aboutsummaryrefslogtreecommitdiff
#define _XOPEN_SOURCE 600

#include "config.h"

#include <cerrno>
#include <algorithm>
#include <vector>
#include <map>

#include <strings.h> // for strcasecmp

#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <dirent.h>
#include <fcntl.h>

#include "archive.hh"
#include "util.hh"


namespace nix {

static string archiveVersion1 = "nix-archive-1";

static string caseHackSuffix = "~nix~case~hack~";

PathFilter defaultPathFilter;


static void dumpContents(const Path & path, size_t size,
    Sink & sink)
{
    writeString("contents", sink);
    writeLongLong(size, sink);

    AutoCloseFD fd = open(path.c_str(), O_RDONLY);
    if (fd == -1) throw SysError(format("opening file `%1%'") % path);

    unsigned char buf[65536];
    size_t left = size;

    while (left > 0) {
        size_t n = left > sizeof(buf) ? sizeof(buf) : left;
        readFull(fd, buf, n);
        left -= n;
        sink(buf, n);
    }

    writePadding(size, sink);
}


static void dump(const Path & path, Sink & sink, PathFilter & filter)
{
    struct stat st;
    if (lstat(path.c_str(), &st))
        throw SysError(format("getting attributes of path `%1%'") % path);

    writeString("(", sink);

    if (S_ISREG(st.st_mode)) {
        writeString("type", sink);
        writeString("regular", sink);
        if (st.st_mode & S_IXUSR) {
            writeString("executable", sink);
            writeString("", sink);
        }
        dumpContents(path, (size_t) st.st_size, sink);
    }

    else if (S_ISDIR(st.st_mode)) {
        writeString("type", sink);
        writeString("directory", sink);

        /* If we're on a case-insensitive system like Mac OS X, undo
           the case hack applied by restorePath(). */
        std::map<string, string> unhacked;
        for (auto & i : readDirectory(path))
	    unhacked[i.name] = i.name;

        for (auto & i : unhacked)
            if (filter(path + "/" + i.first)) {
                writeString("entry", sink);
                writeString("(", sink);
                writeString("name", sink);
                writeString(i.first, sink);
                writeString("node", sink);
                dump(path + "/" + i.second, sink, filter);
                writeString(")", sink);
            }
    }

    else if (S_ISLNK(st.st_mode)) {
        writeString("type", sink);
        writeString("symlink", sink);
        writeString("target", sink);
        writeString(readLink(path), sink);
    }

    else throw Error(format("file `%1%' has an unsupported type") % path);

    writeString(")", sink);
}


void dumpPath(const Path & path, Sink & sink, PathFilter & filter)
{
    writeString(archiveVersion1, sink);
    dump(path, sink, filter);
}


static SerialisationError badArchive(string s)
{
    return SerialisationError("bad archive: " + s);
}


#if 0
static void skipGeneric(Source & source)
{
    if (readString(source) == "(") {
        while (readString(source) != ")")
            skipGeneric(source);
    }
}
#endif


static void parseContents(ParseSink & sink, Source & source, const Path & path)
{
    unsigned long long size = readLongLong(source);

    sink.preallocateContents(size);

    unsigned long long left = size;
    unsigned char buf[65536];

    while (left) {
        checkInterrupt();
        unsigned int n = sizeof(buf);
        if ((unsigned long long) n > left) n = left;
        source(buf, n);
        sink.receiveContents(buf, n);
        left -= n;
    }

    readPadding(size, source);
}


struct CaseInsensitiveCompare
{
    bool operator() (const string & a, const string & b) const
    {
        return strcasecmp(a.c_str(), b.c_str()) < 0;
    }
};


static void parse(ParseSink & sink, Source & source, const Path & path)
{
    string s;

    s = readString(source);
    if (s != "(") throw badArchive("expected open tag");

    enum { tpUnknown, tpRegular, tpDirectory, tpSymlink } type = tpUnknown;

    std::map<Path, int, CaseInsensitiveCompare> names;

    while (1) {
        checkInterrupt();

        s = readString(source);

        if (s == ")") {
            break;
        }

        else if (s == "type") {
            if (type != tpUnknown)
                throw badArchive("multiple type fields");
            string t = readString(source);

            if (t == "regular") {
                type = tpRegular;
                sink.createRegularFile(path);
            }

            else if (t == "directory") {
                sink.createDirectory(path);
                type = tpDirectory;
            }

            else if (t == "symlink") {
                type = tpSymlink;
            }

            else throw badArchive("unknown file type " + t);

        }

        else if (s == "contents" && type == tpRegular) {
            parseContents(sink, source, path);
        }

        else if (s == "executable" && type == tpRegular) {
            readString(source);
            sink.isExecutable();
        }

        else if (s == "entry" && type == tpDirectory) {
            string name, prevName;

            s = readString(source);
            if (s != "(") throw badArchive("expected open tag");

            while (1) {
                checkInterrupt();

                s = readString(source);

                if (s == ")") {
                    break;
                } else if (s == "name") {
                    name = readString(source);
                    if (name.empty() || name == "." || name == ".." || name.find('/') != string::npos || name.find((char) 0) != string::npos)
                        throw Error(format("NAR contains invalid file name `%1%'") % name);
                    if (name <= prevName)
                        throw Error("NAR directory is not sorted");
                    prevName = name;
                } else if (s == "node") {
                    if (s.empty()) throw badArchive("entry name missing");
                    parse(sink, source, path + "/" + name);
                } else
                    throw badArchive("unknown field " + s);
            }
        }

        else if (s == "target" && type == tpSymlink) {
            string target = readString(source);
            sink.createSymlink(path, target);
        }

        else
            throw badArchive("unknown field " + s);
    }
}


void parseDump(ParseSink & sink, Source & source)
{
    string version;
    try {
        version = readString(source);
    } catch (SerialisationError & e) {
        /* This generally means the integer at the start couldn't be
           decoded.  Ignore and throw the exception below. */
    }
    if (version != archiveVersion1)
        throw badArchive("input doesn't look like a normalized archive");
    parse(sink, source, "");
}


struct RestoreSink : ParseSink
{
    Path dstPath;
    AutoCloseFD fd;

    void createDirectory(const Path & path)
    {
        Path p = dstPath + path;
        if (mkdir(p.c_str(), 0777) == -1)
            throw SysError(format("creating directory `%1%'") % p);
    };

    void createRegularFile(const Path & path)
    {
        Path p = dstPath + path;
        fd.close();
        fd = open(p.c_str(), O_CREAT | O_EXCL | O_WRONLY, 0666);
        if (fd == -1) throw SysError(format("creating file `%1%'") % p);
    }

    void isExecutable()
    {
        struct stat st;
        if (fstat(fd, &st) == -1)
            throw SysError("fstat");
        if (fchmod(fd, st.st_mode | (S_IXUSR | S_IXGRP | S_IXOTH)) == -1)
            throw SysError("fchmod");
    }

    void preallocateContents(unsigned long long len)
    {
#if HAVE_POSIX_FALLOCATE
        if (len) {
            errno = posix_fallocate(fd, 0, len);
            /* Note that EINVAL may indicate that the underlying
               filesystem doesn't support preallocation (e.g. on
               OpenSolaris).  Since preallocation is just an
               optimisation, ignore it. */
            if (errno && errno != EINVAL)
                throw SysError(format("preallocating file of %1% bytes") % len);
        }
#endif
    }

    void receiveContents(unsigned char * data, unsigned int len)
    {
        writeFull(fd, data, len);
    }

    void createSymlink(const Path & path, const string & target)
    {
        Path p = dstPath + path;
        nix::createSymlink(target, p);
    }
};


void restorePath(const Path & path, Source & source)
{
    RestoreSink sink;
    sink.dstPath = path;
    parseDump(sink, source);
}


}
-file)))) ,(shepherd-service (documentation "Run Cuirass web interface.") (provision '(cuirass-web)) (requirement '(user-processes cuirass)) (start #~(make-forkexec-constructor (list (string-append #$cuirass "/bin/cuirass") "web" "--database" #$database "--listen" #$host "--port" #$(number->string port) #$@(if parameters (list (string-append "--parameters=" parameters)) '()) #$@web-extra-options) #:user #$user #:group #$group #:log-file #$web-log-file)) (stop #~(make-kill-destructor))) ,@(if remote-server (match-record remote-server <cuirass-remote-server-configuration> (backend-port publish-port log-file log-expiry cache publish? trigger-url public-key private-key) (list (shepherd-service (documentation "Run Cuirass remote build server.") (provision '(cuirass-remote-server)) (requirement '(user-processes avahi-daemon cuirass)) (start #~(make-forkexec-constructor (list (string-append #$cuirass "/bin/cuirass") "remote-server" (string-append "--database=" #$database) (string-append "--cache=" #$cache) (string-append "--user=" #$user) (string-append "--log-expiry=" #$(number->string log-expiry) "s") #$@(if backend-port (list (string-append "--backend-port=" (number->string backend-port))) '()) #$@(if publish-port (list (string-append "--publish-port=" (number->string publish-port))) '()) #$@(if parameters (list (string-append "--parameters=" parameters)) '()) #$@(if trigger-url (list (string-append "--trigger-substitute-url=" trigger-url)) '()) #$@(if publish? '() (list "--no-publish")) #$@(if public-key (list (string-append "--public-key=" public-key)) '()) #$@(if private-key (list (string-append "--private-key=" private-key)) '())) #:log-file #$log-file)) (stop #~(make-kill-destructor))))) '())))) (define (cuirass-account config) "Return the user accounts and user groups for CONFIG." (let ((cuirass-user (cuirass-configuration-user config)) (cuirass-group (cuirass-configuration-group config))) (list (user-group (name cuirass-group) (system? #t)) (user-account (name cuirass-user) (group cuirass-group) (system? #t) (comment "Cuirass privilege separation user") (home-directory (string-append "/var/lib/" cuirass-user)) (shell (file-append shadow "/sbin/nologin")))))) (define (cuirass-postgresql-role config) (let ((user (cuirass-configuration-user config))) (list (postgresql-role (name user) (create-database? #t))))) (define (cuirass-activation config) "Return the activation code for CONFIG." (let* ((cache (cuirass-configuration-cache-directory config)) (remote-server (cuirass-configuration-remote-server config)) (remote-cache (and remote-server (cuirass-remote-server-configuration-cache remote-server))) (user (cuirass-configuration-user config)) ;; RUNSTATEDIR contains the "bridge" Unix-domain socket that 'cuirass ;; web' connects to to communicate with 'cuirass register'. (runstatedir "/var/run/cuirass") (log "/var/log/cuirass") (profile (string-append "/var/guix/profiles/per-user/" user)) (roots (string-append profile "/cuirass")) (group (cuirass-configuration-group config))) (with-imported-modules '((guix build utils)) #~(begin (use-modules (guix build utils)) (mkdir-p #$cache) (mkdir-p #$log) (mkdir-p #$roots) (mkdir-p #$runstatedir) (when #$remote-cache (mkdir-p #$remote-cache)) (let ((uid (passwd:uid (getpw #$user))) (gid (group:gid (getgr #$group)))) (chown #$cache uid gid) (chown #$log uid gid) (chown #$roots uid gid) (chown #$profile uid gid) (chown #$runstatedir uid gid) (chmod #$runstatedir #o700) (when #$remote-cache (chown #$remote-cache uid gid))))))) (define (cuirass-log-rotations config) "Return the list of log rotations that corresponds to CONFIG." (list (log-rotation (files (append (list (cuirass-configuration-log-file config) (cuirass-configuration-web-log-file config)) (let ((server (cuirass-configuration-remote-server config))) (if server (list (cuirass-remote-server-log-file server)) '())))) (frequency 'weekly) (options `("rotate 40" ;worth keeping ,@%default-log-rotation-options))))) (define cuirass-service-type (service-type (name 'cuirass) (extensions (list (service-extension profile-service-type ;for 'info cuirass' (compose list cuirass-configuration-cuirass)) (service-extension rottlog-service-type cuirass-log-rotations) (service-extension activation-service-type cuirass-activation) (service-extension shepherd-root-service-type cuirass-shepherd-service) (service-extension account-service-type cuirass-account) ;; Make sure postgresql and postgresql-role are instantiated. (service-extension postgresql-service-type (const #t)) (service-extension postgresql-role-service-type cuirass-postgresql-role))) (description "Run the Cuirass continuous integration service."))) (define-record-type* <cuirass-remote-worker-configuration> cuirass-remote-worker-configuration make-cuirass-remote-worker-configuration cuirass-remote-worker-configuration? (cuirass cuirass-remote-worker-configuration-cuirass ;file-like (default cuirass)) (workers cuirass-remote-worker-workers ;int (default 1)) (server cuirass-remote-worker-server ;string (default #f)) (systems cuirass-remote-worker-systems ;list (default (list (%current-system)))) (log-file cuirass-remote-worker-log-file ;string (default "/var/log/cuirass-remote-worker.log")) (publish-port cuirass-remote-worker-configuration-publish-port ;int (default 5558)) (substitute-urls cuirass-remote-worker-configuration-substitute-urls (default %default-substitute-urls)) ;list of strings (public-key cuirass-remote-worker-configuration-public-key ;string (default #f)) (private-key cuirass-remote-worker-configuration-private-key ;string (default #f))) (define %cuirass-remote-worker-accounts ;; User account and group for the 'cuirass remote-worker' process. (list (user-group (name "cuirass-worker") (system? #t)) (user-account (name "cuirass-worker") (group name) (system? #t) (comment "Cuirass worker privilege separation user") (home-directory "/var/empty") (shell (file-append shadow "/sbin/nologin"))))) (define (cuirass-remote-worker-shepherd-service config) "Return a <shepherd-service> for the Cuirass remote worker service with CONFIG." (match-record config <cuirass-remote-worker-configuration> (cuirass workers server systems log-file publish-port substitute-urls public-key private-key) (list (shepherd-service (documentation "Run Cuirass remote build worker.") (provision '(cuirass-remote-worker)) (requirement '(user-processes avahi-daemon guix-daemon networking)) (start #~(make-forkexec-constructor (list (string-append #$cuirass "/bin/cuirass") "remote-worker" "--user=cuirass-worker" ;drop privileges early on (string-append "--workers=" #$(number->string workers)) #$@(if server (list (string-append "--server=" server)) '()) #$@(if systems (list (string-append "--systems=" (string-join systems ","))) '()) #$@(if publish-port (list (string-append "--publish-port=" (number->string publish-port))) '()) #$@(if substitute-urls (list (string-append "--substitute-urls=" (string-join substitute-urls))) '()) #$@(if public-key (list (string-append "--public-key=" public-key)) '()) #$@(if private-key (list (string-append "--private-key=" private-key)) '())) #:log-file #$log-file)) (stop #~(make-kill-destructor)))))) (define (cuirass-remote-worker-log-rotations config) "Return the list of log rotations that corresponds to CONFIG." (list (log-rotation (files (list (cuirass-remote-worker-log-file config))) (frequency 'weekly) (options `("rotate 4" ;don't keep too many of them ,@%default-log-rotation-options))))) (define cuirass-remote-worker-service-type (service-type (name 'cuirass-remote-worker) (extensions (list (service-extension shepherd-root-service-type cuirass-remote-worker-shepherd-service) (service-extension account-service-type (const %cuirass-remote-worker-accounts)) (service-extension rottlog-service-type cuirass-remote-worker-log-rotations))) (description "Run the Cuirass remote build worker service.")))