883N/A

290N/A

849N/A

290N/A

2698N/AREPO_PATH_DEFAULT = "/var/pkg/repo"

290N/ACONTENT_PATH_DEFAULT = "/usr/share/lib/pkg"

290N/AMAX_REQUEST_BODY_SIZE = 128 * 1024 * 1024

2339N/APORT_DEFAULT = 80

2535N/ASSL_PORT_DEFAULT = 443

290N/ATHREADS_MIN = 1

2535N/ATHREADS_DEFAULT = 10

290N/ATHREADS_MAX = 100

1660N/ASOCKET_TIMEOUT_DEFAULT = 60

1660N/AREADONLY_DEFAULT = False

1660N/AREBUILD_DEFAULT = False

1660N/AREINDEX_DEFAULT = False

1660N/AMIRROR_DEFAULT = False

1660N/A

1660N/Aimport getopt

1660N/Aimport gettext

1660N/Aimport locale

1660N/Aimport logging

1660N/Aimport os

1660N/Aimport os.path

1660N/Aimport OpenSSL.crypto as crypto

1660N/Aimport subprocess

448N/Aimport sys

448N/Aimport tempfile

2828N/Aimport urlparse

2828N/A

2828N/Atry:

534N/A import cherrypy

534N/A version = cherrypy.__version__.split('.')

534N/A if map(int, version) < [3, 1, 0]:

534N/A raise ImportError

534N/A elif map(int, version) >= [3, 2, 0]:

534N/A raise ImportError

534N/Aexcept ImportError:

290N/A print >> sys.stderr, """cherrypy 3.1.0 or greater (but less than """ \

290N/A """3.2.0) is required to use this program."""

954N/A sys.exit(2)

954N/A

954N/Afrom pkg.misc import port_available, msg, emsg, setlocale

954N/Aimport pkg.client.api_errors as api_errors

534N/Aimport pkg.portable.util as os_util

1099N/Aimport pkg.search_errors as search_errors

290N/Aimport pkg.server.depot as ds

3117N/Aimport pkg.server.depotresponse as dr

3117N/Aimport pkg.server.repository as sr

3117N/Aimport pkg.server.repositoryconfig as rc

3117N/A

290N/A

290N/Aclass LogSink(object):

290N/A """This is a dummy object that we can use to discard log entries

2867N/A

290N/A def write(self, *args, **kwargs):

2494N/A """Discard the bits."""

2494N/A pass

2494N/A

2516N/A def flush(self, *args, **kwargs):

2516N/A """Discard the bits."""

2516N/A pass

2516N/A

2516N/A

2516N/Adef usage(text):

2516N/A if text:

290N/A emsg(text)

2523N/A

3138N/A print """\

395N/A sys.exit(2)

395N/A

290N/Aclass OptionError(Exception):

290N/A """Option exception. """

395N/A

395N/A def __init__(self, *args):

1231N/A Exception.__init__(self, *args)

1557N/A

1903N/Aif __name__ == "__main__":

1557N/A

395N/A setlocale(locale.LC_ALL, "")

395N/A gettext.install("pkg", "/usr/share/locale")

395N/A

395N/A debug_features = {

395N/A "headers": False,

395N/A }

395N/A disable_ops = {}

395N/A port = PORT_DEFAULT

395N/A port_provided = False

395N/A threads = THREADS_DEFAULT

395N/A socket_timeout = SOCKET_TIMEOUT_DEFAULT

290N/A readonly = READONLY_DEFAULT

290N/A rebuild = REBUILD_DEFAULT

430N/A reindex = REINDEX_DEFAULT

395N/A proxy_base = None

395N/A mirror = MIRROR_DEFAULT

395N/A nasty = False

395N/A nasty_value = 0

1302N/A repo_config_file = None

395N/A ssl_cert_file = None

395N/A ssl_key_file = None

290N/A ssl_dialog = "builtin"

3139N/A writable_root = None

3139N/A

395N/A if "PKG_REPO" in os.environ:

3139N/A repo_path = os.environ["PKG_REPO"]

3139N/A else:

3139N/A repo_path = REPO_PATH_DEFAULT

3139N/A

3139N/A try:

3139N/A content_root = os.environ["PKG_DEPOT_CONTENT"]

3139N/A except KeyError:

3139N/A try:

3139N/A content_root = os.path.join(os.environ['PKG_HOME'],

3139N/A 'share/lib/pkg')

3139N/A except KeyError:

3139N/A content_root = CONTENT_PATH_DEFAULT

3139N/A

3139N/A # By default, if the destination for a particular log type is not

3139N/A # specified, this is where we will send the output.

3139N/A log_routes = {

395N/A "access": "none",

3139N/A "errors": "stderr"

3139N/A }

3139N/A log_opts = ["--log-%s" % log_type for log_type in log_routes]

3139N/A

3139N/A # If stdout is a tty, then send access output there by default instead

3139N/A # of discarding it.

3139N/A if os.isatty(sys.stdout.fileno()):

395N/A log_routes["access"] = "stdout"

3139N/A

3139N/A opt = None

3139N/A repo_props = {}

3139N/A try:

3139N/A long_opts = ["cfg-file=", "content-root=", "debug=",

2516N/A "disable-ops=", "mirror", "nasty=", "set-property=",

2516N/A "proxy-base=", "readonly", "rebuild", "refresh-index",

3139N/A "ssl-cert-file=", "ssl-dialog=", "ssl-key-file=",

3139N/A "writable-root="]

3139N/A for opt in log_opts:

3139N/A long_opts.append("%s=" % opt.lstrip('--'))

3139N/A opts, pargs = getopt.getopt(sys.argv[1:], "d:np:s:t:",

3139N/A long_opts)

3139N/A for opt, arg in opts:

3139N/A if opt == "-n":

3139N/A sys.exit(0)

3139N/A elif opt == "-d":

3139N/A repo_path = arg

3139N/A elif opt == "-p":

3139N/A port = int(arg)

3139N/A port_provided = True

3139N/A elif opt == "-s":

2516N/A threads = int(arg)

3139N/A if threads < THREADS_MIN:

3139N/A raise OptionError, \

3139N/A "minimum value is %d" % THREADS_MIN

3139N/A if threads > THREADS_MAX:

3139N/A raise OptionError, \

3139N/A "maximum value is %d" % THREADS_MAX

2516N/A elif opt == "-t":

3139N/A socket_timeout = int(arg)

3139N/A elif opt == "--cfg-file":

3139N/A repo_config_file = os.path.abspath(arg)

3139N/A elif opt == "--content-root":

3139N/A if arg == "":

2516N/A raise OptionError, "You must specify " \

2516N/A "a directory path."

3139N/A content_root = arg

3139N/A elif opt == "--debug":

3139N/A if arg is None or arg == "":

3139N/A raise OptionError, \

3139N/A "A debug feature must be specified."

3139N/A

3139N/A # A list of features can be specified using a

3139N/A # "," or any whitespace character as separators.

3139N/A if "," in arg:

3139N/A features = arg.split(",")

3139N/A else:

3139N/A features = arg.split()

3139N/A

3139N/A for f in features:

3139N/A if f not in debug_features:

2516N/A raise OptionError, \

3139N/A "Invalid debug feature: " \

3139N/A "%s." % f

3139N/A debug_features[f] = True

3139N/A elif opt == "--disable-ops":

3139N/A if arg is None or arg == "":

3139N/A raise OptionError, \

2516N/A "An argument must be specified."

3139N/A

3139N/A disableops = arg.split(",")

3139N/A for s in disableops:

3139N/A if "/" in s:

3139N/A op, ver = s.rsplit("/", 1)

2516N/A else:

395N/A op = s

395N/A ver = "*"

395N/A

395N/A if op not in \

395N/A ds.DepotHTTP.REPO_OPS_DEFAULT:

2339N/A raise OptionError(

1191N/A "Invalid operation "

1452N/A "'%s'." % s)

1231N/A

2046N/A disable_ops.setdefault(op, [])

395N/A disable_ops[op].append(ver)

395N/A elif opt in log_opts:

424N/A if arg is None or arg == "":

395N/A raise OptionError, \

742N/A "You must specify a log " \

2339N/A "destination."

2339N/A log_routes[opt.lstrip("--log-")] = arg

2693N/A elif opt == "--mirror":

2690N/A mirror = True

2339N/A elif opt == "--nasty":

3094N/A value_err = None

2339N/A try:

2690N/A nasty_value = int(arg)

2690N/A except ValueError, e:

2693N/A value_err = e

2693N/A

2690N/A if value_err or (nasty_value > 100 or

2690N/A nasty_value < 1):

2339N/A raise OptionError, "Invalid value " \

2339N/A "for nasty option.\n Please " \

742N/A "choose a value between 1 and 100."

742N/A nasty = True

742N/A elif opt == "--set-property":

742N/A try:

742N/A prop, p_value = arg.split("=", 1)

742N/A p_sec, p_name = prop.split(".", 1)

742N/A except ValueError:

742N/A usage(_("property arguments must be of "

742N/A "the form '<section.property>="

3136N/A "<value>'."))

2688N/A repo_props.setdefault(p_sec, {})

2688N/A repo_props[p_sec][p_name] = p_value

2688N/A elif opt == "--proxy-base":

2688N/A # Attempt to decompose the url provided into

2688N/A # its base parts. This is done so we can

2688N/A # remove any scheme information since we

2688N/A # don't need it.

2688N/A scheme, netloc, path, params, query, \

2688N/A fragment = urlparse.urlparse(arg,

742N/A "http", allow_fragments=0)

2310N/A

2852N/A if not netloc:

1902N/A raise OptionError, "Unable to " \

2867N/A "determine the hostname from " \

2867N/A "the provided URL; please use a " \

1099N/A "fully qualified URL."

2867N/A

2338N/A scheme = scheme.lower()

2338N/A if scheme not in ("http", "https"):

2310N/A raise OptionError, "Invalid URL; http " \

2046N/A "and https are the only supported " \

2223N/A "schemes."

2046N/A

2046N/A # Rebuild the url with the sanitized components.

2523N/A proxy_base = urlparse.urlunparse((scheme,

2523N/A netloc, path, params, query, fragment))

2523N/A elif opt == "--readonly":

2523N/A readonly = True

2523N/A elif opt == "--rebuild":

2523N/A rebuild = True

2310N/A elif opt == "--refresh-index":

2677N/A # Note: This argument is for internal use

2310N/A # only. It's used when pkg.depotd is reexecing

2310N/A # itself and needs to know that's the case.

2310N/A # This flag is purposefully omitted in usage.

2310N/A # The supported way to forcefully reindex is to

2310N/A # kill any pkg.depot using that directory,

2310N/A # remove the index directory, and restart the

2858N/A # pkg.depot process. The index will be rebuilt

2310N/A # automatically on startup.

2852N/A reindex = True

2852N/A elif opt == "--ssl-cert-file":

2852N/A if arg == "none":

2852N/A continue

3136N/A

2852N/A ssl_cert_file = arg

2852N/A if not os.path.isabs(ssl_cert_file):

2852N/A raise OptionError, "The path to " \

2852N/A "the Certificate file must be " \

2858N/A "absolute."

2852N/A elif not os.path.exists(ssl_cert_file):

3138N/A raise OptionError, "The specified " \

3138N/A "file does not exist."

2852N/A elif not os.path.isfile(ssl_cert_file):

2852N/A raise OptionError, "The specified " \

2852N/A "pathname is not a file."

2508N/A elif opt == "--ssl-key-file":

2508N/A if arg == "none":

2508N/A continue

2508N/A

2867N/A ssl_key_file = arg

2535N/A if not os.path.isabs(ssl_key_file):

2535N/A raise OptionError, "The path to " \

2535N/A "the Private Key file must be " \

3053N/A "absolute."

3053N/A elif not os.path.exists(ssl_key_file):

3053N/A raise OptionError, "The specified " \

3026N/A "file does not exist."

3026N/A elif not os.path.isfile(ssl_key_file):

3026N/A raise OptionError, "The specified " \

2339N/A "pathname is not a file."

2339N/A elif opt == "--ssl-dialog":

2339N/A if arg != "builtin" and not \

691N/A arg.startswith("exec:/") and not \

691N/A arg.startswith("smf:"):

691N/A raise OptionError, "Invalid value " \

395N/A "specified. Expected: builtin, " \

395N/A "exec:/path/to/program, or " \

395N/A "smf:fmri."

395N/A

395N/A f = arg

290N/A if f.startswith("exec:"):

395N/A if os_util.get_canonical_os_type() != \

395N/A "unix":

591N/A # Don't allow a somewhat

591N/A # insecure authentication method

591N/A # on some platforms.

2639N/A raise OptionError, "exec is " \

2639N/A "not a supported dialog " \

2639N/A "type for this operating " \

2639N/A "system."

2639N/A

2639N/A f = os.path.abspath(f.split(

1505N/A "exec:")[1])

2516N/A

1505N/A if not os.path.isfile(f):

1505N/A raise OptionError, "Invalid " \

1632N/A "file path specified for " \

1632N/A "exec."

1632N/A

1632N/A f = "exec:%s" % f

2339N/A

2339N/A ssl_dialog = f

2339N/A elif opt == "--writable-root":

2339N/A if arg == "":

2339N/A raise OptionError, "You must specify " \

2339N/A "a directory path."

2339N/A writable_root = arg

2339N/A except getopt.GetoptError, _e:

2339N/A usage("pkg.depotd: %s" % _e.msg)

2339N/A except OptionError, _e:

2339N/A usage("pkg.depotd: option: %s -- %s" % (opt, _e))

2339N/A except (ArithmeticError, ValueError):

2339N/A usage("pkg.depotd: illegal option value: %s specified " \

2339N/A "for option: %s" % (arg, opt))

2339N/A

2339N/A if rebuild and reindex:

2364N/A usage("--refresh-index cannot be used with --rebuild")

2828N/A if rebuild and (readonly or mirror):

2828N/A usage("--readonly and --mirror cannot be used with --rebuild")

2828N/A if reindex and mirror:

2828N/A usage("--mirror cannot be used with --refresh-index")

2828N/A if reindex and readonly and not writable_root:

2828N/A usage("--readonly can only be used with --refresh-index if "

2828N/A "--writable-root is used")

2828N/A

2828N/A if (ssl_cert_file and not ssl_key_file) or (ssl_key_file and not

2828N/A ssl_cert_file):

2828N/A usage("The --ssl-cert-file and --ssl-key-file options must "

2828N/A "must both be provided when using either option.")

2828N/A elif ssl_cert_file and ssl_key_file and not port_provided:

2828N/A # If they didn't already specify a particular port, use the

2828N/A # default SSL port instead.

2828N/A port = SSL_PORT_DEFAULT

2828N/A

2828N/A # If the program is going to reindex, the port is irrelevant since

2828N/A # the program will not bind to a port.

2828N/A if not reindex:

2828N/A available, msg = port_available(None, port)

2828N/A if not available:

2828N/A print "pkg.depotd: unable to bind to the specified " \

2828N/A "port: %d. Reason: %s" % (port, msg)

2828N/A sys.exit(1)

2828N/A else:

2828N/A # Not applicable for reindexing operations.

2828N/A content_root = None

2892N/A

2892N/A key_data = None

2828N/A if not reindex and ssl_cert_file and ssl_key_file and \

2828N/A ssl_dialog != "builtin":

2828N/A cmdline = None

2828N/A def get_ssl_passphrase(*ignored):

2828N/A p = None

2828N/A try:

2828N/A p = subprocess.Popen(cmdline, shell=True,

2828N/A stdout=subprocess.PIPE,

2828N/A stderr=None)

2828N/A p.wait()

2828N/A except Exception, __e:

2828N/A print "pkg.depotd: an error occurred while " \

2339N/A "executing [%s]; unable to obtain the " \

2339N/A "passphrase needed to decrypt the SSL" \

2339N/A "private key file: %s" % (cmdline, __e)

2339N/A sys.exit(1)

2339N/A return p.stdout.read().strip("\n")

2339N/A

2339N/A if ssl_dialog.startswith("exec:"):

2339N/A cmdline = "%s %s %d" % (ssl_dialog.split("exec:")[1],

2339N/A "''", port)

2339N/A elif ssl_dialog.startswith("smf:"):

2339N/A cmdline = "/usr/bin/svcprop -p " \

2339N/A "pkg_secure/ssl_key_passphrase %s" % (

2339N/A ssl_dialog.split("smf:")[1])

2339N/A

2339N/A # The key file requires decryption, but the user has requested

2339N/A # exec-based authentication, so it will have to be decoded first

2339N/A # to an un-named temporary file.

2339N/A try:

2339N/A key_file = file(ssl_key_file, "rb")

2339N/A pkey = crypto.load_privatekey(crypto.FILETYPE_PEM,

2364N/A key_file.read(), get_ssl_passphrase)

2364N/A

2364N/A key_data = tempfile.TemporaryFile()

2364N/A key_data.write(crypto.dump_privatekey(

2364N/A crypto.FILETYPE_PEM, pkey))

2364N/A key_data.seek(0)

2364N/A except EnvironmentError, _e:

2364N/A print "pkg.depotd: unable to read the SSL private " \

2364N/A "key file: %s" % _e

2364N/A sys.exit(1)

2364N/A except crypto.Error, _e:

2364N/A print "pkg.depotd: authentication or cryptography " \

2364N/A "failure while attempting to decode\nthe SSL " \

2339N/A "private key file: %s" % _e

395N/A sys.exit(1)

395N/A else:

290N/A # Redirect the server to the decrypted key file.

290N/A ssl_key_file = "/dev/fd/%d" % key_data.fileno()

2339N/A

2339N/A # Setup our global configuration.

290N/A gconf = {

290N/A "checker.on": True,

290N/A "environment": "production",

290N/A "log.screen": False,

290N/A "server.max_request_body_size": MAX_REQUEST_BODY_SIZE,

290N/A "server.shutdown_timeout": 0,

290N/A "server.socket_host": "0.0.0.0",

290N/A "server.socket_port": port,

290N/A "server.socket_timeout": socket_timeout,

290N/A "server.ssl_certificate": ssl_cert_file,

395N/A "server.ssl_private_key": ssl_key_file,

395N/A "server.thread_pool": threads,

290N/A "tools.log_headers.on": True,

290N/A "tools.encode.on": True

2674N/A }

2674N/A

2674N/A if debug_features["headers"]:

2674N/A # Despite its name, this only logs headers when there is an

290N/A # error; it's redundant with the debug feature enabled.

2674N/A gconf["tools.log_headers.on"] = False

2674N/A

395N/A # Causes the headers of every request to be logged to the error

395N/A # log; even if an exception occurs.

395N/A gconf["tools.log_headers_always.on"] = True

2674N/A cherrypy.tools.log_headers_always = cherrypy.Tool(

395N/A "on_start_resource",

395N/A cherrypy.lib.cptools.log_request_headers)

395N/A

395N/A log_type_map = {

2674N/A "errors": {

591N/A "param": "log.error_file",

591N/A "attr": "error_log"

591N/A },

2674N/A "access": {

2639N/A "param": "log.access_file",

2639N/A "attr": "access_log"

2639N/A }

2674N/A }

2639N/A

2639N/A for log_type in log_type_map:

2639N/A dest = log_routes[log_type]

2674N/A if dest in ("stdout", "stderr", "none"):

2674N/A if dest == "none":

691N/A h = logging.StreamHandler(LogSink())

691N/A else:

691N/A h = logging.StreamHandler(eval("sys.%s" % \

2674N/A dest))

2674N/A

2339N/A h.setLevel(logging.DEBUG)

2339N/A h.setFormatter(cherrypy._cplogging.logfmt)

2339N/A log_obj = eval("cherrypy.log.%s" % \

3026N/A log_type_map[log_type]["attr"])

3026N/A log_obj.addHandler(h)

3026N/A # Since we've replaced cherrypy's log handler with our

3026N/A # own, we don't want the output directed to a file.

3026N/A dest = ""

3026N/A gconf[log_type_map[log_type]["param"]] = dest

3053N/A

3053N/A cherrypy.config.update(gconf)

3053N/A

3053N/A # Now that our logging, etc. has been setup, it's safe to perform any

3053N/A # remaining preparation.

3053N/A

290N/A # Initialize repository state.

290N/A fork_allowed = not reindex

290N/A try:

290N/A repo = sr.Repository(auto_create=not readonly,

290N/A cfgpathname=repo_config_file, fork_allowed=fork_allowed,

591N/A log_obj=cherrypy, mirror=mirror, properties=repo_props,

591N/A read_only=readonly, repo_root=repo_path,

2639N/A writable_root=writable_root)

2639N/A except sr.RepositoryError, _e:

2639N/A emsg("pkg.depotd: %s" % _e)

2639N/A sys.exit(1)

691N/A except rc.RequiredPropertyValueError, _e:

691N/A emsg("pkg.depotd: repository configuration error: %s" % _e)

2339N/A emsg("Please use the --set-property option to provide a value, "

2339N/A "or update the cfg_cache file for the repository to "

3026N/A "correct this.")

3026N/A sys.exit(1)

3053N/A except rc.PropertyError, _e:

3053N/A emsg("pkg.depotd: repository configuration error: %s" % _e)

290N/A sys.exit(1)

290N/A except (search_errors.IndexingException,

2339N/A api_errors.PermissionsException), _e:

2339N/A emsg(str(_e), "INDEX")

2339N/A sys.exit(1)

2339N/A

2339N/A if reindex:

2339N/A # Initializing the repository above updated search indices

2339N/A # as needed; nothing left to do, so exit.

290N/A sys.exit(0)

2339N/A

2339N/A if nasty:

290N/A repo.cfg.set_nasty(nasty_value)

2339N/A

2339N/A if rebuild:

2339N/A try:

2339N/A repo.rebuild()

2339N/A except sr.RepositoryError, e:

2339N/A emsg(str(e), "REBUILD")

2339N/A sys.exit(1)

2339N/A except (search_errors.IndexingException,

290N/A api_errors.PermissionsException), e:

395N/A emsg(str(e), "INDEX")

290N/A sys.exit(1)

395N/A

506N/A # Next, initialize depot.

506N/A if nasty:

506N/A depot = ds.NastyDepotHTTP(repo, content_root,

506N/A disable_ops=disable_ops)

506N/A else:

506N/A depot = ds.DepotHTTP(repo, content_root,

506N/A disable_ops=disable_ops)

506N/A

834N/A # Now build our site configuration.

506N/A conf = {

506N/A "/": {

506N/A # We have to override cherrypy's default response_class so that

513N/A # we have access to the write() callable to stream data

506N/A # directly to the client.

506N/A "wsgi.response_class": dr.DepotResponse,

506N/A },

506N/A "/robots.txt": {

290N/A "tools.staticfile.on": True,

290N/A "tools.staticfile.filename": os.path.join(depot.web_root,

2535N/A "robots.txt")

2535N/A },

2535N/A }

395N/A

413N/A if proxy_base:

395N/A # This changes the base URL for our server, and is primarily

290N/A # intended to allow our depot process to operate behind Apache

1674N/A # or some other webserver process.

1674N/A #

1674N/A # Visit the following URL for more information:

1674N/A # http://cherrypy.org/wiki/BuiltinTools#tools.proxy

1674N/A proxy_conf = {

1674N/A "tools.proxy.on": True,

1674N/A "tools.proxy.local": "",

1674N/A "tools.proxy.base": proxy_base

1674N/A }

1674N/A

1674N/A # Now merge or add our proxy configuration information into the

1674N/A # existing configuration.

1674N/A for entry in proxy_conf:

1674N/A conf["/"][entry] = proxy_conf[entry]

1674N/A

3117N/A try:

3117N/A root = cherrypy.Application(depot)

3117N/A cherrypy.quickstart(root, config=conf)

395N/A except Exception, _e:

395N/A emsg("pkg.depotd: unknown error starting depot server, " \

506N/A "illegal option value specified?")

506N/A emsg(_e)

395N/A sys.exit(1)

2535N/A