239
|
1
|
#!/bin/sh |
|
2
|
set -eu |
|
3
|
main() { |
|
4
|
. ./check.sh |
|
5
|
download --check |
|
6
|
local _arch=$(_read arch | tr -d '"') |
|
7
|
local _ext="" |
|
8
|
case "$_arch" in |
|
9
|
*windows*) |
|
10
|
_ext=".exe" |
|
11
|
;; |
|
12
|
esac |
|
13
|
local _url="https://packy.compiler.company/dist/${_arch}" |
|
14
|
local _stash |
|
15
|
if ! _stash=".stash"; then |
|
16
|
# Because the previous command ran in a subshell, we must manually |
|
17
|
# propagate exit status. |
|
18
|
exit 1 |
|
19
|
fi |
|
20
|
ensure mkdir -p "${_stash}/src" |
|
21
|
ensure mkdir -p "${_stash}/bin" |
|
22
|
local _sk_url="${_url}/bin/sk" |
|
23
|
local _sbcl_url="${_url}/pack/sbcl.tar.zst" |
|
24
|
local _rocksdb_url="${_url}/pack/rocksdb.tar.zst" |
|
25
|
ensure download "$_sbcl_url" "${_stash}/src/sbcl.tar.zst" "$_arch" |
|
26
|
ensure download "$_rocksdb_url" "${_stash}/src/rocksdb.tar.zst" "$_arch" |
|
27
|
ensure download "$_sk_url" "${_stash}/bin/sk" "$_arch" |
|
28
|
} |
|
29
|
|
|
30
|
_read() { |
|
31
|
grep ":$1" $INFRA_HOST_CONFIG | cut -d' ' -f 2- |
|
32
|
} |
|
33
|
|
|
34
|
say() { |
|
35
|
printf 'bootstrap.sh: %s\n' "$1" |
|
36
|
} |
|
37
|
|
|
38
|
err() { |
|
39
|
say "$1" >&2 |
|
40
|
exit 1 |
|
41
|
} |
|
42
|
|
|
43
|
check_cmd() { |
|
44
|
command -v "$1" > /dev/null 2>&1 |
|
45
|
} |
|
46
|
|
|
47
|
need_cmd() { |
|
48
|
if ! check_cmd "$1"; then |
|
49
|
err "need '$1' (command not found)" |
|
50
|
fi |
|
51
|
} |
|
52
|
|
|
53
|
# Run a command that should never fail. If the command fails execution |
|
54
|
# will immediately terminate with an error showing the failing |
|
55
|
# command. |
|
56
|
ensure() { |
|
57
|
if ! "$@"; then err "command failed: $*"; fi |
|
58
|
} |
|
59
|
|
|
60
|
# Check if curl supports the --retry flag, then pass it to the curl invocation. |
|
61
|
check_curl_for_retry_support() { |
|
62
|
local _retry_supported="" |
|
63
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc. |
|
64
|
if check_help_for "notspecified" "curl" "--retry"; then |
|
65
|
_retry_supported="--retry 3" |
|
66
|
if check_help_for "notspecified" "curl" "--continue-at"; then |
|
67
|
# "-C -" tells curl to automatically find where to resume the download when retrying. |
|
68
|
_retry_supported="--retry 3 -C -" |
|
69
|
fi |
|
70
|
fi |
|
71
|
|
|
72
|
RETVAL="$_retry_supported" |
|
73
|
} |
|
74
|
|
|
75
|
# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites |
|
76
|
# if support by local tools is detected. Detection currently supports these curl backends: |
|
77
|
# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty. |
|
78
|
get_ciphersuites_for_curl() { |
|
79
|
if [ -n "${TLS_CIPHERSUITES-}" ]; then |
|
80
|
# user specified custom cipher suites, assume they know what they're doing |
|
81
|
RETVAL="$TLS_CIPHERSUITES" |
|
82
|
return |
|
83
|
fi |
|
84
|
|
|
85
|
local _openssl_syntax="no" |
|
86
|
local _gnutls_syntax="no" |
|
87
|
local _backend_supported="yes" |
|
88
|
if curl -V | grep -q ' OpenSSL/'; then |
|
89
|
_openssl_syntax="yes" |
|
90
|
elif curl -V | grep -iq ' LibreSSL/'; then |
|
91
|
_openssl_syntax="yes" |
|
92
|
elif curl -V | grep -iq ' BoringSSL/'; then |
|
93
|
_openssl_syntax="yes" |
|
94
|
elif curl -V | grep -iq ' GnuTLS/'; then |
|
95
|
_gnutls_syntax="yes" |
|
96
|
else |
|
97
|
_backend_supported="no" |
|
98
|
fi |
|
99
|
|
|
100
|
local _args_supported="no" |
|
101
|
if [ "$_backend_supported" = "yes" ]; then |
|
102
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc. |
|
103
|
if check_help_for "notspecified" "curl" "--tlsv1.2" "--ciphers" "--proto"; then |
|
104
|
_args_supported="yes" |
|
105
|
fi |
|
106
|
fi |
|
107
|
|
|
108
|
local _cs="" |
|
109
|
if [ "$_args_supported" = "yes" ]; then |
|
110
|
if [ "$_openssl_syntax" = "yes" ]; then |
|
111
|
_cs=$(get_strong_ciphersuites_for "openssl") |
|
112
|
elif [ "$_gnutls_syntax" = "yes" ]; then |
|
113
|
_cs=$(get_strong_ciphersuites_for "gnutls") |
|
114
|
fi |
|
115
|
fi |
|
116
|
|
|
117
|
RETVAL="$_cs" |
|
118
|
} |
|
119
|
|
|
120
|
# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites |
|
121
|
# if support by local tools is detected. Detection currently supports these wget backends: |
|
122
|
# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty. |
|
123
|
get_ciphersuites_for_wget() { |
|
124
|
if [ -n "${TLS_CIPHERSUITES-}" ]; then |
|
125
|
# user specified custom cipher suites, assume they know what they're doing |
|
126
|
RETVAL="$TLS_CIPHERSUITES" |
|
127
|
return |
|
128
|
fi |
|
129
|
|
|
130
|
local _cs="" |
|
131
|
if wget -V | grep -q '\-DHAVE_LIBSSL'; then |
|
132
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc. |
|
133
|
if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then |
|
134
|
_cs=$(get_strong_ciphersuites_for "openssl") |
|
135
|
fi |
|
136
|
elif wget -V | grep -q '\-DHAVE_LIBGNUTLS'; then |
|
137
|
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc. |
|
138
|
if check_help_for "notspecified" "wget" "TLSv1_2" "--ciphers" "--https-only" "--secure-protocol"; then |
|
139
|
_cs=$(get_strong_ciphersuites_for "gnutls") |
|
140
|
fi |
|
141
|
fi |
|
142
|
|
|
143
|
RETVAL="$_cs" |
|
144
|
} |
|
145
|
|
|
146
|
check_help_for() { |
|
147
|
local _arch |
|
148
|
local _cmd |
|
149
|
local _arg |
|
150
|
_arch="$1" |
|
151
|
shift |
|
152
|
_cmd="$1" |
|
153
|
shift |
|
154
|
|
|
155
|
local _category |
|
156
|
if "$_cmd" --help | grep -q 'For all options use the manual or "--help all".'; then |
|
157
|
_category="all" |
|
158
|
else |
|
159
|
_category="" |
|
160
|
fi |
|
161
|
|
|
162
|
case "$_arch" in |
|
163
|
|
|
164
|
*darwin*) |
|
165
|
if check_cmd sw_vers; then |
|
166
|
case $(sw_vers -productVersion) in |
|
167
|
10.*) |
|
168
|
# If we're running on macOS, older than 10.13, then we always |
|
169
|
# fail to find these options to force fallback |
|
170
|
if [ "$(sw_vers -productVersion | cut -d. -f2)" -lt 13 ]; then |
|
171
|
# Older than 10.13 |
|
172
|
echo "Warning: Detected macOS platform older than 10.13" |
|
173
|
return 1 |
|
174
|
fi |
|
175
|
;; |
|
176
|
11.*) |
|
177
|
# We assume Big Sur will be OK for now |
|
178
|
;; |
|
179
|
*) |
|
180
|
# Unknown product version, warn and continue |
|
181
|
echo "Warning: Detected unknown macOS major version: $(sw_vers -productVersion)" |
|
182
|
echo "Warning TLS capabilities detection may fail" |
|
183
|
;; |
|
184
|
esac |
|
185
|
fi |
|
186
|
;; |
|
187
|
|
|
188
|
esac |
|
189
|
|
|
190
|
for _arg in "$@"; do |
|
191
|
if ! "$_cmd" --help "$_category" | grep -q -- "$_arg"; then |
|
192
|
return 1 |
|
193
|
fi |
|
194
|
done |
|
195
|
|
|
196
|
true # not strictly needed |
|
197
|
} |
|
198
|
|
|
199
|
# Return strong TLS 1.2-1.3 cipher suites in OpenSSL or GnuTLS syntax. TLS 1.2 |
|
200
|
# excludes non-ECDHE and non-AEAD cipher suites. DHE is excluded due to bad |
|
201
|
# DH params often found on servers (see RFC 7919). Sequence matches or is |
|
202
|
# similar to Firefox 68 ESR with weak cipher suites disabled via about:config. |
|
203
|
# $1 must be openssl or gnutls. |
|
204
|
get_strong_ciphersuites_for() { |
|
205
|
if [ "$1" = "openssl" ]; then |
|
206
|
# OpenSSL is forgiving of unknown values, no problems with TLS 1.3 values on versions that don't support it yet. |
|
207
|
echo "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384" |
|
208
|
elif [ "$1" = "gnutls" ]; then |
|
209
|
# GnuTLS isn't forgiving of unknown values, so this may require a GnuTLS version that supports TLS 1.3 even if wget doesn't. |
|
210
|
# Begin with SECURE128 (and higher) then remove/add to build cipher suites. Produces same 9 cipher suites as OpenSSL but in slightly different order. |
|
211
|
echo "SECURE128:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS-ALL:-CIPHER-ALL:-MAC-ALL:-KX-ALL:+AEAD:+ECDHE-ECDSA:+ECDHE-RSA:+AES-128-GCM:+CHACHA20-POLY1305:+AES-256-GCM" |
|
212
|
fi |
|
213
|
} |
|
214
|
|
|
215
|
check_proc() { |
|
216
|
# Check for /proc by looking for the /proc/self/exe link |
|
217
|
# This is only run on Linux |
|
218
|
if ! test -L /proc/self/exe ; then |
|
219
|
err "fatal: Unable to find /proc/self/exe. Is /proc mounted? Installation cannot proceed without /proc." |
|
220
|
fi |
|
221
|
} |
|
222
|
|
|
223
|
get_bitness() { |
|
224
|
need_cmd head |
|
225
|
# Architecture detection without dependencies beyond coreutils. |
|
226
|
# ELF files start out "\x7fELF", and the following byte is |
|
227
|
# 0x01 for 32-bit and |
|
228
|
# 0x02 for 64-bit. |
|
229
|
# The printf builtin on some shells like dash only supports octal |
|
230
|
# escape sequences, so we use those. |
|
231
|
local _current_exe_head |
|
232
|
_current_exe_head=$(head -c 5 /proc/self/exe ) |
|
233
|
if [ "$_current_exe_head" = "$(printf '\177ELF\001')" ]; then |
|
234
|
echo 32 |
|
235
|
elif [ "$_current_exe_head" = "$(printf '\177ELF\002')" ]; then |
|
236
|
echo 64 |
|
237
|
else |
|
238
|
err "unknown platform bitness" |
|
239
|
fi |
|
240
|
} |
|
241
|
|
|
242
|
is_host_amd64_elf() { |
|
243
|
need_cmd head |
|
244
|
need_cmd tail |
|
245
|
# ELF e_machine detection without dependencies beyond coreutils. |
|
246
|
# Two-byte field at offset 0x12 indicates the CPU, |
|
247
|
# but we're interested in it being 0x3E to indicate amd64, or not that. |
|
248
|
local _current_exe_machine |
|
249
|
_current_exe_machine=$(head -c 19 /proc/self/exe | tail -c 1) |
|
250
|
[ "$_current_exe_machine" = "$(printf '\076')" ] |
|
251
|
} |
|
252
|
|
|
253
|
get_endianness() { |
|
254
|
local cputype=$1 |
|
255
|
local suffix_eb=$2 |
|
256
|
local suffix_el=$3 |
|
257
|
|
|
258
|
# detect endianness without od/hexdump, like get_bitness() does. |
|
259
|
need_cmd head |
|
260
|
need_cmd tail |
|
261
|
|
|
262
|
local _current_exe_endianness |
|
263
|
_current_exe_endianness="$(head -c 6 /proc/self/exe | tail -c 1)" |
|
264
|
if [ "$_current_exe_endianness" = "$(printf '\001')" ]; then |
|
265
|
echo "${cputype}${suffix_el}" |
|
266
|
elif [ "$_current_exe_endianness" = "$(printf '\002')" ]; then |
|
267
|
echo "${cputype}${suffix_eb}" |
|
268
|
else |
|
269
|
err "unknown platform endianness" |
|
270
|
fi |
|
271
|
} |
|
272
|
|
|
273
|
# This wraps curl or wget. Try curl first, if not installed, |
|
274
|
# use wget instead. |
|
275
|
download() { |
|
276
|
local _dld |
|
277
|
local _ciphersuites |
|
278
|
local _err |
|
279
|
local _status |
|
280
|
local _retry |
|
281
|
if check_cmd curl; then |
|
282
|
_dld=curl |
|
283
|
elif check_cmd wget; then |
|
284
|
_dld=wget |
|
285
|
else |
|
286
|
_dld='curl or wget' # to be used in error message of need_cmd |
|
287
|
fi |
|
288
|
|
|
289
|
if [ "$1" = --check ]; then |
|
290
|
need_cmd "$_dld" |
|
291
|
elif [ "$_dld" = curl ]; then |
|
292
|
check_curl_for_retry_support |
|
293
|
_retry="$RETVAL" |
|
294
|
get_ciphersuites_for_curl |
|
295
|
_ciphersuites="$RETVAL" |
|
296
|
if [ -n "$_ciphersuites" ]; then |
|
297
|
_err=$(curl $_retry --proto '=https' --tlsv1.2 --ciphers "$_ciphersuites" --silent --show-error --fail --location "$1" --output "$2" 2>&1) |
|
298
|
_status=$? |
|
299
|
else |
|
300
|
echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure" |
|
301
|
if ! check_help_for "$3" curl --proto --tlsv1.2; then |
|
302
|
echo "Warning: Not enforcing TLS v1.2, this is potentially less secure" |
|
303
|
_err=$(curl $_retry --silent --show-error --fail --location "$1" --output "$2" 2>&1) |
|
304
|
_status=$? |
|
305
|
else |
|
306
|
_err=$(curl $_retry --proto '=https' --tlsv1.2 --silent --show-error --fail --location "$1" --output "$2" 2>&1) |
|
307
|
_status=$? |
|
308
|
fi |
|
309
|
fi |
|
310
|
if [ -n "$_err" ]; then |
|
311
|
echo "$_err" >&2 |
|
312
|
if echo "$_err" | grep -q 404$; then |
|
313
|
err "installer for platform '$3' not found, this may be unsupported" |
|
314
|
fi |
|
315
|
fi |
|
316
|
return $_status |
|
317
|
elif [ "$_dld" = wget ]; then |
|
318
|
if [ "$(wget -V 2>&1|head -2|tail -1|cut -f1 -d" ")" = "BusyBox" ]; then |
|
319
|
echo "Warning: using the BusyBox version of wget. Not enforcing strong cipher suites for TLS or TLS v1.2, this is potentially less secure" |
|
320
|
_err=$(wget "$1" -O "$2" 2>&1) |
|
321
|
_status=$? |
|
322
|
else |
|
323
|
get_ciphersuites_for_wget |
|
324
|
_ciphersuites="$RETVAL" |
|
325
|
if [ -n "$_ciphersuites" ]; then |
|
326
|
_err=$(wget --https-only --secure-protocol=TLSv1_2 --ciphers "$_ciphersuites" "$1" -O "$2" 2>&1) |
|
327
|
_status=$? |
|
328
|
else |
|
329
|
echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure" |
|
330
|
if ! check_help_for "$3" wget --https-only --secure-protocol; then |
|
331
|
echo "Warning: Not enforcing TLS v1.2, this is potentially less secure" |
|
332
|
_err=$(wget "$1" -O "$2" 2>&1) |
|
333
|
_status=$? |
|
334
|
else |
|
335
|
_err=$(wget --https-only --secure-protocol=TLSv1_2 "$1" -O "$2" 2>&1) |
|
336
|
_status=$? |
|
337
|
fi |
|
338
|
fi |
|
339
|
fi |
|
340
|
if [ -n "$_err" ]; then |
|
341
|
echo "$_err" >&2 |
|
342
|
if echo "$_err" | grep -q ' 404 Not Found$'; then |
|
343
|
err "installer for platform '$3' not found, this may be unsupported" |
|
344
|
fi |
|
345
|
fi |
|
346
|
return $_status |
|
347
|
else |
|
348
|
err "Unknown downloader" # should not reach here |
|
349
|
fi |
|
350
|
} |
|
351
|
|
|
352
|
main "$@" || exit 1 |