depot.py revision 2028
20N/A# The contents of this file are subject to the terms of the 20N/A# Common Development and Distribution License (the "License"). 20N/A# You may not use this file except in compliance with the License. 20N/A# See the License for the specific language governing permissions 20N/A# and limitations under the License. 20N/A# When distributing Covered Code, include this CDDL HEADER in each 20N/A# If applicable, add the following below this CDDL HEADER, with the 20N/A# fields enclosed by brackets "[]" replaced with your own identifying 20N/A# information: Portions Copyright [yyyy] [name of copyright owner] 2951N/A# Copyright (c) 2007, 2010 Oracle and/or its affiliates. All rights reserved. 22N/A# pkg.depotd - package repository daemon 50N/A# XXX The prototype pkg.depotd combines both the version management server that 50N/A# answers to pkgsend(1) sessions and the HTTP file server that answers to the 50N/A# various GET operations that a pkg(1) client makes. This split is expected to 50N/A# be made more explicit, by constraining the pkg(1) operations such that they 50N/A# can be served as a typical HTTP/HTTPS session. Thus, pkg.depotd will reduce 50N/A# to a special purpose HTTP/HTTPS server explicitly for the version management 50N/A# operations, and must manipulate the various state files--catalogs, in 50N/A# particular--such that the pkg(1) pull client can operately accurately with 50N/A# XXX Although we pushed the evaluation of next-version, etc. to the pull 50N/A# client, we should probably provide a query API to do same on the server, for 50N/A# dumb clients (like a notification service). 589N/A# The default path for static and other web content. 965N/A# cherrypy has a max_request_body_size parameter that determines whether the 965N/A# server should abort requests with REQUEST_ENTITY_TOO_LARGE when the request 965N/A# body is larger than the specified size (in bytes). The maximum size supported 965N/A# by cherrypy is 2048 * 1024 * 1024 - 1 (just short of 2048MB), but the default 965N/A# here is purposefully conservative. 382N/A# The minimum number of threads allowed. 382N/A# The default number of threads to start. 382N/A# The maximum number of threads that can be started. 382N/A# The default server socket timeout in seconds. We want this to be longer than 382N/A# the normal default of 10 seconds to accommodate clients with poor quality 751N/A print >>
sys.
stderr,
"""cherrypy 3.1.0 or greater (but less than """ \
751N/A """3.2.0) is required to use this program.""" 1431N/A """This is a dummy object that we can use to discard log entries 466N/A without relying on non-portable interfaces such as /dev/null.""" 466N/A """Discard the bits.""" 466N/A """Discard the bits.""" 466N/A """Optionally emit a usage message and then exit using the specified 466N/A # The full usage message isn't desired. 466N/A emsg(_(
"Try `pkg.depotd --help or -?' for more " 1633N/A [-t socket_timeout] [--cfg] [--content-root] 1633N/A [--disable-ops op[/1][,...]] [--debug feature_list] 26N/A [--file-root dir] [--log-access dest] [--log-errors dest] 2230N/A [--mirror] [--nasty] [--proxy-base url] [--readonly] 1968N/A [--socket-path] [--ssl-cert-file] [--ssl-dialog] [--ssl-key-file] 1633N/A [--sort-file-max-size size] [--writable-root dir] 2816N/A -d inst_root The file system path at which the server should find its 2816N/A repository data. Required unless PKG_REPO has been set 382N/A -p port The port number on which the instance should listen for 2230N/A incoming package requests. The default value is 80 if 2230N/A ssl certificate and key information has not been 2230N/A provided; otherwise, the default value is 443. 2230N/A -s threads The number of threads that will be started to serve 2028N/A requests. The default value is 10. 1968N/A -t timeout The maximum number of seconds the server should wait for 1968N/A a response from a client before closing a connection. 1968N/A --cfg The pathname of the file to use when reading and writing 1968N/A depot configuration data, or a fully qualified service 1968N/A fault management resource identifier (FMRI) of the SMF 2028N/A service or instance to read configuration data from. 2028N/A --content-root The file system path to the directory containing the 2028N/A the static and other web content used by the depot's 1968N/A browser user interface. The default value is 1968N/A --disable-ops A comma separated list of operations that the depot 1968N/A should not configure. If, for example, you wanted 1968N/A to omit loading search v1, 'search/1' should be 1968N/A provided as an argument, or to disable all search 589N/A operations, simply 'search'. 589N/A --debug The name of a debug feature to enable; or a whitespace 589N/A or comma separated list of features to enable. 589N/A Possible values are: headers. 1431N/A --file-root The path to the root of the file content for a given 1431N/A repository. This is used to override the default, 1431N/A <inst_root>/file or <inst_root>/publisher/<prefix>/file. 1431N/A --log-access The destination for any access related information 1431N/A logged by the depot process. Possible values are: 858N/A stderr, stdout, none, or an absolute pathname. The 1633N/A default value is stdout if stdout is a tty; otherwise 2962N/A --log-errors The destination for any errors or other information 2515N/A logged by the depot process. Possible values are: 2515N/A stderr, stdout, none, or an absolute pathname. The 466N/A default value is stderr. 466N/A --mirror Package mirror mode; publishing and metadata operations 466N/A disallowed. Cannot be used with --readonly or 466N/A --nasty Instruct the server to misbehave. At random intervals 466N/A it will time-out, send bad responses, hang up on 466N/A clients, and generally be hostile. The option 466N/A takes a value (1 to 100) for how nasty the server 589N/A --proxy-base The url to use as the base for generating internal 589N/A --readonly Read-only operation; modifying operations disallowed. 1191N/A Cannot be used with --mirror or --rebuild. 1191N/A --ssl-cert-file The absolute pathname to a PEM-encoded Certificate file. 1191N/A This option must be used with --ssl-key-file. Usage of 1191N/A this option will cause the depot to only respond to SSL 1191N/A requests on the provided port. 2816N/A --ssl-dialog Specifies what method should be used to obtain the 2816N/A passphrase needed to decrypt the file specified by 589N/A --ssl-key-file. Supported values are: builtin, 589N/A default value is builtin. If smf is specified, an 589N/A SMF FMRI must be provided using the --cfg option. 812N/A --ssl-key-file The absolute pathname to a PEM-encoded Private Key file. 812N/A This option must be used with --ssl-cert-file. Usage of 812N/A this option will cause the depot to only respond to SSL 812N/A requests on the provided port. 812N/A The maximum size of the indexer sort file. Used to 812N/A limit the amount of RAM the depot uses for indexing, 1968N/A --writable-root The path to a directory to which the program has write 1968N/A access. Used with --readonly to allow server to 812N/A create needed files, such as search indices, without 812N/A needing write access to the package information. 1475N/A PKG_REPO Used as default inst_root if -d not provided. 1475N/A PKG_DEPOT_CONTENT Used as default content_root if --content-root 2728N/A # Track initial configuration values. 466N/A "content-root=",
"debug=",
"disable-ops=",
"exit-ready",
2230N/A "file-root=",
"help",
"log-access=",
"log-errors=",
1968N/A "llmirror",
"mirror",
"nasty=",
"proxy-base=",
"readonly",
1968N/A "rebuild",
"refresh-index",
"set-property=",
"socket-path=",
1431N/A "ssl-cert-file=",
"ssl-dialog=",
"ssl-key-file=",
1968N/A "sort-file-max-size=",
"writable-root="]
1542N/A # A list of features can be specified using a 1968N/A # "," or any whitespace character as separators. 858N/A "An argument must be specified." 1968N/A "for nasty option.\n Please " \
1968N/A "choose a value between 1 and 100." 1633N/A # Attempt to decompose the url provided into 589N/A # its base parts. This is done so we can 1968N/A # remove any scheme information since we 2816N/A "determine the hostname from " \
1191N/A "the provided URL; please use a " \
2816N/A "and https are the only supported " \
589N/A # Rebuild the url with the sanitized components. 765N/A # Note: This argument is for internal use 765N/A # This flag is purposefully omitted in usage. 765N/A # The supported way to forcefully reindex is to 589N/A # kill any pkg.depot using that directory, 765N/A # remove the index directory, and restart the 765N/A # pkg.depot process. The index will be rebuilt 765N/A # automatically on startup. 1968N/A "the form '<section.property>=" 429N/A # Assume this is an override to clear 429N/A "the Certificate file must be " \
1968N/A # Assume this is an override to clear 1968N/A "the Private Key file must be " \
812N/A "pathname is not a file." 1968N/A "specified. Expected: builtin, " \
812N/A # Don't allow a somewhat 812N/A # insecure authentication method 812N/A "not a supported dialog " \
1968N/A "type for this operating " \
812N/A "file path specified for " \
873N/A # Set accumulated values. 812N/A # Build configuration object. 1968N/A usage(
"pkg.depotd: illegal option value: %s specified " \
2230N/A # If stdout is a tty, then send access output there by default instead 873N/A # Check for invalid option combinations. 873N/A usage(
"--add-content cannot be used with --rebuild")
466N/A usage(
"--refresh-index cannot be used with --rebuild")
451N/A usage(
"--readonly and --mirror cannot be used with --rebuild " 1633N/A usage(
"--mirror cannot be used with --refresh-index")
1968N/A usage(
"--readonly can only be used with --refresh-index if " 1968N/A # Set any values using defaults if they weren't provided. 1968N/A usage(
"At least one of PKG_REPO, -d, or --file-root" 466N/A usage(
"The --ssl-cert-file and --ssl-key-file options must " 1542N/A "must both be provided when using either option.")
451N/A # If the program is going to reindex, the port is irrelevant since 1968N/A # the program will not bind to a port. 2230N/A emsg(
"pkg.depotd: unable to bind to the specified " 2230N/A # Not applicable if we're not going to serve content 2515N/A # Any relative paths should be made absolute using pkg_root. 'pkg_root' 1902N/A # is a special property that was added to enable internal deployment of 1968N/A # multiple disparate versions of the pkg.depotd software. 429N/A # Setup SSL if requested. 1968N/A "executing [%s]; unable to obtain the " 1968N/A "passphrase needed to decrypt the SSL " 1968N/A # Assume the configuration target was an SMF 1968N/A # FMRI and let svcprop fail with an error if 1968N/A # The key file requires decryption, but the user has requested 1968N/A # exec-based authentication, so it will have to be decoded first 1968N/A # to an un-named temporary file. 812N/A emsg(
"pkg.depotd: unable to read the SSL private key " 873N/A emsg(
"pkg.depotd: authentication or cryptography " 1836N/A "failure while attempting to decode\nthe SSL " 812N/A # Redirect the server to the decrypted key file. 1968N/A # Setup our global configuration. 1968N/A "environment":
"production",
1968N/A "server.shutdown_timeout":
0,
1968N/A # Despite its name, this only logs headers when there is an 1968N/A # error; it's redundant with the debug feature enabled. 812N/A # Causes the headers of every request to be logged to the error 812N/A # log; even if an exception occurs. 873N/A "param":
"log.error_file",
812N/A "param":
"log.access_file",
858N/A # Since we've replaced cherrypy's log handler with our 466N/A # own, we don't want the output directed to a file. 858N/A # Now that our logging, etc. has been setup, it's safe to perform any 858N/A # remaining preparation. 858N/A # Initialize repository state. 2992N/A # Not readonly, so assume a new repository should be created. 2992N/A # Already exists, nothing to do. 466N/A # Automatically update search indexes on startup if not already 2028N/A # Ready to start depot; exit now if requested. 1968N/A # Now build our site configuration. 2515N/A # We have to override cherrypy's default response_class so that 2515N/A # we have access to the write() callable to stream data 2028N/A # This changes the base URL for our server, and is primarily 2028N/A # intended to allow our depot process to operate behind Apache 2028N/A # or some other webserver process. 2028N/A # Visit the following URL for more information: 2028N/A # Now merge or add our proxy configuration information into the 1779N/A emsg(
"pkg.depotd: unknown error starting depot server, " \
1431N/A "illegal option value specified?")