install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I"$PWD" -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_reporoot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_reporoot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::reporoot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 warn() { printf >&2 '%s\n' "$*"; }
  41 die() { warn "$@"; exit 1; }
  42
  43 # Either we must run as root (but preferably not if disable_jailsetup is true)
  44 # or the mirror_user (preferred choice for disable_jailsetup).
  45 if [ "$(id -u)" -eq 0 ]; then
  46         if [ "${cfg_disable_jailsetup:-0}" != "0" ]; then
  47                 cat <<'EOT'
  48
  49 ***
  50 *** WARNING: $Girocco::Config::disable_jailsetup has been enabled
  51 *** WARNING: but installation is being performed as the superuser
  52 ***
  53
  54 You appear to have disabled jailsetup which is perfectly fine for installations
  55 that will not be using an ssh jail.  However, in that case, running the install
  56 process as the superuser is highly discouraged.
  57
  58 Instead, running it as the configured $Girocco::Config::mirror_user is much
  59 preferred.
  60
  61 The install process will now pause for 10 seconds to give you a chance to abort
  62 it before continuing to install a disable_jailsetup config as the superuser.
  63
  64 EOT
  65                 sleep 10 || die "install aborted"
  66         fi
  67 else
  68         [ -n "$cfg_mirror_user" ] || die 'Girocco::Config.pm $mirror_user must be set'
  69         curuname="$(id -un)"
  70         [ -n "$curuname" ] || die "Cannot determine name of current user"
  71         if [ "$cfg_mirror_user" != "$curuname" ]; then
  72                 warn "ERROR: install must run as superuser or Config.pm's \$mirror_user ($cfg_mirror_user)"
  73                 die  "ERROR: install is currently running as $curuname"
  74         fi
  75 fi
  76
  77 # $1 must exist and be a dir
  78 # $2 may exist but must be a dir
  79 # $3 must not exist
  80 # After call $2 will be renamed to $3 (if $2 existed)
  81 # And $1 will be renamed to $2
  82 quick_move() {
  83         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  84         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  85         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  86         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  87         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  88                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  89                 echo "fatal: quick_move: rename failed" >&2
  90                 exit 1
  91         }
  92         ! [ -d "$1" ] && [ -d "$2" ] || {
  93                 echo "fatal: quick_move: rename failed" >&2
  94                 exit 1
  95         }
  96 }
  97
  98 check_sh_builtin() (
  99         "unset" -f command
 100         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
 101 ) 2>/dev/null
 102
 103 owngroup=
 104 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
 105 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
 106         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
 107         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
 108         exit 1
 109 fi
 110
 111
 112 # Check for extra required tools
 113 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
 114         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
 115         exit 1
 116 fi
 117
 118
 119 echo "*** Checking for compiled utilities..."
 120 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
 121         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
 122         echo "ERROR: perhaps you forgot to run make?" >&2
 123         exit 1
 124 fi
 125 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
 126         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
 127         echo "ERROR: perhaps you forgot to run make?" >&2
 128         exit 1
 129 fi
 130 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
 131         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
 132         echo "ERROR: perhaps you forgot to run make?" >&2
 133         exit 1
 134 fi
 135 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
 136         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 137         echo "ERROR: perhaps you forgot to run make?" >&2
 138         exit 1
 139 fi
 140 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 141         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 142         echo "ERROR: perhaps you forgot to run make?" >&2
 143         exit 1
 144 fi
 145 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 146         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 147         echo "ERROR: perhaps you forgot to run make?" >&2
 148         exit 1
 149 fi
 150 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 151         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 152         echo "ERROR: perhaps you forgot to run make?" >&2
 153         exit 1
 154 fi
 155 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 156         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 157         echo "ERROR: perhaps you forgot to run make?" >&2
 158         exit 1
 159 fi
 160 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 161         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 162         echo "ERROR: perhaps you forgot to run make?" >&2
 163         exit 1
 164 fi
 165 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 166         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 167         echo "ERROR: perhaps you forgot to run make?" >&2
 168         exit 1
 169 fi
 170 if ! [ -f src/ulimit512 ] || ! [ -x src/ulimit512 ]; then
 171         echo "ERROR: src/ulimit512 is not built! Did you _REALLY_ read INSTALL?" >&2
 172         echo "ERROR: perhaps you forgot to run make?" >&2
 173         exit 1
 174 fi
 175
 176
 177 echo "*** Checking for ezcert..."
 178 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 179         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 180         exit 1
 181 fi
 182
 183
 184 echo "*** Checking for git..."
 185 case "$cfg_git_bin" in /*) :;; *)
 186         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 187         exit 1
 188 esac
 189 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 190         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 191         exit 1
 192 fi
 193 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 194         echo "ERROR: $cfg_git_bin version failed" >&2
 195         exit 1
 196 fi
 197 case "$git_version" in
 198         [Gg]"it version "*) :;;
 199         *)
 200                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 201                 exit 1
 202 esac
 203 echo "Found $cfg_git_bin $git_version"
 204 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 205 echo "*** Checking Git $git_vernum for compatibility..."
 206 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 207         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 208         exit 1
 209 fi
 210 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 211         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 212 fi
 213 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 214         cat <<'EOT'
 215
 216 ***
 217 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 218 ***
 219
 220 Some Girocco functionality will be gracefully disabled and other things will
 221 just not work at all such as race condition protection against simultaneous
 222 client pushes and server garbage collections.
 223
 224 EOT
 225 fi
 226 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 227         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 228 fi
 229 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 230         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 231 fi
 232 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 233         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 234         echo 'WARNING: See https://lore.kernel.org/git/20141222041944.GA441@peff.net/ for details'
 235 fi
 236 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 237         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 238         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 239 fi
 240 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 241         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 242 fi
 243 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 244         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 245 fi
 246 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 247         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 248 fi
 249 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 250         cat <<'EOT'
 251
 252 ***
 253 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 254 ***
 255
 256 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 257 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 258 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 259
 260 In order to bypass this check you will have to modify install.sh in which case
 261 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 262
 263 EOT
 264         exit 1
 265 fi
 266 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 267         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 268 fi
 269 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 270         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 271 fi
 272 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 273         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 274         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 275         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 276         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 277         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 278 fi
 279 secmsg=
 280 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 281         secmsg='prior to 2.4.11'
 282 fi
 283 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 284         secmsg='2.5.x prior to 2.5.5'
 285 fi
 286 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 287         secmsg='2.6.x prior to 2.6.6'
 288 fi
 289 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 290         secmsg='2.7.x prior to 2.7.4'
 291 fi
 292 if [ -n "$secmsg" ]; then
 293         cat <<EOT
 294
 295 ***
 296 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 297 ***
 298
 299 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 300 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 301
 302 Besides the security fixes included in later versions, versions prior to
 303 2.2.0 may accidentally prune unreachable loose objects earlier than
 304 intended.  Since Git version 2.4.11 is the minimum version to include all
 305 security fixes to date, it should be considered the absolute minimum
 306 version of Git to use when running Girocco.
 307
 308 This is not enforced, but Git is easy to build from the git.git submodule
 309 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 310
 311 We will now pause for a moment so you can reflect on this warning.
 312
 313 EOT
 314         sleep 60
 315 fi
 316 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 317         cat <<'EOT'
 318
 319 ***
 320 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 321 ***
 322
 323 You appear to have enabled mirroring and the Git binary you have selected
 324 appears to contain an experimental patch that cannot be disabled.  This
 325 patch can generate invalid network DNS traffic and/or cause long delays
 326 when fetching using the "git:" protocol when no port number is specified.
 327 It may also end up retrieving repsitory contents from a host other than
 328 the one specified in the "git:" URL when the port is omitted.
 329
 330 You are advised to either build your own version of Git (the problem patch
 331 is not part of the official Git repository) or disable mirroring (via the
 332 $Girocco::Config:mirror setting) to avoid these potential problems.
 333
 334 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 335
 336 EOT
 337         sleep 5
 338 fi
 339
 340 test_nc_U() {
 341         [ -n "$1" ] || return 1
 342         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 343         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 344         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 345         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 346         >"$_tmpdir/output"
 347         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 348         _bgpid="$!"
 349         sleep 1
 350         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 351         sleep 1
 352         kill "$_bgpid" >/dev/null 2>&1 || :
 353         read -r _result <"$_tmpdir/output" || :
 354         _bad=
 355         ! [ -e "$_tmpdir/failed" ] || _bad=1
 356         rm -rf "$_tmpdir"
 357         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 358 } >/dev/null 2>&1
 359
 360 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 361 test_nc_U "$var_nc_openbsd_bin" || {
 362         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 363         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 364         uname_s="$(uname -s 2>/dev/null | tr A-Z a-z 2>/dev/null)" || :
 365         case "$uname_s" in
 366         *dragonfly*)
 367                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2;;
 368         *kfreebsd*|*linux*)
 369                 echo "ERROR: try installing the package named 'netcat-openbsd'" >&2;;
 370         esac
 371         exit 1
 372 }
 373
 374 echo "*** Verifying selected POSIX sh is sane..."
 375 shbin="$var_sh_bin"
 376 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 377         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 378         exit 1
 379 }
 380 [ "$(check_sh_builtin command)" = "command" ] || {
 381         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 382         exit 1
 383 }
 384 sh_not_builtin=
 385 sh_extra_chroot_installs=
 386 badsh=
 387 for sbi in cd pwd read umask unset unalias; do
 388         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 389                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 390                 badsh=1
 391         fi
 392 done
 393 [ -z "$badsh" ] || exit 1
 394 for sbi in '[' echo printf test; do
 395         if ! extra="$(check_sh_builtin "$sbi")"; then
 396                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 397                 badsh=1
 398                 continue
 399         fi
 400         if [ "$extra" != "$sbi" ]; then
 401                 case "$extra" in /*) :;; *)
 402                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 403                         badsh=1
 404                         continue
 405                 esac
 406                 withspc=
 407                 case "$extra" in *" "*) withspc=1; esac
 408                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 409                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 410                         badsh=1
 411                         continue
 412                 }
 413                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 414                 sh_not_builtin="$sh_not_builtin $sbi"
 415                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 416         fi
 417 done
 418 [ -z "$badsh" ] || exit 1
 419 [ -z "$sh_extra_chroot_installs" ] || {
 420         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 421         echo "WARNING: as a result it will run slower than necessary" >&2
 422         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 423         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 424         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 425         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 426         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 427 }
 428
 429 echo "*** Verifying xargs is sane..."
 430 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 431 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 432 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 433 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 434         echo 'ERROR: xargs is unusable' >&2
 435         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>/dev/null)"`' >&2
 436         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>/dev/null)"`' >&2
 437         echo 'ERROR: must be true, but neither is' >&2
 438         exit 1
 439 }
 440
 441 echo "*** Verifying selected perl is sane..."
 442 perlbin="$var_perl_bin"
 443 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 444         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 445         exit 1
 446 }
 447
 448 echo "*** Verifying selected gzip is sane..."
 449 gzipbin="$var_gzip_bin"
 450 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 451     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 452         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 453         exit 1
 454 }
 455
 456 echo "*** Verifying basedir, webroot, webreporoot and cgiroot paths..."
 457 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 458 case "$cfg_basedir" in /*) :;; *)
 459         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 460         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 461         exit 1
 462 esac
 463 case "$cfg_webroot" in /*) :;; *)
 464         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 465         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 466         exit 1
 467 esac
 468 if [ -n "$cfg_webreporoot" ]; then
 469         case "$cfg_webreporoot" in /*) :;; *)
 470                 echo "ERROR: invalid Girocco::Config::webreporoot setting" >&2
 471                 echo "ERROR: \"$cfg_webreporoot\" must be an absolute path (start with '/') or undef" >&2
 472                 exit 1
 473         esac
 474 fi
 475 case "$cfg_cgiroot" in /*) :;; *)
 476         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 477         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 478         exit 1
 479 esac
 480
 481 # return the input with trailing slashes stripped but return "/" for all "/"s
 482 striptrsl() {
 483         [ -n "$1" ] || return 0
 484         _s="${1##*[!/]}"
 485         [ "$_s" != "$1" ] || _s="${_s#?}"
 486         printf "%s\n" "${1%$_s}"
 487 }
 488
 489 # a combination of realpath + dirname where the realpath of the deepest existing
 490 # directory is returned with the rest of the non-existing components appended
 491 # and trailing slashes and multiple slashes are removed
 492 realdir() {
 493         _d="$(striptrsl "$1")"
 494         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 495                 echo "$_d"
 496                 return 0
 497         fi
 498         _c=""
 499         while ! [ -d "$_d" ]; do
 500                 _c="/$(basename "$_d")$_c"
 501                 _d="$(dirname "$_d")"
 502                 [ "$_d" != "/" ] || _c="${_c#/}"
 503         done
 504         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 505 }
 506
 507 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 508 # Wherever we are writing/copying/installing files we use these, but where we
 509 # are editing, adding config settings or printing advice we always stick to the
 510 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 511 # Only the file system directories that could be asynchronously accessed (by
 512 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 513 # The chroot is handled specially and does not need one of these.
 514 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 515 # case the prior contents of cgiroot and/or webroot are discarded.
 516 rbasedir="$(realdir "$cfg_basedir")"
 517 rwebroot="$(realdir "$cfg_webroot")"
 518 rwebreporoot=
 519 [ -z "$cfg_webreporoot" ] || {
 520         # avoid resolving a pre-existing symlink from a previous install
 521         rwebreporoot="$(realdir "${cfg_webreporoot%/}_NOSUCHDIR")"
 522         rwebreporoot="${rwebreporoot%_NOSUCHDIR}"
 523 }
 524 rcgiroot="$(realdir "$cfg_cgiroot")"
 525 case "$rbasedir" in "$rwebroot"/?*)
 526         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 527         exit 1
 528 esac
 529 case "$rbasedir" in "$rcgiroot"/?*)
 530         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 531         exit 1
 532 esac
 533 if [ "$rwebroot" = "$rcgiroot" ]; then
 534         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 535         exit 1
 536 fi
 537 case "$rcgiroot" in "$rwebroot"/?*)
 538         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 539         exit 1
 540 esac
 541 case "$rwebroot" in "$rcgiroot"/?*)
 542         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 543         exit 1
 544 esac
 545 if [ -n "$rwebreporoot" ]; then
 546         if [ "$rwebreporoot" = "$rwebroot" ]; then
 547                 echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::webreporoot settings; must not be the same" >&2
 548                 exit 1
 549         fi
 550         case "$rwebreporoot" in "$rwebroot"/?*);;*)
 551                 echo "ERROR: invalid Girocco::Config::webreporoot setting; must be under webroot or undef" >&2
 552                 exit 1
 553         esac
 554 fi
 555 basedir="$rbasedir-new"
 556 case "$rwebroot" in
 557         "$rbasedir"/?*)
 558                 webroot="$basedir${rwebroot#$rbasedir}"
 559                 webrootsub=1
 560                 ;;
 561         *)
 562                 webroot="$rwebroot-new"
 563                 webrootsub=
 564                 ;;
 565 esac
 566 webreporoot=
 567 [ -z "$rwebreporoot" ] || webreporoot="$webroot${rwebreporoot#$rwebroot}"
 568 case "$rcgiroot" in
 569         "$rbasedir"/?*)
 570                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 571                 cgirootsub=1
 572                 ;;
 573         *)
 574                 cgiroot="$rcgiroot-new"
 575                 cgirootsub=
 576                 ;;
 577 esac
 578
 579 echo "*** Setting up basedir..."
 580
 581 chown_make() {
 582         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 583                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 584         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 585                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 586         fi
 587 }
 588
 589 "$MAKE" --no-print-directory --silent apache.conf
 590 chown_make apache.conf
 591 "$MAKE" --no-print-directory --silent -C src
 592 chown_make src
 593 rm -fr "$basedir"
 594 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 595 cp cgi/*.cgi "$basedir/cgi"
 596 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 597 find -H "$basedir" -type l -exec rm -f '{}' +
 598 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 599         src/rangecgi src/readlink src/strftime src/throttle src/ulimit512 \
 600         ezcert.git/CACreateCert cgi/authrequired.cgi cgi/snapshot.cgi \
 601         "$basedir/bin"
 602 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 603 if [ -n "$cfg_httpspushurl" ]; then
 604         [ -z "$cfg_pretrustedroot" ] || rm -f "$basedir"/html/rootcert.html
 605 else
 606         rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 607 fi
 608 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 609
 610 # Put the correct Config in place
 611 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 612
 613 # Create symbolic links to selected binaries
 614 ln -s "$cfg_git_bin" "$basedir/bin/git"
 615 ln -s "$shbin" "$basedir/bin/sh"
 616 ln -s "$perlbin" "$basedir/bin/perl"
 617 ln -s "$gzipbin" "$basedir/bin/gzip"
 618
 619 echo "*** Preprocessing scripts..."
 620 SHBIN="$shbin" && export SHBIN
 621 PERLBIN="$perlbin" && export PERLBIN
 622 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 623         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 624         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 625         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 626         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 627         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 628         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 629         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 630         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 631         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 632         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 633         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 634         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 635         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 636         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 637         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 638         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 639         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 640         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 641         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 642         -e 's/\@fetch_stash_refs\@/"$Girocco::Config::fetch_stash_refs"/g;' \
 643         -e 's/\@suppress_git_ssh_logging\@/"$Girocco::Config::suppress_git_ssh_logging"/g;' \
 644         -e 'close ARGV if eof;' \
 645         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 646         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 647         "$basedir"/shlib.sh "$basedir"/hooks/* \
 648         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 649         "$basedir"/toolbox/reports/*.sh \
 650         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 651         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 652         "$basedir"/bin/*.cgi "$basedir"/screen/*
 653 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 654         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 655         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 656         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 657 perl -i -p \
 658         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 659         -e 'close ARGV if eof;' \
 660         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 661         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 662 perl -i -p \
 663         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 664         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 665         -e 'close ARGV if eof;' \
 666         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 667 unset PERLBIN
 668 unset SHBIN
 669
 670 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 671 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 672
 673 if [ "${cfg_mirror_darcs:-0}" != "0" ]; then
 674         echo "*** Setting up darcs-fast-export from girocco-darcs-fast-export.git..."
 675         if ! [ -f girocco-darcs-fast-export.git/darcs-fast-export ] ||
 676         ! [ -x girocco-darcs-fast-export.git/darcs-fast-export ]; then
 677                 echo "ERROR: girocco-darcs-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 678                 exit 1
 679         fi
 680         mkdir -p "$basedir"/bin
 681         cp girocco-darcs-fast-export.git/darcs-fast-export "$basedir"/bin
 682 fi
 683
 684 if [ "${cfg_mirror_hg:-0}" != "0" ]; then
 685         echo "*** Setting up hg-fast-export from girocco-hg-fast-export.git..."
 686         if ! [ -f girocco-hg-fast-export.git/hg-fast-export.py ] || ! [ -f girocco-hg-fast-export.git/hg2git.py ]; then
 687                 echo "ERROR: girocco-hg-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 688                 exit 1
 689         fi
 690         mkdir -p "$basedir"/bin
 691         cp girocco-hg-fast-export.git/hg-fast-export.py girocco-hg-fast-export.git/hg2git.py "$basedir"/bin
 692 fi
 693
 694 echo "*** Setting up markdown from markdown.git..."
 695 if ! [ -f markdown.git/Markdown.pl ]; then
 696         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 697         exit 1
 698 fi
 699 mkdir -p "$basedir"/bin
 700 (PERLBIN="$perlbin" && export PERLBIN &&
 701         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 702                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 703         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 704         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 705 test $? -eq 0
 706
 707 # Some permission sanity on basedir/bin just in case
 708 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 709 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 710
 711 if [ -n "$cfg_mirror" ]; then
 712         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 713 fi
 714 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 715 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 716 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 717
 718
 719 echo "*** Setting up repository root..."
 720 [ -d "$cfg_reporoot" ] || {
 721         mkdir -p "$cfg_reporoot"
 722         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 723         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 724 }
 725 [ -z "$cfg_owning_group" ] ||
 726         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 727 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 728 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty"
 729 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" ||
 730         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 731 if [ "$cfg_owning_group" ]; then
 732         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 733         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 734 fi
 735 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 736 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 737
 738
 739 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 740         echo "*** Setting up chroot jail for pushing..."
 741         if [ "$(id -u)" -eq 0 ]; then
 742                 # jailsetup may install things from $cfg_basedir/bin into the
 743                 # chroot so we do a mini-update of just that portion now
 744                 mkdir -p "$cfg_basedir"
 745                 rm -rf "$cfg_basedir/bin-new"
 746                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 747                 rm -rf "$cfg_basedir/bin-old"
 748                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 749                 rm -rf "$cfg_basedir/bin-old"
 750                 if [ -n "$sh_extra_chroot_installs" ]; then
 751                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 752                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 753                 fi
 754                 ./jailsetup.sh
 755                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 756         else
 757                 echo "WARNING: Skipping jail setup, not root"
 758         fi
 759 fi
 760
 761
 762 echo "*** Setting up jail configuration (project database)..."
 763 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 764 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 765 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 766 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 767         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 768 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 769         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 770 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 771         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 772 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 773
 774
 775 echo "*** Setting up global hook scripts..."
 776 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 777 # Otherwise an incoming push might slip in and fail to run the hook script!
 778 # The underlying rename(2) function call provides this and mv will use it.
 779 # First add hook scripts
 780 hooks="pre-auto-gc pre-receive post-commit post-receive update"
 781 for hook in $hooks; do
 782         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 783         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 784                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 785         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 786         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 787 done
 788 # Then remove any hook scripts that do not belong
 789 for hook in "$cfg_reporoot/_global/hooks"/*; do
 790         hook="${hook##*/}"
 791         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 792         case " $hooks " in *" $hook "*);;*)
 793                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 794                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 795         esac
 796 done
 797
 798
 799 echo "*** Setting up gitweb from git.git..."
 800 if ! [ -f git.git/Makefile ]; then
 801         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 802         exit 1
 803 fi
 804
 805 # We do not wholesale replace either webroot or cgiroot unless they are under
 806 # basedir so if they exist and are not we make a copy to start working on them.
 807 # We make a copy using -p which can result in some warnings so we suppress
 808 # error output as it's of no consequence in this case.
 809 rm -rf "$webroot" "$cgiroot"
 810 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 811 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 812 mkdir -p "$webroot" "$cgiroot"
 813
 814 (
 815         cd git.git &&
 816         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 817                 GITWEB_CONFIG_COMMON="" GITWEB_CONFIG_SYSTEM="" \
 818                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 819         chown_make gitweb &&
 820         PERLBIN="$perlbin" && export PERLBIN &&
 821         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 822                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 823         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 824         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 825         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 826         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 827 )
 828 test $? -eq 0
 829
 830
 831 echo "*** Setting up git-browser from git-browser.git..."
 832 if ! [ -f git-browser.git/git-browser.cgi ]; then
 833         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 834         exit 1
 835 fi
 836 mkdir -p "$webroot"/git-browser "$cgiroot"
 837 (
 838         cd git-browser.git &&
 839         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 840         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 841                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 842                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 843         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 844         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 845         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 846         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 847         cp -r JSON "$cgiroot"
 848 )
 849 test $? -eq 0
 850 rm -f "$webroot"/git-browser/index.html
 851 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 852         gitbin: $cfg_git_bin
 853         warehouse: $cfg_reporoot
 854         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 855 EOT
 856 chown_make "$basedir/gitweb"/git-browser.conf.$$
 857 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 858 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 859         cfg_gitweb_url="$cfg_gitweburl/"
 860         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 861 EOT
 862 chown_make "$webroot"/git-browser/GitConfig.js.$$
 863 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 864
 865
 866 echo "*** Setting up our part of the website..."
 867 mkdir -p "$webroot" "$cgiroot"
 868 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 869 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 870 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 871 cp "$basedir/cgi"/*.cgi "$cgiroot"
 872 rm -rf "$basedir/cgi"
 873 [ -z "$webreporoot" ] || { rm -f "$webreporoot" && ln -s "$cfg_reporoot" "$webreporoot"; }
 874 if [ -z "$cfg_httpspushurl" ] || [ -n "$cfg_pretrustedroot" ]; then
 875         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 876 else
 877         cp gitweb/indextext.html "$basedir/gitweb"
 878 fi
 879 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 880 cp mootools.js "$webroot"
 881 cp htaccess "$webroot/.htaccess"
 882 cp cgi/htaccess "$cgiroot/.htaccess"
 883 cp git-favicon.ico "$webroot/favicon.ico"
 884 cp robots.txt "$webroot"
 885 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 886
 887
 888 if [ -n "$cfg_httpspushurl" ]; then
 889         echo "*** Setting up SSL certificates..."
 890         bits=2048
 891         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 892             bits="$cfg_rsakeylength"
 893         fi
 894         mkdir -p "$cfg_certsdir"
 895         [ -d "$cfg_certsdir" ]
 896         wwwcertcn=
 897         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 898                 wwwcertcn="$(
 899                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 900                         sed -e 's,[^/]*,,'
 901                 )"
 902         fi
 903         wwwcertdns=
 904         if [ -n "$cfg_wwwcertaltnames" ]; then
 905                 for dnsopt in $cfg_wwwcertaltnames; do
 906                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 907                 done
 908         fi
 909         wwwcertdnsfile=
 910         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 911                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 912         fi
 913         needroot=
 914         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 915         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 916         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 917         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 918         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 919         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 920                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 921                 umask 0077
 922                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 923                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 924                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 925                 umask 0022
 926                 echo "Created new root key"
 927         fi
 928         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 929                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 930                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 931                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 932                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 933                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 934                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 935                 echo "Created new root certificate"
 936         fi
 937         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 938                 umask 0077
 939                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 940                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 941                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 942                 umask 0022
 943                 echo "Created new www key"
 944         fi
 945         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 946                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 947                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 948                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 949                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 950                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 951                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 952                 echo "Created www certificate"
 953         fi
 954         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 955                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 956                 echo "Created www certificate chain file"
 957         fi
 958         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 959                 umask 0037
 960                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 961                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 962                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 963                 umask 0022
 964                 echo "Created new client key"
 965         fi
 966         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 967                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 968                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 969                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 970                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 971                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 972                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 973                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 974                 echo "Created client certificate"
 975         fi
 976         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 977                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 978                 echo "Created client certificate suffix file"
 979         fi
 980         if [ -z "$cfg_pretrustedroot" ]; then
 981                 cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 982         else
 983                 rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 984         fi
 985         if [ -n "$cfg_mob" ]; then
 986                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 987                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 988                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 989                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 990                         echo "Created new mob user key"
 991                 fi
 992                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 993                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 994                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 995                                 --cert "$cfg_clientcert" \
 996                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
 997                         echo "Created mob user client certificate"
 998                 fi
 999                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
1000                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
1001         else
1002                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1003         fi
1004 else
1005         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
1006         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1007 fi
1008
1009
1010 echo "*** Finalizing permissions and moving into place..."
1011 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
1012 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
1013
1014 # This should always be the very last thing install.sh does
1015 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1016 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
1017 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
1018 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
1019 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1020 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
1021 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
1022         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
1023         touch "$cfg_chroot/etc/taskd.restart"
1024         chown_make "$cfg_chroot/etc/taskd.restart"
1025         trap ':' PIPE
1026         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
1027         trap - PIPE
1028 }