diff -Nru sks-1.1.5/debian/patches/202_makefile_bytecode.patch sks-1.1.5/debian/patches/202_makefile_bytecode.patch --- sks-1.1.5/debian/patches/202_makefile_bytecode.patch 2016-05-07 00:13:34.000000000 +0000 +++ sks-1.1.5/debian/patches/202_makefile_bytecode.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,35 +0,0 @@ -From: Christoph Martin -Date: Fri, 6 May 2016 14:55:00 -0400 -Subject: _makefile_bytecode - ---- - Makefile | 2 +- - bdb/Makefile | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/Makefile b/Makefile -index 8bc3787..49bb386 100644 ---- a/Makefile -+++ b/Makefile -@@ -140,7 +140,7 @@ install: - - install.bc: - mkdir -p $(PREFIX)/bin -- install sks_build.bc.sh sks.bc sks_add_mail.bc $(PREFIX)/bin -+ install sks_build.bc sks.bc sks_add_mail.bc $(PREFIX)/bin - mkdir -p $(MANDIR)/man8 - install sks.8.gz $(MANDIR)/man8 - -diff --git a/bdb/Makefile b/bdb/Makefile -index fcb9063..e136c38 100644 ---- a/bdb/Makefile -+++ b/bdb/Makefile -@@ -36,7 +36,7 @@ endif - COBJS = bdb_stubs.o - - ocextr: ocextr.ml -- $(OCAMLOPT) -o ocextr ocextr.ml -+ $(OCAMLC) -o ocextr ocextr.ml - - libbdb.a: $(COBJS) - $(MKLIB) -custom -o bdb $(COBJS) diff -Nru sks-1.1.5/debian/patches/500_debian_fhs.patch sks-1.1.5/debian/patches/500_debian_fhs.patch --- sks-1.1.5/debian/patches/500_debian_fhs.patch 2016-05-07 00:13:34.000000000 +0000 +++ sks-1.1.5/debian/patches/500_debian_fhs.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,130 +0,0 @@ -From: Christoph Martin -Date: Fri, 6 May 2016 14:55:00 -0400 -Subject: _debian_fhs - ---- - common.ml | 6 +++--- - dbserver.ml | 2 +- - getfileopts.ml | 2 +- - reconserver.ml | 4 ++-- - settings.ml | 20 ++++++++++---------- - 5 files changed, 17 insertions(+), 17 deletions(-) - -diff --git a/common.ml b/common.ml -index f7d3c6b..b3cc726 100644 ---- a/common.ml -+++ b/common.ml -@@ -96,7 +96,7 @@ let plerror level format = - - let set_logfile extension = - if !Settings.filelog then -- let fname = (Filename.concat !Settings.basedir extension) ^ ".log" in -+ let fname = (Filename.concat !Settings.basedir "/var/log/sks/") ^ extension ^ ".log" in - stored_logfile_name := Some fname; - logfile := open_out_gen [ Open_wronly; Open_creat; Open_append; ] - 0o600 fname; -@@ -224,8 +224,8 @@ let recon_port = !Settings.recon_port - let recon_address = !Settings.recon_address - let http_port = !Settings.hkp_port - let http_address = !Settings.hkp_address --let db_command_name = Filename.concat !Settings.basedir "db_com_sock" --let recon_command_name = Filename.concat !Settings.basedir "recon_com_sock" -+let db_command_name = Filename.concat !Settings.basedir "/var/run/sks/db_com_sock" -+let recon_command_name = Filename.concat !Settings.basedir "/var/run/sks/recon_com_sock" - - let db_command_addr = Unix.ADDR_UNIX db_command_name - let recon_command_addr = Unix.ADDR_UNIX recon_command_name -diff --git a/dbserver.ml b/dbserver.ml -index 583c484..d2cab69 100644 ---- a/dbserver.ml -+++ b/dbserver.ml -@@ -419,7 +419,7 @@ struct - - let convert_web_fname fname = - if verify_web_fname fname then -- Filename.concat !Settings.basedir (Filename.concat "web" fname) -+ Filename.concat !Settings.basedir (Filename.concat "/var/lib/sks/www" fname) - else raise (Wserver.Misc_error "Malformed requst") - - let supported_extensions = -diff --git a/getfileopts.ml b/getfileopts.ml -index 4b511b8..da97f4f 100644 ---- a/getfileopts.ml -+++ b/getfileopts.ml -@@ -110,7 +110,7 @@ let fname_convert fname = - (**************************************************************) - (**************************************************************) - --let config_fname = "sksconf" -+let config_fname = "/etc/sks/sksconf" - - let parse args = - Arg.current := 0; -diff --git a/reconserver.ml b/reconserver.ml -index c0ed738..02ec9e2 100644 ---- a/reconserver.ml -+++ b/reconserver.ml -@@ -203,7 +203,7 @@ struct - let elements = ZSet.elements results in - let hashes = hashconvert elements in - print_hashes (sockaddr_to_string http_addr) hashes; -- log_diffs (sprintf "diff-%s.txt" (sockaddr_to_name http_addr)) hashes; -+ log_diffs (sprintf "/var/spool/sks/diff-%s.txt" (sockaddr_to_name http_addr)) hashes; - if List.length elements > 0 - then - begin -@@ -240,7 +240,7 @@ struct - plerror 4 "Reconciliation complete"; - let hashes = hashconvert results in - print_hashes (sockaddr_to_string http_addr) hashes; -- log_diffs (sprintf "diff-%s.txt" (sockaddr_to_name http_addr)) hashes; -+ log_diffs (sprintf "/var/spool/sks/diff-%s.txt" (sockaddr_to_name http_addr)) hashes; - match results with - [] -> [] - | _ -> -diff --git a/settings.ml b/settings.ml -index b66f9af..ea3e95f 100644 ---- a/settings.ml -+++ b/settings.ml -@@ -200,7 +200,7 @@ let set_missing_keys_timeout value = missing_keys_timeout := value - let command_timeout = ref 60 - let set_command_timeout value = command_timeout := value - --let sendmail_cmd = ref "sendmail -t -oi" -+let sendmail_cmd = ref "/usr/lib/sendmail -t -oi" - let set_sendmail_cmd value = sendmail_cmd := value - - let membership_reload_time = ref (60. *. 60. *. 6.) -@@ -226,15 +226,15 @@ let get_from_addr () = - - let use_stdin = ref false - --let basedir = ref "." -+let basedir = ref "" - --let base_dbdir = "KDB" --let base_ptree_dbdir = "PTree" --let base_membership_file = "membership" --let base_mailsync_file = "mailsync" --let base_dumpdir = "dump" --let base_msgdir = "messages" --let base_failed_msgdir = "failed_messages" -+let base_dbdir = "/var/lib/sks/DB" -+let base_ptree_dbdir = "/var/lib/sks/PTree" -+let base_membership_file = "/etc/sks/membership" -+let base_mailsync_file = "/etc/sks/mailsync" -+let base_dumpdir = "/var/lib/sks/dump" -+let base_msgdir = "/var/spool/sks/messages" -+let base_failed_msgdir = "/var/spool/sks/failed_messages" - - let dbdir = lazy (Filename.concat !basedir base_dbdir) - let ptree_dbdir = lazy (Filename.concat !basedir base_ptree_dbdir) -@@ -290,7 +290,7 @@ let parse_spec = - ("-hkp_address",Arg.String set_hkp_address, " Set hkp binding address by hostname or IP"); - ("-use_port_80",Arg.Set use_port_80, - " Have the HKP interface listen on port 80, as well as the hkp_port"); -- ("-basedir", Arg.Set_string basedir, " Base directory"); -+ ("-basedir", Arg.Set_string basedir, " Base directory (Take special care if running the Debian package!)"); - ("-stdoutlog", Arg.Clear filelog, - " Send log messages to stdout instead of log file"); - ("-diskptree", Arg.Set disk_ptree, diff -Nru sks-1.1.5/debian/patches/501_makefile_cflags.patch sks-1.1.5/debian/patches/501_makefile_cflags.patch --- sks-1.1.5/debian/patches/501_makefile_cflags.patch 2016-05-07 00:13:34.000000000 +0000 +++ sks-1.1.5/debian/patches/501_makefile_cflags.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,94 +0,0 @@ -From: Christoph Martin -Date: Fri, 6 May 2016 14:55:01 -0400 -Subject: _makefile_cflags - -This now includes a patch to make the binaries have a read-only -relocation section. ---- - Makefile | 38 +++++++------------------------------- - 1 file changed, 7 insertions(+), 31 deletions(-) - -diff --git a/Makefile b/Makefile -index 49bb386..226295f 100644 ---- a/Makefile -+++ b/Makefile -@@ -45,6 +45,9 @@ else - OCAMLLIB= -ccopt $(BDBLIB) - endif - -+# FIXME: make this optional/dependent on the hardening flags? -+RELRO=-ccopt -Wl,-z,relro -+ - SKSVS=$(shell grep 'version_suffix = "+"' common.ml) - ifeq ($(strip $(SKSVS)),) - WARNERR= -@@ -53,8 +56,8 @@ WARNERR=-warn-error A - endif - - CAMLP4=-pp $(CAMLP4O) --CAMLINCLUDE= -I lib -I bdb --COMMONCAMLFLAGS=$(CAMLINCLUDE) $(OCAMLLIB) -ccopt -Lbdb -dtypes $(WARNERR) -+CAMLINCLUDE= -I lib -I bdb -I +cryptokit -+COMMONCAMLFLAGS=$(CAMLINCLUDE) $(OCAMLLIB) $(RELRO) -ccopt -Lbdb -dtypes $(WARNERR) - OCAMLDEP=ocamldep $(CAMLP4) - CAMLLIBS=unix.cma str.cma bdb.cma nums.cma bigarray.cma cryptokit.cma - OCAMLFLAGS=$(COMMONCAMLFLAGS) -g $(CAMLLIBS) -@@ -107,7 +110,7 @@ ALLOBJS=$(ALLOBJS.bc:.cmo=.cmx) - - EXEOBJS.bc=$(RSERVOBJS.bc) build.cmo fastbuild.cmo dbserver.cmo pdiskTest.cmo - --LIBS.bc= lib/cryptokit.cma bdb/bdb.cma -+LIBS.bc= bdb/bdb.cma - LIBS=$(LIBS.bc:.cma=.cmxa) - - VERSION := $(shell cat VERSION) -@@ -218,7 +221,7 @@ sks_add_mail.bc: pMap.cmo pSet.cmo add_mail.cmo - pMap.cmo pSet.cmo add_mail.cmo - - sks_add_mail: $(LIBS) pMap.cmx pSet.cmx add_mail.cmx -- $(OCAMLOPT) -o sks_add_mail unix.cmxa \ -+ $(OCAMLOPT) -o sks_add_mail $(RELRO) unix.cmxa \ - pMap.cmx pSet.cmx add_mail.cmx - - ocamldoc.out: $(ALLOBJS) $(EXEOBJS) -@@ -278,32 +281,6 @@ prepared: - touch prepared - - --CKVER=cryptokit-1.7 --CKDIR=$(CKVER)/src -- --$(CKVER)/README.txt: -- tar xmvfz $(CKVER).tar.gz -- patch -p 0 < $(CKVER)-sks.patch -- patch -p 0 < $(CKVER)-sks-custom_compare.patch -- --$(CKDIR)/cryptokit.cma: $(CKVER)/README.txt -- cd $(CKDIR) && $(MAKE) all -- --$(CKDIR)/cryptokit.cmxa: $(CKVER)/README.txt -- cd $(CKDIR) && $(MAKE) allopt -- --lib/cryptokit.cma: $(CKDIR)/cryptokit.cma $(CKDIR)/cryptokit.cmxa prepared -- cp $(CKDIR)/cryptokit.cmi $(CKDIR)/cryptokit.cma \ -- $(CKDIR)/cryptokit.mli lib -- cp $(CKDIR)/libcryptokit.a lib -- if test -f $(CKDIR)/dllcryptokit.so; then \ -- cp $(CKDIR)/dllcryptokit.so lib; fi -- if test -f $(CKDIR)/cryptokit.cmxa; then \ -- cp $(CKDIR)/cryptokit.cmxa $(CKDIR)/cryptokit.cmx \ -- $(CKDIR)/cryptokit.a lib; fi -- --lib/cryptokit.cmxa: lib/cryptokit.cma -- - ################################ - # old stuff - ################################ -@@ -402,7 +379,6 @@ clean: mlclean - - cleanall: clean bdbclean - rm -f lib/* -- rm -rf $(CKVER) - - distclean: cleanall - rm -rf Makefile.local diff -Nru sks-1.1.5/debian/patches/502_makefile_install.patch sks-1.1.5/debian/patches/502_makefile_install.patch --- sks-1.1.5/debian/patches/502_makefile_install.patch 2016-05-07 00:13:34.000000000 +0000 +++ sks-1.1.5/debian/patches/502_makefile_install.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,43 +0,0 @@ -From: Christoph Martin -Date: Fri, 6 May 2016 14:55:01 -0400 -Subject: _makefile_install - ---- - Makefile | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/Makefile b/Makefile -index 226295f..76e968b 100644 ---- a/Makefile -+++ b/Makefile -@@ -136,14 +136,17 @@ keyMerge.cmx: keyMerge.ml - # Special targets - - install: -- mkdir -p $(PREFIX)/bin -- install sks_build.sh sks sks_add_mail $(PREFIX)/bin -+ mkdir -p $(PREFIX)/sbin $(PREFIX)/lib/sks -+ install sks $(PREFIX)/sbin -+ install sks_build.sh sks_add_mail $(PREFIX)/lib/sks - mkdir -p $(MANDIR)/man8 - install sks.8.gz $(MANDIR)/man8 - - install.bc: -- mkdir -p $(PREFIX)/bin -- install sks_build.bc sks.bc sks_add_mail.bc $(PREFIX)/bin -+ mkdir -p $(PREFIX)/sbin $(PREFIX)/lib/sks -+ install sks.bc $(PREFIX)/sbin/sks -+ install sks_build.sh $(PREFIX)/lib/sks/ -+ install sks_add_mail.bc $(PREFIX)/lib/sks/sks_add_mail - mkdir -p $(MANDIR)/man8 - install sks.8.gz $(MANDIR)/man8 - -@@ -159,7 +162,7 @@ src: - # Ordinary targets - - sks.8.gz: sks.8 -- gzip -f sks.8 -+ gzip -9 -f sks.8 - - sks.8: sks.pod - pod2man -c "SKS OpenPGP Key server" --section 8 -r 0.1 -name sks sks.pod sks.8 diff -Nru sks-1.1.5/debian/patches/series sks-1.1.5/debian/patches/series --- sks-1.1.5/debian/patches/series 2016-05-07 00:16:09.000000000 +0000 +++ sks-1.1.5/debian/patches/series 2016-05-11 19:27:06.000000000 +0000 @@ -1,11 +1,12 @@ -202_makefile_bytecode.patch -500_debian_fhs.patch -501_makefile_cflags.patch -502_makefile_install.patch -0006-Add-support-for-EdDSA-key-using-Ed25519-signature-sc.patch -0007-Keydb.add_keys-use-List.rev_map-instead-of-List.map-.patch -0008-Build.get_keys-make-it-tail-recursive.patch -0009-parsePGP.ml-Add-OID-for-Curve25519-encryption.patch -0010-Avoid-deprecated-ocaml.patch -0011-Avoid-sending-web-clients-to-third-party-resources.patch -0011-Correct-invalid-md5sum-file.patch +0001-use-debian-fhs.patch +0002-use-system-cryptokit.patch +0003-Add-support-for-EdDSA-key-using-Ed25519-signature-sc.patch +0004-Keydb.add_keys-use-List.rev_map-instead-of-List.map-.patch +0005-Build.get_keys-make-it-tail-recursive.patch +0006-parsePGP.ml-Add-OID-for-Curve25519-encryption.patch +0007-Avoid-deprecated-ocaml.patch +0008-Avoid-sending-web-clients-to-third-party-resources.patch +0009-Correct-invalid-md5sum-file.patch +0010-make-ocextr-as-bytecode-rather-than-native.patch +0011-pull-LDFLAGS-from-environment.patch +0012-remove-YOURDOMAIN-from-sample-web-index.patch diff -Nru sks-1.1.5/debian/README.Debian sks-1.1.5/debian/README.Debian --- sks-1.1.5/debian/README.Debian 2016-05-06 21:39:55.000000000 +0000 +++ sks-1.1.5/debian/README.Debian 2016-05-11 18:49:15.000000000 +0000 @@ -1,33 +1,53 @@ -Some hints to setup your keyserver: +If you've never set up the database before, we ship a simple script to +walk you through the process of fetching a keydump, importing it, and +enabling the service: -If you install a new keyserver you might need a fresh keydump to start -with. At the time of this writing you could get one from + su - debian-sks -c /usr/share/sks/sks-db-setup -http://ftp.prato.linux.it/pub/keyring/dump-latest/ +If you want to connect your server to the global network of SKS +keyservers (you probably do if you're running this daemon publicly), +you should subscribe to the SKS mailing list +(https://lists.nongnu.org/mailman/listinfo/sks-devel/) and ask for +gossip partners. -If you don't find one feel free to ask on the SKS mailing list. +Include the partners in /etc/sks/membership; running daemons will +notice automatically when that file changes. -You can retrieve the keydump by executing following commands as the -root user (or just su to debian-sks user)): + ----- - cd /var/lib/sks/dump - su debian-sks -c "wget -q -r -np -nd -A pgp http://ftp.prato.linux.it/pub/keyring/dump-latest/ -e robots=off" +What does the script do? -To build the database from the keydumps call: +It tries to fetch a full keydump from: - su debian-sks -c "/usr/lib/sks/sks_build.sh" + https://pgp.key-server.io/sks-dump/ -To make the server start you have to edit the defaults file: +or from the keydump location you pass to it -- if this one's not +working for you, feel free to ask on the SKS mailing list. - vi /etc/default/sks +It puts the dumps in /var/lib/sks/dump, owned by the debian-sks user, +and then (also as that user) runs /usr/lib/sks/sks_build.sh to import +them. -If you want to connect to the global sks-network, send a mail to -pgp-keyserver-folk@flame.org or sks-devel@nongnu.org and ask for -gossip partners. Include the partners in /etc/sks/membership. + ---- ------ +But the daemons are still not running, even if the db is set up. +Running the daemons under systemd is recommended. To enable them (so +that they will start at every boot): -Thanks to Peter Palfrader for building the -original Debian package. + systemctl enable sks.service - -- Ondřej Surý , Thu, 19 May 2011 11:55:48 +0200 +To start them up: + + systemctl start sks.service + +If you're using the System V init system, you'll need to enable the +daemons by editing /etc/default/sks, and start and stop them using the +invoke-rc.d or service commands. + + ----- + +For recommended modes of public operation, please see: + + https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Peering + + -- Daniel Kahn Gillmor , Wed, 11 May 2016 02:38:17 -0400 diff -Nru sks-1.1.5/debian/README.patches sks-1.1.5/debian/README.patches --- sks-1.1.5/debian/README.patches 2016-05-06 21:39:55.000000000 +0000 +++ sks-1.1.5/debian/README.patches 1970-01-01 00:00:00.000000000 +0000 @@ -1,6 +0,0 @@ -000 - stolen from HEAD -100 - 199 patches that upstream accepted -200 - 399 patches that should go upstream -400 - 499 patches that upstream rejected, but that we want anyway -500 - 899 debian specific patches -900 - 999 security patches diff -Nru sks-1.1.5/debian/rules sks-1.1.5/debian/rules --- sks-1.1.5/debian/rules 2016-05-07 00:07:23.000000000 +0000 +++ sks-1.1.5/debian/rules 2016-05-12 06:24:16.000000000 +0000 @@ -4,7 +4,6 @@ OCAMLABI = $(shell ocamlc -version) BYTECODE = $(shell [ -x /usr/bin/ocamlopt ] || echo yes) all = $(if $(BYTECODE),all.bc,all) -install = $(if $(BYTECODE),install.bc,install) OCAMLRUN = $(if $(BYTECODE),ocaml-base-nox-$(OCAMLABI)) export DEB_BUILD_OPTIONS += $(if $(BYTECODE)," nostrip",) @@ -29,10 +28,10 @@ [ -n "$(BDB_VERSION)" ] echo $(BDB_VERSION) > debian/berkeley_db.txt dh_auto_build -v -- $(all) + $(if $(BYTECODE), $(foreach x, sks sks_add_mail, mv $(x).bc $(x);)) + chmod a+x sks_build.sh override_dh_auto_install: -# dh_auto_install -v -- PREFIX="$(TMP)/usr" MANDIR="$(TMP)/usr/share/man" $(install) - $(MAKE) PREFIX="$(TMP)/usr" MANDIR="$(TMP)/usr/share/man" $(install) override_dh_gencontrol: dh_gencontrol -- -Vbdb:Depends="db$(BDB_VERSION)-util" diff -Nru sks-1.1.5/debian/sks-db-setup sks-1.1.5/debian/sks-db-setup --- sks-1.1.5/debian/sks-db-setup 1970-01-01 00:00:00.000000000 +0000 +++ sks-1.1.5/debian/sks-db-setup 2016-05-11 18:49:15.000000000 +0000 @@ -0,0 +1,50 @@ +#!/bin/sh + +set -e + +dump_source="${1:-https://pgp.key-server.io/sks-dump/}" + +if [ "$(id -un)" != debian-sks ]; then + printf "SKS db setup script (%s) should only be run by debian-sks user\n" "$0" >&2 + exit 1 +fi + +for dbloc in /var/lib/sks/DB /var/lib/sks/PTree; do + if [ -e "$dbloc" ]; then + printf "Database location %s is already present; you have probably already set up SKS.\nAborting $0\n" "$dbloc" "$0" >&2 + exit 1 + fi +done + +if ls /var/lib/sks/dump/*.pgp 2>/dev/null >/dev/null; then + printf "It looks like a keydump has already been fetched, so we will skip that part.\nIf you want a fresh keydump, remove the following files and re-run %s\n" "$0" >&2 + ls /var/lib/sks/dump/*.pgp >&2 +else + printf "Fetching keydump from %s to /var/lib/sks/dump...\n" "$dump_source" + + (cd /var/lib/sks/dump && + wget --quiet -recursive --no-parent --no-directories \ + --accept pgp --execute robots=off "$dump_source") +fi +/usr/lib/sks/sks_build.sh + +cat >&2 < +(https://lists.nongnu.org/mailman/listinfo/sks-devel/) and read the +current advice on server configuration: + + https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Peering + +EOF diff -Nru sks-1.1.5/debian/sks-db-upgrade sks-1.1.5/debian/sks-db-upgrade --- sks-1.1.5/debian/sks-db-upgrade 1970-01-01 00:00:00.000000000 +0000 +++ sks-1.1.5/debian/sks-db-upgrade 2016-05-11 18:49:15.000000000 +0000 @@ -0,0 +1,72 @@ +#!/bin/sh + +set -e + +if [ "$(id -un)" != debian-sks ]; then + printf "SKS db upgrade script (%s) should only be run by debian-sks user\n" "$0" >&2 + exit 1 +fi + +# Read the active Berkeley DB version, fall back to 4.7 if not found +if [ -r /var/lib/sks/berkeley_db.active ]; then + OLD_BDB=$(cat /var/lib/sks/berkeley_db.active) +else + OLD_BDB=4.7 +fi + +# Read the compiled-in Berkeley DB version +NEW_BDB=$(cat /usr/lib/sks/berkeley_db.txt) + +if [ "$OLD_BDB" != "$NEW_BDB" ]; then + + # Upgrade Berkeley DB in place + BACKUP_DIR=/var/backups/sks/$(date +%Y%m%d-%H%M%S) + SKS_DIR=/var/lib/sks + mkdir -p "$BACKUP_DIR" + + for DBHOME in DB PTree; do + + # Don't run if the database directory doesn't exist + [ ! -d "${SKS_DIR}/${DBHOME}" ] && continue + + # Create backup directory + mkdir -p "${BACKUP_DIR}/${DBHOME}" + + if [ -x /usr/bin/db${OLD_BDB}_recover ]; then + # Run recover with old tools + "db${OLD_BDB}_recover" -h "${SKS_DIR}/${DBHOME}" + # Backup needed log files + LOG_FILES=$("db${OLD_BDB}_archive" -h "${SKS_DIR}/${DBHOME}" -l) + else + # If we don't have the Berkeley DB tools then backup all log files + LOG_FILES=$(cd "${SKS_DIR}/${DBHOME}"; ls -1 | grep -E "^log\." || true) + fi + + # Backup log files + for log_file in ${LOG_FILES}; do + cp -a "${SKS_DIR}/${DBHOME}/$log_file" "${BACKUP_DIR}/${DBHOME}/" + done + + if [ -e "${SKS_DIR}/${DBHOME}/DB_CONFIG" ]; then + cp -a "${SKS_DIR}/${DBHOME}/DB_CONFIG" "${BACKUP_DIR}/${DBHOME}/" + fi + + # Backup & upgrade database files + for db in $(cd "${SKS_DIR}/${DBHOME}"; ls -1 | grep -Ev "^(__|log\.|DB_CONFIG$)" || true); do + # Backup database file + cp "${SKS_DIR}/${DBHOME}/${db}" "${BACKUP_DIR}/${DBHOME}/" + # Upgrade database file + "db${NEW_BDB}_upgrade" -h "${SKS_DIR}/${DBHOME}" "${SKS_DIR}/${DBHOME}/$db"; + done + + # Set checkpoint and delete old logfiles + "db${NEW_BDB}_checkpoint" -h "${SKS_DIR}/${DBHOME}" -1 + "db${NEW_BDB}_archive" -h "${SKS_DIR}/${DBHOME}" -d + done + + # Note the active Berkeley DB version + cp -f /usr/lib/sks/berkeley_db.txt /var/lib/sks/berkeley_db.active + +elif [ ! -e /var/lib/sks/berkeley_db.active ]; then + cp -f /usr/lib/sks/berkeley_db.txt /var/lib/sks/berkeley_db.active +fi diff -Nru sks-1.1.5/debian/sks.install sks-1.1.5/debian/sks.install --- sks-1.1.5/debian/sks.install 2016-05-07 00:07:17.000000000 +0000 +++ sks-1.1.5/debian/sks.install 2016-05-11 18:49:15.000000000 +0000 @@ -1,3 +1,11 @@ debian/berkeley_db.txt usr/lib/sks debian/debcfg/* etc/sks +debian/sks-db-setup usr/share/sks +debian/sks-db-upgrade usr/share/sks debian/sks-recon.service lib/systemd/system +sks usr/sbin +sks_add_mail usr/lib/sks +sks_build.sh usr/lib/sks +sampleWeb/HTML5/index.html var/lib/sks/www +sampleWeb/HTML5/robots.txt var/lib/sks/www +sampleWeb/HTML5/README var/lib/sks/www diff -Nru sks-1.1.5/debian/sks.manpages sks-1.1.5/debian/sks.manpages --- sks-1.1.5/debian/sks.manpages 1970-01-01 00:00:00.000000000 +0000 +++ sks-1.1.5/debian/sks.manpages 2016-05-11 18:49:15.000000000 +0000 @@ -0,0 +1 @@ +sks.8.gz diff -Nru sks-1.1.5/debian/sks.postinst sks-1.1.5/debian/sks.postinst --- sks-1.1.5/debian/sks.postinst 2016-05-06 21:39:55.000000000 +0000 +++ sks-1.1.5/debian/sks.postinst 2016-05-11 18:49:15.000000000 +0000 @@ -38,114 +38,26 @@ debian-sks fi -if [ "$2" = "" ]; then - # ch{owning,moding} things around - # note that sks creates files/dirs with 600/700 - # permissions as default. so let's stick with it for the - # installation. We will do nothing across upgrades. - for i in lib log spool; do - chown -R debian-sks:debian-sks /var/$i/sks - chmod -R 700 /var/$i/sks - find /var/$i/sks -type f -exec chmod 600 '{}' ';' - done - chgrp -R adm /var/log/sks - chmod -R g+rX /var/log/sks - chmod g+s /var/log/sks +if [ "$1" = "configure" ]; then + if [ "$2" = "" ]; then # This is a new install + # ensure the top-level directories that sks needs write access + # to are properly owned by debian-sks + for i in lib log spool; do + chown debian-sks:debian-sks /var/$i/sks + chmod 0700 /var/$i/sks + done + chgrp adm /var/log/sks + chmod g+rX /var/log/sks + chmod g+s /var/log/sks + + # Note the active Berkeley DB version + su debian-sks -c "cp -f /usr/lib/sks/berkeley_db.txt /var/lib/sks/berkeley_db.active" + else + mkdir -m 0700 -p /var/backups/sks + chown debian-sks:debian-sks /var/backups/sks + chmod 0700 /var/backups/sks - # Note the active Berkeley DB version - cp -f /usr/lib/sks/berkeley_db.txt /var/lib/sks/berkeley_db.active -else - if [ "$1" = "configure" ]; then - # fix permissions of logs after 1.0.9-0.1 - if dpkg --compare-versions "$2" lt "1.0.9-0.2" ; then - chgrp -R adm /var/log/sks - chmod -R g+rX /var/log/sks - chmod g+s /var/log/sks - fi - # 1.0.10 renamed log files from /var/log/sks/sks.foo.log to /var/log/sks/foo.log, - # so be nice and rename things for the admin. - if dpkg --compare-versions "$2" lt "1.0.10" ; then - for i in `ls -1 /var/log/sks/`; do - if echo "$i" | grep -q '^sks\.'; then - mv /var/log/sks/"$i" /var/log/sks/`echo "$i" | sed -e 's/^sks.//'` - fi - done - fi - - # Read the active Berkeley DB version, fall back to 4.7 if not found - if [ -r /var/lib/sks/berkeley_db.active ]; then - OLD_BDB=$(cat /var/lib/sks/berkeley_db.active) - else - if dpkg --compare-versions "$2" lt "1.1.1+dpkgv3-1"; then - OLD_BDB=4.6 - elif dpkg --compare-versions "$2" lt "1.1.1+dpkgv3-6.1"; then - OLD_BDB=4.7 - else - OLD_BDB=4.7 - fi - fi - - # Read the compiled-in Berkeley DB version - NEW_BDB=$(cat /usr/lib/sks/berkeley_db.txt) - - if [ "$OLD_BDB" != "$NEW_BDB" ]; then - - # Upgrade Berkeley DB in place - BACKUP_DIR=/var/backups/sks/$(date +%Y%m%d-%H%M%S) - SKS_DIR=/var/lib/sks - mkdir -p $BACKUP_DIR - chown debian-sks:debian-sks ${BACKUP_DIR} - - for DBHOME in DB PTree; do - - # Don't run if the database directory doesn't exist - [ ! -d ${SKS_DIR}/${DBHOME} ] && continue - - # Create backup directory - mkdir -p ${BACKUP_DIR}/${DBHOME} - chown debian-sks:debian-sks ${BACKUP_DIR}/${DBHOME} - - # Make sure we own the files - chown debian-sks:debian-sks -R ${SKS_DIR}/${DBHOME} - - if [ -x /usr/bin/db${OLD_BDB}_recover ]; then - # Run recover with old tools - su debian-sks -c "db${OLD_BDB}_recover -h ${SKS_DIR}/${DBHOME}" - # Backup needed log files - LOG_FILES=$(su debian-sks -c "db${OLD_BDB}_archive -h ${SKS_DIR}/${DBHOME} -l") - else - # If we don't have the Berkeley DB tools then backup all log files - LOG_FILES=$(cd ${SKS_DIR}/${DBHOME}; ls -1 | grep -E "^log\.") - fi - - # Backup log files - for log_file in ${LOG_FILES}; do - cp -a ${SKS_DIR}/${DBHOME}/$log_file ${BACKUP_DIR}/${DBHOME}/ - done - - if [ -e "${SKS_DIR}/${DBHOME}/DB_CONFIG" ]; then - cp -a ${SKS_DIR}/${DBHOME}/DB_CONFIG ${BACKUP_DIR}/${DBHOME}/ - fi - - # Backup & upgrade database files - for db in $(cd ${SKS_DIR}/${DBHOME}; ls -1 | grep -Ev "^(__|log\.|DB_CONFIG$)"); do - # Backup database file - su debian-sks -c "cp ${SKS_DIR}/${DBHOME}/${db} ${BACKUP_DIR}/${DBHOME}/" - # Upgrade database file - su debian-sks -c "db${NEW_BDB}_upgrade -h ${SKS_DIR}/${DBHOME} ${SKS_DIR}/${DBHOME}/$db"; - done - - # Set checkpoint and delete old logfiles - su debian-sks -c "db${NEW_BDB}_checkpoint -h ${SKS_DIR}/${DBHOME} -1" - su debian-sks -c "db${NEW_BDB}_archive -h ${SKS_DIR}/${DBHOME} -d" - done - - # Note the active Berkeley DB version - cp -f /usr/lib/sks/berkeley_db.txt /var/lib/sks/berkeley_db.active - - elif [ ! -e /var/lib/sks/berkeley_db.active ]; then - cp -f /usr/lib/sks/berkeley_db.txt /var/lib/sks/berkeley_db.active - fi + su debian-sks -c /usr/share/sks/sks-db-upgrade fi fi diff -Nru sks-1.1.5/debian/sks.postrm sks-1.1.5/debian/sks.postrm --- sks-1.1.5/debian/sks.postrm 2016-05-06 21:39:55.000000000 +0000 +++ sks-1.1.5/debian/sks.postrm 2016-05-11 18:49:15.000000000 +0000 @@ -4,6 +4,13 @@ # logs, db and backup have to be removed according to policy. rm -rf /var/log/sks /var/lib/sks /var/backup/sks /var/backups/sks [ -d /var/backup ] && rmdir --ignore-fail-on-non-empty /var/backup + + # see https://wiki.debian.org/AccountHandlingInMaintainerScripts + if [ -x "$(command -v deluser)" ]; then + deluser --quiet --system debian-sks > /dev/null || true + else + echo >&2 "not removing debian-sks system account because deluser command was not found" + fi fi #DEBHELPER# diff -Nru sks-1.1.5/debian/sks-recon.service sks-1.1.5/debian/sks-recon.service --- sks-1.1.5/debian/sks-recon.service 2016-05-07 00:07:17.000000000 +0000 +++ sks-1.1.5/debian/sks-recon.service 2016-05-11 18:49:15.000000000 +0000 @@ -1,12 +1,13 @@ [Unit] Description=SKS reconciliation service -BindTo=sks.service +BindsTo=sks.service After=sks.service [Service] Type=simple ExecStart=/usr/sbin/sks -stdoutlog recon User=debian-sks +WorkingDirectory=/var/lib/sks [Install] WantedBy=multi-user.target diff -Nru sks-1.1.5/debian/sks.service sks-1.1.5/debian/sks.service --- sks-1.1.5/debian/sks.service 2016-05-07 00:07:17.000000000 +0000 +++ sks-1.1.5/debian/sks.service 2016-05-11 18:49:15.000000000 +0000 @@ -2,11 +2,15 @@ Description=SKS database service Wants=sks-recon.service Before=sks-recon.service +After=local-fs.target network.target [Service] Type=simple ExecStart=/usr/sbin/sks -stdoutlog db User=debian-sks +RuntimeDirectory=sks +RuntimeDirectoryMode=700 +WorkingDirectory=/var/lib/sks [Install] WantedBy=multi-user.target diff -Nru sks-1.1.5/debian/TODO sks-1.1.5/debian/TODO --- sks-1.1.5/debian/TODO 1970-01-01 00:00:00.000000000 +0000 +++ sks-1.1.5/debian/TODO 2016-05-11 18:49:15.000000000 +0000 @@ -0,0 +1,43 @@ +Debian packaging work needed for sks +------------------------------------ + + * rethink /var/lib/sks/www/* -- people like to customize these files. + is this the best place to ship these, or to serve from? They get + overwritten upon upgrade, which might mean we're encouraging admins + to lose some of their work. configfiles? symlinks? something else? + + * try to get as many of our patches upstream as possible + + * rethink our debian FHS support patches -- can this be done in a + less-invasive fashion? Why hard-code things? It should be + possible to run multiple sks instances on a single host. + + * trim the default sks configs so there is less for an admin to read + through. + + * improve the documentation of sks for configuration purposes; + DB_CONFIG? relationship between sks commandline args and config + file? (this might be upstream work) + + * move sks to /usr/bin ; there is precedent for daemons in /usr/bin, + the daemon doesn't run as the superuser, and it's possible for + normal users to run sks. + + * update sks to allow socket activation + + * find someone who might want to maintain the sysv initscripts -- + maybe move them to a separate binary package for those who want to + use sysvinit? + + * make a standard public-facing setup easy to produce (reverse proxy, + hkps, tor, automated setup, etc) + + * improve database management and backup management -- automated + reasoning about available space, reporting about processing time, + etc. + + * reconsider regular stat generation -- systemd timers? cronjobs? or + just encourage reliance on sks itself to update stats regularly? + + * detect sks hanging or database deadlock? figure out how to recover + from it (or even better: prevent it)