install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I"$PWD" -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_reporoot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_reporoot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::reporoot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 warn() { printf >&2 '%s\n' "$*"; }
  41 die() { warn "$@"; exit 1; }
  42
  43 # Either we must run as root (but preferably not if disable_jailsetup is true)
  44 # or the mirror_user (preferred choice for disable_jailsetup).
  45 if [ "$(id -u)" -eq 0 ]; then
  46         if [ "${cfg_disable_jailsetup:-0}" != "0" ]; then
  47                 cat <<'EOT'
  48
  49 ***
  50 *** WARNING: $Girocco::Config::disable_jailsetup has been enabled
  51 *** WARNING: but installation is being performed as the superuser
  52 ***
  53
  54 You appear to have disabled jailsetup which is perfectly fine for installations
  55 that will not be using an ssh jail.  However, in that case, running the install
  56 process as the superuser is highly discouraged.
  57
  58 Instead, running it as the configured $Girocco::Config::mirror_user is much
  59 preferred.
  60
  61 The install process will now pause for 10 seconds to give you a chance to abort
  62 it before continuing to install a disable_jailsetup config as the superuser.
  63
  64 EOT
  65                 sleep 10 || die "install aborted"
  66         fi
  67 else
  68         [ -n "$cfg_mirror_user" ] || die 'Girocco::Config.pm $mirror_user must be set'
  69         curuname="$(id -un)"
  70         [ -n "$curuname" ] || die "Cannot determine name of current user"
  71         if [ "$cfg_mirror_user" != "$curuname" ]; then
  72                 warn "ERROR: install must run as superuser or Config.pm's \$mirror_user ($cfg_mirror_user)"
  73                 die  "ERROR: install is currently running as $curuname"
  74         fi
  75 fi
  76
  77 # $1 must exist and be a dir
  78 # $2 may exist but must be a dir
  79 # $3 must not exist
  80 # After call $2 will be renamed to $3 (if $2 existed)
  81 # And $1 will be renamed to $2
  82 quick_move() {
  83         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  84         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  85         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  86         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  87         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  88                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  89                 echo "fatal: quick_move: rename failed" >&2
  90                 exit 1
  91         }
  92         ! [ -d "$1" ] && [ -d "$2" ] || {
  93                 echo "fatal: quick_move: rename failed" >&2
  94                 exit 1
  95         }
  96 }
  97
  98 check_sh_builtin() (
  99         "unset" -f command
 100         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
 101 ) 2>/dev/null
 102
 103 owngroup=
 104 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
 105 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
 106         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
 107         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
 108         exit 1
 109 fi
 110
 111
 112 # Check for extra required tools
 113 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
 114         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
 115         exit 1
 116 fi
 117
 118
 119 echo "*** Checking for compiled utilities..."
 120 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
 121         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
 122         echo "ERROR: perhaps you forgot to run make?" >&2
 123         exit 1
 124 fi
 125 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
 126         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
 127         echo "ERROR: perhaps you forgot to run make?" >&2
 128         exit 1
 129 fi
 130 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
 131         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
 132         echo "ERROR: perhaps you forgot to run make?" >&2
 133         exit 1
 134 fi
 135 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
 136         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 137         echo "ERROR: perhaps you forgot to run make?" >&2
 138         exit 1
 139 fi
 140 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 141         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 142         echo "ERROR: perhaps you forgot to run make?" >&2
 143         exit 1
 144 fi
 145 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 146         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 147         echo "ERROR: perhaps you forgot to run make?" >&2
 148         exit 1
 149 fi
 150 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 151         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 152         echo "ERROR: perhaps you forgot to run make?" >&2
 153         exit 1
 154 fi
 155 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 156         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 157         echo "ERROR: perhaps you forgot to run make?" >&2
 158         exit 1
 159 fi
 160 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 161         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 162         echo "ERROR: perhaps you forgot to run make?" >&2
 163         exit 1
 164 fi
 165 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 166         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 167         echo "ERROR: perhaps you forgot to run make?" >&2
 168         exit 1
 169 fi
 170 if ! [ -f src/ulimit512 ] || ! [ -x src/ulimit512 ]; then
 171         echo "ERROR: src/ulimit512 is not built! Did you _REALLY_ read INSTALL?" >&2
 172         echo "ERROR: perhaps you forgot to run make?" >&2
 173         exit 1
 174 fi
 175 ebin="/bin/echo"
 176 if [ ! -x "$ebin" ] && [ -x "/usr/bin/echo" ]; then
 177         ebin="/usr/bin/echo"
 178 fi
 179 if [ ! -x "$ebin" ]; then
 180         echo "ERROR: neither /bin/echo nor /usr/bin/echo found" >&2
 181         echo "ERROR: at least one must be present for testing during install" >&2
 182         exit 1
 183 fi
 184 ec=999
 185 tmpfile="$(mktemp "/tmp/ul512-$$-XXXXXX")"
 186 { src/ulimit512 -f 0 "$ebin" test >"$tmpfile" || ec=$?; } >/dev/null 2>&1
 187 rm -f "$tmpfile"
 188 if [ "$ec" = "999" ] || [ "$ec" = "0" ]; then
 189         echo "ERROR: src/ulimit512 is built, but broken!" >&2
 190         echo "ERROR: exceeding file size limit did not fail!" >&2
 191         exit 1
 192 fi
 193 if ! [ -f src/ltsha256 ] || ! [ -x src/ltsha256 ]; then
 194         echo "ERROR: src/ltsha256 is not built! Did you _REALLY_ read INSTALL?" >&2
 195         echo "ERROR: perhaps you forgot to run make?" >&2
 196         exit 1
 197 fi
 198 sha256check="15e2b0d3c33891ebb0f1ef609ec419420c20e320ce94c65fbc8c3312448eb225"
 199 sha256result="$(printf '%s' '123456789' | src/ltsha256)"
 200 if [ "$sha256check" != "$sha256result" ]; then
 201         echo "ERROR: src/ltsha256 is built, but broken!" >&2
 202         echo "ERROR: verifying sha256 hash of '123456789' failed!" >&2
 203         exit 1
 204 fi
 205
 206
 207 echo "*** Checking for ezcert..."
 208 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 209         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 210         exit 1
 211 fi
 212
 213
 214 echo "*** Checking for git..."
 215 case "$cfg_git_bin" in /*) :;; *)
 216         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 217         exit 1
 218 esac
 219 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 220         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 221         exit 1
 222 fi
 223 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 224         echo "ERROR: $cfg_git_bin version failed" >&2
 225         exit 1
 226 fi
 227 case "$git_version" in
 228         [Gg]"it version "*) :;;
 229         *)
 230                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 231                 exit 1
 232 esac
 233 echo "Found $cfg_git_bin $git_version"
 234 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 235 echo "*** Checking Git $git_vernum for compatibility..."
 236 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 237         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 238         exit 1
 239 fi
 240 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 241         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 242 fi
 243 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 244         cat <<'EOT'
 245
 246 ***
 247 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 248 ***
 249
 250 Some Girocco functionality will be gracefully disabled and other things will
 251 just not work at all such as race condition protection against simultaneous
 252 client pushes and server garbage collections.
 253
 254 EOT
 255 fi
 256 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 257         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 258 fi
 259 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 260         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 261 fi
 262 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 263         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 264         echo 'WARNING: See https://lore.kernel.org/git/20141222041944.GA441@peff.net/ for details'
 265 fi
 266 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 267         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 268         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 269 fi
 270 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 271         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 272 fi
 273 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 274         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 275 fi
 276 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 277         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 278 fi
 279 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 280         cat <<'EOT'
 281
 282 ***
 283 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 284 ***
 285
 286 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 287 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 288 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 289
 290 In order to bypass this check you will have to modify install.sh in which case
 291 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 292
 293 EOT
 294         exit 1
 295 fi
 296 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 297         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 298 fi
 299 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 300         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 301 fi
 302 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 303         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 304         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 305         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 306         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 307         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 308 fi
 309 secmsg=
 310 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 311         secmsg='prior to 2.4.11'
 312 fi
 313 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 314         secmsg='2.5.x prior to 2.5.5'
 315 fi
 316 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 317         secmsg='2.6.x prior to 2.6.6'
 318 fi
 319 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 320         secmsg='2.7.x prior to 2.7.4'
 321 fi
 322 if [ -n "$secmsg" ]; then
 323         cat <<EOT
 324
 325 ***
 326 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 327 ***
 328
 329 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 330 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 331
 332 Besides the security fixes included in later versions, versions prior to
 333 2.2.0 may accidentally prune unreachable loose objects earlier than
 334 intended.  Since Git version 2.4.11 is the minimum version to include all
 335 security fixes to date, it should be considered the absolute minimum
 336 version of Git to use when running Girocco.
 337
 338 This is not enforced, but Git is easy to build from the git.git submodule
 339 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 340
 341 We will now pause for a moment so you can reflect on this warning.
 342
 343 EOT
 344         sleep 60
 345 fi
 346 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 347         cat <<'EOT'
 348
 349 ***
 350 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 351 ***
 352
 353 You appear to have enabled mirroring and the Git binary you have selected
 354 appears to contain an experimental patch that cannot be disabled.  This
 355 patch can generate invalid network DNS traffic and/or cause long delays
 356 when fetching using the "git:" protocol when no port number is specified.
 357 It may also end up retrieving repsitory contents from a host other than
 358 the one specified in the "git:" URL when the port is omitted.
 359
 360 You are advised to either build your own version of Git (the problem patch
 361 is not part of the official Git repository) or disable mirroring (via the
 362 $Girocco::Config:mirror setting) to avoid these potential problems.
 363
 364 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 365
 366 EOT
 367         sleep 5
 368 fi
 369
 370 test_nc_U() {
 371         [ -n "$1" ] || return 1
 372         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 373         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 374         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 375         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 376         >"$_tmpdir/output"
 377         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 378         _bgpid="$!"
 379         sleep 1
 380         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 381         sleep 1
 382         kill "$_bgpid" >/dev/null 2>&1 || :
 383         read -r _result <"$_tmpdir/output" || :
 384         _bad=
 385         ! [ -e "$_tmpdir/failed" ] || _bad=1
 386         rm -rf "$_tmpdir"
 387         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 388 } >/dev/null 2>&1
 389
 390 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 391 test_nc_U "$var_nc_openbsd_bin" || {
 392         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 393         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 394         uname_s="$(uname -s 2>/dev/null | tr A-Z a-z 2>/dev/null)" || :
 395         case "$uname_s" in
 396         *dragonfly*)
 397                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2;;
 398         *kfreebsd*|*linux*)
 399                 echo "ERROR: try installing the package named 'netcat-openbsd'" >&2;;
 400         esac
 401         exit 1
 402 }
 403
 404 echo "*** Verifying selected POSIX sh is sane..."
 405 shbin="$var_sh_bin"
 406 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 407         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 408         exit 1
 409 }
 410 [ "$(check_sh_builtin command)" = "command" ] || {
 411         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 412         exit 1
 413 }
 414 sh_not_builtin=
 415 sh_extra_chroot_installs=
 416 badsh=
 417 for sbi in cd pwd read umask unset unalias; do
 418         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 419                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 420                 badsh=1
 421         fi
 422 done
 423 [ -z "$badsh" ] || exit 1
 424 for sbi in '[' echo printf test; do
 425         if ! extra="$(check_sh_builtin "$sbi")"; then
 426                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 427                 badsh=1
 428                 continue
 429         fi
 430         if [ "$extra" != "$sbi" ]; then
 431                 case "$extra" in /*) :;; *)
 432                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 433                         badsh=1
 434                         continue
 435                 esac
 436                 withspc=
 437                 case "$extra" in *" "*) withspc=1; esac
 438                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 439                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 440                         badsh=1
 441                         continue
 442                 }
 443                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 444                 sh_not_builtin="$sh_not_builtin $sbi"
 445                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 446         fi
 447 done
 448 [ -z "$badsh" ] || exit 1
 449 [ -z "$sh_extra_chroot_installs" ] || {
 450         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 451         echo "WARNING: as a result it will run slower than necessary" >&2
 452         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 453         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 454         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 455         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 456         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 457 }
 458
 459 echo "*** Verifying xargs is sane..."
 460 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 461 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 462 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 463 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 464         echo 'ERROR: xargs is unusable' >&2
 465         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>/dev/null)"`' >&2
 466         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>/dev/null)"`' >&2
 467         echo 'ERROR: must be true, but neither is' >&2
 468         exit 1
 469 }
 470
 471 echo "*** Verifying selected perl is sane..."
 472 perlbin="$var_perl_bin"
 473 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 474         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 475         exit 1
 476 }
 477
 478 echo "*** Verifying selected gzip is sane..."
 479 gzipbin="$var_gzip_bin"
 480 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 481     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 482         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 483         exit 1
 484 }
 485
 486 echo "*** Verifying basedir, webroot, webreporoot and cgiroot paths..."
 487 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 488 case "$cfg_basedir" in /*) :;; *)
 489         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 490         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 491         exit 1
 492 esac
 493 case "$cfg_webroot" in /*) :;; *)
 494         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 495         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 496         exit 1
 497 esac
 498 if [ -n "$cfg_webreporoot" ]; then
 499         case "$cfg_webreporoot" in /*) :;; *)
 500                 echo "ERROR: invalid Girocco::Config::webreporoot setting" >&2
 501                 echo "ERROR: \"$cfg_webreporoot\" must be an absolute path (start with '/') or undef" >&2
 502                 exit 1
 503         esac
 504 fi
 505 case "$cfg_cgiroot" in /*) :;; *)
 506         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 507         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 508         exit 1
 509 esac
 510
 511 # return the input with trailing slashes stripped but return "/" for all "/"s
 512 striptrsl() {
 513         [ -n "$1" ] || return 0
 514         _s="${1##*[!/]}"
 515         [ "$_s" != "$1" ] || _s="${_s#?}"
 516         printf "%s\n" "${1%$_s}"
 517 }
 518
 519 # a combination of realpath + dirname where the realpath of the deepest existing
 520 # directory is returned with the rest of the non-existing components appended
 521 # and trailing slashes and multiple slashes are removed
 522 realdir() {
 523         _d="$(striptrsl "$1")"
 524         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 525                 echo "$_d"
 526                 return 0
 527         fi
 528         _c=""
 529         while ! [ -d "$_d" ]; do
 530                 _c="/$(basename "$_d")$_c"
 531                 _d="$(dirname "$_d")"
 532                 [ "$_d" != "/" ] || _c="${_c#/}"
 533         done
 534         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 535 }
 536
 537 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 538 # Wherever we are writing/copying/installing files we use these, but where we
 539 # are editing, adding config settings or printing advice we always stick to the
 540 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 541 # Only the file system directories that could be asynchronously accessed (by
 542 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 543 # The chroot is handled specially and does not need one of these.
 544 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 545 # case the prior contents of cgiroot and/or webroot are discarded.
 546 rbasedir="$(realdir "$cfg_basedir")"
 547 rwebroot="$(realdir "$cfg_webroot")"
 548 rwebreporoot=
 549 [ -z "$cfg_webreporoot" ] || {
 550         # avoid resolving a pre-existing symlink from a previous install
 551         rwebreporoot="$(realdir "${cfg_webreporoot%/}_NOSUCHDIR")"
 552         rwebreporoot="${rwebreporoot%_NOSUCHDIR}"
 553 }
 554 rcgiroot="$(realdir "$cfg_cgiroot")"
 555 case "$rbasedir" in "$rwebroot"/?*)
 556         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 557         exit 1
 558 esac
 559 case "$rbasedir" in "$rcgiroot"/?*)
 560         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 561         exit 1
 562 esac
 563 if [ "$rwebroot" = "$rcgiroot" ]; then
 564         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 565         exit 1
 566 fi
 567 case "$rcgiroot" in "$rwebroot"/?*)
 568         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 569         exit 1
 570 esac
 571 case "$rwebroot" in "$rcgiroot"/?*)
 572         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 573         exit 1
 574 esac
 575 if [ -n "$rwebreporoot" ]; then
 576         if [ "$rwebreporoot" = "$rwebroot" ]; then
 577                 echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::webreporoot settings; must not be the same" >&2
 578                 exit 1
 579         fi
 580         case "$rwebreporoot" in "$rwebroot"/?*);;*)
 581                 echo "ERROR: invalid Girocco::Config::webreporoot setting; must be under webroot or undef" >&2
 582                 exit 1
 583         esac
 584 fi
 585 basedir="$rbasedir-new"
 586 case "$rwebroot" in
 587         "$rbasedir"/?*)
 588                 webroot="$basedir${rwebroot#$rbasedir}"
 589                 webrootsub=1
 590                 ;;
 591         *)
 592                 webroot="$rwebroot-new"
 593                 webrootsub=
 594                 ;;
 595 esac
 596 webreporoot=
 597 [ -z "$rwebreporoot" ] || webreporoot="$webroot${rwebreporoot#$rwebroot}"
 598 case "$rcgiroot" in
 599         "$rbasedir"/?*)
 600                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 601                 cgirootsub=1
 602                 ;;
 603         *)
 604                 cgiroot="$rcgiroot-new"
 605                 cgirootsub=
 606                 ;;
 607 esac
 608
 609 echo "*** Setting up basedir..."
 610
 611 chown_make() {
 612         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 613                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 614         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 615                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 616         fi
 617 }
 618
 619 "$MAKE" --no-print-directory --silent apache.conf
 620 chown_make apache.conf
 621 "$MAKE" --no-print-directory --silent -C src
 622 chown_make src
 623 rm -fr "$basedir"
 624 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 625 # make the mtlinesfile with 1000 empty lines
 626 yes '' | dd bs=1000 count=1 2>/dev/null >"$basedir/mtlinesfile"
 627 chmod a+r "$basedir/mtlinesfile"
 628 cp cgi/*.cgi "$basedir/cgi"
 629 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 630 find -H "$basedir" -type l -exec rm -f '{}' +
 631 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 632         src/rangecgi src/readlink src/strftime src/throttle src/ulimit512 src/ltsha256 \
 633         ezcert.git/CACreateCert cgi/authrequired.cgi cgi/snapshot.cgi \
 634         "$basedir/bin"
 635 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 636 if [ -n "$cfg_httpspushurl" ]; then
 637         [ -z "$cfg_pretrustedroot" ] || rm -f "$basedir"/html/rootcert.html
 638 else
 639         rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 640 fi
 641 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 642
 643 # Put the correct Config in place
 644 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 645
 646 # Create symbolic links to selected binaries
 647 ln -s "$cfg_git_bin" "$basedir/bin/git"
 648 ln -s "$shbin" "$basedir/bin/sh"
 649 ln -s "$perlbin" "$basedir/bin/perl"
 650 ln -s "$gzipbin" "$basedir/bin/gzip"
 651
 652 echo "*** Preprocessing scripts..."
 653 SHBIN="$shbin" && export SHBIN
 654 PERLBIN="$perlbin" && export PERLBIN
 655 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 656         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 657         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 658         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 659         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 660         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 661         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 662         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 663         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 664         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 665         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 666         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 667         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 668         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 669         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 670         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 671         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 672         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 673         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 674         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 675         -e 's/\@fetch_stash_refs\@/"$Girocco::Config::fetch_stash_refs"/g;' \
 676         -e 's/\@suppress_git_ssh_logging\@/"$Girocco::Config::suppress_git_ssh_logging"/g;' \
 677         -e 's/\@max_file_size512\@/"$Girocco::Config::max_file_size512"/g;' \
 678         -e 'close ARGV if eof;' \
 679         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 680         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 681         "$basedir"/shlib.sh "$basedir"/hooks/* \
 682         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 683         "$basedir"/toolbox/reports/*.sh \
 684         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 685         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 686         "$basedir"/bin/*.cgi "$basedir"/screen/*
 687 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 688         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 689         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 690         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 691 perl -i -p \
 692         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 693         -e 'close ARGV if eof;' \
 694         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 695         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 696 perl -i -p \
 697         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 698         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 699         -e 'close ARGV if eof;' \
 700         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 701 unset PERLBIN
 702 unset SHBIN
 703
 704 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 705 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 706
 707 if [ "${cfg_mirror_darcs:-0}" != "0" ]; then
 708         echo "*** Setting up darcs-fast-export from girocco-darcs-fast-export.git..."
 709         if ! [ -f girocco-darcs-fast-export.git/darcs-fast-export ] ||
 710         ! [ -x girocco-darcs-fast-export.git/darcs-fast-export ]; then
 711                 echo "ERROR: girocco-darcs-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 712                 exit 1
 713         fi
 714         mkdir -p "$basedir"/bin
 715         cp girocco-darcs-fast-export.git/darcs-fast-export "$basedir"/bin
 716 fi
 717
 718 if [ "${cfg_mirror_hg:-0}" != "0" ]; then
 719         echo "*** Setting up hg-fast-export from girocco-hg-fast-export.git..."
 720         if ! [ -f girocco-hg-fast-export.git/hg-fast-export.py ] || ! [ -f girocco-hg-fast-export.git/hg2git.py ]; then
 721                 echo "ERROR: girocco-hg-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 722                 exit 1
 723         fi
 724         mkdir -p "$basedir"/bin
 725         cp girocco-hg-fast-export.git/hg-fast-export.py girocco-hg-fast-export.git/hg2git.py "$basedir"/bin
 726 fi
 727
 728 echo "*** Setting up markdown from markdown.git..."
 729 if ! [ -f markdown.git/Markdown.pl ]; then
 730         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 731         exit 1
 732 fi
 733 mkdir -p "$basedir"/bin
 734 (PERLBIN="$perlbin" && export PERLBIN &&
 735         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 736                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 737         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 738         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 739 test $? -eq 0
 740
 741 # Some permission sanity on basedir/bin just in case
 742 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 743 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 744
 745 if [ -n "$cfg_mirror" ]; then
 746         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 747 fi
 748 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 749 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 750 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 751
 752
 753 echo "*** Setting up repository root..."
 754 [ -d "$cfg_reporoot" ] || {
 755         mkdir -p "$cfg_reporoot"
 756         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 757         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 758 }
 759 [ -z "$cfg_owning_group" ] ||
 760         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 761 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 762 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty"
 763 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" ||
 764         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 765 if [ "$cfg_owning_group" ]; then
 766         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 767         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 768 fi
 769 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 770 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 771
 772
 773 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 774         echo "*** Setting up chroot jail for pushing..."
 775         if [ "$(id -u)" -eq 0 ]; then
 776                 # jailsetup may install things from $cfg_basedir/bin into the
 777                 # chroot so we do a mini-update of just that portion now
 778                 mkdir -p "$cfg_basedir"
 779                 rm -rf "$cfg_basedir/bin-new"
 780                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 781                 rm -rf "$cfg_basedir/bin-old"
 782                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 783                 rm -rf "$cfg_basedir/bin-old"
 784                 if [ -n "$sh_extra_chroot_installs" ]; then
 785                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 786                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 787                 fi
 788                 ./jailsetup.sh
 789                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 790         else
 791                 echo "WARNING: Skipping jail setup, not root"
 792         fi
 793 fi
 794
 795
 796 echo "*** Setting up jail configuration (project database)..."
 797 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 798 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 799 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 800 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 801         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 802 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 803         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 804 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 805         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 806 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 807
 808
 809 echo "*** Setting up global hook scripts..."
 810 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 811 # Otherwise an incoming push might slip in and fail to run the hook script!
 812 # The underlying rename(2) function call provides this and mv will use it.
 813 # First add hook scripts
 814 hooks="pre-auto-gc pre-receive post-commit post-receive update"
 815 for hook in $hooks; do
 816         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 817         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 818                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 819         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 820         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 821 done
 822 # Then remove any hook scripts that do not belong
 823 for hook in "$cfg_reporoot/_global/hooks"/*; do
 824         hook="${hook##*/}"
 825         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 826         case " $hooks " in *" $hook "*);;*)
 827                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 828                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 829         esac
 830 done
 831
 832
 833 echo "*** Setting up gitweb from git.git..."
 834 if ! [ -f git.git/Makefile ]; then
 835         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 836         exit 1
 837 fi
 838
 839 # We do not wholesale replace either webroot or cgiroot unless they are under
 840 # basedir so if they exist and are not we make a copy to start working on them.
 841 # We make a copy using -p which can result in some warnings so we suppress
 842 # error output as it's of no consequence in this case.
 843 rm -rf "$webroot" "$cgiroot"
 844 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 845 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 846 mkdir -p "$webroot" "$cgiroot"
 847
 848 (
 849         cd git.git &&
 850         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 851                 GITWEB_CONFIG_COMMON="" GITWEB_CONFIG_SYSTEM="" \
 852                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 853         chown_make gitweb &&
 854         PERLBIN="$perlbin" && export PERLBIN &&
 855         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 856                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 857         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 858         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 859         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 860         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 861 )
 862 test $? -eq 0
 863
 864
 865 echo "*** Setting up git-browser from git-browser.git..."
 866 if ! [ -f git-browser.git/git-browser.cgi ]; then
 867         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 868         exit 1
 869 fi
 870 mkdir -p "$webroot"/git-browser "$cgiroot"
 871 (
 872         cd git-browser.git &&
 873         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 874         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 875                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 876                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 877         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 878         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 879         perl -p \
 880                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 881                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-diff.cgi >"$cgiroot"/git-diff.cgi.$$ &&
 882         chmod a+x "$cgiroot"/git-diff.cgi.$$ &&
 883         chown_make "$cgiroot"/git-diff.cgi.$$ &&
 884         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 885         mv -f "$cgiroot"/git-diff.cgi.$$ "$cgiroot"/git-diff.cgi &&
 886         for h in *.html; do
 887                 [ "$h" != "index.html" ] || continue
 888                 if [ "$h" = "by-commit.html" ] || [ "$h" = "by-date.html" ]; then
 889                         FAVLINE='<link rel="shortcut icon" href="/git-favicon.png" type="image/png" />' &&
 890                         export FAVLINE && perl -p -e 'print "$ENV{FAVLINE}\n" if m{</head>};' "$h" \
 891                         >"$webroot/git-browser/$h.$$" &&
 892                         chmod a+r "$webroot/git-browser/$h.$$" &&
 893                         mv -f "$webroot/git-browser/$h.$$" "$webroot/git-browser/$h"
 894                 else
 895                         cp -p "$h" "$webroot/git-browser/"
 896                 fi
 897         done
 898         cp -pR *.js *.css js.lib "$webroot/git-browser/" &&
 899         cp -pR JSON "$cgiroot/"
 900 )
 901 test $? -eq 0
 902 gitwebabs="$cfg_gitweburl"
 903 case "$gitwebabs" in "http://"[!/]*|"https://"[!/]*)
 904         gitwebabs="${gitwebabs#*://}"
 905         case "$gitwebabs" in
 906         *"/"*) gitwebabs="/${gitwebabs#*/}";;
 907         *) gitwebabs="";;
 908         esac
 909 esac
 910 case "$gitwebabs" in */);;*) gitwebabs="$gitwebabs/"; esac
 911 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 912         gitbin: $cfg_git_bin
 913         gitweb: $gitwebabs
 914         warehouse: $cfg_reporoot
 915         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 916 EOT
 917 chown_make "$basedir/gitweb"/git-browser.conf.$$
 918 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 919 esctitle="$(printf '%s\n' "$cfg_title" | LC_ALL=C sed 's/\\/\\\\/g;s/"/\\"/g;')" || :
 920 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 921         cfg_gitweb_url="$cfg_gitweburl/"
 922         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 923         cfg_home_url="$cfg_gitweburl/%n"
 924         cfg_home_text="summary"
 925         cfg_bycommit_title="$esctitle - %n/graphiclog1"
 926         cfg_bydate_title="$esctitle - %n/graphiclog2"
 927 EOT
 928 chown_make "$webroot"/git-browser/GitConfig.js.$$
 929 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 930
 931
 932 echo "*** Setting up our part of the website..."
 933 mkdir -p "$webroot" "$cgiroot"
 934 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 935 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 936 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 937 cp "$basedir/cgi"/*.cgi "$cgiroot"
 938 rm -rf "$basedir/cgi"
 939 [ -z "$webreporoot" ] || { rm -f "$webreporoot" && ln -s "$cfg_reporoot" "$webreporoot"; }
 940 if [ -z "$cfg_httpspushurl" ] || [ -n "$cfg_pretrustedroot" ]; then
 941         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 942 else
 943         cp gitweb/indextext.html "$basedir/gitweb"
 944 fi
 945 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 946 cp mootools.js "$webroot"
 947 cp htaccess "$webroot/.htaccess"
 948 cp cgi/htaccess "$cgiroot/.htaccess"
 949 cp git-favicon.ico "$webroot/favicon.ico"
 950 cp robots.txt "$webroot"
 951 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 952
 953
 954 if [ -n "$cfg_httpspushurl" ]; then
 955         echo "*** Setting up SSL certificates..."
 956         bits=2048
 957         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 958             bits="$cfg_rsakeylength"
 959         fi
 960         mkdir -p "$cfg_certsdir"
 961         [ -d "$cfg_certsdir" ]
 962         wwwcertcn=
 963         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 964                 wwwcertcn="$(
 965                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 966                         sed -e 's,[^/]*,,'
 967                 )"
 968         fi
 969         wwwcertdns=
 970         if [ -n "$cfg_wwwcertaltnames" ]; then
 971                 for dnsopt in $cfg_wwwcertaltnames; do
 972                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 973                 done
 974         fi
 975         wwwcertdnsfile=
 976         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 977                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 978         fi
 979         needroot=
 980         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 981         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 982         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 983         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 984         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 985         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 986                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 987                 umask 0077
 988                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 989                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 990                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 991                 umask 0022
 992                 echo "Created new root key"
 993         fi
 994         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 995                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 996                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 997                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 998                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 999                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
1000                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
1001                 echo "Created new root certificate"
1002         fi
1003         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
1004                 umask 0077
1005                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
1006                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
1007                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
1008                 umask 0022
1009                 echo "Created new www key"
1010         fi
1011         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
1012                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
1013                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
1014                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
1015                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
1016                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
1017                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
1018                 echo "Created www certificate"
1019         fi
1020         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
1021                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
1022                 echo "Created www certificate chain file"
1023         fi
1024         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
1025                 umask 0037
1026                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
1027                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
1028                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
1029                 umask 0022
1030                 echo "Created new client key"
1031         fi
1032         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
1033                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
1034                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
1035                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
1036                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
1037                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
1038                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
1039                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
1040                 echo "Created client certificate"
1041         fi
1042         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
1043                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
1044                 echo "Created client certificate suffix file"
1045         fi
1046         if [ -z "$cfg_pretrustedroot" ]; then
1047                 cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
1048         else
1049                 rm -f "$webroot/${cfg_nickname}_root_cert.pem"
1050         fi
1051         if [ -n "$cfg_mob" ]; then
1052                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
1053                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
1054                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
1055                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
1056                         echo "Created new mob user key"
1057                 fi
1058                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
1059                         openssl rsa -in "$cfg_mobuserkey" -pubout |
1060                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
1061                                 --cert "$cfg_clientcert" \
1062                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
1063                         echo "Created mob user client certificate"
1064                 fi
1065                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
1066                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
1067         else
1068                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1069         fi
1070 else
1071         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
1072         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1073 fi
1074
1075
1076 echo "*** Finalizing permissions and moving into place..."
1077 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
1078 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
1079
1080 # This should always be the very last thing install.sh does
1081 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1082 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
1083 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
1084 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
1085 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1086 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
1087 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
1088         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
1089         touch "$cfg_chroot/etc/taskd.restart"
1090         chown_make "$cfg_chroot/etc/taskd.restart"
1091         trap ':' PIPE
1092         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
1093         trap - PIPE
1094 }