build

   1 #!/bin/bash
   2
   3 #  build -- build version of sudo with Apple-specific patches applied
   4 #  Copyright (C) 2013 Kyle J. McKay.  All rights reserved.
   5 #
   6 #  Permission to use, copy, modify, and distribute this software for any
   7 #  purpose with or without fee is hereby granted, provided that the above
   8 #  copyright notice and this permission notice appear in all copies.
   9 #
  10 #  THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11 #  WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12 #  MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13 #  ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14 #  WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15 #  ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16 #  OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18 # build version 1.0.1
  19
  20 myname="$0"
  21 while [ -L "$myname" ]; do
  22   oldname="$myname"
  23   myname="$(readlink "$myname")"
  24   case "$myname" in /*) :;; *)
  25     myname="$(dirname "$oldname")/$myname"
  26   esac
  27 done
  28 unset oldname
  29 mydir="$(cd "$(dirname "$myname")" && pwd -P)"
  30 myname="$(basename "$myname")"
  31
  32 case "$mydir" in
  33   *' '*)
  34     echo "error: build directory path contains a space: '$mydir'" >&2
  35     exit 1
  36     ;;
  37 esac
  38
  39 : "${osmaj:=$(sysctl -n kern.osrelease | cut -d. -f1)}"
  40 if [ $osmaj -lt 8 ]; then
  41   echo "error: build os must be at least 10.4" >&2
  42   exit 1
  43 fi
  44
  45 # exit on error
  46 trap 'echo "FAILED COMMAND ($?): ${BASH_COMMAND:-Run $0 using bash -v for details}"' ERR
  47 set -o errexit
  48
  49 cd "$mydir"
  50 umask 022
  51
  52 SUDO174p10='http://www.sudo.ws/sudo/dist/sudo-1.7.10p7.tar.gz'
  53 SUDO174p10_MD5=9faa5ceaf23cca0468d0f5d211bac6e4
  54 SUDO174p10_SHA1=b5beb1a470d1f03b3940aff612f5089244dd773a
  55
  56 SUDO_TGZ="$SUDO174p10"
  57 SUDO_MD5="$SUDO174p10_MD5"
  58 SUDO_SHA1="$SUDO174p10_SHA1"
  59
  60 # Match Apple's sudo man pages use of the man macros for maximum compatibility
  61 # Note that only 10.6.x embeds /etc/sudoers, all other OS X versions embed /private/etc/sudoers
  62 SUDO_CONFIGURE='--prefix=/usr --sysconfdir=/private/etc --with-timedir=/var/db/sudo --with-man'
  63 SUDO_CONFIGURE="$SUDO_CONFIGURE"' --with-noexec=no --with-bsm-audit --with-libraries=bsm --disable-static'
  64 # Since the OS X sudo installation does not include sudoreplay there's little point in allowing io logging
  65 SUDO_CONFIGURE="$SUDO_CONFIGURE"' --without-iologdir'
  66 if [ $osmaj -lt 11 ]; then
  67   # Prior to OS X 10.7 --disable-setreuid, --with-env-editor and --with-password-timeout=0 were used
  68   SUDO_CONFIGURE="$SUDO_CONFIGURE"' --disable-setreuid --with-env-editor --with-password-timeout=0'
  69   # Prior to OS X 10.7 the version of sudo used logged by default to the local2 facility so emulate that
  70   SUDO_CONFIGURE="$SUDO_CONFIGURE"' --with-logfac=local2' # otherwise current default is authpriv facility
  71 fi
  72 if [ $osmaj -lt 9 ]; then
  73   # The OS X 10.4 compiler does not support -fstack-protector in any form
  74   # and neither does the 10.4 linker support -pie
  75   SUDO_CONFIGURE="$SUDO_CONFIGURE"'  --disable-hardening --disable-pie'
  76   # Also add --disable-env-reset because although env reset by default
  77   # is not actually effective until the version of sudo shipped with OS X 10.6
  78   # it is activated by the OS X 10.5 /etc/sudoers file so env reset is
  79   # effectively active starting with OS X 10.5 and need only be disabled for 10.4
  80   SUDO_CONFIGURE="$SUDO_CONFIGURE"'  --disable-env-reset'
  81 fi
  82
  83 # 10.4 ppc builds only ppc while 10.4 i386 builds i386/ppc
  84 # 10.5 builds i386/ppc
  85 # 10.6-10.7 builds x86_64/i386
  86 # 10.8 builds only x86_64
  87 ARCHS=
  88 if [ $osmaj -eq 8 ]; then
  89   if [ "$(arch)" = "ppc" ]; then
  90     ARCHS=ppc
  91   else
  92     ARCHS='i386 ppc'
  93   fi
  94 elif [ $osmaj -eq 9 ]; then
  95   ARCHS='i386 ppc'
  96 elif [ $osmaj -eq 10 -o $osmaj -eq 11 ]; then
  97   ARCHS='x86_64 i386'
  98 elif [ $osmaj -ge 12 ]; then
  99   ARCHS='x86_64'
 100 fi
 101
 102 DOWNLOADS="$mydir/sources"
 103 BUILD="$mydir/sudo"
 104
 105 PATH="$(getconf PATH)"
 106 export PATH
 107
 108 unset CPATH
 109 unset LIBRARY_PATH
 110 unset DYLD_LIBRARY_PATH
 111 unset MANPATH
 112 export LDFLAGS="$LDFLAGS -Wl,-S,-x,-dead_strip"
 113 if [ $osmaj -ge 9 ]; then
 114   LDFLAGS="$LDFLAGS -Wl,-dead_strip_dylibs,-exported_symbols_list,/dev/null"
 115 else
 116   # The OS X 10.4 linker needs at least one symbol in the file to strip
 117   # and it also needs uninteresting warnings suppressed
 118   LDFLAGS="$LDFLAGS -Wl,-w,-exported_symbols_list,.symbols_list"
 119 fi
 120 for arch in $ARCHS; do
 121   CFLAGS="$CFLAGS -arch $arch"
 122   LDFLAGS="$LDFLAGS -arch $arch"
 123 done
 124 export CFLAGS
 125
 126 strip1=
 127 if ! (tar --strip-path=1 || : ) 2>&1 | grep -Eqi 'unrecognized option|not supported'; then
 128   strip1=--strip-path=1
 129 elif ! (tar --strip-components=1 || : ) 2>&1 | grep -Eqi 'unrecognized option|not supported'; then
 130   strip1=--strip-components=1
 131 fi
 132 if [ -z "$strip1" ]; then
 133   echo "error: Cannot figure out tar option to strip top level path" >&2
 134   exit 1
 135 fi
 136
 137 AGENT1='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'
 138 AGENT2='curl/7.25.0 (unknown-unknown-unknown) libcurl/7.25.0'
 139 CURLOPT="--fail --location --connect-timeout 15 --speed-limit 10240"
 140 CURLOPT0="$CURLOPT -H 'User-Agent:'"
 141 CURLOPT1="$CURLOPT -H 'User-Agent: $AGENT1'"
 142 CURLOPT2="$CURLOPT -H 'User-Agent: $AGENT2'"
 143
 144 die()
 145 {
 146   echo "Fatal: $*" >&2
 147   exit 125;
 148 }
 149
 150 getmd5()
 151 {
 152   openssl dgst -md5 < "$1" 2>/dev/null | sed -e 's/^[^ ][^ ]* //'
 153 }
 154
 155 getsha1()
 156 {
 157   openssl dgst -sha1 < "$1" 2>/dev/null | sed -e 's/^[^ ][^ ]* //'
 158 }
 159
 160 # Usage: downloadfile URL MD5 SHA1
 161 # -> output is full path to downloaded file (will be in $DOWNLOADS)
 162 downloadfile()
 163 {
 164   local url file md5 sha1 bad
 165   url="$1"
 166   file="$(basename "$url")"
 167   md5="$2"
 168   sha1="$3"
 169   local checkmd5 checksha1
 170   if [ ! -d "$DOWNLOADS" ]; then
 171     mkdir "$DOWNLOADS"
 172   fi
 173   if [ -e "$DOWNLOADS/$file" ]; then
 174     checkmd5="$(getmd5 "$DOWNLOADS/$file")"
 175     checksha1="$(getsha1 "$DOWNLOADS/$file")"
 176     if [ "$md5" != "$checkmd5" -o "$sha1" != "$checksha1" ]; then
 177       echo "Wrong md5/sha1 checksum for $DOWNLOADS/$file -- removing" >&2
 178       chmod u+w "$DOWNLOADS/$file"
 179       rm "$DOWNLOADS/$file"
 180     fi
 181   fi
 182   if [ ! -e "$DOWNLOADS/$file" ]; then
 183     eval "curl $CURLOPT0 -o '$DOWNLOADS/$file' '$url'"
 184   fi
 185   if [ ! -e "$DOWNLOADS/$file" ]; then
 186     echo "Failed to download $url" >&2
 187     return 1
 188   fi
 189   checkmd5="$(getmd5 "$DOWNLOADS/$file")"
 190   checksha1="$(getsha1 "$DOWNLOADS/$file")"
 191   bad=
 192   if [ "$md5" != "$checkmd5" ]; then
 193     bad=1
 194     echo "Wrong md5 checksum $checkmd5 (expected $md5) for $DOWNLOADS/$file" >&2
 195   fi
 196   if [ "$sha1" != "$checksha1" ]; then
 197     bad=1
 198     echo "Wrong sha1 checksum $checksha1 (expected $sha1) for $DOWNLOADS/$file" >&2
 199   fi
 200   if [ -n "$bad" ]; then
 201     echo "Checksum verifcation failed for $url" >&2
 202     return 1
 203   fi
 204   echo "$DOWNLOADS/$file"
 205   return 0
 206 }
 207
 208 # return a suitable directory name for a tarball
 209 tgzdir()
 210 {
 211   local tb
 212   tb="$(basename "$1")"
 213   tb="${tb%.gz}"
 214   tb="${tb%.bz2}"
 215   tb="${tb%.tar}"
 216   tb="${tb%.tgz}"
 217   echo "$tb"
 218 }
 219
 220 echo "Fetching/verifying sudo sources tarball" >&2
 221 sudotgz="$(downloadfile "$SUDO_TGZ" "$SUDO_MD5" "$SUDO_SHA1")"
 222 sudodir="$(tgzdir "$sudotgz")"
 223
 224 if [ ! -e "$DOWNLOADS/$sudodir/.extracted" ]; then
 225   echo "Extracting sudo sources from tarball" >&2
 226   rm -rf "$DOWNLOADS/$sudodir" "$BUILD"
 227   mkdir "$DOWNLOADS/$sudodir"
 228   tar -xzf "$sudotgz" -C "$DOWNLOADS/$sudodir" "$strip1"
 229   touch "$DOWNLOADS/$sudodir/.extracted"
 230 fi
 231
 232 if [ ! -e "$DOWNLOADS/$sudodir/.patched" ]; then
 233   [ -e "$DOWNLOADS/$sudodir/.extracted" ] || die "bad extraction"
 234   echo "Patching sudo sources with Apple tweaks" >&2
 235   rm -rf "$BUILD"
 236   cd "$DOWNLOADS/$sudodir"
 237   for pf in "$mydir/patches/"00*.patch.txt; do
 238     echo "$(basename "$pf")" >&2
 239     patch -p1 < "$pf"
 240   done
 241   touch "$DOWNLOADS/$sudodir/.patched"
 242 fi
 243 cd "$mydir"
 244
 245 if [ ! -e "$BUILD/.configured" ]; then
 246   [ -e "$DOWNLOADS/$sudodir/.patched" ] || die "bad patching operation"
 247   echo "Configuring sudo build for OS X" >&2
 248   rm -rf "$BUILD"
 249   mkdir -p "$BUILD"
 250   cd "$BUILD"
 251   if [ $osmaj -lt 9 ]; then
 252     echo __mh_execute_header > .symbols_list
 253   fi
 254   "$DOWNLOADS/$sudodir/configure" $SUDO_CONFIGURE
 255   echo "Stripping CONFIGURE_ARGS to match Apple sudo installation" >&2
 256   perl -i -pe 's/"[^"]+"/""/ if /^#define CONFIGURE_ARGS/' sudo_usage.h
 257   echo "Enabling HAVE_TCSETPGRP which is not set properly with --without-iologdir" >&2
 258   perl -i -pe 's,^/[^/]+/,#define HAVE_TCSETPGRP 1, if /HAVE_TCSETPGRP/' config.h
 259   touch "$BUILD/.configured"
 260 fi
 261 cd "$mydir"
 262
 263 if [ ! -e "$BUILD/.built" ]; then
 264   [ -e "$BUILD/.configured" ] || die "bad configure operation"
 265   echo "Making sudo build for OS X" >&2
 266   make -w -C "$BUILD"
 267   [ -x "$BUILD/sudo" ] || die "build failed"
 268   touch "$BUILD/.built"
 269 fi
 270
 271 echo ""
 272 echo "The newly built sudo executable can be found in the directory:"
 273 echo "        $BUILD"
 274 echo ""
 275 echo "It can be installed with:"
 276 echo "        sudo make -C '$BUILD' install"
 277 echo ""
 278 echo "IMPORTANT: running the above install WILL REPLACE YOUR EXISTING sudo!!!"
 279 echo ""
 280 echo "Try the following to see what will be installed without installing:"
 281 echo "        make -C '$BUILD' -n install"
 282 echo ""
 283 echo "Note that the DESTDIR=/some/dir option can be used to perform a test"
 284 echo "install to a different location first like so:"
 285 echo "        sudo make -C '$BUILD' DESTDIR=/tmp/testsudo install"
 286 echo ""
 287 echo "Using a test installation first can help decide whether or not to go"
 288 echo "ahead with a normal installation."
 289 echo ""