOT
 718 chown_make "$basedir/gitweb"/git-browser.conf.$$
 719 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 720 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 721         cfg_gitweb_url="$cfg_gitweburl/"
 722         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 723 EOT
 724 chown_make "$webroot"/git-browser/GitConfig.js.$$
 725 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 726
 727
 728 echo "*** Setting up our part of the website..."
 729 mkdir -p "$webroot" "$cgiroot"
 730 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 731 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 732 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 733 cp "$basedir/cgi"/*.cgi "$cgiroot"
 734 rm -rf "$basedir/cgi"
 735 ln -fs "$cfg_basedir"/Girocco "$cgiroot"
 736 [ -z "$cfg_webreporoot" ] || { rm -f "$cfg_webreporoot" && ln -s "$cfg_reporoot" "$cfg_webreporoot"; }
 737 if [ -z "$cfg_httpspushurl" ]; then
 738         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 739 else
 740         cp gitweb/indextext.html "$basedir/gitweb"
 741 fi
 742 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 743 cp mootools.js "$webroot"
 744 cp htaccess "$webroot/.htaccess"
 745 cp cgi/htaccess "$cgiroot/.htaccess"
 746 cp git-favicon.ico "$webroot/favicon.ico"
 747 cp robots.txt "$webroot"
 748 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 749
 750
 751 if [ -n "$cfg_httpspushurl" ]; then
 752         echo "*** Setting up SSL certificates..."
 753         bits=2048
 754         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 755             bits="$cfg_rsakeylength"
 756         fi
 757         mkdir -p "$cfg_certsdir"
 758         [ -d "$cfg_certsdir" ]
 759         wwwcertcn=
 760         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 761                 wwwcertcn="$(
 762                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 763                         sed -e 's,[^/]*,,'
 764                 )"
 765         fi
 766         wwwcertdns=
 767         if [ -n "$cfg_wwwcertaltnames" ]; then
 768                 for dnsopt in $cfg_wwwcertaltnames; do
 769                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 770                 done
 771         fi
 772         wwwcertdnsfile=
 773         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 774                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 775         fi
 776         needroot=
 777         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 778         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 779         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 780         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 781         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 782         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 783                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 784                 umask 0077
 785                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 786                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 787                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 788                 umask 0022
 789                 echo "Created new root key"
 790         fi
 791         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 792                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 793                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 794                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 795                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 796                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 797                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 798                 echo "Created new root certificate"
 799         fi
 800         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 801                 umask 0077
 802                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 803                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 804                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 805                 umask 0022
 806                 echo "Created new www key"
 807         fi
 808         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 809                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 810                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 811                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 812                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 813                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 814                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 815                 echo "Created www certificate"
 816         fi
 817         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 818                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 819                 echo "Created www certificate chain file"
 820         fi
 821         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 822                 umask 0037
 823                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 824                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 825                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 826                 umask 0022
 827                 echo "Created new client key"
 828         fi
 829         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 830                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 831                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 832                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 833                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 834                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 835                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 836                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 837                 echo "Created client certificate"
 838         fi
 839         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 840                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 841                 echo "Created client certificate suffix file"
 842         fi
 843         cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 844         if [ -n "$cfg_mob" ]; then
 845                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 846                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 847                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 848                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 849                         echo "Created new mob user key"
 850                 fi
 851                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 852                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 853                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 854                                 --cert "$cfg_clientcert" \
 855                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 856                         echo "Created mob user client certificate"
 857                 fi
 858                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
 859                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
 860         else
 861                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 862         fi
 863 else
 864         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 865         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
 866 fi
 867
 868
 869 echo "*** Finalizing permissions and moving into place..."
 870 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
 871 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
 872
 873 # This should always be the very last thing install.sh does
 874 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 875 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
 876 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
 877 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
 878 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
 879 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
 880         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
 881         touch "$cfg_chroot/etc/taskd.restart"
 882         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
 883 }