install.sh

   1 #!/bin/sh
   2 # The Girocco installation script
   3 # We will OVERWRITE basedir!
   4
   5 set -e
   6
   7 [ -n "$MAKE" ] || MAKE="$(MAKEFLAGS= make -s gnu_make_command_name | grep '^gnu_make_command_name=' | sed 's/^[^=]*=//')"
   8 if [ -z "$MAKE" ]; then
   9         echo "ERROR: cannot determine name of the GNU make command" >&2
  10         echo "Please set MAKE to the name of the GNU make executable" >&2
  11         exit 1
  12 fi
  13
  14 # Run perl module checker
  15 if ! [ -f toolbox/check-perl-modules.pl ] || ! [ -x toolbox/check-perl-modules.pl ]; then
  16         echo "ERROR: missing toolbox/check-perl-modules.pl!" >&2
  17         exit 1
  18 fi
  19
  20 # What Config should we use?
  21 [ -n "$GIROCCO_CONF" ] || GIROCCO_CONF=Girocco::Config
  22 echo "*** Initializing using $GIROCCO_CONF..."
  23
  24 # First run Girocco::Config consistency checks
  25 perl -I"$PWD" -M$GIROCCO_CONF -e ''
  26
  27 . ./shlib.sh
  28 umask 0022
  29 "$var_perl_bin" toolbox/check-perl-modules.pl
  30
  31 # Config.pm already checked $cfg_reporoot to require an absolute path, but
  32 # we also require it does not contain a : or ; that would cause problems when
  33 # used in GIT_ALTERNATE_OBJECT_DIRECTORIES
  34 probch=':;'
  35 case "$cfg_reporoot" in *[$probch]*)
  36         echo "fatal: \$Girocco::Config::reporoot may not contain ':' or ';' characters" >&2
  37         exit 1
  38 esac
  39
  40 warn() { printf >&2 '%s\n' "$*"; }
  41 die() { warn "$@"; exit 1; }
  42
  43 # Either we must run as root (but preferably not if disable_jailsetup is true)
  44 # or the mirror_user (preferred choice for disable_jailsetup).
  45 if [ "$(id -u)" -eq 0 ]; then
  46         if [ "${cfg_disable_jailsetup:-0}" != "0" ]; then
  47                 cat <<'EOT'
  48
  49 ***
  50 *** WARNING: $Girocco::Config::disable_jailsetup has been enabled
  51 *** WARNING: but installation is being performed as the superuser
  52 ***
  53
  54 You appear to have disabled jailsetup which is perfectly fine for installations
  55 that will not be using an ssh jail.  However, in that case, running the install
  56 process as the superuser is highly discouraged.
  57
  58 Instead, running it as the configured $Girocco::Config::mirror_user is much
  59 preferred.
  60
  61 The install process will now pause for 10 seconds to give you a chance to abort
  62 it before continuing to install a disable_jailsetup config as the superuser.
  63
  64 EOT
  65                 sleep 10 || die "install aborted"
  66         fi
  67 else
  68         [ -n "$cfg_mirror_user" ] || die 'Girocco::Config.pm $mirror_user must be set'
  69         curuname="$(id -un)"
  70         [ -n "$curuname" ] || die "Cannot determine name of current user"
  71         if [ "$cfg_mirror_user" != "$curuname" ]; then
  72                 warn "ERROR: install must run as superuser or Config.pm's \$mirror_user ($cfg_mirror_user)"
  73                 die  "ERROR: install is currently running as $curuname"
  74         fi
  75 fi
  76
  77 # $1 must exist and be a dir
  78 # $2 may exist but must be a dir
  79 # $3 must not exist
  80 # After call $2 will be renamed to $3 (if $2 existed)
  81 # And $1 will be renamed to $2
  82 quick_move() {
  83         [ -n "$1" ] && [ -n "$2" ] && [ -n "$3" ] || { echo "fatal: quick_move: bad args: '$1' '$2' '$3'" >&2; exit 1; }
  84         ! [ -e "$3" ] || { echo "fatal: quick_move: already exists: $3" >&2; exit 1; }
  85         [ -d "$1" ] || { echo "fatal: quick_move: no such dir: $1" >&2; exit 1; }
  86         ! [ -e "$2" ] || [ -d "$2" ] || { echo "fatal: quick_move: not a dir: $2" >&2; exit 1; }
  87         perl -e 'rename($ARGV[1], $ARGV[2]) or die "rename failed: $!\n" if -d $ARGV[1];
  88                 rename($ARGV[0], $ARGV[1]) or die "rename failed: $!\n"; exit 0;' "$1" "$2" "$3" || {
  89                 echo "fatal: quick_move: rename failed" >&2
  90                 exit 1
  91         }
  92         ! [ -d "$1" ] && [ -d "$2" ] || {
  93                 echo "fatal: quick_move: rename failed" >&2
  94                 exit 1
  95         }
  96 }
  97
  98 check_sh_builtin() (
  99         "unset" -f command
 100         "command" "$var_sh_bin" -c '{ "unset" -f unalias command "$1" || :; "unalias" "$1" || :; } >/dev/null 2>&1; "command" -v "$1"' "$var_sh_bin" "$1"
 101 ) 2>/dev/null
 102
 103 owngroup=
 104 [ -z "$cfg_owning_group" ] || owngroup=":$cfg_owning_group"
 105 if [ -n "$cfg_httpspushurl" ] && [ -z "$cfg_certsdir" ]; then
 106         echo "ERROR: \$httpspushurl is set but \$certsdir is not!" >&2
 107         echo "ERROR: perhaps you have an incorrect Config.pm?" >&2
 108         exit 1
 109 fi
 110
 111
 112 # Check for extra required tools
 113 if [ "${cfg_xmllint_readme:-0}" != "0" ] && ! command -v xmllint >/dev/null; then
 114         echo "ERROR: \$xmllint_readme set but xmllint not in \$PATH!" >&2
 115         exit 1
 116 fi
 117
 118
 119 echo "*** Checking for compiled utilities..."
 120 if ! [ -f src/can_user_push ] || ! [ -x src/can_user_push ]; then
 121         echo "ERROR: src/can_user_push is not built! Did you _REALLY_ read INSTALL?" >&2
 122         echo "ERROR: perhaps you forgot to run make?" >&2
 123         exit 1
 124 fi
 125 if ! [ -f src/can_user_push_http ] || ! [ -x src/can_user_push_http ]; then
 126         echo "ERROR: src/can_user_push_http is not built! Did you _REALLY_ read INSTALL?" >&2
 127         echo "ERROR: perhaps you forgot to run make?" >&2
 128         exit 1
 129 fi
 130 if ! [ -f src/getent ] || ! [ -x src/getent ]; then
 131         echo "ERROR: src/getent is not built! Did you _REALLY_ read INSTALL?" >&2
 132         echo "ERROR: perhaps you forgot to run make?" >&2
 133         exit 1
 134 fi
 135 if ! [ -f src/get_user_uuid ] || ! [ -x src/get_user_uuid ]; then
 136         echo "ERROR: src/get_user_uuid is not built! Did you _REALLY_ read INSTALL?" >&2
 137         echo "ERROR: perhaps you forgot to run make?" >&2
 138         exit 1
 139 fi
 140 if ! [ -f src/list_packs ] || ! [ -x src/list_packs ]; then
 141         echo "ERROR: src/list_packs is not built! Did you _REALLY_ read INSTALL?" >&2
 142         echo "ERROR: perhaps you forgot to run make?" >&2
 143         exit 1
 144 fi
 145 if ! [ -f src/peek_packet ] || ! [ -x src/peek_packet ]; then
 146         echo "ERROR: src/peek_packet is not built! Did you _REALLY_ read INSTALL?" >&2
 147         echo "ERROR: perhaps you forgot to run make?" >&2
 148         exit 1
 149 fi
 150 if ! [ -f src/rangecgi ] || ! [ -x src/rangecgi ]; then
 151         echo "ERROR: src/rangecgi is not built! Did you _REALLY_ read INSTALL?" >&2
 152         echo "ERROR: perhaps you forgot to run make?" >&2
 153         exit 1
 154 fi
 155 if ! [ -f src/readlink ] || ! [ -x src/readlink ]; then
 156         echo "ERROR: src/readlink is not built! Did you _REALLY_ read INSTALL?" >&2
 157         echo "ERROR: perhaps you forgot to run make?" >&2
 158         exit 1
 159 fi
 160 if ! [ -f src/strftime ] || ! [ -x src/strftime ]; then
 161         echo "ERROR: src/strftime is not built! Did you _REALLY_ read INSTALL?" >&2
 162         echo "ERROR: perhaps you forgot to run make?" >&2
 163         exit 1
 164 fi
 165 if ! [ -f src/throttle ] || ! [ -x src/throttle ]; then
 166         echo "ERROR: src/throttle is not built! Did you _REALLY_ read INSTALL?" >&2
 167         echo "ERROR: perhaps you forgot to run make?" >&2
 168         exit 1
 169 fi
 170 if ! [ -f src/ulimit512 ] || ! [ -x src/ulimit512 ]; then
 171         echo "ERROR: src/ulimit512 is not built! Did you _REALLY_ read INSTALL?" >&2
 172         echo "ERROR: perhaps you forgot to run make?" >&2
 173         exit 1
 174 fi
 175
 176
 177 echo "*** Checking for ezcert..."
 178 if ! [ -f ezcert.git/CACreateCert ] || ! [ -x ezcert.git/CACreateCert ]; then
 179         echo "ERROR: ezcert.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 180         exit 1
 181 fi
 182
 183
 184 echo "*** Checking for git..."
 185 case "$cfg_git_bin" in /*) :;; *)
 186         echo 'ERROR: $Girocco::Config::git_bin must be set to an absolute path' >&2
 187         exit 1
 188 esac
 189 if ! [ -f "$cfg_git_bin" ] || ! [ -x "$cfg_git_bin" ]; then
 190         echo "ERROR: $cfg_git_bin does not exist or is not executable" >&2
 191         exit 1
 192 fi
 193 if ! git_version="$("$cfg_git_bin" version)" || [ -z "$git_version" ]; then
 194         echo "ERROR: $cfg_git_bin version failed" >&2
 195         exit 1
 196 fi
 197 case "$git_version" in
 198         [Gg]"it version "*) :;;
 199         *)
 200                 echo "ERROR: '$cfg_git_bin version' output does not start with 'git version '" >&2
 201                 exit 1
 202 esac
 203 echo "Found $cfg_git_bin $git_version"
 204 git_vernum="$(echo "$git_version" | sed -ne 's/^[^0-9]*\([0-9][0-9]*\(\.[0-9][0-9]*\)*\).*$/\1/p')"
 205 echo "*** Checking Git $git_vernum for compatibility..."
 206 if [ "$(vcmp "$git_vernum" 1.6.6)" -lt 0 ]; then
 207         echo 'ERROR: $Girocco::Config::git_bin must be at least Git version 1.6.6'
 208         exit 1
 209 fi
 210 if [ "$(vcmp "$git_vernum" 1.6.6.3)" -lt 0 ]; then
 211         echo 'WARNING: $Girocco::Config::git_bin version < 1.6.6.3, clients will not see useful error messages'
 212 fi
 213 if [ "$(vcmp "$git_vernum" 1.7.3)" -lt 0 ]; then
 214         cat <<'EOT'
 215
 216 ***
 217 *** SEVERE WARNING: $Girocco::Config::git_bin is set to a version of Git before 1.7.3
 218 ***
 219
 220 Some Girocco functionality will be gracefully disabled and other things will
 221 just not work at all such as race condition protection against simultaneous
 222 client pushes and server garbage collections.
 223
 224 EOT
 225 fi
 226 if [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 1.7.5)" -lt 0 ]; then
 227         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.5 and mirroring enabled, some sources can cause an infinite fetch loop'
 228 fi
 229 if [ "$(vcmp "$git_vernum" 1.7.6.6)" -lt 0 ]; then
 230         echo 'WARNING: $Girocco::Config::git_bin version < 1.7.6.6, performance may be degraded'
 231 fi
 232 if [ "$(uname -m 2>/dev/null)" = "x86_64" ] && [ "$(vcmp "$git_vernum" 1.7.11)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.0)" -lt 0 ]; then
 233         echo 'WARNING: $Girocco::Config::git_bin version >= 1.7.11 and < 2.12.0 and x86_64, make sure Git built WITHOUT XDL_FAST_HASH'
 234         echo 'WARNING: See https://lore.kernel.org/git/20141222041944.GA441@peff.net/ for details'
 235 fi
 236 if [ "$(vcmp "$git_vernum" 1.8.4.2)" -ge 0 ] && [ -n "$cfg_mirror" ] && [ "$(vcmp "$git_vernum" 2)" -lt 0 ]; then
 237         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, git-daemon needs write access for shallow clones'
 238         echo 'WARNING: $Girocco::Config::git_bin version >= 1.8.4.2 and < 2.0.0, shallow clones will leave repository turds'
 239 fi
 240 if [ "$(vcmp "$git_vernum" 1.8.4.3)" -lt 0 ]; then
 241         echo 'WARNING: $Girocco::Config::git_bin version < 1.8.4.3, clients will not receive symref=HEAD:refs/heads/...'
 242 fi
 243 if [ "$(vcmp "$git_vernum" 2.1)" -lt 0 ]; then
 244         echo 'WARNING: $Girocco::Config::git_bin version < 2.1.0, pack bitmaps will not be available'
 245 fi
 246 if [ "$(vcmp "$git_vernum" 2.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.1.3)" -lt 0 ]; then
 247         echo 'WARNING: $Girocco::Config::git_bin version >= 2.1.0 and < 2.1.3, pack bitmaps may not be reliable, please upgrade to at least Git version 2.1.3'
 248 fi
 249 if [ "$(vcmp "$git_vernum" 2.2)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.3.2)" -lt 0 ]; then
 250         cat <<'EOT'
 251
 252 ***
 253 *** ERROR: $Girocco::Config::git_bin is set to an incompatible version of Git
 254 ***
 255
 256 Git versions starting with 2.2.0 and continuing up through 2.3.1 are incompatible
 257 with Girocco due to various unresolved issues.  Please either downgrade to 2.1.4
 258 or earlier or, more preferred, upgrade to 2.3.2 (ideally 2.4.11) or later.
 259
 260 In order to bypass this check you will have to modify install.sh in which case
 261 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 262
 263 EOT
 264         exit 1
 265 fi
 266 if [ "$(vcmp "$git_vernum" 2.3.3)" -lt 0 ]; then
 267         echo 'WARNING: $Girocco::Config::git_bin version < 2.3.3, performance will be sub-optimal'
 268 fi
 269 if [ "$(vcmp "$git_vernum" 2.4.4)" -lt 0 ]; then
 270         echo 'WARNING: $Girocco::Config::git_bin version < 2.4.4, many refs smart HTTP fetches can deadlock'
 271 fi
 272 if [ "$(vcmp "$git_vernum" 2.10.1)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.12.3)" -lt 0 ]; then
 273         echo 'WARNING: $Girocco::Config::git_bin version >= 2.10.1 and < 2.12.3, --pickaxe-regex can segfault'
 274         echo 'WARNING: If gitweb pickaxe regular expression searches are enabled, --pickaxe-regex will be used'
 275         echo 'WARNING: See the fix at http://repo.or.cz/git.git/f53c5de29cec68e3 for details'
 276         echo 'WARNING: The fix is trivial and easily cherry-picked into a custom 2.10.1 - 2.12.2 build'
 277         echo 'WARNING: Leaving the gitweb/gitweb_config.perl "regexp" feature off as recommended avoids the issue'
 278 fi
 279 secmsg=
 280 if [ "$(vcmp "$git_vernum" 2.4.11)" -lt 0 ]; then
 281         secmsg='prior to 2.4.11'
 282 fi
 283 if [ "$(vcmp "$git_vernum" 2.5)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.5.5)" -lt 0 ]; then
 284         secmsg='2.5.x prior to 2.5.5'
 285 fi
 286 if [ "$(vcmp "$git_vernum" 2.6)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.6.6)" -lt 0 ]; then
 287         secmsg='2.6.x prior to 2.6.6'
 288 fi
 289 if [ "$(vcmp "$git_vernum" 2.7)" -ge 0 ] && [ "$(vcmp "$git_vernum" 2.7.4)" -lt 0 ]; then
 290         secmsg='2.7.x prior to 2.7.4'
 291 fi
 292 if [ -n "$secmsg" ]; then
 293         cat <<EOT
 294
 295 ***
 296 *** SEVERE WARNING: \$Girocco::Config::git_bin is set to a version of Git $secmsg
 297 ***
 298
 299 Security issues exist in Git versions prior to 2.4.11, 2.5.x prior to 2.5.5,
 300 2.6.x prior to 2.6.6 and 2.7.x prior to 2.7.4.
 301
 302 Besides the security fixes included in later versions, versions prior to
 303 2.2.0 may accidentally prune unreachable loose objects earlier than
 304 intended.  Since Git version 2.4.11 is the minimum version to include all
 305 security fixes to date, it should be considered the absolute minimum
 306 version of Git to use when running Girocco.
 307
 308 This is not enforced, but Git is easy to build from the git.git submodule
 309 and upgrading to GIT VERSION 2.4.11 OR LATER IS HIGHLY RECOMMENDED.
 310
 311 We will now pause for a moment so you can reflect on this warning.
 312
 313 EOT
 314         sleep 60
 315 fi
 316 if [ -n "$cfg_mirror" ] && [ "$cfg_mirror" != 0 ] && grep -q ns_parserr "$cfg_git_bin"; then
 317         cat <<'EOT'
 318
 319 ***
 320 *** WARNING: $Girocco::Config::git_bin is set to a questionable Git binary
 321 ***
 322
 323 You appear to have enabled mirroring and the Git binary you have selected
 324 appears to contain an experimental patch that cannot be disabled.  This
 325 patch can generate invalid network DNS traffic and/or cause long delays
 326 when fetching using the "git:" protocol when no port number is specified.
 327 It may also end up retrieving repsitory contents from a host other than
 328 the one specified in the "git:" URL when the port is omitted.
 329
 330 You are advised to either build your own version of Git (the problem patch
 331 is not part of the official Git repository) or disable mirroring (via the
 332 $Girocco::Config:mirror setting) to avoid these potential problems.
 333
 334 USE THE SELECTED GIT BINARY AT YOUR OWN RISK!
 335
 336 EOT
 337         sleep 5
 338 fi
 339
 340 test_nc_U() {
 341         [ -n "$1" ] || return 1
 342         _cmdnc="$(command -v "$1" 2>/dev/null)" || :
 343         [ -n "$_cmdnc" ] && [ -f "$_cmdnc" ] && [ -x "$_cmdnc" ] || return 1
 344         _tmpdir="$(mktemp -d /tmp/nc-u-XXXXXX)"
 345         [ -n "$_tmpdir" ] && [ -d "$_tmpdir" ] || return 1
 346         >"$_tmpdir/output"
 347         (sleep 3 | "$_cmdnc" -l -U "$_tmpdir/socket" 2>/dev/null >"$_tmpdir/output" || >"$_tmpdir/failed")&
 348         _bgpid="$!"
 349         sleep 1
 350         echo "testing" | "$_cmdnc" -w 1 -U "$_tmpdir/socket" >/dev/null 2>&1 || >"$_tmpdir/failed"
 351         sleep 1
 352         kill "$_bgpid" >/dev/null 2>&1 || :
 353         read -r _result <"$_tmpdir/output" || :
 354         _bad=
 355         ! [ -e "$_tmpdir/failed" ] || _bad=1
 356         rm -rf "$_tmpdir"
 357         [ -z "$_bad" ] && [ "$_result" = "testing" ]
 358 } >/dev/null 2>&1
 359
 360 echo "*** Verifying \$Girocco::Config::nc_openbsd_bin supports -U option..."
 361 test_nc_U "$var_nc_openbsd_bin" || {
 362         echo "ERROR: invalid Girocco::Config::nc_openbsd_bin setting" >&2
 363         echo "ERROR: \"$var_nc_openbsd_bin\" does not grok the -U option" >&2
 364         uname_s="$(uname -s 2>/dev/null | tr A-Z a-z 2>/dev/null)" || :
 365         case "$uname_s" in
 366         *dragonfly*)
 367                 echo "ERROR: see the src/dragonfly/README file for a solution" >&2;;
 368         *kfreebsd*|*linux*)
 369                 echo "ERROR: try installing the package named 'netcat-openbsd'" >&2;;
 370         esac
 371         exit 1
 372 }
 373
 374 echo "*** Verifying selected POSIX sh is sane..."
 375 shbin="$var_sh_bin"
 376 [ -n "$shbin" ] && [ -f "$shbin" ] && [ -x "$shbin" ] && [ "$("$shbin" -c 'echo sh $(( 1 + 1 ))' 2>/dev/null)" = "sh 2" ] || {
 377         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting' >&2
 378         exit 1
 379 }
 380 [ "$(check_sh_builtin command)" = "command" ] || {
 381         echo 'ERROR: invalid $Girocco::Config::posix_sh_bin setting (does not understand command -v)' >&2
 382         exit 1
 383 }
 384 sh_not_builtin=
 385 sh_extra_chroot_installs=
 386 badsh=
 387 for sbi in cd pwd read umask unset unalias; do
 388         if [ "$(check_sh_builtin "$sbi")" != "$sbi" ]; then
 389                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing built-in $sbi)" >&2
 390                 badsh=1
 391         fi
 392 done
 393 [ -z "$badsh" ] || exit 1
 394 for sbi in '[' echo printf test; do
 395         if ! extra="$(check_sh_builtin "$sbi")"; then
 396                 echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (missing command $sbi)" >&2
 397                 badsh=1
 398                 continue
 399         fi
 400         if [ "$extra" != "$sbi" ]; then
 401                 case "$extra" in /*) :;; *)
 402                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (bad command -v $sbi result: $extra)" >&2
 403                         badsh=1
 404                         continue
 405                 esac
 406                 withspc=
 407                 case "$extra" in *" "*) withspc=1; esac
 408                 [ -z "$withspc" ] && [ -f "$extra" ] && [ -r "$extra" ] && [ -x "$extra" ] || {
 409                         echo "ERROR: invalid \$Girocco::Config::posix_sh_bin setting (unusable command -v $sbi result: $extra)" >&2
 410                         badsh=1
 411                         continue
 412                 }
 413                 echo "WARNING: slow \$Girocco::Config::posix_sh_bin setting (not built-in $sbi)" >&2
 414                 sh_not_builtin="$sh_not_builtin $sbi"
 415                 sh_extra_chroot_installs="$sh_extra_chroot_installs $extra"
 416         fi
 417 done
 418 [ -z "$badsh" ] || exit 1
 419 [ -z "$sh_extra_chroot_installs" ] || {
 420         echo "WARNING: the selected POSIX sh implements these as non-built-in:$sh_not_builtin" >&2
 421         echo "WARNING: as a result it will run slower than necessary" >&2
 422         echo "WARNING: consider building and switching to dash which can be found at:" >&2
 423         echo "WARNING:   http://gondor.apana.org.au/~herbert/dash/" >&2
 424         echo "WARNING: (download a tarball from the files section or clone the Git repository" >&2
 425         echo "WARNING:  and checkout the latest tag, run autogen.sh, configure and build)" >&2
 426         echo "WARNING: dash is licensed under the 3-clause BSD license" >&2
 427 }
 428
 429 echo "*** Verifying xargs is sane..."
 430 _xargsr="$(</dev/null command xargs printf %s -r)" || :
 431 xtest1="$(</dev/null command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 432 xtest2="$(printf '%s\n' one two | command xargs $_xargsr printf 'test %s ' 2>/dev/null)" || :
 433 [ -z "$xtest1" ] && [ "$xtest2" = "test one test two " ] || {
 434         echo 'ERROR: xargs is unusable' >&2
 435         echo 'ERROR: either `test -z "$(</dev/null xargs echo test 2>/dev/null)"`' >&2
 436         echo 'ERROR: or `test -z "$(</dev/null xargs -r echo test 2>/dev/null)"`' >&2
 437         echo 'ERROR: must be true, but neither is' >&2
 438         exit 1
 439 }
 440
 441 echo "*** Verifying selected perl is sane..."
 442 perlbin="$var_perl_bin"
 443 [ -n "$perlbin" ] && [ -f "$perlbin" ] && [ -x "$perlbin" ] && [ "$("$perlbin" -wle 'print STDOUT "perl ", + ( 1 + 1 )' 2>/dev/null)" = "perl 2" ] || {
 444         echo 'ERROR: invalid $Girocco::Config::perl_bin setting' >&2
 445         exit 1
 446 }
 447
 448 echo "*** Verifying selected gzip is sane..."
 449 gzipbin="$var_gzip_bin"
 450 [ -n "$gzipbin" ] && [ -f "$gzipbin" ] && [ -x "$gzipbin" ] && "$gzipbin" -V 2>&1 | grep -q gzip &&
 451     [ "$(echo Girocco | "$gzipbin" -c -n -9 | "$gzipbin" -c -d)" = "Girocco" ] || {
 452         echo 'ERROR: invalid $Girocco::Config::gzip_bin setting' >&2
 453         exit 1
 454 }
 455
 456 echo "*** Verifying basedir, webroot, webreporoot and cgiroot paths..."
 457 # Make sure $cfg_basedir, $cfg_webroot and $cfg_cgiroot are absolute paths
 458 case "$cfg_basedir" in /*) :;; *)
 459         echo "ERROR: invalid Girocco::Config::basedir setting" >&2
 460         echo "ERROR: \"$cfg_basedir\" must be an absolute path (start with '/')" >&2
 461         exit 1
 462 esac
 463 case "$cfg_webroot" in /*) :;; *)
 464         echo "ERROR: invalid Girocco::Config::webroot setting" >&2
 465         echo "ERROR: \"$cfg_webroot\" must be an absolute path (start with '/')" >&2
 466         exit 1
 467 esac
 468 if [ -n "$cfg_webreporoot" ]; then
 469         case "$cfg_webreporoot" in /*) :;; *)
 470                 echo "ERROR: invalid Girocco::Config::webreporoot setting" >&2
 471                 echo "ERROR: \"$cfg_webreporoot\" must be an absolute path (start with '/') or undef" >&2
 472                 exit 1
 473         esac
 474 fi
 475 case "$cfg_cgiroot" in /*) :;; *)
 476         echo "ERROR: invalid Girocco::Config::cgiroot setting" >&2
 477         echo "ERROR: \"$cfg_cgiroot\" must be an absolute path (start with '/')" >&2
 478         exit 1
 479 esac
 480
 481 # return the input with trailing slashes stripped but return "/" for all "/"s
 482 striptrsl() {
 483         [ -n "$1" ] || return 0
 484         _s="${1##*[!/]}"
 485         [ "$_s" != "$1" ] || _s="${_s#?}"
 486         printf "%s\n" "${1%$_s}"
 487 }
 488
 489 # a combination of realpath + dirname where the realpath of the deepest existing
 490 # directory is returned with the rest of the non-existing components appended
 491 # and trailing slashes and multiple slashes are removed
 492 realdir() {
 493         _d="$(striptrsl "$1")"
 494         if [ "$_d" = "/" ] || [ -z "$_d" ]; then
 495                 echo "$_d"
 496                 return 0
 497         fi
 498         _c=""
 499         while ! [ -d "$_d" ]; do
 500                 _c="/$(basename "$_d")$_c"
 501                 _d="$(dirname "$_d")"
 502                 [ "$_d" != "/" ] || _c="${_c#/}"
 503         done
 504         printf "%s%s\n" "$(cd "$_d" && pwd -P)" "$_c"
 505 }
 506
 507 # Use basedir, webroot and cgiroot for easier control of filesystem locations
 508 # Wherever we are writing/copying/installing files we use these, but where we
 509 # are editing, adding config settings or printing advice we always stick to the
 510 # cfg_xxx Config variable versions.  These are like a set of DESTDIR variables.
 511 # Only the file system directories that could be asynchronously accessed (by
 512 # the web server, jobd.pl, taskd.pl or incoming pushes) get these special vars.
 513 # The chroot is handled specially and does not need one of these.
 514 # We must be careful to allow cgiroot and/or webroot to be under basedir in which
 515 # case the prior contents of cgiroot and/or webroot are discarded.
 516 rbasedir="$(realdir "$cfg_basedir")"
 517 rwebroot="$(realdir "$cfg_webroot")"
 518 rwebreporoot=
 519 [ -z "$cfg_webreporoot" ] || {
 520         # avoid resolving a pre-existing symlink from a previous install
 521         rwebreporoot="$(realdir "${cfg_webreporoot%/}_NOSUCHDIR")"
 522         rwebreporoot="${rwebreporoot%_NOSUCHDIR}"
 523 }
 524 rcgiroot="$(realdir "$cfg_cgiroot")"
 525 case "$rbasedir" in "$rwebroot"/?*)
 526         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under webroot" >&2
 527         exit 1
 528 esac
 529 case "$rbasedir" in "$rcgiroot"/?*)
 530         echo "ERROR: invalid Girocco::Config::basedir setting; must not be under cgiroot" >&2
 531         exit 1
 532 esac
 533 if [ "$rwebroot" = "$rcgiroot" ]; then
 534         echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::cgiroot settings; must not be the same" >&2
 535         exit 1
 536 fi
 537 case "$rcgiroot" in "$rwebroot"/?*)
 538         echo "ERROR: invalid Girocco::Config::cgiroot setting; must not be under webroot" >&2
 539         exit 1
 540 esac
 541 case "$rwebroot" in "$rcgiroot"/?*)
 542         echo "ERROR: invalid Girocco::Config::webroot setting; must not be under cgiroot" >&2
 543         exit 1
 544 esac
 545 if [ -n "$rwebreporoot" ]; then
 546         if [ "$rwebreporoot" = "$rwebroot" ]; then
 547                 echo "ERROR: invalid Girocco::Config::webroot and Girocco::Config::webreporoot settings; must not be the same" >&2
 548                 exit 1
 549         fi
 550         case "$rwebreporoot" in "$rwebroot"/?*);;*)
 551                 echo "ERROR: invalid Girocco::Config::webreporoot setting; must be under webroot or undef" >&2
 552                 exit 1
 553         esac
 554 fi
 555 basedir="$rbasedir-new"
 556 case "$rwebroot" in
 557         "$rbasedir"/?*)
 558                 webroot="$basedir${rwebroot#$rbasedir}"
 559                 webrootsub=1
 560                 ;;
 561         *)
 562                 webroot="$rwebroot-new"
 563                 webrootsub=
 564                 ;;
 565 esac
 566 webreporoot=
 567 [ -z "$rwebreporoot" ] || webreporoot="$webroot${rwebreporoot#$rwebroot}"
 568 case "$rcgiroot" in
 569         "$rbasedir"/?*)
 570                 cgiroot="$basedir${rcgiroot#$rbasedir}"
 571                 cgirootsub=1
 572                 ;;
 573         *)
 574                 cgiroot="$rcgiroot-new"
 575                 cgirootsub=
 576                 ;;
 577 esac
 578
 579 echo "*** Setting up basedir..."
 580
 581 chown_make() {
 582         if [ "$LOGNAME" = root ] && [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != root ]; then
 583                 find -H "$@" -user root -exec chown "$SUDO_USER:$(id -gn "$SUDO_USER")" '{}' + 2>/dev/null || :
 584         elif [ "$LOGNAME" = root ] && { [ -z "$SUDO_USER" ] || [ "$SUDO_USER" = root ]; }; then
 585                 echo "*** WARNING: running make as root w/o sudo may leave root-owned: $*"
 586         fi
 587 }
 588
 589 "$MAKE" --no-print-directory --silent apache.conf
 590 chown_make apache.conf
 591 "$MAKE" --no-print-directory --silent -C src
 592 chown_make src
 593 rm -fr "$basedir"
 594 mkdir -p "$basedir" "$basedir/gitweb" "$basedir/cgi"
 595 # make the mtlinesfile with 1000 empty lines
 596 yes '' | dd bs=1000 count=1 2>/dev/null >"$basedir/mtlinesfile"
 597 chmod a+r "$basedir/mtlinesfile"
 598 cp cgi/*.cgi "$basedir/cgi"
 599 cp -pR Girocco jobd taskd html jobs toolbox hooks apache.conf shlib.sh bin screen "$basedir"
 600 find -H "$basedir" -type l -exec rm -f '{}' +
 601 cp -p src/can_user_push src/can_user_push_http src/get_user_uuid src/list_packs src/peek_packet \
 602         src/rangecgi src/readlink src/strftime src/throttle src/ulimit512 \
 603         ezcert.git/CACreateCert cgi/authrequired.cgi cgi/snapshot.cgi \
 604         "$basedir/bin"
 605 cp -p gitweb/*.sh gitweb/*.perl "$basedir/gitweb"
 606 if [ -n "$cfg_httpspushurl" ]; then
 607         [ -z "$cfg_pretrustedroot" ] || rm -f "$basedir"/html/rootcert.html
 608 else
 609         rm -f "$basedir"/html/rootcert.html "$basedir"/html/httpspush.html
 610 fi
 611 [ -n "$cfg_mob" ] || rm -f "$basedir"/html/mob.html
 612
 613 # Put the correct Config in place
 614 [ "$GIROCCO_CONF" = "Girocco::Config" ] || cp "$(echo "$GIROCCO_CONF" | sed 's#::#/#g; s/$/.pm/')" "$basedir/Girocco/Config.pm"
 615
 616 # Create symbolic links to selected binaries
 617 ln -s "$cfg_git_bin" "$basedir/bin/git"
 618 ln -s "$shbin" "$basedir/bin/sh"
 619 ln -s "$perlbin" "$basedir/bin/perl"
 620 ln -s "$gzipbin" "$basedir/bin/gzip"
 621
 622 echo "*** Preprocessing scripts..."
 623 SHBIN="$shbin" && export SHBIN
 624 PERLBIN="$perlbin" && export PERLBIN
 625 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 626         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 627         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 628         -e 's/(?<!")\@basedir\@/"$Girocco::Config::basedir"/g;' \
 629         -e 's/(?<=")\@basedir\@/$Girocco::Config::basedir/g;' \
 630         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 631         -e 's/\@reporoot\@/"$Girocco::Config::reporoot"/g;' \
 632         -e 's/\@shbin\@/"$ENV{SHBIN}"/g;' \
 633         -e 's/\@perlbin\@/"$ENV{PERLBIN}"/g;' \
 634         -e 's/\@jailreporoot\@/"$Girocco::Config::jailreporoot"/g;' \
 635         -e 's/\@chroot\@/"$Girocco::Config::chroot"/g;' \
 636         -e 's/\@webadmurl\@/"$Girocco::Config::webadmurl"/g;' \
 637         -e 's/\@screen_acl_file\@/"$Girocco::Config::screen_acl_file"/g;' \
 638         -e 's/\@mob\@/"$Girocco::Config::mob"/g;' \
 639         -e 's/\@autogchack\@/"$Girocco::Config::autogchack"/g;' \
 640         -e 's/\@git_server_ua\@/"$Girocco::Config::git_server_ua"/g;' \
 641         -e 's/\@defined_git_server_ua\@/defined($Girocco::Config::git_server_ua)/ge;' \
 642         -e 's/\@git_no_mmap\@/"$Girocco::Config::git_no_mmap"/g;' \
 643         -e 's/\@big_file_threshold\@/"'"$var_big_file_threshold"'"/g;' \
 644         -e 's/\@upload_pack_window\@/"'"$var_upload_window"'"/g;' \
 645         -e 's/\@fetch_stash_refs\@/"$Girocco::Config::fetch_stash_refs"/g;' \
 646         -e 's/\@suppress_git_ssh_logging\@/"$Girocco::Config::suppress_git_ssh_logging"/g;' \
 647         -e 'close ARGV if eof;' \
 648         "$basedir"/jobs/*.sh "$basedir"/jobd/*.sh \
 649         "$basedir"/taskd/*.sh "$basedir"/gitweb/*.sh \
 650         "$basedir"/shlib.sh "$basedir"/hooks/* \
 651         "$basedir"/toolbox/*.sh "$basedir"/toolbox/*.pl \
 652         "$basedir"/toolbox/reports/*.sh \
 653         "$basedir"/bin/git-* "$basedir"/bin/*.sh \
 654         "$basedir"/bin/create-* "$basedir"/bin/update-* \
 655         "$basedir"/bin/*.cgi "$basedir"/screen/*
 656 perl -I"$PWD" -M$GIROCCO_CONF -i -p \
 657         -e 's/__BASE''DIR__/$Girocco::Config::basedir/g;' \
 658         "$basedir"/cgi/*.cgi "$basedir"/gitweb/*.perl \
 659         "$basedir"/jobd/*.pl "$basedir"/taskd/*.pl
 660 perl -i -p \
 661         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 662         -e 'close ARGV if eof;' \
 663         "$basedir"/jobd/jobd.pl "$basedir"/taskd/taskd.pl \
 664         "$basedir"/bin/sendmail.pl "$basedir"/bin/CACreateCert
 665 perl -i -p \
 666         -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 667         -e 's/^#!.*sh/#!$ENV{SHBIN}/ if $. == 1;' \
 668         -e 'close ARGV if eof;' \
 669         "$basedir"/bin/format-readme "$basedir/cgi"/*.cgi
 670 unset PERLBIN
 671 unset SHBIN
 672
 673 # Dump all the cfg_ and defined_ variables to shlib_vars.sh
 674 get_girocco_config_var_list >"$basedir"/shlib_vars.sh
 675
 676 if [ "${cfg_mirror_darcs:-0}" != "0" ]; then
 677         echo "*** Setting up darcs-fast-export from girocco-darcs-fast-export.git..."
 678         if ! [ -f girocco-darcs-fast-export.git/darcs-fast-export ] ||
 679         ! [ -x girocco-darcs-fast-export.git/darcs-fast-export ]; then
 680                 echo "ERROR: girocco-darcs-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 681                 exit 1
 682         fi
 683         mkdir -p "$basedir"/bin
 684         cp girocco-darcs-fast-export.git/darcs-fast-export "$basedir"/bin
 685 fi
 686
 687 if [ "${cfg_mirror_hg:-0}" != "0" ]; then
 688         echo "*** Setting up hg-fast-export from girocco-hg-fast-export.git..."
 689         if ! [ -f girocco-hg-fast-export.git/hg-fast-export.py ] || ! [ -f girocco-hg-fast-export.git/hg2git.py ]; then
 690                 echo "ERROR: girocco-hg-fast-export.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 691                 exit 1
 692         fi
 693         mkdir -p "$basedir"/bin
 694         cp girocco-hg-fast-export.git/hg-fast-export.py girocco-hg-fast-export.git/hg2git.py "$basedir"/bin
 695 fi
 696
 697 echo "*** Setting up markdown from markdown.git..."
 698 if ! [ -f markdown.git/Markdown.pl ]; then
 699         echo "ERROR: markdown.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 700         exit 1
 701 fi
 702 mkdir -p "$basedir"/bin
 703 (PERLBIN="$perlbin" && export PERLBIN &&
 704         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 705                 markdown.git/Markdown.pl >"$basedir"/bin/Markdown.pl.$$ &&
 706         chmod a+x "$basedir"/bin/Markdown.pl.$$ &&
 707         mv -f "$basedir"/bin/Markdown.pl.$$ "$basedir"/bin/Markdown.pl)
 708 test $? -eq 0
 709
 710 # Some permission sanity on basedir/bin just in case
 711 find -H "$basedir"/bin -type f -exec chmod go-w '{}' +
 712 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir"/bin
 713
 714 if [ -n "$cfg_mirror" ]; then
 715         echo "--- Remember to start $cfg_basedir/taskd/taskd.pl"
 716 fi
 717 echo "--- Also remember to either start $cfg_basedir/jobd/jobd.pl, or add this"
 718 echo "--- to the crontab of $cfg_mirror_user (adjust frequency on number of repos):"
 719 echo "*/30 * * * * /usr/bin/nice -n 18 $cfg_basedir/jobd/jobd.pl -q --all-once"
 720
 721
 722 echo "*** Setting up repository root..."
 723 [ -d "$cfg_reporoot" ] || {
 724         mkdir -p "$cfg_reporoot"
 725         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot" ||
 726         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot"
 727 }
 728 [ -z "$cfg_owning_group" ] ||
 729         chgrp "$cfg_owning_group" "$cfg_reporoot" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot"
 730 chmod 02775 "$cfg_reporoot" || echo "WARNING: Cannot chmod $cfg_reporoot properly"
 731 mkdir -p "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty"
 732 chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_recyclebin" "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" ||
 733         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_reporoot/{_recyclebin,_global} properly"
 734 if [ "$cfg_owning_group" ]; then
 735         chgrp "$cfg_owning_group" "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chgrp $cfg_owning_group $cfg_reporoot/_recyclebin"
 736         chgrp -R "$cfg_owning_group" "$cfg_reporoot/_global" || echo "WARNING: Cannot chgrp -R $cfg_owning_group $cfg_reporoot/_global"
 737 fi
 738 chmod 02775 "$cfg_reporoot/_recyclebin" || echo "WARNING: Cannot chmod $cfg_reporoot/_recyclebin properly"
 739 chmod 00755 "$cfg_reporoot/_global" "$cfg_reporoot/_global/hooks" "$cfg_reporoot/_global/empty" || echo "WARNING: Cannot chmod $cfg_reporoot/_global properly"
 740
 741
 742 if [ "${cfg_disable_jailsetup:-0}" = "0" ] && [ -n "$cfg_chrooted" ]; then
 743         echo "*** Setting up chroot jail for pushing..."
 744         if [ "$(id -u)" -eq 0 ]; then
 745                 # jailsetup may install things from $cfg_basedir/bin into the
 746                 # chroot so we do a mini-update of just that portion now
 747                 mkdir -p "$cfg_basedir"
 748                 rm -rf "$cfg_basedir/bin-new"
 749                 cp -pR "$basedir/bin" "$cfg_basedir/bin-new" >/dev/null 2>&1
 750                 rm -rf "$cfg_basedir/bin-old"
 751                 quick_move "$cfg_basedir/bin-new" "$cfg_basedir/bin" "$cfg_basedir/bin-old"
 752                 rm -rf "$cfg_basedir/bin-old"
 753                 if [ -n "$sh_extra_chroot_installs" ]; then
 754                         GIROCCO_CHROOT_EXTRA_INSTALLS="$sh_extra_chroot_installs"
 755                         export GIROCCO_CHROOT_EXTRA_INSTALLS
 756                 fi
 757                 ./jailsetup.sh
 758                 unset GIROCCO_CHROOT_EXTRA_INSTALLS
 759         else
 760                 echo "WARNING: Skipping jail setup, not root"
 761         fi
 762 fi
 763
 764
 765 echo "*** Setting up jail configuration (project database)..."
 766 [ "$(id -u)" -eq 0 ] || ./jailsetup.sh dbonly
 767 mkdir -p "$cfg_chroot" "$cfg_chroot/etc"
 768 touch "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group"
 769 chown "$cfg_mirror_user""$owngroup" "$cfg_chroot/etc" ||
 770         echo "WARNING: Cannot chown $cfg_mirror_user$owngroup $cfg_chroot/etc"
 771 chown "$cfg_cgi_user""$owngroup" "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 772         echo "WARNING: Cannot chown $cfg_cgi_user$owngroup the etc/passwd and/or etc/group files"
 773 chmod g+w "$cfg_chroot/etc/passwd" "$cfg_chroot/etc/group" ||
 774         echo "WARNING: Cannot chmod g+w the etc/passwd and/or etc/group files"
 775 chmod 02775 "$cfg_chroot/etc" || echo "WARNING: Cannot chmod 02775 $cfg_chroot/etc"
 776
 777
 778 echo "*** Setting up global hook scripts..."
 779 # It is absolutely CRUCIAL that hook script replacements are done atomically!
 780 # Otherwise an incoming push might slip in and fail to run the hook script!
 781 # The underlying rename(2) function call provides this and mv will use it.
 782 # First add hook scripts
 783 hooks="pre-auto-gc pre-receive post-commit post-receive update"
 784 for hook in $hooks; do
 785         cat "$basedir/hooks/$hook" >"$cfg_reporoot/_global/hooks/$hook.$$"
 786         chown "$cfg_mirror_user""$owngroup" "$cfg_reporoot/_global/hooks/$hook.$$" ||
 787                 echo "WARNING: Cannot chown $cfg_reporoot/_global/hooks/$hook"
 788         chmod 0755 "$cfg_reporoot/_global/hooks/$hook.$$"
 789         mv -f "$cfg_reporoot/_global/hooks/$hook.$$" "$cfg_reporoot/_global/hooks/$hook"
 790 done
 791 # Then remove any hook scripts that do not belong
 792 for hook in "$cfg_reporoot/_global/hooks"/*; do
 793         hook="${hook##*/}"
 794         [ -f "$cfg_reporoot/_global/hooks/$hook" ] || continue
 795         case " $hooks " in *" $hook "*);;*)
 796                 rm -f "$cfg_reporoot/_global/hooks/$hook" ||
 797                         echo "WARNING: Cannot remove extraneous $cfg_reporoot/_global/hooks/$hook"
 798         esac
 799 done
 800
 801
 802 echo "*** Setting up gitweb from git.git..."
 803 if ! [ -f git.git/Makefile ]; then
 804         echo "ERROR: git.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 805         exit 1
 806 fi
 807
 808 # We do not wholesale replace either webroot or cgiroot unless they are under
 809 # basedir so if they exist and are not we make a copy to start working on them.
 810 # We make a copy using -p which can result in some warnings so we suppress
 811 # error output as it's of no consequence in this case.
 812 rm -rf "$webroot" "$cgiroot"
 813 [ -n "$webrootsub" ] || ! [ -d "$rwebroot" ] || cp -pR "$rwebroot" "$webroot" >/dev/null 2>&1 || :
 814 [ -n "$cgirootsub" ] || ! [ -d "$rcgiroot" ] || cp -pR "$rcgiroot" "$cgiroot" >/dev/null 2>&1 || :
 815 mkdir -p "$webroot" "$cgiroot"
 816
 817 (
 818         cd git.git &&
 819         "$MAKE" --no-print-directory --silent NO_SUBDIR=: bindir="$(dirname "$cfg_git_bin")" \
 820                 GITWEB_CONFIG_COMMON="" GITWEB_CONFIG_SYSTEM="" \
 821                 GITWEB_CONFIG="$cfg_basedir/gitweb/gitweb_config.perl" SHELL_PATH="$shbin" gitweb &&
 822         chown_make gitweb &&
 823         PERLBIN="$perlbin" && export PERLBIN &&
 824         perl -p -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 825                 -e 's/^(\s*use\s+warnings\s*;.*)$/#$1/;' gitweb/gitweb.cgi >"$cgiroot"/gitweb.cgi.$$ &&
 826         chmod a+x "$cgiroot"/gitweb.cgi.$$ &&
 827         chown_make "$cgiroot"/gitweb.cgi.$$ &&
 828         mv -f "$cgiroot"/gitweb.cgi.$$ "$cgiroot"/gitweb.cgi &&
 829         cp gitweb/static/*.png gitweb/static/*.css gitweb/static/*.js "$webroot"
 830 )
 831 test $? -eq 0
 832
 833
 834 echo "*** Setting up git-browser from git-browser.git..."
 835 if ! [ -f git-browser.git/git-browser.cgi ]; then
 836         echo "ERROR: git-browser.git is not checked out! Did you _REALLY_ read INSTALL?" >&2
 837         exit 1
 838 fi
 839 mkdir -p "$webroot"/git-browser "$cgiroot"
 840 (
 841         cd git-browser.git &&
 842         CFG="$cfg_basedir/gitweb/git-browser.conf" && export CFG &&
 843         PERLBIN="$perlbin" && export PERLBIN && perl -p \
 844                 -e 's/^#!.*perl/#!$ENV{PERLBIN}/ if $. == 1;' \
 845                 -e 's/"git-browser\.conf"/"$ENV{"CFG"}"/' git-browser.cgi >"$cgiroot"/git-browser.cgi.$$ &&
 846         chmod a+x "$cgiroot"/git-browser.cgi.$$ &&
 847         chown_make "$cgiroot"/git-browser.cgi.$$ &&
 848         mv -f "$cgiroot"/git-browser.cgi.$$ "$cgiroot"/git-browser.cgi &&
 849         cp -r *.html *.js *.css js.lib "$webroot"/git-browser &&
 850         cp -r JSON "$cgiroot"
 851 )
 852 test $? -eq 0
 853 rm -f "$webroot"/git-browser/index.html
 854 cat >"$basedir/gitweb"/git-browser.conf.$$ <<-EOT
 855         gitbin: $cfg_git_bin
 856         warehouse: $cfg_reporoot
 857         doconfig: $cfg_basedir/gitweb/gitbrowser_config.perl
 858 EOT
 859 chown_make "$basedir/gitweb"/git-browser.conf.$$
 860 mv -f "$basedir/gitweb"/git-browser.conf.$$ "$basedir/gitweb"/git-browser.conf
 861 cat >"$webroot"/git-browser/GitConfig.js.$$ <<-EOT
 862         cfg_gitweb_url="$cfg_gitweburl/"
 863         cfg_browsercgi_url="$cfg_webadmurl/git-browser.cgi"
 864 EOT
 865 chown_make "$webroot"/git-browser/GitConfig.js.$$
 866 mv -f "$webroot"/git-browser/GitConfig.js.$$ "$webroot"/git-browser/GitConfig.js
 867
 868
 869 echo "*** Setting up our part of the website..."
 870 mkdir -p "$webroot" "$cgiroot"
 871 cp "$basedir"/bin/snapshot.cgi "$basedir/cgi"
 872 cp "$basedir"/bin/authrequired.cgi "$basedir/cgi"
 873 [ -n "$cfg_httpspushurl" ] || rm -f "$basedir/cgi"/usercert.cgi "$cgiroot"/usercert.cgi
 874 cp "$basedir/cgi"/*.cgi "$cgiroot"
 875 rm -rf "$basedir/cgi"
 876 [ -z "$webreporoot" ] || { rm -f "$webreporoot" && ln -s "$cfg_reporoot" "$webreporoot"; }
 877 if [ -z "$cfg_httpspushurl" ] || [ -n "$cfg_pretrustedroot" ]; then
 878         grep -v 'rootcert[.]html' gitweb/indextext.html >"$basedir/gitweb/indextext.html"
 879 else
 880         cp gitweb/indextext.html "$basedir/gitweb"
 881 fi
 882 mv "$basedir"/html/*.css "$basedir"/html/*.js "$webroot"
 883 cp mootools.js "$webroot"
 884 cp htaccess "$webroot/.htaccess"
 885 cp cgi/htaccess "$cgiroot/.htaccess"
 886 cp git-favicon.ico "$webroot/favicon.ico"
 887 cp robots.txt "$webroot"
 888 cat gitweb/gitweb.css >>"$webroot"/gitweb.css
 889
 890
 891 if [ -n "$cfg_httpspushurl" ]; then
 892         echo "*** Setting up SSL certificates..."
 893         bits=2048
 894         if [ "$cfg_rsakeylength" -gt "$bits" ] 2>/dev/null; then
 895             bits="$cfg_rsakeylength"
 896         fi
 897         mkdir -p "$cfg_certsdir"
 898         [ -d "$cfg_certsdir" ]
 899         wwwcertcn=
 900         if [ -e "$cfg_certsdir/girocco_www_crt.pem" ]; then
 901                 wwwcertcn="$(
 902                         openssl x509 -in "$cfg_certsdir/girocco_www_crt.pem" -noout -subject |
 903                         sed -e 's,[^/]*,,'
 904                 )"
 905         fi
 906         wwwcertdns=
 907         if [ -n "$cfg_wwwcertaltnames" ]; then
 908                 for dnsopt in $cfg_wwwcertaltnames; do
 909                         wwwcertdns="${wwwcertdns:+$wwwcertdns }--dns $dnsopt"
 910                 done
 911         fi
 912         wwwcertdnsfile=
 913         if [ -r "$cfg_certsdir/girocco_www_crt.dns" ]; then
 914                 wwwcertdnsfile="$(cat "$cfg_certsdir/girocco_www_crt.dns")"
 915         fi
 916         needroot=
 917         [ -e "$cfg_certsdir/girocco_client_crt.pem" ] &&
 918         [ -e "$cfg_certsdir/girocco_client_key.pem" ] &&
 919         [ -e "$cfg_certsdir/girocco_www_key.pem" ] &&
 920         [ -e "$cfg_certsdir/girocco_www_crt.pem" ] && [ "$wwwcertcn" = "/CN=$cfg_httpsdnsname" ] &&
 921         [ -e "$cfg_certsdir/girocco_root_crt.pem" ] || needroot=1
 922         if [ -n "$needroot" ] && ! [ -e "$cfg_certsdir/girocco_root_key.pem" ]; then
 923                 rm -f "$cfg_certsdir/girocco_root_crt.pem" "$cfg_certsdir/girocco_root_key.pem"
 924                 umask 0077
 925                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_root_key.pem" $bits
 926                 chmod 0600 "$cfg_certsdir/girocco_root_key.pem"
 927                 rm -f "$cfg_certsdir/girocco_root_crt.pem"
 928                 umask 0022
 929                 echo "Created new root key"
 930         fi
 931         if ! [ -e "$cfg_certsdir/girocco_root_crt.pem" ]; then
 932                 "$basedir/bin/CACreateCert" --root --key "$cfg_certsdir/girocco_root_key.pem" \
 933                         --out "$cfg_certsdir/girocco_root_crt.pem" "girocco $cfg_nickname root certificate"
 934                 rm -f "$cfg_certsdir/girocco_www_crt.pem" "$cfg_certsdir/girocco_www_chain.pem"
 935                 rm -f "$cfg_certsdir/girocco_client_crt.pem" "$cfg_certsdir/girocco_client_suffix.pem"
 936                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 937                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 938                 echo "Created new root certificate"
 939         fi
 940         if ! [ -e "$cfg_certsdir/girocco_www_key.pem" ]; then
 941                 umask 0077
 942                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_www_key.pem" $bits
 943                 chmod 0600 "$cfg_certsdir/girocco_www_key.pem"
 944                 rm -f "$cfg_certsdir/girocco_www_crt.pem"
 945                 umask 0022
 946                 echo "Created new www key"
 947         fi
 948         if ! [ -e "$cfg_certsdir/girocco_www_crt.pem" ] ||
 949                 [ "$wwwcertcn" != "/CN=$cfg_httpsdnsname" ] || [ "$wwwcertdns" != "$wwwcertdnsfile" ]; then
 950                 openssl rsa -in "$cfg_certsdir/girocco_www_key.pem" -pubout |
 951                 "$basedir/bin/CACreateCert" --server --key "$cfg_certsdir/girocco_root_key.pem" \
 952                         --cert "$cfg_certsdir/girocco_root_crt.pem" $wwwcertdns \
 953                         --out "$cfg_certsdir/girocco_www_crt.pem" "$cfg_httpsdnsname"
 954                 printf '%s\n' "$wwwcertdns" >"$cfg_certsdir/girocco_www_crt.dns"
 955                 echo "Created www certificate"
 956         fi
 957         if ! [ -e "$cfg_certsdir/girocco_www_chain.pem" ]; then
 958                 cat "$cfg_certsdir/girocco_root_crt.pem" >"$cfg_certsdir/girocco_www_chain.pem"
 959                 echo "Created www certificate chain file"
 960         fi
 961         if ! [ -e "$cfg_certsdir/girocco_client_key.pem" ]; then
 962                 umask 0037
 963                 openssl genrsa -f4 -out "$cfg_certsdir/girocco_client_key.pem" $bits
 964                 chmod 0640 "$cfg_certsdir/girocco_client_key.pem"
 965                 rm -f "$cfg_certsdir/girocco_client_crt.pem"
 966                 umask 0022
 967                 echo "Created new client key"
 968         fi
 969         if ! [ -e "$cfg_certsdir/girocco_client_crt.pem" ]; then
 970                 openssl rsa -in "$cfg_certsdir/girocco_client_key.pem" -pubout |
 971                 "$basedir/bin/CACreateCert" --subca --key "$cfg_certsdir/girocco_root_key.pem" \
 972                         --cert "$cfg_certsdir/girocco_root_crt.pem" \
 973                         --out "$cfg_certsdir/girocco_client_crt.pem" "girocco $cfg_nickname client authority"
 974                 rm -f "$cfg_certsdir/girocco_client_suffix.pem"
 975                 rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 976                 rm -f "$cfg_chroot/etc/sshcerts"/*.pem
 977                 echo "Created client certificate"
 978         fi
 979         if ! [ -e "$cfg_certsdir/girocco_client_suffix.pem" ]; then
 980                 cat "$cfg_certsdir/girocco_client_crt.pem" >"$cfg_certsdir/girocco_client_suffix.pem"
 981                 echo "Created client certificate suffix file"
 982         fi
 983         if [ -z "$cfg_pretrustedroot" ]; then
 984                 cat "$cfg_rootcert" >"$webroot/${cfg_nickname}_root_cert.pem"
 985         else
 986                 rm -f "$webroot/${cfg_nickname}_root_cert.pem"
 987         fi
 988         if [ -n "$cfg_mob" ]; then
 989                 if ! [ -e "$cfg_certsdir/girocco_mob_user_key.pem" ]; then
 990                         openssl genrsa -f4 -out "$cfg_certsdir/girocco_mob_user_key.pem" $bits
 991                         chmod 0644 "$cfg_certsdir/girocco_mob_user_key.pem"
 992                         rm -f "$cfg_certsdir/girocco_mob_user_crt.pem"
 993                         echo "Created new mob user key"
 994                 fi
 995                 if ! [ -e "$cfg_certsdir/girocco_mob_user_crt.pem" ]; then
 996                         openssl rsa -in "$cfg_mobuserkey" -pubout |
 997                         "$basedir/bin/CACreateCert" --client --key "$cfg_clientkey" \
 998                                 --cert "$cfg_clientcert" \
 999                                 --out "$cfg_certsdir/girocco_mob_user_crt.pem" 'mob'
1000                         echo "Created mob user client certificate"
1001                 fi
1002                 cat "$cfg_mobuserkey" >"$webroot/${cfg_nickname}_mob_key.pem"
1003                 cat "$cfg_mobusercert" "$cfg_clientcertsuffix" >"$webroot/${cfg_nickname}_mob_user.pem"
1004         else
1005                 rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1006         fi
1007 else
1008         rm -f "$webroot/${cfg_nickname}_root_cert.pem"
1009         rm -f "$webroot/${cfg_nickname}_mob_key.pem" "$webroot/${cfg_nickname}_mob_user.pem"
1010 fi
1011
1012
1013 echo "*** Finalizing permissions and moving into place..."
1014 chown -R -h "$cfg_mirror_user""$owngroup" "$basedir" "$webroot" "$cgiroot"
1015 [ -z "$cfg_httpspushurl" ] || chown -R -h "$cfg_mirror_user""$owngroup" "$cfg_certsdir"
1016
1017 # This should always be the very last thing install.sh does
1018 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1019 quick_move "$basedir" "$rbasedir" "$rbasedir-old"
1020 [ -n "$webrootsub" ] || quick_move "$webroot" "$rwebroot" "$rwebroot-old"
1021 [ -n "$cgirootsub" ] || quick_move "$cgiroot" "$rcgiroot" "$rcgiroot-old"
1022 rm -rf "$rbasedir-old" "$rwebroot-old" "$rcgiroot-old"
1023 echo "--- Update hooks and config with $cfg_basedir/toolbox/update-all-projects.sh"
1024 ! [ -S "$cfg_chroot/etc/taskd.socket" ] || {
1025         echo "*** Requesting graceful restart of running taskd (and, if running, jobd)..."
1026         touch "$cfg_chroot/etc/taskd.restart"
1027         chown_make "$cfg_chroot/etc/taskd.restart"
1028         trap ':' PIPE
1029         echo "nop" | nc_openbsd -w 5 -U "$cfg_chroot/etc/taskd.socket" || :
1030         trap - PIPE
1031 }