install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 # Include custom configuration, if any
   8 [ ! -e config.sh ] || [ ! -f config.sh ] || [ ! -r config.sh ] || . ./config.sh
   9
  10 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
  11 if [ -z "$MAKE" ]; then
  12         echo "ERROR: cannot determine name of the GNU make command" >&2
  13         echo "Please set MAKE to the name of the GNU make executable" >&2
  14         exit 1
  15 fi
  16
  17 # Run perl module checker
  18 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  19         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  20         exit 1
  21 fi
  22
  23 # What Config should we use?
  24 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  25 export GIROCCO_CONF
  26 echo "*** Initializing using $GIROCCO_CONF..."
  27
  28 # First run Girocco::Config consistency checks
  29 perl -I"$PWD" -M$GIROCCO_CONF -e ''
  30
  31 . ./shlib.sh
  32 umask 0022
  33 "$var_perl_bin" toolbox/check-perl-modules.pl
  34
  35 # Config.pm already checked $cfg_reporoot to require an absolute path, but
  36 # we also require it does not contain a : or ; that would cause problems when
  37 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  38 probch=':;'
  39 case "$cfg_reporoot" in *[$probch]*)
  40         echo "fatal: \$Girocco::Config::reporoot may not contain ':' or ';' characters" >&2
  41         exit 1
  42 esac
  43
  44 warn() { printf >&2 '%s\n' "$*"; }
  45 die() { warn "$@"; exit 1; }
  46
  47 # Either we must run as root (but preferably not if disable_jailsetup is true)
  48 # or the mirror_user (preferred choice for disable_jailsetup).
  49 isroot=
  50 [ "$(id -u)" -ne 0 ] || isroot=1
  51 if [ -n "$isroot" ]; then
  52         if [ "${cfg_disable_jailsetup:-0}" != "0" ]; then
  53                 cat <<'EOT'
  54
  55 ***
  56 *** WARNING: $Girocco::Config::disable_jailsetup has been enabled
  57 *** WARNING: but installation is being performed as the superuser
  58 ***
  59
  60 You appear to have disabled jailsetup which is perfectly fine for installations
  61 that will not be using an ssh jail.  However, in that case, running the install
  62 process as the superuser is highly discouraged.
  63
  64 Instead, running it as the configured $Girocco::Config::mirror_user is much
  65 preferred.
  66
  67 The install process will now pause for 10 seconds to give you a chance to abort
  68 it before continuing to install a disable_jailsetup config as the superuser.
  69
  70 EOT
  71                 sleep 10 || die "install aborted"
  72         fi
  73 else
  74         [ -n "$cfg_mirror_user" ] || die 'Girocco::Config.pm $mirror_user must be set'
  75         curuname="$(id -un)"
  76         [ -n "$curuname" ] || die "Cannot determine name of current user"
  77         if [ "$cfg_mirror_user" != "$curuname" ]; then
  78                 warn "ERROR: install must run as superuser or Config.pm's \$mirror_user ($cfg_mirror_user)"
  79                 die  "ERROR: install is currently running as $curuname"
  80         fi
  81 fi
  82
  83 # $1 must exist and be a dir
  84 # $2 may exist but must be a dir
  85 # $3 must not exist
  86 # After call $2 will be renamed to $3 (if $2 existed)
  87 # And $1 will be renamed to $2
  88 quick_move() {
  89         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  90         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  91         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  92         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  93         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  94                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  95                 echo "fatal: quick_move: rename failed" >&2
  96                 exit 1
  97         }
  98         ! [ -d "$1" ] && [ -d "$2" ] || {
  99                 echo "fatal: quick_move: rename failed" >&2
 100                 exit 1
 101         }
 102 }
 103
 104 check_sh_builtin() (
 105         "unset" -f command
 106         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
 107 ) 2>/dev/null
 108
 109 owngroup=
 110 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
 111 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
 112         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
 113         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
 114         exit 1
 115 fi
 116
 117
 118 # Check for extra required tools
 119 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
 120         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
 121         exit 1
 122 fi
 123
 124
 125 echo "*** Checking for compiled utilities..."
 126 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
 127         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
 128         echo "ERROR: perhaps you forgot to run make?" >&2
 129         exit 1
 130 fi
 131 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
 132         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
 133         echo "ERROR: perhaps you forgot to run make?" >&2
 134         exit 1
 135 fi
 136 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
 137         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
 138         echo "ERROR: perhaps you forgot to run make?" >&2
 139         exit 1
 140 fi
 141 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
 142         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 143         echo "ERROR: perhaps you forgot to run make?" >&2
 144         exit 1
 145 fi
 146 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 147         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 148         echo "ERROR: perhaps you forgot to run make?" >&2
 149         exit 1
 150 fi
 151 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 152         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 153         echo "ERROR: perhaps you forgot to run make?" >&2
 154         exit 1
 155 fi
 156 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 157         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 158         echo "ERROR: perhaps you forgot to run make?" >&2
 159         exit 1
 160 fi
 161 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 162         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 163         echo "ERROR: perhaps you forgot to run make?" >&2
 164         exit 1
 165 fi
 166 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 167         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 168         echo "ERROR: perhaps you forgot to run make?" >&2
 169         exit 1
 170 fi
 171 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 172         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 173         echo "ERROR: perhaps you forgot to run make?" >&2
 174         exit 1
 175 fi
 176 if ! [ -f src/ulimit512 ] || ! [ -x src/ulimit512 ]; then
 177         echo "ERROR: src/ulimit512 is not built! Did you _REALLY_ read INSTALL?" >&2
 178         echo "ERROR: perhaps you forgot to run make?" >&2
 179         exit 1
 180 fi
 181 ebin="/bin/echo"
 182 if [ ! -x "$ebin" ] && [ -x "/usr/bin/echo" ]; then
 183         ebin="/usr/bin/echo"
 184 fi
 185 if [ ! -x "$ebin" ]; then
 186         echo "ERROR: neither /bin/echo nor /usr/bin/echo found" >&2
 187         echo "ERROR: at least one must be present for testing during install" >&2
 188         exit 1
 189 fi
 190 ec=999
 191 tmpfile="$(mktemp "/tmp/ul512-$$-XXXXXX")"
 192 { src/ulimit512 -f 0 "$ebin" test >"$tmpfile" || ec=$?; } >/dev/null 2>&1
 193 rm -f "$tmpfile"
 194 if [ "$ec" = "999" ] || [ "$ec" = "0" ]; then
 195         echo "ERROR: src/ulimit512 is built, but broken!" >&2
 196         echo "ERROR: exceeding file size limit did not fail!" >&2
 197         exit 1
 198 fi
 199 if ! [ -f src/ltsha256 ] || ! [ -x src/ltsha256 ]; then
 200         echo "ERROR: src/ltsha256 is not built! Did you _REALLY_ read INSTALL?" >&2
 201         echo "ERROR: perhaps you forgot to run make?" >&2
 202         exit 1
 203 fi
 204 sha256check="15e2b0d3c33891ebb0f1ef609ec419420c20e320ce94c65fbc8c3312448eb225"
 205 sha256result="$(printf '%s' '123456789' | src/ltsha256)"
 206 if [ "$sha256check" != "$sha256result" ]; then
 207         echo "ERROR: src/ltsha256 is built, but broken!" >&2
 208         echo "ERROR: verifying sha256 hash of '123456789' failed!" >&2
 209         exit 1
 210 fi
 211
 212
 213 echo "*** Checking for ezcert..."
 214 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 215         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 216         exit 1
 217 fi
 218
 219
 220 echo "*** Checking for git..."
 221 case "$cfg_git_bin" in /*) :;; *)
 222         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 223         exit 1
 224 esac
 225 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 226         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 227         exit 1
 228 fi
 229 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 230         echo "ERROR: $cfg_git_bin version failed" >&2
 231         exit 1
 232 fi
 233 case "$git_version" in
 234         [Gg]"it version "*) :;;
 235         *)
 236                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 237                 exit 1
 238 esac
 239 echo "Found $cfg_git_bin $git_version"
 240 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 241 echo "*** Checking Git $git_vernum for compatibility..."
 242 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 243         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 244         exit 1
 245 fi
 246 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 247         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 248 fi
 249 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 250         cat <<'EOT'
 251
 252 ***
 253 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 254 ***
 255
 256 Some Girocco functionality will be gracefully disabled and other things will
 257 just not work at all such as race condition protection against simultaneous
 258 client pushes and server garbage collections.
 259
 260 EOT
 261 fi
 262 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 263         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 264 fi
 265 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 266         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 267 fi
 268 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 269         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 270         echo 'WARNING: See https://lore.kernel.org/git/20141222041944.GA441@peff.net/ for details'
 271 fi
 272 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 273         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 274         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 275 fi
 276 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 277         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 278 fi
 279 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 280         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 281 fi
 282 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 283         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 284 fi
 285 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 286         cat <<'EOT'
 287
 288 ***
 289 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 290 ***
 291
 292 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 293 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 294 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 295
 296 In order to bypass this check you will have to modify install.sh in which case
 297 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 298
 299 EOT
 300         exit 1
 301 fi
 302 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 303         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 304 fi
 305 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 306         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 307 fi
 308 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 309         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 310         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 311         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 312         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 313         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 314 fi
 315 secmsg=
 316 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 317         secmsg='prior to 2.4.11'
 318 fi
 319 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 320         secmsg='2.5.x prior to 2.5.5'
 321 fi
 322 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 323         secmsg='2.6.x prior to 2.6.6'
 324 fi
 325 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 326         secmsg='2.7.x prior to 2.7.4'
 327 fi
 328 if [ -n "$secmsg" ]; then
 329         cat <<EOT
 330
 331 ***
 332 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 333 ***
 334
 335 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 336 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 337
 338 Besides the security fixes included in later versions, versions prior to
 339 2.2.0 may accidentally prune unreachable loose objects earlier than
 340 intended.  Since Git version 2.4.11 is the minimum version to include all
 341 security fixes to date, it should be considered the absolute minimum
 342 version of Git to use when running Girocco.
 343
 344 This is not enforced, but Git is easy to build from the git.git submodule
 345 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 346
 347 We will now pause for a moment so you can reflect on this warning.
 348
 349 EOT
 350         sleep 60
 351 fi
 352 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && LC_ALL=C grep -a -q ns_parserr "$cfg_git_bin"; then
 353         cat <<'EOT'
 354
 355 ***
 356 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 357 ***
 358
 359 You appear to have enabled mirroring and the Git binary you have selected
 360 appears to contain an experimental patch that cannot be disabled.  This
 361 patch can generate invalid network DNS traffic and/or cause long delays
 362 when fetching using the "git:" protocol when no port number is specified.
 363 It may also end up retrieving repsitory contents from a host other than
 364 the one specified in the "git:" URL when the port is omitted.
 365
 366 You are advised to either build your own version of Git (the problem patch
 367 is not part of the official Git repository) or disable mirroring (via the
 368 $Girocco::Config:mirror setting) to avoid these potential problems.
 369
 370 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 371
 372 EOT
 373         sleep 5
 374 fi
 375
 376 test_nc_U() {
 377         [ -n "$1" ] || return 1
 378         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 379         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 380         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 381         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 382         >"$_tmpdir/output"
 383         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 384         _bgpid="$!"
 385         sleep 1
 386         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 387         sleep 1
 388         kill "$_bgpid" >/dev/null 2>&1 || :
 389         read -r _result <"$_tmpdir/output" || :
 390         _bad=
 391         ! [ -e "$_tmpdir/failed" ] || _bad=1
 392         rm -rf "$_tmpdir"
 393         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 394 } >/dev/null 2>&1
 395
 396 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 397 test_nc_U "$var_nc_openbsd_bin" || {
 398         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 399         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 400         uname_s="$(uname -s 2>/dev/null | tr A-Z a-z 2>/dev/null)" || :
 401         case "$uname_s" in
 402         *dragonfly*)
 403                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2;;
 404         *kfreebsd*|*linux*)
 405                 echo "ERROR: try installing the package named 'netcat-openbsd'" >&2;;
 406         esac
 407         exit 1
 408 }
 409
 410 echo "*** Verifying selected POSIX sh is sane..."
 411 shbin="$var_sh_bin"
 412 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 413         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 414         exit 1
 415 }
 416 [ "$(check_sh_builtin command)" = "command" ] || {
 417         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 418         exit 1
 419 }
 420 sh_not_builtin=
 421 sh_extra_chroot_installs=
 422 badsh=
 423 for sbi in cd pwd read umask unset unalias; do
 424         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 425                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 426                 badsh=1
 427         fi
 428 done
 429 [ -z "$badsh" ] || exit 1
 430 for sbi in '[' echo printf test; do
 431         if ! extra="$(check_sh_builtin "$sbi")"; then
 432                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 433                 badsh=1
 434                 continue
 435         fi
 436         if [ "$extra" != "$sbi" ]; then
 437                 case "$extra" in /*) :;; *)
 438                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 439                         badsh=1
 440                         continue
 441                 esac
 442                 withspc=
 443                 case "$extra" in *" "*) withspc=1; esac
 444                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 445                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 446                         badsh=1
 447                         continue
 448                 }
 449                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 450                 sh_not_builtin="$sh_not_builtin $sbi"
 451                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 452         fi
 453 done
 454 [ -z "$badsh" ] || exit 1
 455 [ -z "$sh_extra_chroot_installs" ] || {
 456         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 457         echo "WARNING: as a result it will run slower than necessary" >&2
 458         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 459         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 460         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 461         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 462         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 463 }
 464
 465 echo "*** Verifying xargs is sane..."
 466 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 467 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 468 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 469 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 470         echo 'ERROR: xargs is unusable' >&2
 471         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>/dev/null)"`' >&2
 472         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>/dev/null)"`' >&2
 473         echo 'ERROR: must be true, but neither is' >&2
 474         exit 1
 475 }
 476
 477 echo "*** Verifying selected perl is sane..."
 478 perlbin="$var_perl_bin"
 479 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 480         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 481         exit 1
 482 }
 483
 484 echo "*** Verifying selected gzip is sane..."
 485 gzipbin="$var_gzip_bin"
 486 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 487     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 488         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 489         exit 1
 490 }
 491
 492 echo "*** Verifying basedir, webroot, webreporoot and cgiroot paths..."
 493 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 494 case "$cfg_basedir" in /*) :;; *)
 495         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 496         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 497         exit 1
 498 esac
 499 case "$cfg_webroot" in /*) :;; *)
 500         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 501         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 502         exit 1
 503 esac
 504 if [ -n "$cfg_webreporoot" ]; then
 505         case "$cfg_webreporoot" in /*) :;; *)
 506                 echo "ERROR: invalid Girocco::Config::webreporoot setting" >&2
 507                 echo "ERROR: \"$cfg_webreporoot\" must be an absolute path (start with '/') or undef" >&2
 508                 exit 1
 509         esac
 510 fi
 511 case "$cfg_cgiroot" in /*) :;; *)
 512         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 513         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 514         exit 1
 515 esac
 516
 517 # return the input with trailing slashes stripped but return "/" for all "/"s
 518 striptrsl() {
 519         [ -n "$1" ] || return 0
 520         _s="${1##*[!/]}"
 521         [ "$_s" != "$1" ] || _s="${_s#?}"
 522         printf "%s\n" "${1%$_s}"
 523 }
 524
 525 # a combination of realpath + dirname where the realpath of the deepest existing
 526 # directory is returned with the rest of the non-existing components appended
 527 # and trailing slashes and multiple slashes are removed
 528 realdir() {
 529         _d="$(striptrsl "$1")"
 530         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 531                 echo "$_d"
 532                 return 0
 533         fi
 534         _c=""
 535         while ! [ -d "$_d" ]; do
 536                 _c="/$(basename "$_d")$_c"
 537                 _d="$(dirname "$_d")"
 538                 [ "$_d" != "/" ] || _c="${_c#/}"
 539         done
 540         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 541 }
 542
 543 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 544 # Wherever we are writing/copying/installing files we use these, but where we
 545 # are editing, adding config settings or printing advice we always stick to the
 546 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 547 # Only the file system directories that could be asynchronously accessed (by
 548 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 549 # The chroot is handled specially and does not need one of these.
 550 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 551 # case the prior contents of cgiroot and/or webroot are discarded.
 552 rbasedir="$(realdir "$cfg_basedir")"
 553 rwebroot="$(realdir "$cfg_webroot")"
 554 rwebreporoot=
 555 [ -z "$cfg_webreporoot" ] || {
 556         # avoid resolving a pre-existing symlink from a previous install
 557         rwebreporoot="$(realdir "${cfg_webreporoot%/}_NOSUCHDIR")"
 558         rwebreporoot="${rwebreporoot%_NOSUCHDIR}"
 559 }
 560 rcgiroot="$(realdir "$cfg_cgiroot")"
 561 case "$rbasedir" in "$rwebroot"/?*)
 562         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 563         exit 1
 564 esac
 565 case "$rbasedir" in "$rcgiroot"/?*)
 566         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 567         exit 1
 568 esac
 569 if [ "$rwebroot" = "$rcgiroot" ]; then
 570         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 571         exit 1
 572 fi
 573 case "$rcgiroot" in "$rwebroot"/?*)
 574         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 575         exit 1
 576 esac
 577 case "$rwebroot" in "$rcgiroot"/?*)
 578         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 579         exit 1
 580 esac
 581 if [ -n "$rwebreporoot" ]; then
 582         if [ "$rwebreporoot" = "$rwebroot" ]; then
 583                 echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::webreporoot settings; must not be the same" >&2
 584                 exit 1
 585         fi
 586         case "$rwebreporoot" in "$rwebroot"/?*);;*)
 587                 echo "ERROR: invalid Girocco::Config::webreporoot setting; must be under webroot or undef" >&2
 588                 exit 1
 589         esac
 590 fi
 591 basedir="$rbasedir-new"
 592 case "$rwebroot" in
 593         "$rbasedir"/?*)
 594                 webroot="$basedir${rwebroot#$rbasedir}"
 595                 webrootsub=1
 596                 ;;
 597         *)
 598                 webroot="$rwebroot-new"
 599                 webrootsub=
 600                 ;;
 601 esac
 602 webreporoot=
 603 [ -z "$rwebreporoot" ] || webreporoot="$webroot${rwebreporoot#$rwebroot}"
 604 case "$rcgiroot" in
 605         "$rbasedir"/?*)
 606                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 607                 cgirootsub=1
 608                 ;;
 609         *)
 610                 cgiroot="$rcgiroot-new"
 611                 cgirootsub=
 612                 ;;
 613 esac
 614
 615 echo "*** Setting up basedir..."
 616
 617 chown_make() {
 618         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 619                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 620         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 621                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 622         fi
 623 }
 624
 625 "$MAKE" --no-print-directory --silent apache.conf
 626 chown_make apache.conf
 627 "$MAKE" --no-print-directory --silent -C src
 628 chown_make src
 629 rm -fr "$basedir"
 630 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 631 # make the mtlinesfile with 1000 empty lines
 632 yes '' | dd bs=1000 count=1 2>/dev/null >"$basedir/mtlinesfile"
 633 chmod a+r "$basedir/mtlinesfile"
 634 cp cgi/*.cgi "$basedir/cgi"
 635 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 636 rm -f "$basedir/Girocco/Dumper.pm" # Dumper.pm is only for the install.sh process
 637 find -H "$basedir" -type l -exec rm -f '{}' +
 638 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 639         src/rangecgi src/readlink src/strftime src/throttle src/ulimit512 src/ltsha256 \
 640         ezcert.git/CACreateCert cgi/authrequired.cgi cgi/snapshot.cgi \
 641         "$basedir/bin"
 642 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 643 if [ -n "$cfg_httpspushurl" ]; then
 644         [ -z "$cfg_pretrustedroot" ] || rm -f "$basedir"/html/rootcert.html
 645 else
 646         rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 647 fi
 648 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 649
 650 # Put the frozen Config in place
 651 VARLIST="$(get_girocco_config_var_list varonly)" && export VARLIST
 652 perl -I"$PWD" -MGirocco::Dumper=FreezeConfig -MScalar::Util=looks_like_number -e '
 653         my $usemod = $ARGV[0];
 654         my $f = sub { return () unless $_[0] =~ /^(var_[^=\s]+)=(.*)$/;
 655                 my ($k,$v) = ($1,$2);
 656                 $v =~ s/([\@\%])/\\$1/gos;
 657                 $v = "\"".$v."\"" unless substr($v,0,1) eq "\"" || looks_like_number($v);
 658                 my $e = eval $v;
 659                 [$k, $e] };
 660         my @vars = map({&$f($_)} split(/\n+/, $ENV{VARLIST}));
 661         my $s = sub { my $conf = shift;
 662                 foreach (@vars) {
 663                         my ($k,$v) = @{$_};
 664                         eval "\$${conf}::$k=\$v";
 665                 }
 666         };
 667         print FreezeConfig($usemod, undef, $s);
 668 ' -- "$GIROCCO_CONF" >"$basedir/Girocco/Config.pm"
 669 unset VARLIST
 670
 671 # Create symbolic links to selected binaries
 672 ln -s "$cfg_git_bin" "$basedir/bin/git"
 673 ln -s "$shbin" "$basedir/bin/sh"
 674 ln -s "$perlbin" "$basedir/bin/perl"
 675 ln -s "$gzipbin" "$basedir/bin/gzip"
 676 [ -z "$var_openssl_bin" ] || ln -s "$var_openssl_bin" "$basedir/bin/openssl"
 677
 678 echo "*** Preprocessing scripts..."
 679 SHBIN="$shbin" && export SHBIN
 680 PERLBIN="$perlbin" && export PERLBIN
 681 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 682         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 683         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 684         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 685         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 686         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 687         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 688         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 689         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 690         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 691         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 692         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 693         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 694         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 695         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 696         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 697         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 698         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 699         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 700         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 701         -e 's/\@fetch_stash_refs\@/"$Girocco::Config::fetch_stash_refs"/g;' \
 702         -e 's/\@suppress_git_ssh_logging\@/"$Girocco::Config::suppress_git_ssh_logging"/g;' \
 703         -e 's/\@max_file_size512\@/"$Girocco::Config::max_file_size512"/g;' \
 704         -e 'close ARGV if eof;' \
 705         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 706         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 707         "$basedir"/shlib.sh "$basedir"/hooks/* \
 708         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 709         "$basedir"/toolbox/reports/*.sh \
 710         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 711         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 712         "$basedir"/bin/*.cgi "$basedir"/screen/*
 713 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 714         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 715         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 716         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 717 perl -i -p \
 718         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 719         -e 'close ARGV if eof;' \
 720         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 721         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 722 perl -i -p \
 723         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 724         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 725         -e 'close ARGV if eof;' \
 726         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 727 unset PERLBIN
 728 unset SHBIN
 729
 730 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 731 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 732
 733 if [ "${cfg_mirror_darcs:-0}" != "0" ]; then
 734         echo "*** Setting up darcs-fast-export from girocco-darcs-fast-export.git..."
 735         if ! [ -f girocco-darcs-fast-export.git/darcs-fast-export ] ||
 736         ! [ -x girocco-darcs-fast-export.git/darcs-fast-export ]; then
 737                 echo "ERROR: girocco-darcs-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 738                 exit 1
 739         fi
 740         mkdir -p "$basedir"/bin
 741         cp girocco-darcs-fast-export.git/darcs-fast-export "$basedir"/bin
 742 fi
 743
 744 if [ "${cfg_mirror_hg:-0}" != "0" ]; then
 745         echo "*** Setting up hg-fast-export from girocco-hg-fast-export.git..."
 746         if ! [ -f girocco-hg-fast-export.git/hg-fast-export.py ] || ! [ -f girocco-hg-fast-export.git/hg2git.py ]; then
 747                 echo "ERROR: girocco-hg-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 748                 exit 1
 749         fi
 750         mkdir -p "$basedir"/bin
 751         cp girocco-hg-fast-export.git/hg-fast-export.py girocco-hg-fast-export.git/hg2git.py "$basedir"/bin
 752 fi
 753
 754 echo "*** Setting up markdown from markdown.git..."
 755 if ! [ -f markdown.git/Markdown.pl ]; then
 756         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 757         exit 1
 758 fi
 759 mkdir -p "$basedir"/bin
 760 (PERLBIN="$perlbin" && export PERLBIN &&
 761         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 762                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 763         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 764         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 765 test $? -eq 0
 766
 767 # Some permission sanity on basedir/bin just in case
 768 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 769 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 770
 771 if [ -n "$cfg_mirror" ]; then
 772         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 773 fi
 774 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 775 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 776 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 777
 778
 779 echo "*** Setting up repository root..."
 780 [ -d "$cfg_reporoot" ] || {
 781         mkdir -p "$cfg_reporoot"
 782         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 783         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 784 }
 785 [ -z "$cfg_owning_group" ] ||
 786         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 787 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 788 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty"
 789 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" ||
 790         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 791 if [ "$cfg_owning_group" ]; then
 792         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 793         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 794 fi
 795 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 796 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 797
 798
 799 usejail=
 800 [ "${cfg_disable_jailsetup:-0}" != "0" ] || [ "${cfg_chrooted:-0}" = "0" ] || usejail=1
 801 if [ -n "$usejail" ]; then
 802         echo "*** Setting up chroot jail for pushing..."
 803         if [ -n "$isroot" ]; then
 804                 # jailsetup may install things from $cfg_basedir/bin into the
 805                 # chroot so we do a mini-update of just that portion now
 806                 mkdir -p "$cfg_basedir"
 807                 rm -rf "$cfg_basedir/bin-new"
 808                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 809                 rm -rf "$cfg_basedir/bin-old"
 810                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 811                 rm -rf "$cfg_basedir/bin-old"
 812                 if [ -n "$sh_extra_chroot_installs" ]; then
 813                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 814                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 815                 fi
 816                 ./jailsetup.sh
 817                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 818         else
 819                 echo "WARNING: Skipping jail setup, not root"
 820         fi
 821 fi
 822
 823
 824 echo "*** Setting up jail configuration (project database)..."
 825 [ -n "$usejail" ] && [ -n "$isroot" ] || ./jailsetup.sh dbonly
 826 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 827 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 828 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 829         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 830 if [ -n "$usejail" ]; then
 831         chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 832                 echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 833 else
 834         # If a chroot jail is not in use, sudo privileges are neither expected nor required
 835         # which means it will not be possible to change the owner of the passwd and group
 836         # files if it differs from the mirror user.  And that's okay, provided the group
 837         # can still be set correctly to the owning group.  But, just in case we're running
 838         # as root, go ahead and set the owner to the mirror user.
 839         chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 840                 echo "WARNING: Cannot chown $cfg_mirror_user$owngroup the etc/passwd and/or etc/group files"
 841 fi
 842 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 843         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 844 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 845
 846
 847 echo "*** Setting up global hook scripts..."
 848 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 849 # Otherwise an incoming push might slip in and fail to run the hook script!
 850 # The underlying rename(2) function call provides this and mv will use it.
 851 # First add hook scripts
 852 hooks="pre-auto-gc pre-receive post-commit post-receive update"
 853 for hook in $hooks; do
 854         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 855         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 856                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 857         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 858         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 859 done
 860 # Then remove any hook scripts that do not belong
 861 for hook in "$cfg_reporoot/_global/hooks"/*; do
 862         hook="${hook##*/}"
 863         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 864         case " $hooks " in *" $hook "*);;*)
 865                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 866                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 867         esac
 868 done
 869
 870
 871 echo "*** Setting up gitweb from git.git..."
 872 if ! [ -f git.git/Makefile ]; then
 873         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 874         exit 1
 875 fi
 876
 877 # We do not wholesale replace either webroot or cgiroot unless they are under
 878 # basedir so if they exist and are not we make a copy to start working on them.
 879 # We make a copy using -p which can result in some warnings so we suppress
 880 # error output as it's of no consequence in this case.
 881 rm -rf "$webroot" "$cgiroot"
 882 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 883 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 884 mkdir -p "$webroot" "$cgiroot"
 885
 886 (
 887         cd git.git &&
 888         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 889                 GITWEB_CONFIG_COMMON="" GITWEB_CONFIG_SYSTEM="" \
 890                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 891         chown_make gitweb &&
 892         PERLBIN="$perlbin" && export PERLBIN &&
 893         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 894                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 895         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 896         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 897         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 898         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 899 )
 900 test $? -eq 0
 901
 902
 903 echo "*** Setting up git-browser from git-browser.git..."
 904 if ! [ -f git-browser.git/git-browser.cgi ]; then
 905         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 906         exit 1
 907 fi
 908 mkdir -p "$webroot"/git-browser "$cgiroot"
 909 (
 910         cd git-browser.git &&
 911         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 912         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 913                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 914                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 915         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 916         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 917         perl -p \
 918                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 919                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-diff.cgi >"$cgiroot"/git-diff.cgi.$$ &&
 920         chmod a+x "$cgiroot"/git-diff.cgi.$$ &&
 921         chown_make "$cgiroot"/git-diff.cgi.$$ &&
 922         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 923         mv -f "$cgiroot"/git-diff.cgi.$$ "$cgiroot"/git-diff.cgi &&
 924         for h in *.html; do
 925                 [ "$h" != "index.html" ] || continue
 926                 if [ "$h" = "by-commit.html" ] || [ "$h" = "by-date.html" ]; then
 927                         FAVLINE='<link rel="shortcut icon" href="/git-favicon.png" type="image/png" />' &&
 928                         export FAVLINE && perl -p -e 'print "$ENV{FAVLINE}\n" if m{</head>};' "$h" \
 929                         >"$webroot/git-browser/$h.$$" &&
 930                         chmod a+r "$webroot/git-browser/$h.$$" &&
 931                         mv -f "$webroot/git-browser/$h.$$" "$webroot/git-browser/$h"
 932                 else
 933                         cp -p "$h" "$webroot/git-browser/"
 934                 fi
 935         done
 936         cp -pR *.js *.css js.lib "$webroot/git-browser/" &&
 937         cp -pR JSON "$cgiroot/"
 938 )
 939 test $? -eq 0
 940 gitwebabs="$cfg_gitweburl"
 941 case "$gitwebabs" in "http://"[!/]*|"https://"[!/]*)
 942         gitwebabs="${gitwebabs#*://}"
 943         case "$gitwebabs" in
 944         *"/"*) gitwebabs="/${gitwebabs#*/}";;
 945         *) gitwebabs="";;
 946         esac
 947 esac
 948 case "$gitwebabs" in */);;*) gitwebabs="$gitwebabs/"; esac
 949 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 950         gitbin: $cfg_git_bin
 951         gitweb: $gitwebabs
 952         warehouse: $cfg_reporoot
 953         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 954 EOT
 955 chown_make "$basedir/gitweb"/git-browser.conf.$$
 956 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 957 esctitle="$(printf '%s\n' "$cfg_title" | LC_ALL=C sed 's/\\/\\\\/g;s/"/\\"/g;')" || :
 958 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 959         cfg_gitweb_url="$cfg_gitweburl/"
 960         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 961         cfg_home_url="$cfg_gitweburl/%n"
 962         cfg_home_text="summary"
 963         cfg_bycommit_title="$esctitle - %n/graphiclog1"
 964         cfg_bydate_title="$esctitle - %n/graphiclog2"
 965 EOT
 966 chown_make "$webroot"/git-browser/GitConfig.js.$$
 967 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 968
 969
 970 echo "*** Setting up our part of the website..."
 971 mkdir -p "$webroot" "$cgiroot"
 972 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 973 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 974 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 975 cp "$basedir/cgi"/*.cgi "$cgiroot"
 976 rm -rf "$basedir/cgi"
 977 [ -z "$webreporoot" ] || { rm -f "$webreporoot" && ln -s "$cfg_reporoot" "$webreporoot"; }
 978 if [ -z "$cfg_httpspushurl" ] || [ -n "$cfg_pretrustedroot" ]; then
 979         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 980 else
 981         cp gitweb/indextext.html "$basedir/gitweb"
 982 fi
 983 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 984 cp mootools.js "$webroot"
 985 cp htaccess "$webroot/.htaccess"
 986 cp cgi/htaccess "$cgiroot/.htaccess"
 987 cp git-favicon.ico "$webroot/favicon.ico"
 988 cp robots.txt "$webroot"
 989 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 990
 991
 992 if [ -n "$cfg_httpspushurl" ]; then
 993         echo "*** Setting up SSL certificates..."
 994         openssl="${var_openssl_bin:-openssl}"
 995         createcert() { PATH="$basedir/bin:$PATH" "$basedir/bin/CACreateCert" "$@"; }
 996         bits=2048
 997         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 998             bits="$cfg_rsakeylength"
 999         fi
1000         mkdir -p "$cfg_certsdir"
1001         [ -d "$cfg_certsdir" ]
1002         wwwcertcn=
1003         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
1004                 wwwcertcn="$(
1005                         "$openssl" x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
1006                         sed -e 's,[^/]*,,'
1007                 )"
1008         fi
1009         wwwcertdns=
1010         if [ -n "$cfg_wwwcertaltnames" ]; then
1011                 for dnsopt in $cfg_wwwcertaltnames; do
1012                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
1013                 done
1014         fi
1015         wwwcertdnsfile=
1016         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
1017                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
1018         fi
1019         needroot=
1020         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
1021         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
1022         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
1023         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
1024         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
1025         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
1026                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
1027                 umask 0077
1028                 "$openssl" genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
1029                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
1030                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
1031                 umask 0022
1032                 echo "Created new root key"
1033         fi
1034         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
1035                 createcert --root --key "$cfg_certsdir/girocco_root_key.pem" \
1036                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
1037                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
1038                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
1039                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
1040                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
1041                 echo "Created new root certificate"
1042         fi
1043         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
1044                 umask 0077
1045                 "$openssl" genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
1046                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
1047                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
1048                 umask 0022
1049                 echo "Created new www key"
1050         fi
1051         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
1052                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
1053                 "$openssl" rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
1054                 createcert --server --key "$cfg_certsdir/girocco_root_key.pem" \
1055                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
1056                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
1057                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
1058                 echo "Created www certificate"
1059         fi
1060         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
1061                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
1062                 echo "Created www certificate chain file"
1063         fi
1064         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
1065                 umask 0037
1066                 "$openssl" genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
1067                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
1068                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
1069                 umask 0022
1070                 echo "Created new client key"
1071         fi
1072         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
1073                 "$openssl" rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
1074                 createcert --subca --key "$cfg_certsdir/girocco_root_key.pem" \
1075                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
1076                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
1077                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
1078                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
1079                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
1080                 echo "Created client certificate"
1081         fi
1082         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
1083                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
1084                 echo "Created client certificate suffix file"
1085         fi
1086         if [ -z "$cfg_pretrustedroot" ]; then
1087                 cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
1088         else
1089                 rm -f "$webroot/${cfg_nickname}_root_cert.pem"
1090         fi
1091         if [ -n "$cfg_mob" ]; then
1092                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
1093                         "$openssl" genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
1094                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
1095                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
1096                         echo "Created new mob user key"
1097                 fi
1098                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
1099                         "$openssl" rsa -in "$cfg_mobuserkey" -pubout |
1100                         createcert --client --key "$cfg_clientkey" \
1101                                 --cert "$cfg_clientcert" \
1102                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
1103                         echo "Created mob user client certificate"
1104                 fi
1105                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
1106                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
1107         else
1108                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1109         fi
1110 else
1111         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
1112         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1113 fi
1114
1115
1116 echo "*** Processing website html templates..."
1117 rm -f "$cgiroot/html.cgi"
1118 rm -rf "$cgiroot/html"
1119 mkdir -p "$cgiroot/html"
1120 for tf in "$basedir/html"/*.html; do
1121         tfb="${tf##*/}"
1122         "$perlbin" -I"$basedir" cgi/html.cgi "$webroot" "$tfb" "$basedir" >"$cgiroot/html/$tfb"
1123         rm -f "$tf"
1124 done
1125
1126 echo "*** Formatting markdown documentation..."
1127 mkdir -p "$cgiroot/html/gfm"
1128 for d in basics.md syntax.md; do
1129         {
1130                 cat <<-HEADER
1131                         <!DOCTYPE html>
1132                         <html xmlns="http://www.w3.org/1999/xhtml">
1133                         <head>
1134                         <meta charset="utf-8" />
1135                         <meta http-equiv="content-type" content="text/html; charset=utf-8" />
1136                         <title>$d</title>
1137                         </head>
1138                         <body><pre>
1139                 HEADER
1140                 <"markdown.git/$d" LC_ALL=C sed -e '/\[[Ll]icense\]/d' \
1141                 -e 's, \([a-z][a-z]*\)\.md, \1.md.html,' \
1142                 -e 's/ by adding `.md` to the URL//' \
1143                 -e 's/&/\&amp;/g' -e 's/</\&lt;/g' <"markdown.git/$d"
1144                 cat <<-FOOTER
1145                         </pre></body>
1146                         </html>
1147                 FOOTER
1148         } >"$cgiroot/html/gfm/$d.html"
1149         {
1150                 title="Markdown: $(echo "${d%.md}" | "$perlbin" -pe '$_=ucfirst')"
1151                 gwfpath="$cfg_gitwebfiles"
1152                 case "$gwfpath" in *"//"*)
1153                         case "$gwfpath" in *"/");;*) gwfpath="$gwfpath/"; esac
1154                         gwfpath="${gwfpath#*//}"; gwfpath="${gwfpath#*/}"
1155                 esac
1156                 case "$gwfpath" in "/"*);;*) gwfpath="/$gwfpath"; esac
1157                 gwfpath="${gwfpath%/}"
1158                 cat <<-HEADER
1159                         <!DOCTYPE html>
1160                         <html xmlns="http://www.w3.org/1999/xhtml">
1161                         <head>
1162                         <meta charset="utf-8" />
1163                         <meta http-equiv="content-type" content="text/html; charset=utf-8" />
1164                         <title>$title</title>
1165                         <link rel="stylesheet" type="text/css" href="$gwfpath/gitweb.css" />
1166                         <link rel="stylesheet" type="text/css" href="$gwfpath/girocco.css" />
1167                         <link rel="shortcut icon" href="$gwfpath/git-favicon.png" type="image/png" />
1168                         </head>
1169                         <body style="text-align:center">
1170                         <div class="readme" style="overflow:inherit;display:inline-block;text-align:left;max-width:42pc">
1171                 HEADER
1172                 <"markdown.git/$d" LC_ALL=C sed -e '/\[[Ll]icense\]/d' \
1173                         -e 's, \([a-z][a-z]*\)\.md, \1.md.html,' \
1174                         -e 's/ by adding `.md` to the URL//' |
1175                 "$perlbin" "markdown.git/Markdown.pl"
1176                 cat <<-FOOTER
1177                         </div>
1178                         </body>
1179                         </html>
1180                 FOOTER
1181         } >"$cgiroot/html/gfm/${d%.md}.html"
1182 done
1183
1184
1185 echo "*** Finalizing permissions and moving into place..."
1186 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
1187 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
1188
1189 # This should always be the very last thing install.sh does
1190 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1191 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
1192 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
1193 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
1194 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1195 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
1196 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
1197         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
1198         touch "$cfg_chroot/etc/taskd.restart"
1199         chown_make "$cfg_chroot/etc/taskd.restart"
1200         trap ':' PIPE
1201         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
1202         trap - PIPE
1203 }