mirror of
https://github.com/ben-grande/qusal.git
synced 2025-01-18 10:57:07 -05:00
011a71a36d
Editorconfig can only act based on file extension and path, not attributes, it remains a mean only for multiple collaborators to use the same configuration on their editor. When it is too restrictive, such as not considering the file syntax, use a lint tool for the specific file type instead of trusting editorconfig. Changes were made to increase readability.
345 lines
10 KiB
Bash
Executable File
345 lines
10 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# SPDX-FileCopyrightText: 2015 - 2020 Marek Marczykowski-Gorecki <marmarek@invisiblethingslab.com>
|
|
# SPDX-FileCopyrightText: 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
|
#
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
## Description: rewrite repositories definitions to be used with the cacher.
|
|
## It works for qubes that should be configured to use the cacher via Qrexec
|
|
## or Netvm (direct networking).
|
|
##
|
|
## Looping through files and testing their permissions (read, write) is better
|
|
## than finding a file and trying to sed it without knowledge, it is also
|
|
## beneficial as 'find' fails if file is not existent and sending all 'find'
|
|
## output to /dev/stderr is not great.
|
|
##
|
|
## Assigning the repositories files to '$@' avoids having to parse their names
|
|
## in case they contain spaces, newlines and other dangerous characters to the
|
|
## shell, it is also an easy way to use an array for /bin/sh.
|
|
|
|
set -eu
|
|
|
|
set_proxy_marker(){
|
|
marker_begin_text="QUBES BEGIN"
|
|
marker_end_text="QUBES END"
|
|
marker_begin="### ${marker_begin_text} ###"
|
|
marker_end="### ${marker_end_text} ###"
|
|
proxy_file="${1}"
|
|
proxy_options="${2}"
|
|
|
|
if ! grep -q "^${marker_begin}$" "${proxy_file}"; then
|
|
if grep -q "^${marker_end}$" "${proxy_file}"; then
|
|
msg="found marker ${marker_end_text} but not ${marker_begin_text}"
|
|
msg="${msg} in ${proxy_file}."
|
|
msg="${msg} fix it by removing markers or adding missing ones and retry"
|
|
echo "Error: ${msg}" >&2
|
|
exit 1
|
|
fi
|
|
cp "${proxy_file}" "${proxy_file}.qubes-orig"
|
|
echo "${marker_begin}" | tee -a "${proxy_file}" >/dev/null
|
|
echo "${marker_end}" | tee -a "${proxy_file}" >/dev/null
|
|
elif ! grep -q "^${marker_end}$" "${proxy_file}"; then
|
|
msg="found marker ${marker_begin_text} but not ${marker_end_text}"
|
|
msg="${msg} in ${proxy_file}."
|
|
msg="${msg} fix it by removing markers or adding missing ones and retry"
|
|
echo "error: ${msg}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
proxy_tmp_file="$(mktemp)"
|
|
cat >"${proxy_tmp_file}" <<EOF
|
|
# The text between ${marker_begin_text} and ${marker_end_text} is
|
|
# automatically generated by $0. All changes here will be overridden.
|
|
# You can override options after the ${marker_end_text}.
|
|
${proxy_options}
|
|
EOF
|
|
|
|
## Couldn't figure out how to write only changes on the next sed.
|
|
if ! grep -q "${proxy_options}" "${proxy_file}"; then
|
|
tee -a "${changes_file}" <"${proxy_tmp_file}" >/dev/null
|
|
fi
|
|
## GNU Sed, only reliable while we don't support BSD.
|
|
sed -i -e "/^${marker_begin}$/,/^${marker_end}$/{
|
|
/^${marker_end}$/b
|
|
/^${marker_begin}$/!d
|
|
r ${proxy_tmp_file}
|
|
}" "${proxy_file}"
|
|
rm -f "${proxy_tmp_file}"
|
|
}
|
|
|
|
check_netvm_cacher(){
|
|
proxy_host="127.0.0.1"
|
|
proxy_port="8082"
|
|
proxy_addr=""
|
|
proxy_url=""
|
|
proxy_conf=""
|
|
if ! test -f /var/run/qubes-service/updates-proxy-setup; then
|
|
return 0
|
|
fi
|
|
if test -f /var/run/qubes-service/netvm-cacher; then
|
|
proxy_host="$(qubesdb-read /qubes-gateway)"
|
|
if test -z "${proxy_host}"; then
|
|
echo "Error: service netvm-cacher enabled but netvm IP not found" >&2
|
|
return 1
|
|
fi
|
|
fi
|
|
proxy_addr="${proxy_host}:${proxy_port}"
|
|
proxy_url="http://${proxy_addr}"
|
|
proxy_conf="proxy=${proxy_addr}"
|
|
}
|
|
|
|
reject_os(){
|
|
echo "${0##*/} does not support your Operating System distribution." >&2
|
|
exit 1
|
|
}
|
|
|
|
# shellcheck disable=SC2317
|
|
set_proxy_os(){
|
|
if test -e /etc/fedora-release; then
|
|
## Fedora
|
|
|
|
if test -w /etc/dnf/dnf.conf; then
|
|
set_proxy_marker /etc/dnf/dnf.conf "zchunk=False
|
|
${proxy_conf}"
|
|
fi
|
|
if test -n "${proxy_addr}"; then
|
|
cat >/etc/yum.conf.d/qubes-proxy.conf <<EOF
|
|
${proxy_conf}
|
|
EOF
|
|
else
|
|
rm -f /etc/yum.conf.d/qubes-proxy.conf
|
|
fi
|
|
|
|
set --
|
|
for repo in \
|
|
/etc/yum.repos.d/*.repo
|
|
do
|
|
test -f "${repo}" || continue
|
|
test -r "${repo}" || continue
|
|
test -w "${repo}" || continue
|
|
set -- "${@}" "${repo}"
|
|
done
|
|
test -n "${*}" || return 0
|
|
|
|
case "${action}" in
|
|
install)
|
|
baseurl_search="baseurl\s*=\s*https://"
|
|
baseurl_repl="baseurl=http://HTTPS///"
|
|
meta_search="metalink\s*=\s*https://"
|
|
meta_repl="metalink=http://HTTPS///"
|
|
baseurl_expr="s|${baseurl_search}|${baseurl_repl}|w ${changes_file}"
|
|
meta_expr="s|${meta_search}|${meta_repl}|w ${changes_file}"
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "${baseurl_expr}" -e "${meta_expr}" \
|
|
{} \+
|
|
|
|
set --
|
|
for repo in \
|
|
/etc/yum.repos.d/rpmfusion*.repo
|
|
do
|
|
test -f "${repo}" || continue
|
|
test -r "${repo}" || continue
|
|
test -w "${repo}" || continue
|
|
set -- "${@}" "${repo}"
|
|
done
|
|
test -n "${*}" || return 0
|
|
|
|
baseurl_search="^\s*#.*baseurl"
|
|
baseurl_repl="baseurl"
|
|
meta_search="^\s*metalink\s*=\s*"
|
|
meta_expr="#metalink="
|
|
baseurl_expr="s|${baseurl_search}|${baseurl_repl}|w ${changes_file}"
|
|
meta_expr="s|${meta_search}|${meta_repl}|w ${changes_file}"
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "${baseurl_expr}" -e "${meta_expr}" \
|
|
{} \+
|
|
;;
|
|
|
|
uninstall)
|
|
baseurl_search="baseurl\s*=\s*http://HTTPS///"
|
|
baseurl_repl="baseurl=https://"
|
|
meta_search="metalink\s*=\s*http://HTTPS///"
|
|
meta_repl="metalink=https://"
|
|
baseurl_expr="s|${baseurl_search}|${baseurl_repl}|w ${changes_file}"
|
|
meta_expr="s|${meta_search}|${meta_repl}|w ${changes_file}"
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "${baseurl_expr}" -e "${meta_expr}" \
|
|
{} \+
|
|
|
|
set --
|
|
for repo in \
|
|
/etc/yum.repos.d/rpmfusion*.repo
|
|
do
|
|
test -f "${repo}" || continue
|
|
test -r "${repo}" || continue
|
|
test -w "${repo}" || continue
|
|
set -- "${@}" "${repo}"
|
|
done
|
|
test -n "${*}" || return 0
|
|
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "s|^\s*baseurl|#baseurl|w ${changes_file}" \
|
|
-e "s|^\s*#.*metalink\s*=|metalink=|w ${changes_file}" \
|
|
{} \+ 2>/dev/null || true
|
|
;;
|
|
esac
|
|
|
|
elif test -e /etc/debian_version && test ! -e /usr/share/whonix/marker; then
|
|
## Debian and derivatives but not Whonix.
|
|
|
|
if test -n "${proxy_addr}"; then
|
|
cat >/etc/apt/apt.conf.d/50cacher-proxy <<EOF
|
|
# Use Cacher NetVM Update Proxy
|
|
Acquire::http::Proxy "${proxy_url}";
|
|
Acquire::tor::proxy "${proxy_url}";
|
|
EOF
|
|
else
|
|
rm -f /etc/apt/apt.conf.d/50cacher-proxy
|
|
fi
|
|
|
|
set --
|
|
for repo in \
|
|
/etc/apt/sources.list \
|
|
/etc/apt/sources.list.d/*.list \
|
|
/etc/apt/sources.list.d/*.sources
|
|
do
|
|
test -f "${repo}" || continue
|
|
test -r "${repo}" || continue
|
|
test -w "${repo}" || continue
|
|
set -- "${@}" "${repo}"
|
|
done
|
|
test -n "${*}" || return 0
|
|
|
|
case "${action}" in
|
|
install)
|
|
sources_search="URIs:\s*https://"
|
|
sources_repl="URIs: http://HTTPS///"
|
|
list_search="^\s*\(#*\)\s*deb\(.*\)https://"
|
|
list_repl="\1deb\2http://HTTPS///"
|
|
sources_expr="s|${sources_search}|${sources_repl}|w ${changes_file}"
|
|
list_expr="s|${list_search}|${list_repl}|w ${changes_file}"
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "${list_expr}" -e "${sources_expr}" \
|
|
{} \+
|
|
;;
|
|
|
|
uninstall)
|
|
sources_search="URIs:\s*http://HTTPS///"
|
|
sources_repl="URIs: https://"
|
|
list_search="^\s*\(#*\)\s*deb\(.*\)http://HTTPS///"
|
|
list_repl="\1deb\2https://"
|
|
sources_expr="s|${sources_search}|${sources_repl}|w ${changes_file}"
|
|
list_expr="s|${list_search}|${list_repl}|w ${changes_file}"
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "${list_expr}" -e "${sources_expr}" \
|
|
{} \+
|
|
;;
|
|
esac
|
|
|
|
elif test -e /etc/arch-release; then
|
|
## Archlinux
|
|
|
|
if test -n "${proxy_addr}"; then
|
|
if ! test -d /run/qubes/bin; then
|
|
mkdir -p /run/qubes/bin
|
|
fi
|
|
cat >/run/qubes/bin/pacman <<EOF
|
|
#!/bin/sh
|
|
exec env ALL_PROXY="${proxy_url}" /usr/bin/pacman "\$@"
|
|
EOF
|
|
chmod +x /run/qubes/bin/pacman
|
|
cat >/etc/profile.d/qubes-proxy.sh << EOF
|
|
export PATH=/run/qubes/bin:\$PATH
|
|
EOF
|
|
else
|
|
rm -f /run/qubes/bin/pacman /etc/profile.d/qubes-proxy.sh
|
|
fi
|
|
|
|
set --
|
|
for repo in \
|
|
/etc/pacman.d/mirrorlist \
|
|
/etc/pacman.d/*.conf \
|
|
/etc/pacman.d/*.conf.disabled
|
|
do
|
|
test -f "${repo}" || continue
|
|
test -r "${repo}" || continue
|
|
test -w "${repo}" || continue
|
|
set -- "${@}" "${repo}"
|
|
done
|
|
test -n "${*}" || return 0
|
|
|
|
case "${action}" in
|
|
install)
|
|
repo_search="Server\s*=\s*https://" \
|
|
repo_repl="Server = http://HTTPS///"
|
|
repo_regex="s|${repo_search}|${repo_repl}|w ${changes_file}"
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "${repo_regex}" \
|
|
{} \+
|
|
;;
|
|
|
|
uninstall)
|
|
repo_search="Server\s*=\s*http://HTTPS///"
|
|
repo_repl="Server = https://"
|
|
repo_regex="s|${repo_search}|${repo_repl}|w ${changes_file}"
|
|
find "${@}" -type f -exec sed -i \
|
|
-e "${repo_regex}" \
|
|
{} \+
|
|
;;
|
|
esac
|
|
|
|
else
|
|
## Gentoo: upstream does not have a good solution:
|
|
## https://wiki.gentoo.org/wiki/Local_distfiles_cache#Configuring_for_Gentoo
|
|
reject_os
|
|
fi
|
|
}
|
|
|
|
set_proxy_unspecific_os(){
|
|
if test -w /etc/PackageKit/PackageKit.conf; then
|
|
set_proxy_marker /etc/PackageKit/PackageKit.conf "ProxyHTTP=${proxy_url}"
|
|
fi
|
|
}
|
|
|
|
usage(){
|
|
echo "Usage: ${0##*/} [install|uninstall]"
|
|
echo "Note: autodetection occurs if not argument is specified"
|
|
exit 1
|
|
}
|
|
|
|
changes_file="$(mktemp)"
|
|
trap 'rm -f "${changes_file}"' HUP INT QUIT ABRT EXIT
|
|
|
|
if test -f /var/run/qubes-service/updates-proxy-setup ||
|
|
test -f /var/run/qubes-service/netvm-cacher
|
|
then
|
|
action="install"
|
|
else
|
|
action="uninstall"
|
|
fi
|
|
|
|
case "${1-}" in
|
|
install|uninstall) action="${1}";;
|
|
"") ;;
|
|
*) usage;;
|
|
esac
|
|
|
|
if test "$(id -u)" != "0"; then
|
|
echo "Error: Permission denied, action requires root privileges."
|
|
exit 1
|
|
fi
|
|
|
|
check_netvm_cacher
|
|
set_proxy_os
|
|
set_proxy_unspecific_os
|
|
|
|
## Stateful Salt cmd Module.
|
|
echo
|
|
if test -s "${changes_file}"; then
|
|
echo "changed=yes comment='configuration was modified'"
|
|
else
|
|
echo "changed=no comment='configuration remained untouched'"
|
|
fi
|
|
exit
|