20N/A

0N/A

50N/A

50N/A

50N/A

382N/AAUTH_DEFAULT = "opensolaris.org"

382N/AREPO_PATH_DEFAULT = "/var/pkg/repo"

589N/ACONTENT_PATH_DEFAULT = "/usr/share/lib/pkg"

965N/APORT_DEFAULT = 80

965N/ASSL_PORT_DEFAULT = 443

965N/ATHREADS_MIN = 1

812N/ATHREADS_DEFAULT = 10

812N/ATHREADS_MAX = 100

382N/ASOCKET_TIMEOUT_DEFAULT = 60

382N/AREADONLY_DEFAULT = False

382N/AREBUILD_DEFAULT = False

382N/AREINDEX_DEFAULT = False

382N/AMIRROR_DEFAULT = False

382N/A

382N/Aimport getopt

429N/Aimport gettext

429N/Aimport locale

461N/Aimport logging

461N/Aimport os

382N/Aimport os.path

26N/Aimport OpenSSL.crypto as crypto

689N/Aimport OpenSSL.SSL as ssl

689N/Aimport pkg.portable.util as os_util

466N/Aimport subprocess

0N/Aimport sys

468N/Aimport tempfile

812N/Aimport urlparse

812N/A

52N/Atry:

812N/A import cherrypy

451N/A version = cherrypy.__version__.split('.')

0N/A if map(int, version) < [3, 1, 0]:

382N/A raise ImportError

382N/A elif map(int, version) >= [3, 2, 0]:

382N/A raise ImportError

452N/Aexcept ImportError:

382N/A print >> sys.stderr, """cherrypy 3.1.0 or greater (but less than """ \

452N/A """3.2.0) is required to use this program."""

382N/A sys.exit(2)

382N/A

751N/Afrom pkg.misc import port_available, msg, emsg, setlocale

751N/Aimport pkg.search_errors as search_errors

382N/Aimport pkg.server.config as config

22N/Aimport pkg.server.depot as depot

814N/Aimport pkg.server.repository as repo

812N/Aimport pkg.server.repositoryconfig as rc

873N/A

812N/Aclass LogSink(object):

26N/A """This is a dummy object that we can use to discard log entries

873N/A

975N/A def write(self, *args, **kwargs):

428N/A """Discard the bits."""

466N/A pass

466N/A

466N/A def flush(self, *args, **kwargs):

466N/A """Discard the bits."""

23N/A pass

466N/A

466N/Adef usage(text):

466N/A if text:

466N/A emsg(text)

466N/A

466N/A print """\

589N/A sys.exit(2)

589N/A

812N/Aclass OptionError(Exception):

812N/A """Option exception. """

812N/A

812N/A def __init__(self, *args):

812N/A Exception.__init__(self, *args)

812N/A

812N/Aif __name__ == "__main__":

812N/A

812N/A setlocale(locale.LC_ALL, "")

812N/A gettext.install("pkg", "/usr/share/locale")

812N/A

812N/A port = PORT_DEFAULT

812N/A port_provided = False

975N/A threads = THREADS_DEFAULT

975N/A socket_timeout = SOCKET_TIMEOUT_DEFAULT

975N/A readonly = READONLY_DEFAULT

975N/A rebuild = REBUILD_DEFAULT

26N/A reindex = REINDEX_DEFAULT

135N/A proxy_base = None

14N/A mirror = MIRROR_DEFAULT

382N/A repo_config_file = None

429N/A ssl_cert_file = None

14N/A ssl_key_file = None

404N/A ssl_dialog = "builtin"

404N/A

30N/A if "PKG_REPO" in os.environ:

382N/A repo_path = os.environ["PKG_REPO"]

30N/A else:

791N/A repo_path = REPO_PATH_DEFAULT

689N/A

689N/A try:

858N/A content_root = os.environ["PKG_DEPOT_CONTENT"]

858N/A except KeyError:

858N/A try:

382N/A content_root = os.path.join(os.environ['PKG_HOME'],

812N/A 'share/lib/pkg')

382N/A except KeyError:

382N/A content_root = CONTENT_PATH_DEFAULT

382N/A

382N/A # By default, if the destination for a particular log type is not

429N/A # specified, this is where we will send the output.

451N/A log_routes = {

461N/A "access": "none",

1191N/A "errors": "stderr"

1191N/A }

797N/A log_opts = ["--log-%s" % log_type for log_type in log_routes]

812N/A

812N/A # If stdout is a tty, then send access output there by default instead

812N/A # of discarding it.

975N/A if os.isatty(sys.stdout.fileno()):

258N/A log_routes["access"] = "stdout"

382N/A

382N/A opt = None

382N/A try:

382N/A long_opts = ["cfg-file", "content-root=", "mirror",

30N/A "proxy-base=", "readonly", "rebuild", "refresh-index",

589N/A "ssl-cert-file=", "ssl-dialog=", "ssl-key-file="]

589N/A for opt in log_opts:

589N/A long_opts.append("%s=" % opt.lstrip('--'))

589N/A opts, pargs = getopt.getopt(sys.argv[1:], "d:np:s:t:",

589N/A long_opts)

589N/A for opt, arg in opts:

589N/A if opt == "-n":

589N/A sys.exit(0)

589N/A elif opt == "-d":

466N/A repo_path = arg

466N/A elif opt == "-p":

466N/A port = int(arg)

466N/A port_provided = True

466N/A elif opt == "-s":

466N/A threads = int(arg)

466N/A if threads < THREADS_MIN:

466N/A raise OptionError, \

466N/A "minimum value is %d" % THREADS_MIN

466N/A if threads > THREADS_MAX:

466N/A raise OptionError, \

466N/A "maximum value is %d" % THREADS_MAX

466N/A elif opt == "-t":

466N/A socket_timeout = int(arg)

54N/A elif opt == "--cfg-file":

858N/A repo_config_file = os.path.abspath(arg)

1191N/A elif opt == "--content-root":

1191N/A if arg == "":

1191N/A raise OptionError, "You must specify " \

466N/A "a directory path."

466N/A content_root = arg

382N/A elif opt in log_opts:

466N/A if arg is None or arg == "":

135N/A raise OptionError, \

135N/A "You must specify a log " \

135N/A "destination."

135N/A log_routes[opt.lstrip("--log-")] = arg

382N/A elif opt == "--mirror":

135N/A mirror = True

135N/A elif opt == "--proxy-base":

812N/A # Attempt to decompose the url provided into

382N/A # its base parts. This is done so we can

382N/A # remove any scheme information since we

382N/A # don't need it.

382N/A scheme, netloc, path, params, query, \

382N/A fragment = urlparse.urlparse(arg,

382N/A "http", allow_fragments=0)

382N/A

382N/A if not netloc:

382N/A raise OptionError, "Unable to " \

382N/A "determine the hostname from " \

812N/A "the provided URL; please use a " \

812N/A "fully qualified URL."

589N/A

589N/A scheme = scheme.lower()

589N/A if scheme not in ("http", "https"):

589N/A raise OptionError, "Invalid URL; http " \

589N/A "and https are the only supported " \

858N/A "schemes."

858N/A

858N/A # Rebuild the url with the sanitized components.

858N/A proxy_base = urlparse.urlunparse((scheme, netloc,

858N/A path, params, query, fragment)

858N/A )

858N/A elif opt == "--readonly":

858N/A readonly = True

858N/A elif opt == "--rebuild":

858N/A rebuild = True

858N/A elif opt == "--refresh-index":

858N/A # Note: This argument is for internal use

858N/A # only. It's used when pkg.depotd is reexecing

858N/A # itself and needs to know that's the case.

858N/A # This flag is purposefully omitted in usage.

858N/A # The supported way to forcefully reindex is to

858N/A # kill any pkg.depot using that directory,

858N/A # remove the index directory, and restart the

466N/A # pkg.depot process. The index will be rebuilt

466N/A # automatically on startup.

466N/A reindex = True

466N/A elif opt == "--ssl-cert-file":

466N/A if arg == "none":

466N/A continue

589N/A

589N/A ssl_cert_file = arg

1191N/A if not os.path.isabs(ssl_cert_file):

1191N/A raise OptionError, "The path to " \

1191N/A "the Certificate file must be " \

1191N/A "absolute."

1191N/A elif not os.path.exists(ssl_cert_file):

1191N/A raise OptionError, "The specified " \

1191N/A "file does not exist."

1191N/A elif not os.path.isfile(ssl_cert_file):

1191N/A raise OptionError, "The specified " \

1191N/A "pathname is not a file."

1191N/A elif opt == "--ssl-key-file":

1191N/A if arg == "none":

1191N/A continue

589N/A

589N/A ssl_key_file = arg

589N/A if not os.path.isabs(ssl_key_file):

589N/A raise OptionError, "The path to " \

589N/A "the Private Key file must be " \

589N/A "absolute."

589N/A elif not os.path.exists(ssl_key_file):

765N/A raise OptionError, "The specified " \

765N/A "file does not exist."

765N/A elif not os.path.isfile(ssl_key_file):

765N/A raise OptionError, "The specified " \

765N/A "pathname is not a file."

765N/A elif opt == "--ssl-dialog":

765N/A if arg != "builtin" and not \

589N/A arg.startswith("exec:/") and not \

765N/A arg.startswith("smf:"):

765N/A raise OptionError, "Invalid value " \

765N/A "specified. Expected: builtin, " \

765N/A "exec:/path/to/program, or " \

765N/A "smf:fmri."

765N/A

765N/A f = arg

873N/A if f.startswith("exec:"):

873N/A if os_util.get_canonical_os_type() != \

135N/A "unix":

382N/A # Don't allow a somewhat insecure

157N/A # authentication method on some

382N/A # platforms.

429N/A raise OptionError, "exec is not " \

429N/A "a supported dialog type for " \

429N/A "this operating system."

429N/A

429N/A f = os.path.abspath(f.split(

429N/A "exec:")[1])

429N/A

429N/A if not os.path.isfile(f):

429N/A raise OptionError, "Invalid " \

429N/A "file path specified for " \

429N/A "exec."

812N/A

812N/A f = "exec:%s" % f

812N/A

812N/A ssl_dialog = f

812N/A except getopt.GetoptError, e:

812N/A usage("pkg.depotd: %s" % e.msg)

812N/A except OptionError, e:

812N/A usage("pkg.depotd: option: %s -- %s" % (opt, e))

812N/A except (ArithmeticError, ValueError):

812N/A usage("pkg.depotd: illegal option value: %s specified " \

812N/A "for option: %s" % (arg, opt))

812N/A

812N/A if rebuild and reindex:

812N/A usage("--refresh-index cannot be used with --rebuild")

812N/A if rebuild and (readonly or mirror):

812N/A usage("--readonly and --mirror cannot be used with --rebuild")

812N/A if reindex and (readonly or mirror):

812N/A usage("--readonly and --mirror cannot be used with " \

812N/A "--refresh-index")

812N/A

812N/A if (ssl_cert_file and not ssl_key_file) or (ssl_key_file and not

812N/A ssl_cert_file):

812N/A usage("The --ssl-cert-file and --ssl-key-file options must "

812N/A "must both be provided when using either option.")

812N/A elif ssl_cert_file and ssl_key_file and not port_provided:

812N/A # If they didn't already specify a particular port, use the

812N/A # default SSL port instead.

812N/A port = SSL_PORT_DEFAULT

812N/A

812N/A # If the program is going to reindex, the port is irrelevant since

812N/A # the program will not bind to a port.

812N/A if not reindex:

812N/A available, msg = port_available(None, port)

812N/A if not available:

812N/A print "pkg.depotd: unable to bind to the specified " \

812N/A "port: %d. Reason: %s" % (port, msg)

812N/A sys.exit(1)

812N/A else:

812N/A # Not applicable for reindexing operations.

812N/A content_root = None

812N/A

812N/A scfg = config.SvrConfig(repo_path, content_root, AUTH_DEFAULT)

812N/A

873N/A if rebuild:

873N/A scfg.destroy_catalog()

873N/A

873N/A if readonly:

873N/A scfg.set_read_only()

873N/A

873N/A if mirror:

812N/A scfg.set_mirror()

812N/A

812N/A try:

812N/A scfg.init_dirs()

812N/A except (RuntimeError, EnvironmentError), e:

812N/A print "pkg.depotd: an error occurred while trying to " \

812N/A "initialize the depot repository directory " \

812N/A "structures:\n%s" % e

812N/A sys.exit(1)

812N/A

812N/A key_data = None

812N/A if not reindex and ssl_cert_file and ssl_key_file and \

975N/A ssl_dialog != "builtin":

975N/A cmdline = None

975N/A def get_ssl_passphrase(*ignored):

975N/A p = None

975N/A try:

873N/A p = subprocess.Popen(cmdline, shell=True,

873N/A stdout=subprocess.PIPE,

873N/A stderr=None)

873N/A p.wait()

382N/A except Exception, e:

466N/A print "pkg.depotd: an error occurred while " \

466N/A "executing [%s]; unable to obtain the " \

451N/A "passphrase needed to decrypt the SSL" \

445N/A "private key file: %s" (cmd, e)

466N/A sys.exit(1)

461N/A return p.stdout.read().strip("\n")

466N/A

1020N/A if ssl_dialog.startswith("exec:"):

1020N/A cmdline = "%s %s %d" % (ssl_dialog.split("exec:")[1],

1020N/A "''", port)

1020N/A elif ssl_dialog.startswith("smf:"):

1020N/A cmdline = "/usr/bin/svcprop -p " \

451N/A "pkg_secure/ssl_key_passphrase %s" % (

812N/A ssl_dialog.split("smf:")[1])

812N/A

812N/A # The key file requires decryption, but the user has requested

812N/A # exec-based authentication, so it will have to be decoded first

812N/A # to an un-named temporary file.

812N/A try:

812N/A key_file = file(ssl_key_file, "rb")

812N/A pkey = crypto.load_privatekey(crypto.FILETYPE_PEM,

812N/A key_file.read(), get_ssl_passphrase)

429N/A

429N/A key_data = tempfile.TemporaryFile()

429N/A key_data.write(crypto.dump_privatekey(

429N/A crypto.FILETYPE_PEM, pkey))

429N/A key_data.seek(0)

429N/A except EnvironmentError, e:

429N/A print "pkg.depotd: unable to read the SSL private " \

429N/A "key file: %s" % e

612N/A sys.exit(1)

612N/A except crypto.Error, e:

612N/A print "pkg.depotd: authentication or cryptography " \

386N/A "failure while attempting to decode\nthe SSL " \

916N/A "private key file: %s" % e

916N/A sys.exit(1)

1191N/A else:

1191N/A # Redirect the server to the decrypted key file.

1191N/A ssl_key_file = "/dev/fd/%d" % key_data.fileno()

1191N/A

1191N/A # Setup our global configuration.

1191N/A gconf = {

1191N/A "environment": "production",

1191N/A "checker.on": True,

1191N/A "log.screen": False,

382N/A "server.socket_host": "0.0.0.0",

382N/A "server.socket_port": port,

382N/A "server.thread_pool": threads,

382N/A "server.socket_timeout": socket_timeout,

461N/A "server.shutdown_timeout": 0,

461N/A "tools.log_headers.on": True,

461N/A "tools.encode.on": True,

1191N/A "server.ssl_certificate": ssl_cert_file,

382N/A "server.ssl_private_key": ssl_key_file

382N/A }

975N/A

382N/A log_type_map = {

382N/A "errors": {

873N/A "param": "log.error_file",

382N/A "attr": "error_log"

382N/A },

812N/A "access": {

812N/A "param": "log.access_file",

812N/A "attr": "access_log"

812N/A }

812N/A }

812N/A

812N/A for log_type in log_type_map:

812N/A dest = log_routes[log_type]

812N/A if dest in ("stdout", "stderr", "none"):

812N/A if dest == "none":

812N/A h = logging.StreamHandler(LogSink())

873N/A else:

812N/A h = logging.StreamHandler(eval("sys.%s" % \

812N/A dest))

812N/A

873N/A h.setLevel(logging.DEBUG)

812N/A h.setFormatter(cherrypy._cplogging.logfmt)

812N/A log_obj = eval("cherrypy.log.%s" % \

812N/A log_type_map[log_type]["attr"])

812N/A log_obj.addHandler(h)

812N/A # Since we've replaced cherrypy's log handler with our

812N/A # own, we don't want the output directed to a file.

812N/A dest = ""

812N/A

812N/A gconf[log_type_map[log_type]["param"]] = dest

812N/A

812N/A cherrypy.config.update(gconf)

812N/A

812N/A # Now that our logging, etc. has been setup, it's safe to perform any

812N/A # remaining preparation.

812N/A if reindex:

812N/A scfg.acquire_catalog(rebuild=False)

812N/A try:

812N/A scfg.catalog.run_update_index()

812N/A except search_errors.IndexingException, e:

812N/A cherrypy.log(str(e), "INDEX")

812N/A sys.exit(1)

812N/A sys.exit(0)

812N/A

873N/A # Now build our site configuration.

812N/A conf = {

873N/A "/": {

812N/A # We have to override cherrypy's default response_class so that

873N/A # we have access to the write() callable to stream data

812N/A # directly to the client.

812N/A "wsgi.response_class": depot.DepotResponse,

873N/A },

812N/A "/robots.txt": {

812N/A "tools.staticfile.on": True,

812N/A "tools.staticfile.filename": os.path.join(scfg.web_root,

812N/A "robots.txt")

812N/A },

452N/A }

466N/A

858N/A if proxy_base:

382N/A # This changes the base URL for our server, and is primarily

466N/A # intended to allow our depot process to operate behind Apache

965N/A # or some other webserver process.

858N/A #

452N/A # Visit the following URL for more information:

382N/A # http://cherrypy.org/wiki/BuiltinTools#tools.proxy

858N/A proxy_conf = {

858N/A "tools.proxy.on": True,

858N/A "tools.proxy.local": "",

382N/A "tools.proxy.base": proxy_base

742N/A }

858N/A

466N/A # Now merge or add our proxy configuration information into the

466N/A # existing configuration.

858N/A for entry in proxy_conf:

858N/A conf["/"][entry] = proxy_conf[entry]

858N/A

858N/A scfg.acquire_in_flight()

858N/A scfg.acquire_catalog()

858N/A

858N/A try:

858N/A root = cherrypy.Application(repo.Repository(scfg,

858N/A repo_config_file))

858N/A except rc.InvalidAttributeValueError, e:

858N/A emsg("pkg.depotd: repository.conf error: %s" % e)

858N/A sys.exit(1)

466N/A

466N/A try:

466N/A cherrypy.quickstart(root, config=conf)

466N/A except Exception, e:

466N/A emsg("pkg.depotd: unknown error starting depot server, " \

466N/A "illegal option value specified?")

466N/A sys.exit(1)

466N/A

466N/A