From fa40a5cf3b0f3f46c54e61b29094c9ab486b3c9a Mon Sep 17 00:00:00 2001 From: ljf Date: Fri, 1 Sep 2017 03:10:31 +0200 Subject: [PATCH 001/313] [enh] Bootprompt is back --- bin/yunoprompt | 103 ++++++++++++++++++++++++++++++++++ data/other/yunoprompt.service | 14 +++++ debian/postinst | 3 + 3 files changed, 120 insertions(+) create mode 100644 bin/yunoprompt create mode 100644 data/other/yunoprompt.service diff --git a/bin/yunoprompt b/bin/yunoprompt new file mode 100644 index 000000000..212debdc9 --- /dev/null +++ b/bin/yunoprompt @@ -0,0 +1,103 @@ +#!/bin/bash + +ip=$(hostname --all-ip-address) + +i=0 +for key in /etc/ssh/ssh_host_*_key.pub ; do + output=$(ssh-keygen -l -f $key) + fingerprint[$i]=" - $(echo $output | cut -d' ' -f2) $(echo $output| cut -d' ' -f4)" + i=$(($i + 1)) +done + +cat > /etc/issue.net << EOF + '. ' '' -d. + /M+ h- .shh/ // /NMy- hMdosso + 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ + sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' + .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. + mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: + 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - + hy /yy: :- -. -Nh ' + . + +IP: ${ip} +SSH fingerprints: +${fingerprint[0]} +${fingerprint[1]} +${fingerprint[2]} +${fingerprint[3]} +${fingerprint[4]} +EOF +if [[ ! -f /etc/yunohost/installed ]] +then + if [[ ! -f /etc/yunohost/from_script ]] + then +sleep 5 +chvt 2 +cat << EOF + '. ' '' -d. + /M+ h- .shh/ // /NMy- hMdosso + 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ + sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' + .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. + mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: + 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - + hy /yy: :- -. -Nh ' + . + +IP: ${ip} +SSH fingerprints*: +${fingerprint[0]} +${fingerprint[1]} +${fingerprint[2]} +${fingerprint[3]} +${fingerprint[4]} +EOF + +echo -e "\e[m Post-installation \e[0m" +cat << EOF +Congratulations! YunoHost has been successfully installed. +Two more steps are required to activate the services of your server. +EOF +read -p "Proceed to post-installation? (y/n) " -n 1 + RESULT=1 + while [ $RESULT -gt 0 ]; do + if [[ $REPLY =~ ^[Nn]$ ]]; then + chvt 1 + exit 0 + fi + echo -e "\n" + /usr/bin/yunohost tools postinstall + let RESULT=$? + if [ $RESULT -gt 0 ]; then + echo -e "\n" + read -p "Retry? (y/n) " -n 1 + fi + done + fi +else # YunoHost is already post-installed + + domain=$(cat /etc/yunohost/current_host) +cat > /etc/issue << EOF + '. ' '' -d. + /M+ h- .shh/ // /NMy- hMdosso + 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ + sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' + .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. + mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: + 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - + hy /yy: :- -. -Nh ' + . + +IP: ${ip} +SSH fingerprints: +${fingerprint[0]} +${fingerprint[1]} +${fingerprint[2]} +${fingerprint[3]} +${fingerprint[4]} +EOF + + +fi + diff --git a/data/other/yunoprompt.service b/data/other/yunoprompt.service new file mode 100644 index 000000000..3c4df50f9 --- /dev/null +++ b/data/other/yunoprompt.service @@ -0,0 +1,14 @@ +[Unit] +Description=YunoHost boot prompt +After=getty@tty2.service + +[Service] +Type=simple +ExecStart=/usr/bin/yunoprompt +StandardInput=tty +TTYPath=/dev/tty2 +TTYReset=yes +TTYVHangup=yes + +[Install] +WantedBy=default.target diff --git a/debian/postinst b/debian/postinst index 7e91ffbb3..39063694b 100644 --- a/debian/postinst +++ b/debian/postinst @@ -24,6 +24,9 @@ do_configure() { "consider to start it by doing 'service yunohost-firewall start'." fi + # Yunoprompt + systemctl enable yunoprompt.service + # remove old PAM config and update it [[ ! -f /usr/share/pam-configs/my_mkhomedir ]] \ || rm /usr/share/pam-configs/my_mkhomedir From 6bbcf0ee95e03781f30b89a156f6f8ba9f7dbc2f Mon Sep 17 00:00:00 2001 From: ljf Date: Fri, 1 Sep 2017 03:16:52 +0200 Subject: [PATCH 002/313] [fix] Missing install path --- debian/install | 1 + 1 file changed, 1 insertion(+) diff --git a/debian/install b/debian/install index 70add7992..e9c79e963 100644 --- a/debian/install +++ b/debian/install @@ -3,6 +3,7 @@ sbin/* /usr/sbin/ data/bash-completion.d/yunohost /etc/bash_completion.d/ data/actionsmap/* /usr/share/moulinette/actionsmap/ data/hooks/* /usr/share/yunohost/hooks/ +data/other/yunoprompt.service /etc/systemd/system/ data/other/* /usr/share/yunohost/yunohost-config/moulinette/ data/templates/* /usr/share/yunohost/templates/ data/helpers /usr/share/yunohost/ From bd2ea3c12cf81eba6879de6d67c44bad3e66b96e Mon Sep 17 00:00:00 2001 From: "ljf (zamentur)" Date: Tue, 3 Oct 2017 18:46:29 +0200 Subject: [PATCH 003/313] [fix] Limit ascii logo to 79 characters --- bin/yunoprompt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/yunoprompt b/bin/yunoprompt index 212debdc9..9839564e3 100644 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -11,13 +11,13 @@ done cat > /etc/issue.net << EOF '. ' '' -d. - /M+ h- .shh/ // /NMy- hMdosso + /M+ h- .shh/ // /NMy- hMdosso 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - - hy /yy: :- -. -Nh ' + hy /yy: :- -. -Nh ' . IP: ${ip} From 44676438fe642b4843ecb56cae7a95d4e4c16b8b Mon Sep 17 00:00:00 2001 From: "ljf (zamentur)" Date: Tue, 3 Oct 2017 18:47:52 +0200 Subject: [PATCH 004/313] [fix] Limit ascii 2nd and 3rd logo to 79 char --- bin/yunoprompt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/yunoprompt b/bin/yunoprompt index 9839564e3..200e81933 100644 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -36,13 +36,13 @@ sleep 5 chvt 2 cat << EOF '. ' '' -d. - /M+ h- .shh/ // /NMy- hMdosso + /M+ h- .shh/ // /NMy- hMdosso 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - - hy /yy: :- -. -Nh ' + hy /yy: :- -. -Nh ' . IP: ${ip} @@ -80,13 +80,13 @@ else # YunoHost is already post-installed domain=$(cat /etc/yunohost/current_host) cat > /etc/issue << EOF '. ' '' -d. - /M+ h- .shh/ // /NMy- hMdosso + /M+ h- .shh/ // /NMy- hMdosso 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - - hy /yy: :- -. -Nh ' + hy /yy: :- -. -Nh ' . IP: ${ip} From f25ef833e935a2b8d70acde8863a6bd8b80eabfa Mon Sep 17 00:00:00 2001 From: "ljf (zamentur)" Date: Tue, 3 Oct 2017 18:50:46 +0200 Subject: [PATCH 005/313] [fix] Remove dead code --- bin/yunoprompt | 1 - 1 file changed, 1 deletion(-) diff --git a/bin/yunoprompt b/bin/yunoprompt index 200e81933..83b28296f 100644 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -77,7 +77,6 @@ read -p "Proceed to post-installation? (y/n) " -n 1 fi else # YunoHost is already post-installed - domain=$(cat /etc/yunohost/current_host) cat > /etc/issue << EOF '. ' '' -d. /M+ h- .shh/ // /NMy- hMdosso From 421994a3efe93d93eb20b2dcad0185aeb6449ded Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Fri, 22 Dec 2017 19:01:09 +0100 Subject: [PATCH 006/313] [enh] Tranfert backup_core_only to BACKUP_CORE_ONLY --- data/helpers.d/utils | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index 2cb18c5c0..4679121e4 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -77,7 +77,7 @@ ynh_backup_before_upgrade () { fi # Create backup - sudo yunohost backup create --ignore-system --apps $app --name $app_bck-pre-upgrade$backup_number + sudo BACKUP_CORE_ONLY=1 yunohost backup create --ignore-system --apps $app --name $app_bck-pre-upgrade$backup_number if [ "$?" -eq 0 ] then # If the backup succeeded, remove the previous backup From 810eaec8c995495f2b86ef17d73b7f12ffbb342f Mon Sep 17 00:00:00 2001 From: Jimmy Monin Date: Fri, 22 Dec 2017 19:27:02 +0100 Subject: [PATCH 007/313] Don't backup big data items when BACKUP_CORE_ONLY is set --- data/helpers.d/filesystem | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/data/helpers.d/filesystem b/data/helpers.d/filesystem index 6fb073e06..6f24a7777 100644 --- a/data/helpers.d/filesystem +++ b/data/helpers.d/filesystem @@ -47,6 +47,12 @@ ynh_backup() { local DEST_PATH="${2:-}" local IS_BIG="${3:-0}" + # If backing up core only (used by ynh_backup_before_upgrade), + # don't backup big data items + if [ "$IS_BIG" == "1" ] && [ -n "$BACKUP_CORE_ONLY" ] ; then + return 0 + fi + # ============================================================================== # Format correctly source and destination paths # ============================================================================== From 3dd6317ae6d93997c9f4d512c4ded0c626108b08 Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Fri, 22 Dec 2017 19:33:47 +0100 Subject: [PATCH 008/313] Add info --- data/helpers.d/filesystem | 1 + 1 file changed, 1 insertion(+) diff --git a/data/helpers.d/filesystem b/data/helpers.d/filesystem index 6f24a7777..f8da72ad5 100644 --- a/data/helpers.d/filesystem +++ b/data/helpers.d/filesystem @@ -50,6 +50,7 @@ ynh_backup() { # If backing up core only (used by ynh_backup_before_upgrade), # don't backup big data items if [ "$IS_BIG" == "1" ] && [ -n "$BACKUP_CORE_ONLY" ] ; then + echo "$SRC_PATH will not be saved, because backup_core_only is set." >&2 return 0 fi From e696caa31fc2c6f3613ab11568fc0d2392a047af Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 29 Dec 2017 16:00:29 +0100 Subject: [PATCH 009/313] [Fix] Nginx headers --- data/templates/nginx/server.tpl.conf | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 685ae01b8..90a258433 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -42,7 +42,12 @@ server { # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 #ssl_dhparam /etc/ssl/private/dh2048.pem; - add_header Strict-Transport-Security "max-age=31536000;"; + add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"; + add_header 'Referrer-Policy' 'no-referrer'; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options "SAMEORIGIN"; access_by_lua_file /usr/share/ssowat/access.lua; From 9e19e5316ccbeeb1c6d3dd16dc70278eee18c648 Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 29 Dec 2017 16:07:15 +0100 Subject: [PATCH 010/313] [Fix] Nginx headers --- data/templates/nginx/server.tpl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 90a258433..dee667939 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -42,7 +42,7 @@ server { # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 #ssl_dhparam /etc/ssl/private/dh2048.pem; - add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"; + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header 'Referrer-Policy' 'no-referrer'; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; From 5cd30e584d4225a3c82ca54709189aa4f9bc9ba9 Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 29 Dec 2017 16:16:37 +0100 Subject: [PATCH 011/313] [Fix] Nginx headers in Admin conf --- data/templates/nginx/plain/yunohost_admin.conf | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index a9d26d151..349be9177 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -36,8 +36,14 @@ server { # Uncomment the following directive after DH generation # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 #ssl_dhparam /etc/ssl/private/dh2048.pem; - - add_header Strict-Transport-Security "max-age=31536000;"; + + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; + add_header 'Referrer-Policy' 'no-referrer'; + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options "SAMEORIGIN"; location / { return 302 https://$http_host/yunohost/admin; From 95835118bd8e0c308dec2c3659719760cd17570f Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 29 Dec 2017 17:59:12 +0100 Subject: [PATCH 012/313] [Fix] CSP Standart. --- data/templates/nginx/server.tpl.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index dee667939..6f49d68c3 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -43,9 +43,11 @@ server { #ssl_dhparam /etc/ssl/private/dh2048.pem; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header 'Referrer-Policy' 'no-referrer'; + add_header 'Referrer-Policy' 'origin-when-cross-origin'; + add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';report-uri /csp-violation-report-endpoint/"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; + add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; add_header X-Frame-Options "SAMEORIGIN"; From 804d0b29c35aa450608487ae12ad4deefb1e8537 Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 29 Dec 2017 18:25:17 +0100 Subject: [PATCH 013/313] [Fix] Add CSP in Admin conf --- data/templates/nginx/plain/yunohost_admin.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index 349be9177..9bdbb0f26 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -38,7 +38,8 @@ server { #ssl_dhparam /etc/ssl/private/dh2048.pem; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header 'Referrer-Policy' 'no-referrer'; + add_header 'Referrer-Policy' 'origin-when-cross-origin'; + add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';report-uri /csp-violation-report-endpoint/"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Download-Options noopen; From b655229cbd8c00cf57838f848b1988ff8d02d1d2 Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 30 Dec 2017 11:18:17 +0100 Subject: [PATCH 014/313] [Fix] Referrer --- data/templates/nginx/server.tpl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 6f49d68c3..11f503c98 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -43,7 +43,7 @@ server { #ssl_dhparam /etc/ssl/private/dh2048.pem; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header 'Referrer-Policy' 'origin-when-cross-origin'; + add_header 'Referrer-Policy' 'same-origin'; add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';report-uri /csp-violation-report-endpoint/"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; From bd2f459e8663c401506faa2ac5503e74aa8e50b8 Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 30 Dec 2017 11:18:58 +0100 Subject: [PATCH 015/313] [Fix] Referrer --- data/templates/nginx/plain/yunohost_admin.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index 9bdbb0f26..eedbd61b3 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -38,7 +38,7 @@ server { #ssl_dhparam /etc/ssl/private/dh2048.pem; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header 'Referrer-Policy' 'origin-when-cross-origin'; + add_header 'Referrer-Policy' 'same-origin'; add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';report-uri /csp-violation-report-endpoint/"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; From ab282e88a75d80bafd4eaa1c3b0d9b566177aaa0 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 4 Jan 2018 22:04:15 +0100 Subject: [PATCH 016/313] [enh] add commands to allow user to have access in ssh --- data/actionsmap/yunohost.yml | 24 ++++++++++++++++ src/yunohost/user.py | 56 ++++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index 966de21df..c4e95e748 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -203,6 +203,30 @@ user: extra: pattern: *pattern_mailbox_quota + ### ssh_user_enable_ssh() + allow-ssh: + action_help: Allow the user to uses ssh + api: POST /ssh/user/enable-ssh + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + + ### ssh_user_disable_ssh() + disallow-ssh: + action_help: Disallow the user to uses ssh + api: POST /ssh/user/disable-ssh + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + ### user_info() info: action_help: Get user information diff --git a/src/yunohost/user.py b/src/yunohost/user.py index 11f61d807..123438da3 100644 --- a/src/yunohost/user.py +++ b/src/yunohost/user.py @@ -25,6 +25,7 @@ """ import os import re +import pwd import json import errno import crypt @@ -435,6 +436,36 @@ def user_info(auth, username): raise MoulinetteError(167, m18n.n('user_info_failed')) +def user_allow_ssh(auth, username): + """ + Allow YunoHost user connect as ssh. + + Keyword argument: + username -- User username + """ + # TODO it would be good to support different kind of shells + + if not _get_user_for_ssh(auth, username): + raise MoulinetteError(errno.EINVAL, m18n.n('user_unknown', user=username)) + + auth.update('uid=%s,ou=users' % username, {'loginShell': '/bin/bash'}) + + +def user_disallow_ssh(auth, username): + """ + Disallow YunoHost user connect as ssh. + + Keyword argument: + username -- User username + """ + # TODO it would be good to support different kind of shells + + if not _get_user_for_ssh(auth, username) : + raise MoulinetteError(errno.EINVAL, m18n.n('user_unknown', user=username)) + + auth.update('uid=%s,ou=users' % username, {'loginShell': '/bin/false'}) + + def _convertSize(num, suffix=''): for unit in ['K', 'M', 'G', 'T', 'P', 'E', 'Z']: if abs(num) < 1024.0: @@ -470,3 +501,28 @@ def _hash_user_password(password): salt = '$6$' + salt + '$' return '{CRYPT}' + crypt.crypt(str(password), salt) + + +def _get_user_for_ssh(auth, username, attrs=None): + if username == "admin": + admin_unix = pwd.getpwnam("admin") + return { + 'username': 'admin', + 'fullname': '', + 'mail': '', + 'ssh_allowed': admin_unix.pw_shell.strip() != "/bin/false", + 'shell': admin_unix.pw_shell, + 'home_path': admin_unix.pw_dir, + } + + # TODO escape input using https://www.python-ldap.org/doc/html/ldap-filter.html + user = auth.search('ou=users,dc=yunohost,dc=org', + '(&(objectclass=person)(uid=%s))' % username, + attrs) + + assert len(user) in (0, 1) + + if not user: + return None + + return user[0] From 3deb11cf8a57cec5cbf5131de603c135698d354e Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 4 Jan 2018 22:10:36 +0100 Subject: [PATCH 017/313] [enh] add ssh information in userlist for admin UI --- src/yunohost/user.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/yunohost/user.py b/src/yunohost/user.py index 123438da3..3cb848582 100644 --- a/src/yunohost/user.py +++ b/src/yunohost/user.py @@ -57,6 +57,7 @@ def user_list(auth, fields=None): 'cn': 'fullname', 'mail': 'mail', 'maildrop': 'mail-forward', + 'loginShell': 'shell', 'mailuserquota': 'mailbox-quota' } @@ -72,7 +73,7 @@ def user_list(auth, fields=None): raise MoulinetteError(errno.EINVAL, m18n.n('field_invalid', attr)) else: - attrs = ['uid', 'cn', 'mail', 'mailuserquota'] + attrs = ['uid', 'cn', 'mail', 'mailuserquota', 'loginShell'] result = auth.search('ou=users,dc=yunohost,dc=org', '(&(objectclass=person)(!(uid=root))(!(uid=nobody)))', @@ -82,6 +83,12 @@ def user_list(auth, fields=None): entry = {} for attr, values in user.items(): if values: + if attr == "loginShell": + if values[0].strip() == "/bin/false": + entry["ssh_allowed"] = False + else: + entry["ssh_allowed"] = True + entry[user_attrs[attr]] = values[0] uid = entry[user_attrs['uid']] From c55b8cec16ded23162c1cf34bbddaa7fb5b70942 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 4 Jan 2018 22:31:13 +0100 Subject: [PATCH 018/313] [enh] add commands to manage authorized-keys of users --- data/actionsmap/yunohost.yml | 68 +++++++++++++++++++++++ src/yunohost/ssh.py | 102 +++++++++++++++++++++++++++++++++++ 2 files changed, 170 insertions(+) create mode 100644 src/yunohost/ssh.py diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index c4e95e748..e47d0b04a 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -1336,6 +1336,74 @@ dyndns: api: DELETE /dyndns/cron +############################# +# SSH # +############################# +ssh: + category_help: Manage ssh keys and access + actions: {} + subcategories: + authorized-keys: + subcategory_help: Manage user's authorized ssh keys + + actions: + ### ssh_authorized_keys_list() + list: + action_help: Show user's authorized ssh keys + api: GET /ssh/authorized-keys + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + + ### ssh_authorized_keys_add() + add: + action_help: Add a new authorized ssh key for this user + api: POST /ssh/authorized-keys + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + -u: + full: --public + help: Public key + extra: + required: True + -i: + full: --private + help: Private key + extra: + required: True + -n: + full: --name + help: Key name + extra: + required: True + + ### ssh_authorized_keys_remove() + remove: + action_help: Remove an authorized ssh key for this user + api: DELETE /ssh/authorized-keys + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + -k: + full: --key + help: Key as a string + extra: + required: True + + ############################# # Tools # ############################# diff --git a/src/yunohost/ssh.py b/src/yunohost/ssh.py new file mode 100644 index 000000000..5f1f33b55 --- /dev/null +++ b/src/yunohost/ssh.py @@ -0,0 +1,102 @@ +# encoding: utf-8 + +import os + +from moulinette.utils.filesystem import read_file, write_to_file, chown, chmod, mkdir + +from yunohost.user import _get_user_for_ssh + + +def ssh_authorized_keys_list(auth, username): + user = _get_user_for_ssh(auth, username, ["homeDirectory"]) + if not user: + raise Exception("User with username '%s' doesn't exists" % username) + + authorized_keys_file = os.path.join(user["homeDirectory"][0], ".ssh", "authorized_keys") + + if not os.path.exists(authorized_keys_file): + return [] + + keys = [] + last_comment = "" + for line in read_file(authorized_keys_file).split("\n"): + # empty line + if not line.strip(): + continue + + if line.lstrip().startswith("#"): + last_comment = line.lstrip().lstrip("#").strip() + continue + + # assuming a key per non empty line + key = line.strip() + keys.append({ + "key": key, + "name": last_comment, + }) + + last_comment = "" + + return {"keys": keys} + + +def ssh_authorized_keys_add(auth, username, key, comment): + user = _get_user_for_ssh(auth, username, ["homeDirectory", "uid"]) + if not user: + raise Exception("User with username '%s' doesn't exists" % username) + + authorized_keys_file = os.path.join(user["homeDirectory"][0], ".ssh", "authorized_keys") + + if not os.path.exists(authorized_keys_file): + # ensure ".ssh" exists + mkdir(os.path.join(user["homeDirectory"][0], ".ssh"), + force=True, parents=True, uid=user["uid"][0]) + + # create empty file to set good permissions + write_to_file(authorized_keys_file, "") + chown(authorized_keys_file, uid=user["uid"][0]) + chmod(authorized_keys_file, 0600) + + authorized_keys_content = read_file(authorized_keys_file) + + authorized_keys_content += "\n" + authorized_keys_content += "\n" + + if comment and comment.strip(): + if not comment.lstrip().startswith("#"): + comment = "# " + comment + authorized_keys_content += comment.replace("\n", " ").strip() + authorized_keys_content += "\n" + + authorized_keys_content += key.strip() + authorized_keys_content += "\n" + + write_to_file(authorized_keys_file, authorized_keys_content) + + +def ssh_authorized_keys_remove(auth, username, key): + user = _get_user(auth, username, ["homeDirectory", "uid"]) + if not user: + raise Exception("User with username '%s' doesn't exists" % username) + + authorized_keys_file = os.path.join(user["homeDirectory"][0], ".ssh", "authorized_keys") + + if not os.path.exists(authorized_keys_file): + raise Exception("this key doesn't exists ({} dosesn't exists)".format(authorized_keys_file)) + + authorized_keys_content = read_file(authorized_keys_file) + + if key not in authorized_keys_content: + raise Exception("Key '{}' is not present in authorized_keys".format(key)) + + # don't delete the previous comment because we can't verify if it's legit + + # this regex approach failed for some reasons and I don't know why :( + # authorized_keys_content = re.sub("{} *\n?".format(key), + # "", + # authorized_keys_content, + # flags=re.MULTILINE) + + authorized_keys_content = authorized_keys_content.replace(key, "") + + write_to_file(authorized_keys_file, authorized_keys_content) From 1e5323eb08c6e268feffc4a107ff4a86e69b96a4 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 5 Jan 2018 00:13:26 +0100 Subject: [PATCH 019/313] [enh] handle root user for being allowed to work on his authorized keys --- src/yunohost/user.py | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/src/yunohost/user.py b/src/yunohost/user.py index 3cb848582..793ccaf7a 100644 --- a/src/yunohost/user.py +++ b/src/yunohost/user.py @@ -36,10 +36,13 @@ import subprocess from moulinette import m18n from moulinette.core import MoulinetteError from moulinette.utils.log import getActionLogger +from moulinette.utils.filesystem import read_file from yunohost.service import service_status logger = getActionLogger('yunohost.user') +SSHD_CONFIG_PATH = "/etc/ssh/sshd_config" + def user_list(auth, fields=None): """ @@ -58,6 +61,7 @@ def user_list(auth, fields=None): 'mail': 'mail', 'maildrop': 'mail-forward', 'loginShell': 'shell', + 'homeDirectory': 'home_path', 'mailuserquota': 'mailbox-quota' } @@ -511,6 +515,34 @@ def _hash_user_password(password): def _get_user_for_ssh(auth, username, attrs=None): + def ssh_root_login_status(auth): + # XXX temporary placed here for when the ssh_root commands are integrated + # extracted from https://github.com/YunoHost/yunohost/pull/345 + # XXX should we support all the options? + # this is the content of "man sshd_config" + # PermitRootLogin + # Specifies whether root can log in using ssh(1). The argument must be + # “yes”, “without-password”, “forced-commands-only”, or “no”. The + # default is “yes”. + sshd_config_content = read_file(SSHD_CONFIG_PATH) + + if re.search("^ *PermitRootLogin +(no|forced-commands-only) *$", + sshd_config_content, re.MULTILINE): + return {"PermitRootLogin": False} + + return {"PermitRootLogin": True} + + if username == "root": + root_unix = pwd.getpwnam("root") + return { + 'username': 'root', + 'fullname': '', + 'mail': '', + 'ssh_allowed': ssh_root_login_status(auth)["PermitRootLogin"], + 'shell': root_unix.pw_shell, + 'home_path': root_unix.pw_dir, + } + if username == "admin": admin_unix = pwd.getpwnam("admin") return { From 52898891742dfb868581a8af1d322e129ab6751f Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Wed, 10 Jan 2018 00:44:25 +0100 Subject: [PATCH 020/313] Be nice with set -eu --- data/helpers.d/filesystem | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/data/helpers.d/filesystem b/data/helpers.d/filesystem index f8da72ad5..8f6665891 100644 --- a/data/helpers.d/filesystem +++ b/data/helpers.d/filesystem @@ -46,10 +46,11 @@ ynh_backup() { local SRC_PATH="$1" local DEST_PATH="${2:-}" local IS_BIG="${3:-0}" + BACKUP_CORE_ONLY=${BACKUP_CORE_ONLY:-0} # If backing up core only (used by ynh_backup_before_upgrade), # don't backup big data items - if [ "$IS_BIG" == "1" ] && [ -n "$BACKUP_CORE_ONLY" ] ; then + if [ "$IS_BIG" == "1" ] && [ "$BACKUP_CORE_ONLY" == "1" ] ; then echo "$SRC_PATH will not be saved, because backup_core_only is set." >&2 return 0 fi From 9c4ddcca39d9d6d92bd5f9a23978337e48d0a4e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Josu=C3=A9=20Tille?= Date: Fri, 26 Jan 2018 21:17:18 +0100 Subject: [PATCH 021/313] Add service name as arg (optionnal) --- data/helpers.d/backend | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/data/helpers.d/backend b/data/helpers.d/backend index 8fef412cf..c04f2230b 100644 --- a/data/helpers.d/backend +++ b/data/helpers.d/backend @@ -64,6 +64,10 @@ ynh_remove_logrotate () { # Create a dedicated systemd config # +# usage: ynh_add_systemd_config [Service name] [Source file] +# | arg: Service name +# | arg: Systemd source file (for example appname.service) +# # This will use a template in ../conf/systemd.service # and will replace the following keywords with # global variables that should be defined before calling @@ -74,9 +78,11 @@ ynh_remove_logrotate () { # # usage: ynh_add_systemd_config ynh_add_systemd_config () { - finalsystemdconf="/etc/systemd/system/$app.service" + local service_name="${1:-$app}" + + finalsystemdconf="/etc/systemd/system/$service_name.service" ynh_backup_if_checksum_is_different "$finalsystemdconf" - sudo cp ../conf/systemd.service "$finalsystemdconf" + sudo cp ../conf/${2:-systemd.service} "$finalsystemdconf" # To avoid a break by set -u, use a void substitution ${var:-}. If the variable is not set, it's simply set with an empty variable. # Substitute in a nginx config file only if the variable is not empty @@ -89,19 +95,25 @@ ynh_add_systemd_config () { ynh_store_file_checksum "$finalsystemdconf" sudo chown root: "$finalsystemdconf" - sudo systemctl enable $app + sudo systemctl enable $service_name sudo systemctl daemon-reload } # Remove the dedicated systemd config # +# usage: ynh_remove_systemd_config [Service name] +# | arg: Service name +# # usage: ynh_remove_systemd_config ynh_remove_systemd_config () { - local finalsystemdconf="/etc/systemd/system/$app.service" + local service_name="${1:-$app}" + + local finalsystemdconf="/etc/systemd/system/$service_name.service" if [ -e "$finalsystemdconf" ]; then - sudo systemctl stop $app - sudo systemctl disable $app + sudo systemctl stop $service_name + sudo systemctl disable $service_name ynh_secure_remove "$finalsystemdconf" + sudo systemctl daemon-reload fi } From a975e5e6843c97dbacdc7401fa38d4d1a72922e7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 26 Jan 2018 22:21:14 +0100 Subject: [PATCH 022/313] Improve comment / helper description --- data/helpers.d/backend | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/data/helpers.d/backend b/data/helpers.d/backend index c04f2230b..33d87db2c 100644 --- a/data/helpers.d/backend +++ b/data/helpers.d/backend @@ -64,13 +64,13 @@ ynh_remove_logrotate () { # Create a dedicated systemd config # -# usage: ynh_add_systemd_config [Service name] [Source file] -# | arg: Service name -# | arg: Systemd source file (for example appname.service) +# usage: ynh_add_systemd_config [Service name] [Template name] +# | arg: Service name (optionnal, $app by default) +# | arg: Name of template file (optionnal, this is 'systemd' by default, meaning ./conf/systemd.service will be used as template) # -# This will use a template in ../conf/systemd.service -# and will replace the following keywords with -# global variables that should be defined before calling +# This will use the template ../conf/.service +# to generate a systemd config, by replacing the following keywords +# with global variables that should be defined before calling # this helper : # # __APP__ by $app @@ -102,7 +102,7 @@ ynh_add_systemd_config () { # Remove the dedicated systemd config # # usage: ynh_remove_systemd_config [Service name] -# | arg: Service name +# | arg: Service name (optionnal, $app by default) # # usage: ynh_remove_systemd_config ynh_remove_systemd_config () { From a1831ce0f8f0e18d0b1b831509c9727895f87e08 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 26 Jan 2018 22:40:33 +0100 Subject: [PATCH 023/313] Manage etckeeper.conf to make etckeeper quiet --- data/hooks/conf_regen/01-yunohost | 3 ++ data/templates/yunohost/etckeeper.conf | 43 ++++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 data/templates/yunohost/etckeeper.conf diff --git a/data/hooks/conf_regen/01-yunohost b/data/hooks/conf_regen/01-yunohost index f8bef0614..e1daa7c3d 100755 --- a/data/hooks/conf_regen/01-yunohost +++ b/data/hooks/conf_regen/01-yunohost @@ -53,6 +53,9 @@ do_pre_regen() { else sudo cp services.yml /etc/yunohost/services.yml fi + + mkdir -p "$pending_dir"/etc/etckeeper/ + cp etckeeper.conf "$pending_dir"/etc/etckeeper/ } _update_services() { diff --git a/data/templates/yunohost/etckeeper.conf b/data/templates/yunohost/etckeeper.conf new file mode 100644 index 000000000..2d11c3dc6 --- /dev/null +++ b/data/templates/yunohost/etckeeper.conf @@ -0,0 +1,43 @@ +# The VCS to use. +#VCS="hg" +VCS="git" +#VCS="bzr" +#VCS="darcs" + +# Options passed to git commit when run by etckeeper. +GIT_COMMIT_OPTIONS="--quiet" + +# Options passed to hg commit when run by etckeeper. +HG_COMMIT_OPTIONS="" + +# Options passed to bzr commit when run by etckeeper. +BZR_COMMIT_OPTIONS="" + +# Options passed to darcs record when run by etckeeper. +DARCS_COMMIT_OPTIONS="-a" + +# Uncomment to avoid etckeeper committing existing changes +# to /etc automatically once per day. +#AVOID_DAILY_AUTOCOMMITS=1 + +# Uncomment the following to avoid special file warning +# (the option is enabled automatically by cronjob regardless). +#AVOID_SPECIAL_FILE_WARNING=1 + +# Uncomment to avoid etckeeper committing existing changes to +# /etc before installation. It will cancel the installation, +# so you can commit the changes by hand. +#AVOID_COMMIT_BEFORE_INSTALL=1 + +# The high-level package manager that's being used. +# (apt, pacman-g2, yum, zypper etc) +HIGHLEVEL_PACKAGE_MANAGER=apt + +# The low-level package manager that's being used. +# (dpkg, rpm, pacman, pacman-g2, etc) +LOWLEVEL_PACKAGE_MANAGER=dpkg + +# To push each commit to a remote, put the name of the remote here. +# (eg, "origin" for git). Space-separated lists of multiple remotes +# also work (eg, "origin gitlab github" for git). +PUSH_REMOTE="" From 50bd20fce9d0a716114d0165d222f9a90e8c3f0f Mon Sep 17 00:00:00 2001 From: Jean-Baptiste Lescher Date: Tue, 30 Jan 2018 17:16:46 +0100 Subject: [PATCH 024/313] [Fix] Stronger match for acme-challenge nginx location If an application (for instance roundcube) installed at the root of a subdomain has the following nginx configuration: location ~ ^/(.+/|)\. { deny all; } acme-challenge matching location: location '/.well-known/acme-challenge' { default_type "text/plain"; alias /tmp/acme-challenge-public/; } will not be used. This fix prevents further matching by regular expressions. Co-authored-by: Tomo59 --- src/yunohost/certificate.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/certificate.py b/src/yunohost/certificate.py index b6fb0e275..2394f26d5 100644 --- a/src/yunohost/certificate.py +++ b/src/yunohost/certificate.py @@ -463,7 +463,7 @@ def _configure_for_acme_challenge(auth, domain): nginx_conf_file = "%s/000-acmechallenge.conf" % nginx_conf_folder nginx_configuration = ''' -location '/.well-known/acme-challenge' +location ^~ '/.well-known/acme-challenge' { default_type "text/plain"; alias %s; From ebdc67e02ffaa8bf2b30abb82e0e01bea852ceff Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Sun, 4 Feb 2018 19:21:24 +0100 Subject: [PATCH 025/313] [enh] Allow to disable the backup during the upgrade --- data/helpers.d/utils | 70 ++++++++++++++++++++++++++------------------ 1 file changed, 41 insertions(+), 29 deletions(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index 3dc0c9bfc..db51578db 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -37,16 +37,22 @@ ynh_get_plain_key() { ynh_restore_upgradebackup () { echo "Upgrade failed." >&2 local app_bck=${app//_/-} # Replace all '_' by '-' - - # Check if an existing backup can be found before removing and restoring the application. - if sudo yunohost backup list | grep -q $app_bck-pre-upgrade$backup_number - then - # Remove the application then restore it - sudo yunohost app remove $app - # Restore the backup - sudo yunohost backup restore --ignore-system $app_bck-pre-upgrade$backup_number --apps $app --force - ynh_die "The app was restored to the way it was before the failed upgrade." - fi + NO_BACKUP_UPGRADE=${NO_BACKUP_UPGRADE:-0} + + if [ "$NO_BACKUP_UPGRADE" -eq 0 ] + then + # Check if an existing backup can be found before removing and restoring the application. + if sudo yunohost backup list | grep -q $app_bck-pre-upgrade$backup_number + then + # Remove the application then restore it + sudo yunohost app remove $app + # Restore the backup + sudo yunohost backup restore --ignore-system $app_bck-pre-upgrade$backup_number --apps $app --force + ynh_die "The app was restored to the way it was before the failed upgrade." + fi + else + echo "\$NO_BACKUP_UPGRADE is set, that means there's no backup to restore. You have to fix this upgrade by yourself !" >&2 + fi } # Make a backup in case of failed upgrade @@ -67,28 +73,34 @@ ynh_backup_before_upgrade () { backup_number=1 local old_backup_number=2 local app_bck=${app//_/-} # Replace all '_' by '-' + NO_BACKUP_UPGRADE=${NO_BACKUP_UPGRADE:-0} - # Check if a backup already exists with the prefix 1 - if sudo yunohost backup list | grep -q $app_bck-pre-upgrade1 - then - # Prefix becomes 2 to preserve the previous backup - backup_number=2 - old_backup_number=1 - fi - - # Create backup - sudo yunohost backup create --ignore-system --apps $app --name $app_bck-pre-upgrade$backup_number - if [ "$?" -eq 0 ] - then - # If the backup succeeded, remove the previous backup - if sudo yunohost backup list | grep -q $app_bck-pre-upgrade$old_backup_number + if [ "$NO_BACKUP_UPGRADE" -eq 0 ] + then + # Check if a backup already exists with the prefix 1 + if sudo yunohost backup list | grep -q $app_bck-pre-upgrade1 then - # Remove the previous backup only if it exists - sudo yunohost backup delete $app_bck-pre-upgrade$old_backup_number > /dev/null + # Prefix becomes 2 to preserve the previous backup + backup_number=2 + old_backup_number=1 fi - else - ynh_die "Backup failed, the upgrade process was aborted." - fi + + # Create backup + sudo yunohost backup create --ignore-system --apps $app --name $app_bck-pre-upgrade$backup_number + if [ "$?" -eq 0 ] + then + # If the backup succeeded, remove the previous backup + if sudo yunohost backup list | grep -q $app_bck-pre-upgrade$old_backup_number + then + # Remove the previous backup only if it exists + sudo yunohost backup delete $app_bck-pre-upgrade$old_backup_number > /dev/null + fi + else + ynh_die "Backup failed, the upgrade process was aborted." + fi + else + echo "\$NO_BACKUP_UPGRADE is set, backup will be avoided. Be careful, this upgrade is going to be operated without securi$ + fi } # Download, check integrity, uncompress and patch the source from app.src From c824f403a421e63ede69922c4bb931dad599c1fa Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 9 Feb 2018 16:10:31 +0100 Subject: [PATCH 026/313] [Fix] Referrer, CSP bad conf. cf. Another pr. --- data/templates/nginx/server.tpl.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 11f503c98..20301b2c1 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -43,8 +43,7 @@ server { #ssl_dhparam /etc/ssl/private/dh2048.pem; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header 'Referrer-Policy' 'same-origin'; - add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';report-uri /csp-violation-report-endpoint/"; + add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Download-Options noopen; From 4f616fe8c7a0d2de9f40b80b541a6cbd2b11eea2 Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 9 Feb 2018 16:11:41 +0100 Subject: [PATCH 027/313] [Fix] CSP cf. another PR. --- data/templates/nginx/plain/yunohost_admin.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index eedbd61b3..51424f289 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -39,7 +39,7 @@ server { add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header 'Referrer-Policy' 'same-origin'; - add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';report-uri /csp-violation-report-endpoint/"; + add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval'"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Download-Options noopen; From 03273e3b946a74972185ad429fd9fe7ea49da474 Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 9 Feb 2018 16:20:29 +0100 Subject: [PATCH 028/313] [fix] typo --- data/templates/nginx/server.tpl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 20301b2c1..d5356fd6a 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -43,7 +43,7 @@ server { #ssl_dhparam /etc/ssl/private/dh2048.pem; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval';"; + add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval'"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Download-Options noopen; From 4276a187a05c01378cd4574f7a09bcff30a9f00f Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 9 Feb 2018 16:24:16 +0100 Subject: [PATCH 029/313] [enh] Comment with the URL of the Mozilla Directives --- data/templates/nginx/server.tpl.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index d5356fd6a..ac2ff8486 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -42,6 +42,9 @@ server { # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 #ssl_dhparam /etc/ssl/private/dh2048.pem; + # Follows the Web Security Directives from the Mozilla Dev Lab and the Mozilla Obervatory + Partners + # https://wiki.mozilla.org/Security/Guidelines/Web_Security + # https://observatory.mozilla.org/ add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval'"; add_header X-Content-Type-Options nosniff; From 6ab29260cf7669da78aa25fa088735b7f5f69846 Mon Sep 17 00:00:00 2001 From: frju365 Date: Fri, 9 Feb 2018 16:25:09 +0100 Subject: [PATCH 030/313] [enh] Mozilla directives. --- data/templates/nginx/plain/yunohost_admin.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index 51424f289..156d61bd6 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -37,6 +37,9 @@ server { # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 #ssl_dhparam /etc/ssl/private/dh2048.pem; + # Follows the Web Security Directives from the Mozilla Dev Lab and the Mozilla Obervatory + Partners + # https://wiki.mozilla.org/Security/Guidelines/Web_Security + # https://observatory.mozilla.org/ add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; add_header 'Referrer-Policy' 'same-origin'; add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval'"; From f70949b35019f51be47bd4a7e3a9b106bc2ee3fe Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sun, 11 Feb 2018 05:39:31 +0100 Subject: [PATCH 031/313] [fix] handle uncatched exception --- src/yunohost/tools.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 381cd07e0..f98d48fc5 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -33,8 +33,9 @@ import logging import subprocess import pwd import socket -from collections import OrderedDict +from xmlrpclib import Fault from importlib import import_module +from collections import OrderedDict import apt import apt.progress @@ -569,7 +570,7 @@ def tools_diagnosis(auth, private=False): diagnosis['system'] = OrderedDict() try: disks = monitor_disk(units=['filesystem'], human_readable=True) - except MoulinetteError as e: + except (MoulinetteError, Fault) as e: logger.warning(m18n.n('diagnosis_monitor_disk_error', error=format(e)), exc_info=1) else: diagnosis['system']['disks'] = {} From 88d7a31bda1780b9cc81ff073092fc41629d58b3 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 11 Feb 2018 22:23:40 +0100 Subject: [PATCH 032/313] [fix] Microdecision : add mailutils as a dependency --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index dcdd0dd9a..c15c5eec5 100644 --- a/debian/control +++ b/debian/control @@ -18,7 +18,7 @@ Depends: ${python:Depends}, ${misc:Depends} , ca-certificates, netcat-openbsd, iproute , mariadb-server | mysql-server, php5-mysql | php5-mysqlnd , slapd, ldap-utils, sudo-ldap, libnss-ldapd, nscd - , postfix-ldap, postfix-policyd-spf-perl, postfix-pcre, procmail + , postfix-ldap, postfix-policyd-spf-perl, postfix-pcre, procmail, mailutils , dovecot-ldap, dovecot-lmtpd, dovecot-managesieved , dovecot-antispam, fail2ban , nginx-extras (>=1.6.2), php5-fpm, php5-ldap, php5-intl From 79c7ba7615bc63a2acce648a8c18d8a976af102e Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Thu, 22 Feb 2018 11:52:55 +0100 Subject: [PATCH 033/313] Indentation fix... --- data/helpers.d/utils | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index d39bb78f5..81a76fdf3 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -38,10 +38,10 @@ ynh_restore_upgradebackup () { echo "Upgrade failed." >&2 local app_bck=${app//_/-} # Replace all '_' by '-' - NO_BACKUP_UPGRADE=${NO_BACKUP_UPGRADE:-0} + NO_BACKUP_UPGRADE=${NO_BACKUP_UPGRADE:-0} - if [ "$NO_BACKUP_UPGRADE" -eq 0 ] - then + if [ "$NO_BACKUP_UPGRADE" -eq 0 ] + then # Check if an existing backup can be found before removing and restoring the application. if sudo yunohost backup list | grep -q $app_bck-pre-upgrade$backup_number then @@ -51,9 +51,9 @@ ynh_restore_upgradebackup () { sudo yunohost backup restore --ignore-system $app_bck-pre-upgrade$backup_number --apps $app --force --verbose ynh_die "The app was restored to the way it was before the failed upgrade." fi - else - echo "\$NO_BACKUP_UPGRADE is set, that means there's no backup to restore. You have to fix this upgrade by yourself !" >&2 - fi + else + echo "\$NO_BACKUP_UPGRADE is set, that means there's no backup to restore. You have to fix this upgrade by yourself !" >&2 + fi } # Make a backup in case of failed upgrade From 9a80635dbc33babd4da63eff4d2d157991f069e6 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 28 Feb 2018 08:54:11 -0500 Subject: [PATCH 034/313] [fix] Fail2ban conf/filter was not matching failed login attempts... --- data/templates/fail2ban/jail.conf | 3 ++- data/templates/fail2ban/yunohost.conf | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/data/templates/fail2ban/jail.conf b/data/templates/fail2ban/jail.conf index d34763e48..648d44fa8 100644 --- a/data/templates/fail2ban/jail.conf +++ b/data/templates/fail2ban/jail.conf @@ -581,5 +581,6 @@ enabled = true port = http,https protocol = tcp filter = yunohost -logpath = /var/log/nginx*/*error.log +logpath = /var/log/nginx/*error.log + /var/log/nginx/*access.log maxretry = 6 diff --git a/data/templates/fail2ban/yunohost.conf b/data/templates/fail2ban/yunohost.conf index 3ca8f1c8f..a501c10ba 100644 --- a/data/templates/fail2ban/yunohost.conf +++ b/data/templates/fail2ban/yunohost.conf @@ -14,8 +14,8 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = helpers.lua:[1-9]+: authenticate\(\): Connection failed for: .*, client: - ^ -.*\"POST /yunohost/api/login HTTP/1.1\" 401 22 +failregex = helpers.lua:[0-9]+: authenticate\(\): Connection failed for: .*, client: + ^ -.*\"POST /yunohost/api/login HTTP/1.1\" 401 # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 89215f0402ba5502940abc7b5e22f0d8c2326dce Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 28 Feb 2018 08:54:11 -0500 Subject: [PATCH 035/313] [fix] Fail2ban conf/filter was not matching failed login attempts... --- data/templates/fail2ban/jail.conf | 3 ++- data/templates/fail2ban/yunohost.conf | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/data/templates/fail2ban/jail.conf b/data/templates/fail2ban/jail.conf index d34763e48..648d44fa8 100644 --- a/data/templates/fail2ban/jail.conf +++ b/data/templates/fail2ban/jail.conf @@ -581,5 +581,6 @@ enabled = true port = http,https protocol = tcp filter = yunohost -logpath = /var/log/nginx*/*error.log +logpath = /var/log/nginx/*error.log + /var/log/nginx/*access.log maxretry = 6 diff --git a/data/templates/fail2ban/yunohost.conf b/data/templates/fail2ban/yunohost.conf index 3ca8f1c8f..a501c10ba 100644 --- a/data/templates/fail2ban/yunohost.conf +++ b/data/templates/fail2ban/yunohost.conf @@ -14,8 +14,8 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = helpers.lua:[1-9]+: authenticate\(\): Connection failed for: .*, client: - ^ -.*\"POST /yunohost/api/login HTTP/1.1\" 401 22 +failregex = helpers.lua:[0-9]+: authenticate\(\): Connection failed for: .*, client: + ^ -.*\"POST /yunohost/api/login HTTP/1.1\" 401 # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 00481af499fea58f8ade0a8b65474442def326c8 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 7 Mar 2018 12:44:15 +0000 Subject: [PATCH 036/313] Update changelog for 2.7.10 release --- debian/changelog | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index 4ebe4e14c..989419109 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,14 @@ +yunohost (2.7.10) stable; urgency=low + + * [fix] Fail2ban conf/filter was not matching failed login attempts... + + -- Alexandre Aubin Wed, 07 Mar 2018 12:43:35 +0000 + yunohost (2.7.9) stable; urgency=low (Bumping version number for stable release) - -- Alexandre Aubin Tue, 30 Jan 2018 17:42:00 +0000 + -- Alexandre Aubin Tue, 30 Jan 2018 17:42:00 +0000 yunohost (2.7.8) testing; urgency=low From 8652435d8a5e05975810991a45f25e42223fe182 Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Thu, 8 Mar 2018 18:53:21 +0100 Subject: [PATCH 037/313] [fix] Remove warning from equivs --- data/helpers.d/package | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/data/helpers.d/package b/data/helpers.d/package index c616105d1..870147f2e 100644 --- a/data/helpers.d/package +++ b/data/helpers.d/package @@ -97,6 +97,10 @@ ynh_package_install_from_equivs () { # Build and install the package local TMPDIR=$(mktemp -d) + + # Force the compatibility level at 10, levels below are deprecated + echo 10 > /usr/share/equivs/template/debian/compat + # Note that the cd executes into a sub shell # Create a fake deb package with equivs-build and the given control file # Install the fake package without its dependencies with dpkg From 935b972d6e61a8966da862cdee4421ce8e5ffb19 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 9 Mar 2018 17:55:07 +0100 Subject: [PATCH 038/313] Misc fixes in the helpers to clean the autodoc --- data/helpers.d/backend | 17 ++++++++--------- data/helpers.d/ip | 10 +++++----- data/helpers.d/mysql | 4 ++-- data/helpers.d/system | 32 +++++++++++++++++--------------- 4 files changed, 32 insertions(+), 31 deletions(-) diff --git a/data/helpers.d/backend b/data/helpers.d/backend index c2c626829..28c5b8e91 100644 --- a/data/helpers.d/backend +++ b/data/helpers.d/backend @@ -2,7 +2,7 @@ # # usage: ynh_use_logrotate [logfile] [--non-append] # | arg: logfile - absolute path of logfile -# | option: --non-append - Replace the config file instead of appending this new config. +# | arg: --non-append - (Option) Replace the config file instead of appending this new config. # # If no argument provided, a standard directory will be use. /var/log/${app} # You can provide a path with the directory only or with the logfile. @@ -64,9 +64,9 @@ ynh_remove_logrotate () { # Create a dedicated systemd config # -# usage: ynh_add_systemd_config [Service name] [Template name] -# | arg: Service name (optionnal, $app by default) -# | arg: Name of template file (optionnal, this is 'systemd' by default, meaning ./conf/systemd.service will be used as template) +# usage: ynh_add_systemd_config [service] [template] +# | arg: service - Service name (optionnal, $app by default) +# | arg: template - Name of template file (optionnal, this is 'systemd' by default, meaning ./conf/systemd.service will be used as template) # # This will use the template ../conf/.service # to generate a systemd config, by replacing the following keywords @@ -76,7 +76,6 @@ ynh_remove_logrotate () { # __APP__ by $app # __FINALPATH__ by $final_path # -# usage: ynh_add_systemd_config ynh_add_systemd_config () { local service_name="${1:-$app}" @@ -101,10 +100,9 @@ ynh_add_systemd_config () { # Remove the dedicated systemd config # -# usage: ynh_remove_systemd_config [Service name] -# | arg: Service name (optionnal, $app by default) +# usage: ynh_remove_systemd_config [service] +# | arg: service - Service name (optionnal, $app by default) # -# usage: ynh_remove_systemd_config ynh_remove_systemd_config () { local service_name="${1:-$app}" @@ -119,6 +117,8 @@ ynh_remove_systemd_config () { # Create a dedicated nginx config # +# usage: ynh_add_nginx_config +# # This will use a template in ../conf/nginx.conf # __PATH__ by $path_url # __DOMAIN__ by $domain @@ -126,7 +126,6 @@ ynh_remove_systemd_config () { # __NAME__ by $app # __FINALPATH__ by $final_path # -# usage: ynh_add_nginx_config ynh_add_nginx_config () { finalnginxconf="/etc/nginx/conf.d/$domain.d/$app.conf" ynh_backup_if_checksum_is_different "$finalnginxconf" diff --git a/data/helpers.d/ip b/data/helpers.d/ip index 874675c9d..092cdff4b 100644 --- a/data/helpers.d/ip +++ b/data/helpers.d/ip @@ -1,10 +1,10 @@ # Validate an IP address # +# usage: ynh_validate_ip [family] [ip_address] +# | ret: 0 for valid ip addresses, 1 otherwise +# # example: ynh_validate_ip 4 111.222.333.444 # -# usage: ynh_validate_ip -# -# exit code : 0 for valid ip addresses, 1 otherwise ynh_validate_ip() { # http://stackoverflow.com/questions/319279/how-to-validate-ip-address-in-python#319298 @@ -31,8 +31,8 @@ EOF # example: ynh_validate_ip4 111.222.333.444 # # usage: ynh_validate_ip4 +# | ret: 0 for valid ipv4 addresses, 1 otherwise # -# exit code : 0 for valid ipv4 addresses, 1 otherwise ynh_validate_ip4() { ynh_validate_ip 4 $1 @@ -44,8 +44,8 @@ ynh_validate_ip4() # example: ynh_validate_ip6 2000:dead:beef::1 # # usage: ynh_validate_ip6 +# | ret: 0 for valid ipv6 addresses, 1 otherwise # -# exit code : 0 for valid ipv6 addresses, 1 otherwise ynh_validate_ip6() { ynh_validate_ip 6 $1 diff --git a/data/helpers.d/mysql b/data/helpers.d/mysql index 8aa81a1fe..452a95eec 100644 --- a/data/helpers.d/mysql +++ b/data/helpers.d/mysql @@ -90,7 +90,7 @@ ynh_mysql_create_user() { # # usage: ynh_mysql_user_exists user # | arg: user - the user for which to check existence -function ynh_mysql_user_exists() +ynh_mysql_user_exists() { local user=$1 if [[ -z $(ynh_mysql_execute_as_root "SELECT User from mysql.user WHERE User = '$user';") ]] @@ -153,7 +153,7 @@ ynh_mysql_remove_db () { # Sanitize a string intended to be the name of a database # (More specifically : replace - and . by _) # -# Exemple: dbname=$(ynh_sanitize_dbid $app) +# example: dbname=$(ynh_sanitize_dbid $app) # # usage: ynh_sanitize_dbid name # | arg: name - name to correct/sanitize diff --git a/data/helpers.d/system b/data/helpers.d/system index f204c836a..dbd21a4ec 100644 --- a/data/helpers.d/system +++ b/data/helpers.d/system @@ -1,18 +1,17 @@ # Manage a fail of the script # -# Print a warning to inform that the script was failed -# Execute the ynh_clean_setup function if used in the app script -# -# usage of ynh_clean_setup function -# This function provide a way to clean some residual of installation that not managed by remove script. -# To use it, simply add in your script: +# usage: +# ynh_exit_properly is used only by the helper ynh_abort_if_errors. +# You should not use it directly. +# Instead, add to your script: # ynh_clean_setup () { # instructions... # } -# This function is optionnal. # -# Usage: ynh_exit_properly is used only by the helper ynh_abort_if_errors. -# You must not use it directly. +# This function provide a way to clean some residual of installation that not managed by remove script. +# +# It prints a warning to inform that the script was failed, and execute the ynh_clean_setup function if used in the app script +# ynh_exit_properly () { local exit_code=$? if [ "$exit_code" -eq 0 ]; then @@ -31,20 +30,23 @@ ynh_exit_properly () { ynh_die # Exit with error status } -# Exit if an error occurs during the execution of the script. +# Exits if an error occurs during the execution of the script. # -# Stop immediatly the execution if an error occured or if a empty variable is used. -# The execution of the script is derivate to ynh_exit_properly function before exit. +# usage: ynh_abort_if_errors +# +# This configure the rest of the script execution such that, if an error occurs +# or if an empty variable is used, the execution of the script stops +# immediately and a call to `ynh_exit_properly` is triggered. # -# Usage: ynh_abort_if_errors ynh_abort_if_errors () { set -eu # Exit if a command fail, and if a variable is used unset. trap ynh_exit_properly EXIT # Capturing exit signals on shell script } -# Return the Debian release codename (i.e. jessie, stretch, etc.) +# Fetch the Debian release codename # # usage: ynh_get_debian_release +# | ret: The Debian release codename (i.e. jessie, stretch, ...) ynh_get_debian_release () { echo $(lsb_release --codename --short) -} \ No newline at end of file +} From af22474a5068093f22b0074c01eaa784d29a0d5d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 10 Mar 2018 19:01:33 +0100 Subject: [PATCH 039/313] Add some [internal] flags in the comment to hide a few helpers from autodoc --- data/helpers.d/filesystem | 7 +++++++ data/helpers.d/mysql | 8 ++++++++ data/helpers.d/package | 4 ++++ data/helpers.d/print | 4 ++++ data/helpers.d/system | 5 ++++- 5 files changed, 27 insertions(+), 1 deletion(-) diff --git a/data/helpers.d/filesystem b/data/helpers.d/filesystem index 6361d278e..6836aeebe 100644 --- a/data/helpers.d/filesystem +++ b/data/helpers.d/filesystem @@ -136,6 +136,8 @@ ynh_restore () { # Return the path in the archive where has been stocked the origin path # +# [internal] +# # usage: _get_archive_path ORIGIN_PATH _get_archive_path () { # For security reasons we use csv python library to read the CSV @@ -203,6 +205,9 @@ ynh_restore_file () { } # Deprecated helper since it's a dangerous one! +# +# [internal] +# ynh_bind_or_cp() { local AS_ROOT=${3:-0} local NO_ROOT=0 @@ -213,6 +218,8 @@ ynh_bind_or_cp() { # Create a directory under /tmp # +# [internal] +# # Deprecated helper # # usage: ynh_mkdir_tmp diff --git a/data/helpers.d/mysql b/data/helpers.d/mysql index 452a95eec..7bc93fad5 100644 --- a/data/helpers.d/mysql +++ b/data/helpers.d/mysql @@ -35,6 +35,8 @@ ynh_mysql_execute_file_as_root() { # Create a database and grant optionnaly privilegies to a user # +# [internal] +# # usage: ynh_mysql_create_db db [user [pwd]] # | arg: db - the database name to create # | arg: user - the user to grant privilegies @@ -56,6 +58,8 @@ ynh_mysql_create_db() { # Drop a database # +# [internal] +# # If you intend to drop the database *and* the associated user, # consider using ynh_mysql_remove_db instead. # @@ -78,6 +82,8 @@ ynh_mysql_dump_db() { # Create a user # +# [internal] +# # usage: ynh_mysql_create_user user pwd [host] # | arg: user - the user name to create # | arg: pwd - the password to identify user by @@ -103,6 +109,8 @@ ynh_mysql_user_exists() # Drop a user # +# [internal] +# # usage: ynh_mysql_drop_user user # | arg: user - the user name to drop ynh_mysql_drop_user() { diff --git a/data/helpers.d/package b/data/helpers.d/package index c616105d1..4d147488c 100644 --- a/data/helpers.d/package +++ b/data/helpers.d/package @@ -26,6 +26,8 @@ ynh_package_version() { # APT wrapper for non-interactive operation # +# [internal] +# # usage: ynh_apt update ynh_apt() { DEBIAN_FRONTEND=noninteractive sudo apt-get -y -qq $@ @@ -73,6 +75,8 @@ ynh_package_autopurge() { # Build and install a package from an equivs control file # +# [internal] +# # example: generate an empty control file with `equivs-control`, adjust its # content and use helper to build and install the package: # ynh_package_install_from_equivs /path/to/controlfile diff --git a/data/helpers.d/print b/data/helpers.d/print index d9c8f1ec4..b13186d62 100644 --- a/data/helpers.d/print +++ b/data/helpers.d/print @@ -6,7 +6,11 @@ ynh_die() { } # Ignore the yunohost-cli log to prevent errors with conditionals commands +# +# [internal] +# # usage: ynh_no_log COMMAND +# # Simply duplicate the log, execute the yunohost command and replace the log without the result of this command # It's a very badly hack... ynh_no_log() { diff --git a/data/helpers.d/system b/data/helpers.d/system index dbd21a4ec..70cc57493 100644 --- a/data/helpers.d/system +++ b/data/helpers.d/system @@ -1,5 +1,7 @@ # Manage a fail of the script # +# [internal] +# # usage: # ynh_exit_properly is used only by the helper ynh_abort_if_errors. # You should not use it directly. @@ -36,7 +38,8 @@ ynh_exit_properly () { # # This configure the rest of the script execution such that, if an error occurs # or if an empty variable is used, the execution of the script stops -# immediately and a call to `ynh_exit_properly` is triggered. +# immediately and a call to `ynh_clean_setup` is triggered if it has been +# defined by your script. # ynh_abort_if_errors () { set -eu # Exit if a command fail, and if a variable is used unset. From bdf923aafcea2c0aacfdbb80e6cd4b1140ab6f51 Mon Sep 17 00:00:00 2001 From: Josue-T Date: Thu, 15 Mar 2018 18:58:11 +0100 Subject: [PATCH 040/313] Solve issue with ynh_restore_file (#384) * Solve issue with ynh_restore_file While we use the `ynh_restore_file` if the destination already exist the `mv` fonction don't work correctly. By this commit the old directory is renamed. * Move to /home/yunohost.conf file if already exist in restoration * Remove if the file is bigger than 500Mo * Use a local variable * Fix DEST_PATH * Fix comment and typo * More precise comment regarding the behavior if DEST_PATH exists --- data/helpers.d/filesystem | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/data/helpers.d/filesystem b/data/helpers.d/filesystem index d8e7dc4c7..d4146ad8f 100644 --- a/data/helpers.d/filesystem +++ b/data/helpers.d/filesystem @@ -175,6 +175,9 @@ with open(sys.argv[1], 'r') as backup_file: # the destination will be ORIGIN_PATH or if the ORIGIN_PATH doesn't exist in # the archive, the destination will be searched into backup.csv # +# If DEST_PATH already exists and is lighter than 500 Mo, a backup will be made in +# /home/yunohost.conf/backup/. Otherwise, the existing file is removed. +# # examples: # ynh_restore_file "/etc/nginx/conf.d/$domain.d/$app.conf" # # if apps/wordpress/etc/nginx/conf.d/$domain.d/$app.conf exists, restore it into @@ -196,6 +199,20 @@ ynh_restore_file () { ARCHIVE_PATH="$YNH_BACKUP_DIR/$(_get_archive_path \"$ORIGIN_PATH\")" fi + # Move the old directory if it already exists + if [[ -e "${DEST_PATH}" ]] + then + # Check if the file/dir size is less than 500 Mo + if [[ $(du -sb ${DEST_PATH} | cut -d"/" -f1) -le "500000000" ]] + then + local backup_file="/home/yunohost.conf/backup/${DEST_PATH}.backup.$(date '+%Y%m%d.%H%M%S')" + mkdir -p "$(dirname "$backup_file")" + mv "${DEST_PATH}" "$backup_file" # Move the current file or directory + else + ynh_secure_remove ${DEST_PATH} + fi + fi + # Restore ORIGIN_PATH into DEST_PATH mkdir -p $(dirname "$DEST_PATH") From 020dea653190afc16f928e063c354511823fbaf4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Feb 2018 01:42:33 +0100 Subject: [PATCH 041/313] Change the way we list migrations (always load the module) and the way we manage its infos --- locales/en.json | 4 +-- src/yunohost/tools.py | 59 +++++++++++++++++++++++++------------------ 2 files changed, 37 insertions(+), 26 deletions(-) diff --git a/locales/en.json b/locales/en.json index 66fa93f45..f5f706d69 100644 --- a/locales/en.json +++ b/locales/en.json @@ -226,9 +226,9 @@ "migrations_bad_value_for_target": "Invalide number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", "migrations_current_target": "Migration target is {}", - "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {number} {name}", + "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {migration_id}", "migrations_forward": "Migrating forward", - "migrations_loading_migration": "Loading migration {number} {name}...", + "migrations_loading_migration": "Loading migration {migration_id}...", "migrations_migration_has_failed": "Migration {number} {name} has failed with exception {exception}, aborting", "migrations_no_migrations_to_run": "No migrations to run", "migrations_show_currently_running_migration": "Running migration {number} {name}...", diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index f98d48fc5..fcea5ffb3 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -741,11 +741,7 @@ def tools_migrations_list(): migrations = {"migrations": []} for migration in _get_migrations_list(): - migrations["migrations"].append({ - "number": int(migration.split("_", 1)[0]), - "name": migration.split("_", 1)[1], - "file_name": migration, - }) + migrations["migrations"].append(migration.infos()) return migrations @@ -905,55 +901,57 @@ def _get_migrations_list(): logger.warn(m18n.n('migrations_cant_reach_migration_file', migrations_path)) return migrations - for migration in filter(lambda x: re.match("^\d+_[a-zA-Z0-9_]+\.py$", x), os.listdir(migrations_path)): - migrations.append(migration[:-len(".py")]) + for migration_file in filter(lambda x: re.match("^\d+_[a-zA-Z0-9_]+\.py$", x), os.listdir(migrations_path)): + migrations.append(_load_migration(migration_file)) - return sorted(migrations) + return sorted(migrations, key=lambda m: m.id) -def _get_migration_by_name(migration_name, with_module=True): +def _get_migration_by_name(migration_name): """ Low-level / "private" function to find a migration by its name """ - migrations = tools_migrations_list()["migrations"] + try: + import data_migrations + except ImportError: + raise AssertionError("Unable to find migration with name %s" % migration_name) - matches = [ m for m in migrations if m["name"] == migration_name ] + migrations_path = data_migrations.__path__[0] + migrations_found = filter(lambda x: re.match("^\d+_%s\.py$" % migration_name, x), os.listdir(migrations_path)) - assert len(matches) == 1, "Unable to find migration with name %s" % migration_name + assert len(migrations_found) == 1, "Unable to find migration with name %s" % migration_name - migration = matches[0] - - if with_module: - migration["module"] = _get_migration_module(migration) - - return migration + return _load_migration(migrations_found[0]) -def _get_migration_module(migration): +def _load_migration(migration_file): + + migration_id = migration_file[:-len(".py")] logger.debug(m18n.n('migrations_loading_migration', - number=migration["number"], - name=migration["name"], + migration_id=migration_id, )) try: # this is python builtin method to import a module using a name, we # use that to import the migration as a python object so we'll be # able to run it in the next loop - return import_module("yunohost.data_migrations.{file_name}".format(**migration)) + module = import_module("yunohost.data_migrations.{}".format(migration_id)) + return module.MyMigration(migration_id) except Exception: import traceback traceback.print_exc() raise MoulinetteError(errno.EINVAL, m18n.n('migrations_error_failed_to_load_migration', - number=migration["number"], - name=migration["name"], + migration_id=migration_id, )) class Migration(object): + # forward() and backward() are to be implemented by daughter classes + def migrate(self): self.forward() @@ -962,3 +960,16 @@ class Migration(object): def backward(self): pass + + # The followings shouldn't be overriden + + def __init__(self, id_): + self.id = id_ + + def infos(self): + + return { + "id": self.id, + "number": int(self.id.split("_", 1)[0]), + "name": self.id.split("_", 1)[1], + } From 7f359e363b1bbced3984d13230c49f315857ba77 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Feb 2018 02:59:03 +0100 Subject: [PATCH 042/313] Add mode, description and optionnal disclaimer for migrations --- locales/en.json | 2 ++ src/yunohost/tools.py | 17 ++++++++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/locales/en.json b/locales/en.json index f5f706d69..49376a1e6 100644 --- a/locales/en.json +++ b/locales/en.json @@ -222,6 +222,8 @@ "migrate_tsig_wait_3": "1min...", "migrate_tsig_wait_4": "30 secondes...", "migrate_tsig_not_needed": "You do not appear to use a dyndns domain, so no migration is needed !", + "migration_description_0001_change_cert_group_to_sslcert": "Change certificates group permissions from 'metronome' to 'ssl-cert'", + "migration_description_0002_migrate_to_tsig_sha256": "Improve security of dyndns TSIG by using SHA512 instead of MD5", "migrations_backward": "Migrating backward.", "migrations_bad_value_for_target": "Invalide number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index fcea5ffb3..f0e0315ca 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -950,10 +950,9 @@ def _load_migration(migration_file): class Migration(object): - # forward() and backward() are to be implemented by daughter classes + # Those are to be implemented by daughter classes - def migrate(self): - self.forward() + mode = "auto" def forward(self): raise NotImplementedError() @@ -961,15 +960,27 @@ class Migration(object): def backward(self): pass + def disclaimer(self): + return None + # The followings shouldn't be overriden + def migrate(self): + self.forward() + def __init__(self, id_): self.id = id_ + def description(self): + return m18n.n("migration_description_%s" % self.id) + def infos(self): return { "id": self.id, "number": int(self.id.split("_", 1)[0]), "name": self.id.split("_", 1)[1], + "mode": self.mode, + "description": self.description(), + "disclaimer": self.disclaimer() } From 0702af6054e386fae499cf955bd55a65b2f467f1 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Feb 2018 17:08:52 +0100 Subject: [PATCH 043/313] Simplify my previous stuff about managing migration infos ? --- src/yunohost/tools.py | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index f0e0315ca..107359469 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -741,7 +741,14 @@ def tools_migrations_list(): migrations = {"migrations": []} for migration in _get_migrations_list(): - migrations["migrations"].append(migration.infos()) + migrations["migrations"].append({ + "id": migration.id, + "number": migration.number, + "name": migration.name, + "mode": migration.mode, + "description": migration.description, + "disclaimer": migration.disclaimer + }) return migrations @@ -960,6 +967,7 @@ class Migration(object): def backward(self): pass + @property def disclaimer(self): return None @@ -970,17 +978,9 @@ class Migration(object): def __init__(self, id_): self.id = id_ + self.number = int(self.id.split("_", 1)[0]) + self.name = self.id.split("_", 1)[1] + @property def description(self): return m18n.n("migration_description_%s" % self.id) - - def infos(self): - - return { - "id": self.id, - "number": int(self.id.split("_", 1)[0]), - "name": self.id.split("_", 1)[1], - "mode": self.mode, - "description": self.description(), - "disclaimer": self.disclaimer() - } From d73197793c37fc8c45d21569be9265b67f01ef5a Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Feb 2018 17:44:25 +0100 Subject: [PATCH 044/313] Adapt migrations_migrate according to previous changes --- src/yunohost/tools.py | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 107359469..1e49d1f00 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -770,26 +770,18 @@ def tools_migrations_migrate(target=None, skip=False): last_run_migration_number = state["last_run_migration"]["number"] if state["last_run_migration"] else 0 - migrations = [] - - # loading all migrations - for migration in tools_migrations_list()["migrations"]: - migrations.append({ - "number": migration["number"], - "name": migration["name"], - "module": _get_migration_module(migration), - }) - - migrations = sorted(migrations, key=lambda x: x["number"]) + # load all migrations + migrations = _get_migrations_list() + migrations = sorted(migrations, key=lambda x: x.number) if not migrations: logger.info(m18n.n('migrations_no_migrations_to_run')) return - all_migration_numbers = [x["number"] for x in migrations] + all_migration_numbers = [x.number for x in migrations] if target is None: - target = migrations[-1]["number"] + target = migrations[-1].number # validate input, target must be "0" or a valid number elif target != 0 and target not in all_migration_numbers: @@ -808,14 +800,14 @@ def tools_migrations_migrate(target=None, skip=False): if last_run_migration_number < target: logger.debug(m18n.n('migrations_forward')) # drop all already run migrations - migrations = filter(lambda x: target >= x["number"] > last_run_migration_number, migrations) + migrations = filter(lambda x: target >= x.number > last_run_migration_number, migrations) mode = "forward" # we need to go backward on already run migrations elif last_run_migration_number > target: logger.debug(m18n.n('migrations_backward')) # drop all not already run migrations - migrations = filter(lambda x: target < x["number"] <= last_run_migration_number, migrations) + migrations = filter(lambda x: target < x.number <= last_run_migration_number, migrations) mode = "backward" else: # can't happen, this case is handle before @@ -824,19 +816,24 @@ def tools_migrations_migrate(target=None, skip=False): # effectively run selected migrations for migration in migrations: if not skip: - logger.warn(m18n.n('migrations_show_currently_running_migration', **migration)) + logger.warn(m18n.n('migrations_show_currently_running_migration', + number=migration.number, name=migration.name)) try: if mode == "forward": - migration["module"].MyMigration().migrate() + migration.migrate() elif mode == "backward": - migration["module"].MyMigration().backward() + migration.backward() else: # can't happen raise Exception("Illegal state for migration: '%s', should be either 'forward' or 'backward'" % mode) except Exception as e: # migration failed, let's stop here but still update state because # we managed to run the previous ones - logger.error(m18n.n('migrations_migration_has_failed', exception=e, **migration), exc_info=1) + logger.error(m18n.n('migrations_migration_has_failed', + exception=e, + number=migration.number, + name=migration.name), + exc_info=1) break else: # if skip @@ -844,8 +841,8 @@ def tools_migrations_migrate(target=None, skip=False): # update the state to include the latest run migration state["last_run_migration"] = { - "number": migration["number"], - "name": migration["name"], + "number": migration.number, + "name": migration.name } # special case where we want to go back from the start From bafe6efde2f3b93523b4702facaf36b24d841ed3 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Feb 2018 17:45:03 +0100 Subject: [PATCH 045/313] Typo --- locales/en.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/en.json b/locales/en.json index 49376a1e6..4828c6f2a 100644 --- a/locales/en.json +++ b/locales/en.json @@ -225,7 +225,7 @@ "migration_description_0001_change_cert_group_to_sslcert": "Change certificates group permissions from 'metronome' to 'ssl-cert'", "migration_description_0002_migrate_to_tsig_sha256": "Improve security of dyndns TSIG by using SHA512 instead of MD5", "migrations_backward": "Migrating backward.", - "migrations_bad_value_for_target": "Invalide number for target argument, available migrations numbers are 0 or {}", + "migrations_bad_value_for_target": "Invalid number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", "migrations_current_target": "Migration target is {}", "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {migration_id}", From c40f14e8f0a21e5ec663ba4bd8358899ed5cf921 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Feb 2018 17:49:46 +0100 Subject: [PATCH 046/313] Adapt 'manual' call to migration from dyndns according to previous changes --- src/yunohost/dyndns.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/yunohost/dyndns.py b/src/yunohost/dyndns.py index ec3bf88c8..60bea90e8 100644 --- a/src/yunohost/dyndns.py +++ b/src/yunohost/dyndns.py @@ -232,10 +232,13 @@ def dyndns_update(dyn_host="dyndns.yunohost.org", domain=None, key=None, from yunohost.tools import _get_migration_by_name migration = _get_migration_by_name("migrate_to_tsig_sha256") try: - migration["module"].MyMigration().migrate(dyn_host, domain, key) + migration.migrate(dyn_host, domain, key) except Exception as e: - logger.error(m18n.n('migrations_migration_has_failed', exception=e, **migration), exc_info=1) - + logger.error(m18n.n('migrations_migration_has_failed', + exception=e, + number=migration.number, + name=migration.name), + exc_info=1) return # Extract 'host', e.g. 'nohost.me' from 'foo.nohost.me' From c568b04459422bea7d0e8a92a2b33bbfedec7ac3 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 1 Feb 2018 21:11:12 +0100 Subject: [PATCH 047/313] Manage the auto/manual flag in migrations_migrate --- data/actionsmap/yunohost.yml | 3 +++ debian/postinst | 2 +- locales/en.json | 1 + src/yunohost/tools.py | 16 +++++++++++++--- 4 files changed, 18 insertions(+), 4 deletions(-) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index 77887b41a..d84d308c0 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -1589,6 +1589,9 @@ tools: help: skip the migration(s), use it only if you know what you are doing full: --skip action: store_true + --auto: + help: automatic mode, won't run manual migrations, use it only if you know what you are doing + action: store_true ### tools_migrations_state() diff --git a/debian/postinst b/debian/postinst index 7e91ffbb3..5b6ed8259 100644 --- a/debian/postinst +++ b/debian/postinst @@ -15,7 +15,7 @@ do_configure() { yunohost service regen-conf --output-as none echo "Launching migrations.." - yunohost tools migrations migrate + yunohost tools migrations migrate --auto # restart yunohost-firewall if it's running service yunohost-firewall status >/dev/null \ diff --git a/locales/en.json b/locales/en.json index 4828c6f2a..7597e17e4 100644 --- a/locales/en.json +++ b/locales/en.json @@ -236,6 +236,7 @@ "migrations_show_currently_running_migration": "Running migration {number} {name}...", "migrations_show_last_migration": "Last ran migration is {}", "migrations_skip_migration": "Skipping migration {number} {name}...", + "migrations_to_be_ran_manually": "Migration {number} {name} has to be ran manually. Please go to Tools > Migrations on the webadmin, or run `yunohost tools migrations migrate`.", "monitor_disabled": "The server monitoring has been disabled", "monitor_enabled": "The server monitoring has been enabled", "monitor_glances_con_failed": "Unable to connect to Glances server", diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 1e49d1f00..0e2e1195c 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -753,7 +753,7 @@ def tools_migrations_list(): return migrations -def tools_migrations_migrate(target=None, skip=False): +def tools_migrations_migrate(target=None, skip=False, auto=False): """ Perform migrations """ @@ -816,8 +816,18 @@ def tools_migrations_migrate(target=None, skip=False): # effectively run selected migrations for migration in migrations: if not skip: - logger.warn(m18n.n('migrations_show_currently_running_migration', - number=migration.number, name=migration.name)) + + # If we are migrating in "automatic mode" (i.e. from debian + # configure during an upgrade of the package) but the migration + # is to be ran manually by the user + if auto and migration.mode == "manual": + logger.warn(m18n.n('migrations_to_be_ran_manually', + number=migration.number, name=migration.name)) + break + else: + logger.warn(m18n.n('migrations_show_currently_running_migration', + number=migration.number, name=migration.name)) + try: if mode == "forward": From c266147fd9ce4654c6b0b0766aa45eff21c4a71d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 3 Feb 2018 03:27:13 +0100 Subject: [PATCH 048/313] Be able to list only pending or done migrations --- data/actionsmap/yunohost.yml | 7 +++++++ locales/en.json | 1 + src/yunohost/tools.py | 36 ++++++++++++++++++++++++------------ 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index d84d308c0..8eba45306 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -1575,6 +1575,13 @@ tools: list: action_help: List migrations api: GET /migrations + arguments: + --pending: + help: list only pending migrations + action: store_true + --done: + help: list only migrations already performed + action: store_true ### tools_migrations_migrate() migrate: diff --git a/locales/en.json b/locales/en.json index 7597e17e4..e5034cf81 100644 --- a/locales/en.json +++ b/locales/en.json @@ -230,6 +230,7 @@ "migrations_current_target": "Migration target is {}", "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {migration_id}", "migrations_forward": "Migrating forward", + "migrations_list_conflict_pending_done": "You cannot use both --previous and --done at the same time.", "migrations_loading_migration": "Loading migration {migration_id}...", "migrations_migration_has_failed": "Migration {number} {name} has failed with exception {exception}, aborting", "migrations_no_migrations_to_run": "No migrations to run", diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 0e2e1195c..0978956fd 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -733,24 +733,36 @@ def tools_reboot(force=False): subprocess.check_call(['systemctl', 'reboot']) -def tools_migrations_list(): +def tools_migrations_list(pending=False, done=False): """ List existing migrations """ - migrations = {"migrations": []} + # Check for option conflict + if pending and done: + raise MoulinetteError(errno.EINVAL, m18n.n("migrations_list_conflict_pending_done")) - for migration in _get_migrations_list(): - migrations["migrations"].append({ - "id": migration.id, - "number": migration.number, - "name": migration.name, - "mode": migration.mode, - "description": migration.description, - "disclaimer": migration.disclaimer - }) + # Get all migrations + migrations = _get_migrations_list() - return migrations + # If asked, filter pending or done migrations + if pending or done: + last_migration = tools_migrations_state()["last_run_migration"] + last_migration = last_migration["number"] if last_migration else -1 + if done: + migrations = [m for m in migrations if m.number <= last_migration] + if pending: + migrations = [m for m in migrations if m.number > last_migration] + + # Reduce to dictionnaries + migrations = [{ "id": migration.id, + "number": migration.number, + "name": migration.name, + "mode": migration.mode, + "description": migration.description, + "disclaimer": migration.disclaimer } for migration in migrations ] + + return {"migrations": migrations} def tools_migrations_migrate(target=None, skip=False, auto=False): From c8b1d7e2c3a830d4a242a251304ed7d13f241093 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 5 Feb 2018 15:23:42 +0100 Subject: [PATCH 049/313] Forgot to adapt this also.. --- src/yunohost/tools.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 0978956fd..2fd139318 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -859,7 +859,9 @@ def tools_migrations_migrate(target=None, skip=False, auto=False): break else: # if skip - logger.warn(m18n.n('migrations_skip_migration', **migration)) + logger.warn(m18n.n('migrations_skip_migration', + number=migration.number, + name=migration.name)) # update the state to include the latest run migration state["last_run_migration"] = { From 9009b3f9d35b6d2945926e0b144c553bf4af4850 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 5 Feb 2018 18:13:51 +0100 Subject: [PATCH 050/313] Handle disclaimers --- data/actionsmap/yunohost.yml | 4 +++- locales/en.json | 1 + src/yunohost/tools.py | 37 ++++++++++++++++++++++++------------ 3 files changed, 29 insertions(+), 13 deletions(-) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index 8eba45306..715a13504 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -1599,7 +1599,9 @@ tools: --auto: help: automatic mode, won't run manual migrations, use it only if you know what you are doing action: store_true - + --accept-disclaimer: + help: accept disclaimers of migration (please read them before using this option) + action: store_true ### tools_migrations_state() state: diff --git a/locales/en.json b/locales/en.json index e5034cf81..b0c2ea3d2 100644 --- a/locales/en.json +++ b/locales/en.json @@ -238,6 +238,7 @@ "migrations_show_last_migration": "Last ran migration is {}", "migrations_skip_migration": "Skipping migration {number} {name}...", "migrations_to_be_ran_manually": "Migration {number} {name} has to be ran manually. Please go to Tools > Migrations on the webadmin, or run `yunohost tools migrations migrate`.", + "migrations_need_to_accept_disclaimer": "To run the migration {number} {name}, your must accept the following disclaimer:\n---\n{disclaimer}\n---\nIf you accept to run the migration, please re-run the command with the option --accept-disclaimer.", "monitor_disabled": "The server monitoring has been disabled", "monitor_enabled": "The server monitoring has been enabled", "monitor_glances_con_failed": "Unable to connect to Glances server", diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 2fd139318..9719f9223 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -765,7 +765,7 @@ def tools_migrations_list(pending=False, done=False): return {"migrations": migrations} -def tools_migrations_migrate(target=None, skip=False, auto=False): +def tools_migrations_migrate(target=None, skip=False, auto=False, accept_disclaimer=False): """ Perform migrations """ @@ -825,21 +825,34 @@ def tools_migrations_migrate(target=None, skip=False, auto=False): else: # can't happen, this case is handle before raise Exception() + # If we are migrating in "automatic mode" (i.e. from debian + # configure during an upgrade of the package) but we are asked to run + # migrations is to be ran manually by the user + manual_migrations = [m for m in migrations if m.mode == "manual"] + if auto and manual_migrations: + for m in manual_migrations: + logger.warn(m18n.n('migrations_to_be_ran_manually', + number=m.number, + name=m.name)) + return + + # If some migrations have disclaimers, require the --accept-disclaimer + # option + migrations_with_disclaimer = [m for m in migrations if m.disclaimer] + if not accept_disclaimer and migrations_with_disclaimer: + for m in migrations_with_disclaimer: + logger.warn(m18n.n('migrations_need_to_accept_disclaimer', + number=m.number, + name=m.name, + disclaimer=m.disclaimer)) + return + # effectively run selected migrations for migration in migrations: if not skip: - # If we are migrating in "automatic mode" (i.e. from debian - # configure during an upgrade of the package) but the migration - # is to be ran manually by the user - if auto and migration.mode == "manual": - logger.warn(m18n.n('migrations_to_be_ran_manually', - number=migration.number, name=migration.name)) - break - else: - logger.warn(m18n.n('migrations_show_currently_running_migration', - number=migration.number, name=migration.name)) - + logger.warn(m18n.n('migrations_show_currently_running_migration', + number=migration.number, name=migration.name)) try: if mode == "forward": From 44a66b1ff4453d2e88aebe64a38de275a2e02844 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 5 Mar 2018 23:42:01 +0100 Subject: [PATCH 051/313] Fix migration skipping during postinstall --- src/yunohost/tools.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 9719f9223..5e6e3f881 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -396,7 +396,7 @@ def tools_postinstall(domain, password, ignore_dyndns=False): _install_appslist_fetch_cron() # Init migrations (skip them, no need to run them on a fresh system) - tools_migrations_migrate(skip=True) + tools_migrations_migrate(skip=True, auto=True) os.system('touch /etc/yunohost/installed') @@ -829,7 +829,7 @@ def tools_migrations_migrate(target=None, skip=False, auto=False, accept_disclai # configure during an upgrade of the package) but we are asked to run # migrations is to be ran manually by the user manual_migrations = [m for m in migrations if m.mode == "manual"] - if auto and manual_migrations: + if not skip and auto and manual_migrations: for m in manual_migrations: logger.warn(m18n.n('migrations_to_be_ran_manually', number=m.number, @@ -839,7 +839,7 @@ def tools_migrations_migrate(target=None, skip=False, auto=False, accept_disclai # If some migrations have disclaimers, require the --accept-disclaimer # option migrations_with_disclaimer = [m for m in migrations if m.disclaimer] - if not accept_disclaimer and migrations_with_disclaimer: + if not skip and not accept_disclaimer and migrations_with_disclaimer: for m in migrations_with_disclaimer: logger.warn(m18n.n('migrations_need_to_accept_disclaimer', number=m.number, From 79eb70ec61ae35b7984e57096629a5603b0f5707 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 10 Mar 2018 16:09:16 +0100 Subject: [PATCH 052/313] Use number/name in i18n string to avoid breaking existing translations... --- locales/en.json | 4 ++-- src/yunohost/tools.py | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/locales/en.json b/locales/en.json index b0c2ea3d2..9957c25a0 100644 --- a/locales/en.json +++ b/locales/en.json @@ -228,10 +228,10 @@ "migrations_bad_value_for_target": "Invalid number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", "migrations_current_target": "Migration target is {}", - "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {migration_id}", + "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {number} {name}", "migrations_forward": "Migrating forward", "migrations_list_conflict_pending_done": "You cannot use both --previous and --done at the same time.", - "migrations_loading_migration": "Loading migration {migration_id}...", + "migrations_loading_migration": "Loading migration {number} {name}...", "migrations_migration_has_failed": "Migration {number} {name} has failed with exception {exception}, aborting", "migrations_no_migrations_to_run": "No migrations to run", "migrations_show_currently_running_migration": "Running migration {number} {name}...", diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 5e6e3f881..c92f3bda4 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -970,9 +970,10 @@ def _load_migration(migration_file): migration_id = migration_file[:-len(".py")] + number, name = migration_id.split("_", 1) + logger.debug(m18n.n('migrations_loading_migration', - migration_id=migration_id, - )) + number=number, name=name)) try: # this is python builtin method to import a module using a name, we @@ -985,8 +986,7 @@ def _load_migration(migration_file): traceback.print_exc() raise MoulinetteError(errno.EINVAL, m18n.n('migrations_error_failed_to_load_migration', - migration_id=migration_id, - )) + number=number, name=name)) class Migration(object): From cf78e4065839309d50dc45bfe69292b50941aeb1 Mon Sep 17 00:00:00 2001 From: "ljf (zamentur)" Date: Sun, 18 Mar 2018 15:11:49 +0100 Subject: [PATCH 053/313] Add wget as dependency --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index c15c5eec5..d1505994a 100644 --- a/debian/control +++ b/debian/control @@ -14,7 +14,7 @@ Depends: ${python:Depends}, ${misc:Depends} , python-psutil, python-requests, python-dnspython, python-openssl , python-apt, python-miniupnpc , glances - , dnsutils, bind9utils, unzip, git, curl, cron + , dnsutils, bind9utils, unzip, git, curl, cron, wget , ca-certificates, netcat-openbsd, iproute , mariadb-server | mysql-server, php5-mysql | php5-mysqlnd , slapd, ldap-utils, sudo-ldap, libnss-ldapd, nscd From 91d0965569708ee66bf012f35a6cda34ba59b709 Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Fri, 30 Mar 2018 23:05:04 +0200 Subject: [PATCH 054/313] Add nodejs helpers (#441) * Add nodejs helpers * Typo fix * Add explanation for load_n_path * Remove useless line * Remove another old useless line * Move to a dedicated file * Move to a dedicated file * Fix check n already installed --- data/helpers.d/nodejs | 203 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 203 insertions(+) create mode 100644 data/helpers.d/nodejs diff --git a/data/helpers.d/nodejs b/data/helpers.d/nodejs new file mode 100644 index 000000000..ff69cacd2 --- /dev/null +++ b/data/helpers.d/nodejs @@ -0,0 +1,203 @@ +n_install_dir="/opt/node_n" +node_version_path="/opt/node_n/n/versions/node" +# N_PREFIX is the directory of n, it needs to be loaded as a environment variable. +export N_PREFIX="$n_install_dir" + +# Install Node version management +# +# [internal] +# +# usage: ynh_install_n +ynh_install_n () { + echo "Installation of N - Node.js version management" >&2 + # Build an app.src for n + mkdir -p "../conf" + echo "SOURCE_URL=https://github.com/tj/n/archive/v2.1.7.tar.gz +SOURCE_SUM=2ba3c9d4dd3c7e38885b37e02337906a1ee91febe6d5c9159d89a9050f2eea8f" > "../conf/n.src" + # Download and extract n + ynh_setup_source "$n_install_dir/git" n + # Install n + (cd "$n_install_dir/git" + PREFIX=$N_PREFIX make install 2>&1) +} + +# Load the version of node for an app, and set variables. +# +# ynh_use_nodejs has to be used in any app scripts before using node for the first time. +# +# 2 variables are available: +# - $nodejs_path: The absolute path of node for the chosen version. +# - $nodejs_version: Just the version number of node for this app. Stored as 'nodejs_version' in settings.yml. +# And 2 alias stored in variables: +# - $nodejs_use_version: An alias to load a node version in the current shell. Especially useful for systemd. +# NB: $PATH will contain the path to node, it has to be propagated to any other shell which needs to use it. +# - $ynh_node_exec: An alias to execute a command with node. +# +# usage: ynh_use_nodejs +ynh_use_nodejs () { + nodejs_version=$(ynh_app_setting_get $app nodejs_version) + + # Add "$n_install_dir/bin" to the PATH variable if it isn't already added. + # And define N_PREFIX in the current shell. + load_n_path="[[ :$PATH: == *\":$n_install_dir/bin:\"* ]] || PATH=\"$n_install_dir/bin:$PATH\"; N_PREFIX="$n_install_dir"" + + nodejs_use_version="$n_install_dir/bin/n -q $nodejs_version" + + # "Load" a version of node + eval $load_n_path; $nodejs_use_version + + # Get the absolute path of this version of node + nodejs_path="$(n bin $nodejs_version)" + + # Make an alias for node use + ynh_node_exec="eval $load_n_path; n use $nodejs_version" +} + +# Install a specific version of nodejs +# +# n (Node version management) uses the PATH variable to store the path of the version of node it is going to use. +# That's how it changes the version +# +# ynh_install_nodejs will install the version of node provided as argument by using n. +# +# usage: ynh_install_nodejs [nodejs_version] +# | arg: nodejs_version - Version of node to install. +# If possible, prefer to use major version number (e.g. 8 instead of 8.10.0). +# The crontab will handle the update of minor versions when needed. +ynh_install_nodejs () { + # Use n, https://github.com/tj/n to manage the nodejs versions + nodejs_version="$1" + + # Create $n_install_dir + mkdir -p "$n_install_dir" + + # Load n path in PATH + CLEAR_PATH="$n_install_dir/bin:$PATH" + # Remove /usr/local/bin in PATH in case of node prior installation + PATH=$(echo $CLEAR_PATH | sed 's@/usr/local/bin:@@') + + # Move an existing node binary, to avoid to block n. + test -x /usr/bin/node && mv /usr/bin/node /usr/bin/node_n + test -x /usr/bin/npm && mv /usr/bin/npm /usr/bin/npm_n + + # If n is not previously setup, install it + if ! test $(n --version) > /dev/null 2>&1 + then + ynh_install_n + fi + + # Modify the default N_PREFIX in n script + ynh_replace_string "^N_PREFIX=\${N_PREFIX-.*}$" "N_PREFIX=\${N_PREFIX-$N_PREFIX}" "$n_install_dir/bin/n" + + # Restore /usr/local/bin in PATH + PATH=$CLEAR_PATH + + # And replace the old node binary. + test -x /usr/bin/node_n && mv /usr/bin/node_n /usr/bin/node + test -x /usr/bin/npm_n && mv /usr/bin/npm_n /usr/bin/npm + + # Install the requested version of nodejs + n $nodejs_version + + # Find the last "real" version for this major version of node. + real_nodejs_version=$(find $node_version_path/$nodejs_version* -maxdepth 0 | sort --version-sort | tail --lines=1) + real_nodejs_version=$(basename $real_nodejs_version) + + # Create a symbolic link for this major version if the file doesn't already exist + if [ ! -e "$node_version_path/$nodejs_version" ] + then + ln --symbolic --force --no-target-directory $node_version_path/$real_nodejs_version $node_version_path/$nodejs_version + fi + + # Store the ID of this app and the version of node requested for it + echo "$YNH_APP_ID:$nodejs_version" | tee --append "$n_install_dir/ynh_app_version" + + # Store nodejs_version into the config of this app + ynh_app_setting_set $app nodejs_version $nodejs_version + + # Build the update script and set the cronjob + ynh_cron_upgrade_node + + ynh_use_nodejs +} + +# Remove the version of node used by the app. +# +# This helper will check if another app uses the same version of node, +# if not, this version of node will be removed. +# If no other app uses node, n will be also removed. +# +# usage: ynh_remove_nodejs +ynh_remove_nodejs () { + ynh_use_nodejs + + # Remove the line for this app + sed --in-place "/$YNH_APP_ID:$nodejs_version/d" "$n_install_dir/ynh_app_version" + + # If no other app uses this version of nodejs, remove it. + if ! grep --quiet "$nodejs_version" "$n_install_dir/ynh_app_version" + then + n rm $nodejs_version + fi + + # If no other app uses n, remove n + if [ ! -s "$n_install_dir/ynh_app_version" ] + then + ynh_secure_remove "$n_install_dir" + ynh_secure_remove "/usr/local/n" + fi +} + +# Set a cron design to update your node versions +# +# [internal] +# +# This cron will check and update all minor node versions used by your apps. +# +# usage: ynh_cron_upgrade_node +ynh_cron_upgrade_node () { + # Build the update script + cat > "$n_install_dir/node_update.sh" << EOF +#!/bin/bash + +version_path="$node_version_path" +n_install_dir="$n_install_dir" + +# Log the date +date + +# List all real installed version of node +all_real_version="\$(find \$version_path/* -maxdepth 0 -type d | sed "s@\$version_path/@@g")" + +# Keep only the major version number of each line +all_real_version=\$(echo "\$all_real_version" | sed 's/\..*\$//') + +# Remove double entries +all_real_version=\$(echo "\$all_real_version" | sort --unique) + +# Read each major version +while read version +do + echo "Update of the version \$version" + sudo \$n_install_dir/bin/n \$version + + # Find the last "real" version for this major version of node. + real_nodejs_version=\$(find \$version_path/\$version* -maxdepth 0 | sort --version-sort | tail --lines=1) + real_nodejs_version=\$(basename \$real_nodejs_version) + + # Update the symbolic link for this version + sudo ln --symbolic --force --no-target-directory \$version_path/\$real_nodejs_version \$version_path/\$version +done <<< "\$(echo "\$all_real_version")" +EOF + + chmod +x "$n_install_dir/node_update.sh" + + # Build the cronjob + cat > "/etc/cron.daily/node_update" << EOF +#!/bin/bash + +$n_install_dir/node_update.sh >> $n_install_dir/node_update.log +EOF + + chmod +x "/etc/cron.daily/node_update" +} From 6c7fb0cef2e25cb6d2044a8f3e078604ef182e8e Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Fri, 13 Apr 2018 14:28:58 +0200 Subject: [PATCH 055/313] Fix n usage (#446) * Fix n usage * Fix ynh_remove_nodejs as well --- data/helpers.d/nodejs | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) diff --git a/data/helpers.d/nodejs b/data/helpers.d/nodejs index ff69cacd2..156507c3c 100644 --- a/data/helpers.d/nodejs +++ b/data/helpers.d/nodejs @@ -1,5 +1,5 @@ n_install_dir="/opt/node_n" -node_version_path="/opt/node_n/n/versions/node" +node_version_path="$n_install_dir/n/versions/node" # N_PREFIX is the directory of n, it needs to be loaded as a environment variable. export N_PREFIX="$n_install_dir" @@ -29,28 +29,21 @@ SOURCE_SUM=2ba3c9d4dd3c7e38885b37e02337906a1ee91febe6d5c9159d89a9050f2eea8f" > " # - $nodejs_path: The absolute path of node for the chosen version. # - $nodejs_version: Just the version number of node for this app. Stored as 'nodejs_version' in settings.yml. # And 2 alias stored in variables: -# - $nodejs_use_version: An alias to load a node version in the current shell. Especially useful for systemd. +# - $nodejs_use_version: An old variable, not used anymore. Keep here to not break old apps # NB: $PATH will contain the path to node, it has to be propagated to any other shell which needs to use it. -# - $ynh_node_exec: An alias to execute a command with node. +# That's means it has to be added to any systemd script. # # usage: ynh_use_nodejs ynh_use_nodejs () { nodejs_version=$(ynh_app_setting_get $app nodejs_version) - # Add "$n_install_dir/bin" to the PATH variable if it isn't already added. - # And define N_PREFIX in the current shell. - load_n_path="[[ :$PATH: == *\":$n_install_dir/bin:\"* ]] || PATH=\"$n_install_dir/bin:$PATH\"; N_PREFIX="$n_install_dir"" - - nodejs_use_version="$n_install_dir/bin/n -q $nodejs_version" - - # "Load" a version of node - eval $load_n_path; $nodejs_use_version + nodejs_use_version="echo \"Deprecated command, should be removed\"" # Get the absolute path of this version of node - nodejs_path="$(n bin $nodejs_version)" + nodejs_path="$node_version_path/$nodejs_version/bin" - # Make an alias for node use - ynh_node_exec="eval $load_n_path; n use $nodejs_version" + # Load the path of this version of node in $PATH + [[ :$PATH: == *":$nodejs_path"* ]] || PATH="$nodejs_path:$PATH" } # Install a specific version of nodejs @@ -81,7 +74,7 @@ ynh_install_nodejs () { test -x /usr/bin/npm && mv /usr/bin/npm /usr/bin/npm_n # If n is not previously setup, install it - if ! test $(n --version) > /dev/null 2>&1 + if ! test $(n --version > /dev/null 2>&1) then ynh_install_n fi @@ -129,7 +122,7 @@ ynh_install_nodejs () { # # usage: ynh_remove_nodejs ynh_remove_nodejs () { - ynh_use_nodejs + nodejs_version=$(ynh_app_setting_get $app nodejs_version) # Remove the line for this app sed --in-place "/$YNH_APP_ID:$nodejs_version/d" "$n_install_dir/ynh_app_version" @@ -137,7 +130,7 @@ ynh_remove_nodejs () { # If no other app uses this version of nodejs, remove it. if ! grep --quiet "$nodejs_version" "$n_install_dir/ynh_app_version" then - n rm $nodejs_version + $n_install_dir/bin/n rm $nodejs_version fi # If no other app uses n, remove n From ab2b7db0cfd452fc15d2a3634bd55eae3e6e6b39 Mon Sep 17 00:00:00 2001 From: Josue-T Date: Fri, 13 Apr 2018 14:31:36 +0200 Subject: [PATCH 056/313] Trigger error if app dependency install fails (Redmine 1006) + allow for 'or' in dependencies (#381) * Solve issue https://dev.yunohost.org/issues/1006 I purpose this change to improve the helper 'ynh_install_app_dependencies'. Before this change if the dependences are not installable the install didn't fail. By these change the helper generate an error and the install stop. * Get the error if apt fail * Remove old change * Add dependence choice --- data/helpers.d/package | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/data/helpers.d/package b/data/helpers.d/package index 4d147488c..a1d29651e 100644 --- a/data/helpers.d/package +++ b/data/helpers.d/package @@ -109,7 +109,7 @@ ynh_package_install_from_equivs () { && equivs-build ./control 1>/dev/null \ && sudo dpkg --force-depends \ -i "./${pkgname}_${pkgversion}_all.deb" 2>&1 \ - && ynh_package_install -f) + && ynh_package_install -f) || ynh_die "Unable to install dependencies" [[ -n "$TMPDIR" ]] && rm -rf $TMPDIR # Remove the temp dir. # check if the package is actually installed @@ -121,8 +121,13 @@ ynh_package_install_from_equivs () { # # usage: ynh_install_app_dependencies dep [dep [...]] # | arg: dep - the package name to install in dependence +# You can give a choice between some package with this syntax : "dep1|dep2" +# Example : ynh_install_app_dependencies dep1 dep2 "dep3|dep4|dep5" +# This mean in the dependence tree : dep1 & dep2 & (dep3 | dep4 | dep5) ynh_install_app_dependencies () { local dependencies=$@ + local dependencies=${dependencies// /, } + local dependencies=${dependencies//|/ | } local manifest_path="../manifest.json" if [ ! -e "$manifest_path" ]; then manifest_path="../settings/manifest.json" # Into the restore script, the manifest is not at the same place @@ -139,7 +144,7 @@ Section: misc Priority: optional Package: ${dep_app}-ynh-deps Version: ${version} -Depends: ${dependencies// /, } +Depends: ${dependencies} Architecture: all Description: Fake package for ${app} (YunoHost app) dependencies This meta-package is only responsible of installing its dependencies. @@ -158,4 +163,4 @@ EOF ynh_remove_app_dependencies () { local dep_app=${app//_/-} # Replace all '_' by '-' ynh_package_autopurge ${dep_app}-ynh-deps # Remove the fake package and its dependencies if they not still used. -} +} \ No newline at end of file From fa152adee6e3bb67cf5e599c37e097a58508c70a Mon Sep 17 00:00:00 2001 From: Bram Date: Tue, 17 Apr 2018 17:23:04 +0200 Subject: [PATCH 057/313] [enh] Display debug information on cert-install/renew failure (#447) * [mod] split function to add _get_dns_ip * [enh] display debug information on cert-install/renew failure --- src/yunohost/certificate.py | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/src/yunohost/certificate.py b/src/yunohost/certificate.py index d4ddeff36..2ea9b682a 100644 --- a/src/yunohost/certificate.py +++ b/src/yunohost/certificate.py @@ -296,6 +296,7 @@ def _certificate_install_letsencrypt(auth, domain_list, force=False, no_checks=F m18n.n("certmanager_cert_install_success", domain=domain)) except Exception as e: + _display_debug_information(domain) logger.error("Certificate installation for %s failed !\nException: %s", domain, e) @@ -564,6 +565,7 @@ def _fetch_and_enable_new_certificate(domain, staging=False): 'certmanager_hit_rate_limit', domain=domain)) else: logger.error(str(e)) + _display_debug_information(domain) raise MoulinetteError(errno.EINVAL, m18n.n( 'certmanager_cert_signing_failed')) @@ -823,7 +825,7 @@ def _check_domain_is_ready_for_ACME(domain): 'certmanager_domain_http_not_working', domain=domain)) -def _dns_ip_match_public_ip(public_ip, domain): +def _get_dns_ip(domain): try: resolver = dns.resolver.Resolver() resolver.nameservers = DNS_RESOLVERS @@ -832,9 +834,11 @@ def _dns_ip_match_public_ip(public_ip, domain): raise MoulinetteError(errno.EINVAL, m18n.n( 'certmanager_error_no_A_record', domain=domain)) - dns_ip = str(answers[0]) + return str(answers[0]) - return dns_ip == public_ip + +def _dns_ip_match_public_ip(public_ip, domain): + return _get_dns_ip(domain) == public_ip def _domain_is_accessible_through_HTTP(ip, domain): @@ -850,6 +854,30 @@ def _domain_is_accessible_through_HTTP(ip, domain): return True +def _get_local_dns_ip(domain): + try: + resolver = dns.resolver.Resolver() + answers = resolver.query(domain, "A") + except (dns.resolver.NoAnswer, dns.resolver.NXDOMAIN): + logger.warning("Failed to resolved domain '%s' locally", domain) + return None + + return str(answers[0]) + + +def _display_debug_information(domain): + dns_ip = _get_dns_ip(domain) + public_ip = get_public_ip() + local_dns_ip = _get_local_dns_ip(domain) + + logger.warning("""\ +Debug information: + - domain ip from DNS %s + - domain ip from local DNS %s + - public ip of the server %s +""", dns_ip, local_dns_ip, public_ip) + + # FIXME / TODO : ideally this should not be needed. There should be a proper # mechanism to regularly check the value of the public IP and trigger # corresponding hooks (e.g. dyndns update and dnsmasq regen-conf) From de305ce18e84adf1835531336f38f081173a4e29 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Wed, 18 Apr 2018 04:29:11 +0200 Subject: [PATCH 058/313] [mod] more explicite error message for dyndns subscribe server failure --- src/yunohost/dyndns.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/dyndns.py b/src/yunohost/dyndns.py index ec3bf88c8..f6048b06e 100644 --- a/src/yunohost/dyndns.py +++ b/src/yunohost/dyndns.py @@ -161,7 +161,7 @@ def dyndns_subscribe(subscribe_host="dyndns.yunohost.org", domain=None, key=None try: error = json.loads(r.text)['error'] except: - error = "Server error" + error = "Server error, code: %s. (Message: \"%s\")" % (r.status_code, r.text) raise MoulinetteError(errno.EPERM, m18n.n('dyndns_registration_failed', error=error)) From c20fa217a710a57a7d7ae002278d30d9a5ee747f Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Tue, 24 Apr 2018 00:02:07 +0200 Subject: [PATCH 059/313] fix bad line --- data/helpers.d/utils | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index 81a76fdf3..e58f0aaab 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -100,7 +100,7 @@ ynh_backup_before_upgrade () { ynh_die "Backup failed, the upgrade process was aborted." fi else - echo "\$NO_BACKUP_UPGRADE is set, backup will be avoided. Be careful, this upgrade is going to be operated without securi$ + echo "\$NO_BACKUP_UPGRADE is set, backup will be avoided. Be careful, this upgrade is going to be operated without a security backup" fi } From b9330d7501d519fb7d28187d883f203b941a83ab Mon Sep 17 00:00:00 2001 From: pitchum Date: Thu, 26 Apr 2018 16:49:38 +0200 Subject: [PATCH 060/313] [enh] Lazy-load some module for perf improvements (#451) * Lazy load some python imports (perfs improved a lot). These commands became way faster: - yunohost app setting ... - yunohost app list - yunohost domain list - yunohost domain dns-conf - yunohost dyndns installcron/removecron - ... and maybe others * [fix] Timeout wat not defined anymore --- src/yunohost/app.py | 2 +- src/yunohost/certificate.py | 12 +++++++----- src/yunohost/domain.py | 1 - src/yunohost/dyndns.py | 2 +- src/yunohost/tools.py | 1 - 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index ac70833f6..6ddf08f52 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -32,7 +32,6 @@ import re import urlparse import errno import subprocess -import requests import glob import pwd import grp @@ -129,6 +128,7 @@ def app_fetchlist(url=None, name=None): else: appslists_to_be_fetched = appslists.keys() + import requests # lazy loading this module for performance reasons # Fetch all appslists to be fetched for name in appslists_to_be_fetched: diff --git a/src/yunohost/certificate.py b/src/yunohost/certificate.py index 2ea9b682a..775e726e9 100644 --- a/src/yunohost/certificate.py +++ b/src/yunohost/certificate.py @@ -29,14 +29,11 @@ import shutil import pwd import grp import smtplib -import requests import subprocess import dns.resolver import glob -from OpenSSL import crypto from datetime import datetime -from requests.exceptions import Timeout from yunohost.vendor.acme_tiny.acme_tiny import get_crt as sign_certificate @@ -575,9 +572,10 @@ def _fetch_and_enable_new_certificate(domain, staging=False): raise MoulinetteError(errno.EINVAL, m18n.n( 'certmanager_cert_signing_failed')) + import requests # lazy loading this module for performance reasons try: intermediate_certificate = requests.get(INTERMEDIATE_CERTIFICATE_URL, timeout=30).text - except Timeout as e: + except requests.exceptions.Timeout as e: raise MoulinetteError(errno.EINVAL, m18n.n('certmanager_couldnt_fetch_intermediate_cert')) # Now save the key and signed certificate @@ -626,6 +624,7 @@ def _fetch_and_enable_new_certificate(domain, staging=False): def _prepare_certificate_signing_request(domain, key_file, output_folder): + from OpenSSL import crypto # lazy loading this module for performance reasons # Init a request csr = crypto.X509Req() @@ -657,6 +656,7 @@ def _get_status(domain): raise MoulinetteError(errno.EINVAL, m18n.n( 'certmanager_no_cert_file', domain=domain, file=cert_file)) + from OpenSSL import crypto # lazy loading this module for performance reasons try: cert = crypto.load_certificate( crypto.FILETYPE_PEM, open(cert_file).read()) @@ -759,6 +759,7 @@ def _generate_account_key(): def _generate_key(destination_path): + from OpenSSL import crypto # lazy loading this module for performance reasons k = crypto.PKey() k.generate_key(crypto.TYPE_RSA, KEY_SIZE) @@ -842,9 +843,10 @@ def _dns_ip_match_public_ip(public_ip, domain): def _domain_is_accessible_through_HTTP(ip, domain): + import requests # lazy loading this module for performance reasons try: requests.head("http://" + ip, headers={"Host": domain}, timeout=10) - except Timeout as e: + except requests.exceptions.Timeout as e: logger.warning(m18n.n('certmanager_http_check_timeout', domain=domain, ip=ip)) return False except Exception as e: diff --git a/src/yunohost/domain.py b/src/yunohost/domain.py index 026c4da36..354df2887 100644 --- a/src/yunohost/domain.py +++ b/src/yunohost/domain.py @@ -28,7 +28,6 @@ import re import json import yaml import errno -import requests from moulinette import m18n, msettings from moulinette.core import MoulinetteError diff --git a/src/yunohost/dyndns.py b/src/yunohost/dyndns.py index f6048b06e..0aa6cf36c 100644 --- a/src/yunohost/dyndns.py +++ b/src/yunohost/dyndns.py @@ -30,7 +30,6 @@ import glob import time import base64 import errno -import requests import subprocess from moulinette import m18n @@ -152,6 +151,7 @@ def dyndns_subscribe(subscribe_host="dyndns.yunohost.org", domain=None, key=None with open(key_file) as f: key = f.readline().strip().split(' ', 6)[-1] + import requests # lazy loading this module for performance reasons # Send subscription try: r = requests.post('https://%s/key/%s?key_algo=hmac-sha512' % (subscribe_host, base64.b64encode(key)), data={'subdomain': domain}, timeout=30) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index f98d48fc5..0b6de942e 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -26,7 +26,6 @@ import re import os import yaml -import requests import json import errno import logging From 0154f15d95634347dd295012ebc39ed6f0f61e28 Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 20:42:57 +0200 Subject: [PATCH 061/313] [enh] ECDH Curves --- data/templates/nginx/server.tpl.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index ac2ff8486..5e69aeca8 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -24,6 +24,7 @@ server { ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; + ssl_ecdh_curve secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From 8c3c9e697aa584e4c5c775b7431d4e7d79e7753c Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 20:44:44 +0200 Subject: [PATCH 062/313] [enh] ECDH Curves --- data/templates/nginx/plain/yunohost_admin.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index 156d61bd6..e293327aa 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -19,6 +19,7 @@ server { ssl_certificate_key /etc/yunohost/certs/yunohost.org/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; + ssl_ecdh_curve secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From d73789c546383652309392103a9289097d69506f Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 21:21:25 +0200 Subject: [PATCH 063/313] Update server.tpl.conf --- data/templates/nginx/server.tpl.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 5e69aeca8..eb3c4a1d5 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -24,6 +24,7 @@ server { ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; + # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS ssl_ecdh_curve secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From 15a331ec5d6286c1abcbde50ada8fa7b0451426c Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 21:21:44 +0200 Subject: [PATCH 064/313] Update yunohost_admin.conf --- data/templates/nginx/plain/yunohost_admin.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index e293327aa..e6f7d16f7 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -19,6 +19,7 @@ server { ssl_certificate_key /etc/yunohost/certs/yunohost.org/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; + # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS ssl_ecdh_curve secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From f59eed7b7ed410c1b60c32377d6012c132b02623 Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 21:33:49 +0200 Subject: [PATCH 065/313] [enh] add X25519 curve --- data/templates/nginx/server.tpl.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index eb3c4a1d5..19e7d8ca6 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -24,8 +24,8 @@ server { ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; - # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS - ssl_ecdh_curve secp521r1:secp384r1:prime256v1; + # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 + ssl_ecdh_curve X25519:sect571r1:secp521r1:secp384r1; ssl_prefer_server_ciphers on; From 1bb65cfdf8ac09c1dc2dda9a314e1bed4e0c9396 Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 21:34:23 +0200 Subject: [PATCH 066/313] [enh] add X25519 curve --- data/templates/nginx/plain/yunohost_admin.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index e6f7d16f7..76525aab6 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -19,8 +19,8 @@ server { ssl_certificate_key /etc/yunohost/certs/yunohost.org/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; - # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS - ssl_ecdh_curve secp521r1:secp384r1:prime256v1; + # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 + ssl_ecdh_curve X25519:sect571r1:secp521r1:secp384r1; ssl_prefer_server_ciphers on; From 3a4ac25721cffd66847d74d35bebe393030a4029 Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 21:40:13 +0200 Subject: [PATCH 067/313] Update yunohost_admin.conf --- data/templates/nginx/plain/yunohost_admin.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index 76525aab6..11f5d11d2 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -20,7 +20,7 @@ server { ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 - ssl_ecdh_curve X25519:sect571r1:secp521r1:secp384r1; + ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From d497fd216a722154848bec10cd2d882f6095b810 Mon Sep 17 00:00:00 2001 From: frju365 Date: Sat, 28 Apr 2018 21:40:39 +0200 Subject: [PATCH 068/313] Update server.tpl.conf --- data/templates/nginx/server.tpl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 19e7d8ca6..421cef712 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -25,7 +25,7 @@ server { ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 - ssl_ecdh_curve X25519:sect571r1:secp521r1:secp384r1; + ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From 57155c94d85ade8cdbea11490b0ec792aa8573e9 Mon Sep 17 00:00:00 2001 From: frju365 Date: Tue, 1 May 2018 17:15:55 +0200 Subject: [PATCH 069/313] [Fix] ECDH curve not compatible --- data/templates/nginx/plain/yunohost_admin.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index 11f5d11d2..b1fb0d2ef 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -20,7 +20,7 @@ server { ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 - ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1; + ssl_ecdh_curve secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From 6c07296b9f2ae617741c68eacd3e834a4bffe81c Mon Sep 17 00:00:00 2001 From: frju365 Date: Tue, 1 May 2018 17:16:27 +0200 Subject: [PATCH 070/313] =?UTF-8?q?[Fix]=C2=A0ECdH=20curve=20not=20compati?= =?UTF-8?q?ble=20with=20Jessie?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- data/templates/nginx/server.tpl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 421cef712..88296c755 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -25,7 +25,7 @@ server { ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 - ssl_ecdh_curve X25519:secp521r1:secp384r1:prime256v1; + ssl_ecdh_curve secp521r1:secp384r1:prime256v1; ssl_prefer_server_ciphers on; From 90e093a482dc2bd6e0f7f0e6b08275a0c963dfad Mon Sep 17 00:00:00 2001 From: frju365 Date: Tue, 1 May 2018 23:44:23 +0200 Subject: [PATCH 071/313] Tweak the CSP config in nginx template for domains (#456) * Little correction for template conf for apps * Move the default-src CSP thing to report-only for now --- data/templates/nginx/server.tpl.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index ac2ff8486..495a15bdc 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -46,7 +46,8 @@ server { # https://wiki.mozilla.org/Security/Guidelines/Web_Security # https://observatory.mozilla.org/ add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header Content-Security-Policy "upgrade-insecure-requests; object-src 'none'; script-src https: 'unsafe-eval'"; + add_header Content-Security-Policy "upgrade-insecure-requests;" + add_header Content-Security-Policy-Report-Only "default-src https: data: 'unsafe-inline' 'unsafe-eval'"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Download-Options noopen; From 062ca32eac775802186bfa5776b58f8790c7accb Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 1 May 2018 23:45:12 +0200 Subject: [PATCH 072/313] Move ssh commands into a subcategory of 'user' + fix a few bugs (#445) * Move all ssh commands to a subcategory in user... * [fix] Actionmap didn't match functions input ? * [fix] Invalidate nscd cache to propagate new loginShell * Consistency of list-keys even if there's no key.. --- data/actionsmap/yunohost.yml | 164 +++++++++++++++-------------------- src/yunohost/ssh.py | 113 ++++++++++++++++++++++-- src/yunohost/user.py | 95 ++++---------------- 3 files changed, 197 insertions(+), 175 deletions(-) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index 77887b41a..31fb0e6cf 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -203,30 +203,6 @@ user: extra: pattern: *pattern_mailbox_quota - ### ssh_user_enable_ssh() - allow-ssh: - action_help: Allow the user to uses ssh - api: POST /ssh/user/enable-ssh - configuration: - authenticate: all - arguments: - username: - help: Username of the user - extra: - pattern: *pattern_username - - ### ssh_user_disable_ssh() - disallow-ssh: - action_help: Disallow the user to uses ssh - api: POST /ssh/user/disable-ssh - configuration: - authenticate: all - arguments: - username: - help: Username of the user - extra: - pattern: *pattern_username - ### user_info() info: action_help: Get user information @@ -238,6 +214,78 @@ user: username: help: Username or email to get information + subcategories: + + ssh: + subcategory_help: Manage ssh access + actions: + ### user_ssh_enable() + allow: + action_help: Allow the user to uses ssh + api: POST /users/ssh/enable + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + + ### user_ssh_disable() + disallow: + action_help: Disallow the user to uses ssh + api: POST /users/ssh/disable + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + + ### user_ssh_keys_list() + list-keys: + action_help: Show user's authorized ssh keys + api: GET /users/ssh/keys + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + + ### user_ssh_keys_add() + add-key: + action_help: Add a new authorized ssh key for this user + api: POST /users/ssh/key + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + key: + help: The key to be added + -c: + full: --comment + help: Optionnal comment about the key + + ### user_ssh_keys_remove() + remove-key: + action_help: Remove an authorized ssh key for this user + api: DELETE /users/ssh/key + configuration: + authenticate: all + arguments: + username: + help: Username of the user + extra: + pattern: *pattern_username + key: + help: The key to be removed + ############################# # Domain # @@ -1349,74 +1397,6 @@ dyndns: api: DELETE /dyndns/cron -############################# -# SSH # -############################# -ssh: - category_help: Manage ssh keys and access - actions: {} - subcategories: - authorized-keys: - subcategory_help: Manage user's authorized ssh keys - - actions: - ### ssh_authorized_keys_list() - list: - action_help: Show user's authorized ssh keys - api: GET /ssh/authorized-keys - configuration: - authenticate: all - arguments: - username: - help: Username of the user - extra: - pattern: *pattern_username - - ### ssh_authorized_keys_add() - add: - action_help: Add a new authorized ssh key for this user - api: POST /ssh/authorized-keys - configuration: - authenticate: all - arguments: - username: - help: Username of the user - extra: - pattern: *pattern_username - -u: - full: --public - help: Public key - extra: - required: True - -i: - full: --private - help: Private key - extra: - required: True - -n: - full: --name - help: Key name - extra: - required: True - - ### ssh_authorized_keys_remove() - remove: - action_help: Remove an authorized ssh key for this user - api: DELETE /ssh/authorized-keys - configuration: - authenticate: all - arguments: - username: - help: Username of the user - extra: - pattern: *pattern_username - -k: - full: --key - help: Key as a string - extra: - required: True - - ############################# # Tools # ############################# diff --git a/src/yunohost/ssh.py b/src/yunohost/ssh.py index 5f1f33b55..5ddebfc2f 100644 --- a/src/yunohost/ssh.py +++ b/src/yunohost/ssh.py @@ -1,13 +1,57 @@ # encoding: utf-8 +import re import os +import errno +import pwd +import subprocess +from moulinette import m18n +from moulinette.core import MoulinetteError from moulinette.utils.filesystem import read_file, write_to_file, chown, chmod, mkdir -from yunohost.user import _get_user_for_ssh +SSHD_CONFIG_PATH = "/etc/ssh/sshd_config" -def ssh_authorized_keys_list(auth, username): +def user_ssh_allow(auth, username): + """ + Allow YunoHost user connect as ssh. + + Keyword argument: + username -- User username + """ + # TODO it would be good to support different kind of shells + + if not _get_user_for_ssh(auth, username): + raise MoulinetteError(errno.EINVAL, m18n.n('user_unknown', user=username)) + + auth.update('uid=%s,ou=users' % username, {'loginShell': '/bin/bash'}) + + # Somehow this is needed otherwise the PAM thing doesn't forget about the + # old loginShell value ? + subprocess.call(['nscd', '-i', 'passwd']) + + +def user_ssh_disallow(auth, username): + """ + Disallow YunoHost user connect as ssh. + + Keyword argument: + username -- User username + """ + # TODO it would be good to support different kind of shells + + if not _get_user_for_ssh(auth, username): + raise MoulinetteError(errno.EINVAL, m18n.n('user_unknown', user=username)) + + auth.update('uid=%s,ou=users' % username, {'loginShell': '/bin/false'}) + + # Somehow this is needed otherwise the PAM thing doesn't forget about the + # old loginShell value ? + subprocess.call(['nscd', '-i', 'passwd']) + + +def user_ssh_list_keys(auth, username): user = _get_user_for_ssh(auth, username, ["homeDirectory"]) if not user: raise Exception("User with username '%s' doesn't exists" % username) @@ -15,7 +59,7 @@ def ssh_authorized_keys_list(auth, username): authorized_keys_file = os.path.join(user["homeDirectory"][0], ".ssh", "authorized_keys") if not os.path.exists(authorized_keys_file): - return [] + return {"keys": []} keys = [] last_comment = "" @@ -40,7 +84,7 @@ def ssh_authorized_keys_list(auth, username): return {"keys": keys} -def ssh_authorized_keys_add(auth, username, key, comment): +def user_ssh_add_key(auth, username, key, comment): user = _get_user_for_ssh(auth, username, ["homeDirectory", "uid"]) if not user: raise Exception("User with username '%s' doesn't exists" % username) @@ -74,8 +118,8 @@ def ssh_authorized_keys_add(auth, username, key, comment): write_to_file(authorized_keys_file, authorized_keys_content) -def ssh_authorized_keys_remove(auth, username, key): - user = _get_user(auth, username, ["homeDirectory", "uid"]) +def user_ssh_remove_key(auth, username, key): + user = _get_user_for_ssh(auth, username, ["homeDirectory", "uid"]) if not user: raise Exception("User with username '%s' doesn't exists" % username) @@ -100,3 +144,60 @@ def ssh_authorized_keys_remove(auth, username, key): authorized_keys_content = authorized_keys_content.replace(key, "") write_to_file(authorized_keys_file, authorized_keys_content) + +# +# Helpers +# + + +def _get_user_for_ssh(auth, username, attrs=None): + def ssh_root_login_status(auth): + # XXX temporary placed here for when the ssh_root commands are integrated + # extracted from https://github.com/YunoHost/yunohost/pull/345 + # XXX should we support all the options? + # this is the content of "man sshd_config" + # PermitRootLogin + # Specifies whether root can log in using ssh(1). The argument must be + # “yes”, “without-password”, “forced-commands-only”, or “no”. The + # default is “yes”. + sshd_config_content = read_file(SSHD_CONFIG_PATH) + + if re.search("^ *PermitRootLogin +(no|forced-commands-only) *$", + sshd_config_content, re.MULTILINE): + return {"PermitRootLogin": False} + + return {"PermitRootLogin": True} + + if username == "root": + root_unix = pwd.getpwnam("root") + return { + 'username': 'root', + 'fullname': '', + 'mail': '', + 'ssh_allowed': ssh_root_login_status(auth)["PermitRootLogin"], + 'shell': root_unix.pw_shell, + 'home_path': root_unix.pw_dir, + } + + if username == "admin": + admin_unix = pwd.getpwnam("admin") + return { + 'username': 'admin', + 'fullname': '', + 'mail': '', + 'ssh_allowed': admin_unix.pw_shell.strip() != "/bin/false", + 'shell': admin_unix.pw_shell, + 'home_path': admin_unix.pw_dir, + } + + # TODO escape input using https://www.python-ldap.org/doc/html/ldap-filter.html + user = auth.search('ou=users,dc=yunohost,dc=org', + '(&(objectclass=person)(uid=%s))' % username, + attrs) + + assert len(user) in (0, 1) + + if not user: + return None + + return user[0] diff --git a/src/yunohost/user.py b/src/yunohost/user.py index 793ccaf7a..bed5fb8c8 100644 --- a/src/yunohost/user.py +++ b/src/yunohost/user.py @@ -41,9 +41,6 @@ from yunohost.service import service_status logger = getActionLogger('yunohost.user') -SSHD_CONFIG_PATH = "/etc/ssh/sshd_config" - - def user_list(auth, fields=None): """ List users @@ -446,36 +443,30 @@ def user_info(auth, username): else: raise MoulinetteError(167, m18n.n('user_info_failed')) +# +# SSH subcategory +# +# +import yunohost.ssh -def user_allow_ssh(auth, username): - """ - Allow YunoHost user connect as ssh. +def user_ssh_allow(auth, username): + return yunohost.ssh.user_ssh_allow(auth, username) - Keyword argument: - username -- User username - """ - # TODO it would be good to support different kind of shells +def user_ssh_disallow(auth, username): + return yunohost.ssh.user_ssh_disallow(auth, username) - if not _get_user_for_ssh(auth, username): - raise MoulinetteError(errno.EINVAL, m18n.n('user_unknown', user=username)) +def user_ssh_list_keys(auth, username): + return yunohost.ssh.user_ssh_list_keys(auth, username) - auth.update('uid=%s,ou=users' % username, {'loginShell': '/bin/bash'}) +def user_ssh_add_key(auth, username, key, comment): + return yunohost.ssh.user_ssh_add_key(auth, username, key, comment) +def user_ssh_remove_key(auth, username, key): + return yunohost.ssh.user_ssh_remove_key(auth, username, key) -def user_disallow_ssh(auth, username): - """ - Disallow YunoHost user connect as ssh. - - Keyword argument: - username -- User username - """ - # TODO it would be good to support different kind of shells - - if not _get_user_for_ssh(auth, username) : - raise MoulinetteError(errno.EINVAL, m18n.n('user_unknown', user=username)) - - auth.update('uid=%s,ou=users' % username, {'loginShell': '/bin/false'}) - +# +# End SSH subcategory +# def _convertSize(num, suffix=''): for unit in ['K', 'M', 'G', 'T', 'P', 'E', 'Z']: @@ -514,54 +505,4 @@ def _hash_user_password(password): return '{CRYPT}' + crypt.crypt(str(password), salt) -def _get_user_for_ssh(auth, username, attrs=None): - def ssh_root_login_status(auth): - # XXX temporary placed here for when the ssh_root commands are integrated - # extracted from https://github.com/YunoHost/yunohost/pull/345 - # XXX should we support all the options? - # this is the content of "man sshd_config" - # PermitRootLogin - # Specifies whether root can log in using ssh(1). The argument must be - # “yes”, “without-password”, “forced-commands-only”, or “no”. The - # default is “yes”. - sshd_config_content = read_file(SSHD_CONFIG_PATH) - if re.search("^ *PermitRootLogin +(no|forced-commands-only) *$", - sshd_config_content, re.MULTILINE): - return {"PermitRootLogin": False} - - return {"PermitRootLogin": True} - - if username == "root": - root_unix = pwd.getpwnam("root") - return { - 'username': 'root', - 'fullname': '', - 'mail': '', - 'ssh_allowed': ssh_root_login_status(auth)["PermitRootLogin"], - 'shell': root_unix.pw_shell, - 'home_path': root_unix.pw_dir, - } - - if username == "admin": - admin_unix = pwd.getpwnam("admin") - return { - 'username': 'admin', - 'fullname': '', - 'mail': '', - 'ssh_allowed': admin_unix.pw_shell.strip() != "/bin/false", - 'shell': admin_unix.pw_shell, - 'home_path': admin_unix.pw_dir, - } - - # TODO escape input using https://www.python-ldap.org/doc/html/ldap-filter.html - user = auth.search('ou=users,dc=yunohost,dc=org', - '(&(objectclass=person)(uid=%s))' % username, - attrs) - - assert len(user) in (0, 1) - - if not user: - return None - - return user[0] From 9d249e6eb95ee5509046ddf37909b902753f37af Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Wed, 7 Feb 2018 23:18:22 +0000 Subject: [PATCH 073/313] [i18n] Translated using Weblate (Arabic) Currently translated at 99.7% (366 of 367 strings) --- locales/ar.json | 366 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 366 insertions(+) diff --git a/locales/ar.json b/locales/ar.json index 2c63c0851..81b73f5ec 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -1,2 +1,368 @@ { + "action_invalid": "Invalid action '{action:s}'", + "admin_password": "كلمة السر الإدارية", + "admin_password_change_failed": "Unable to change password", + "admin_password_changed": "The administration password has been changed", + "app_already_installed": "{app:s} is already installed", + "app_already_installed_cant_change_url": "This app is already installed. The url cannot be changed just by this function. Look into `app changeurl` if it's available.", + "app_already_up_to_date": "{app:s} is already up to date", + "app_argument_choice_invalid": "Invalid choice for argument '{name:s}', it must be one of {choices:s}", + "app_argument_invalid": "Invalid value for argument '{name:s}': {error:s}", + "app_argument_required": "Argument '{name:s}' is required", + "app_change_no_change_url_script": "The application {app_name:s} doesn't support changing it's URL yet, you might need to upgrade it.", + "app_change_url_failed_nginx_reload": "Failed to reload nginx. Here is the output of 'nginx -t':\n{nginx_errors:s}", + "app_change_url_identical_domains": "The old and new domain/url_path are identical ('{domain:s}{path:s}'), nothing to do.", + "app_change_url_no_script": "This application '{app_name:s}' doesn't support url modification yet. Maybe you should upgrade the application.", + "app_change_url_success": "Successfully changed {app:s} url to {domain:s}{path:s}", + "app_extraction_failed": "Unable to extract installation files", + "app_id_invalid": "Invalid app id", + "app_incompatible": "The app {app} is incompatible with your YunoHost version", + "app_install_files_invalid": "Invalid installation files", + "app_location_already_used": "The app '{app}' is already installed on that location ({path})", + "app_make_default_location_already_used": "Can't make the app '{app}' the default on the domain {domain} is already used by the other app '{other_app}'", + "app_location_install_failed": "Unable to install the app in this location because it conflit with the app '{other_app}' already installed on '{other_path}'", + "app_location_unavailable": "This url is not available or conflicts with an already installed app", + "app_manifest_invalid": "Invalid app manifest: {error}", + "app_no_upgrade": "البرمجيات لا تحتاج إلى تحديث", + "app_not_correctly_installed": "{app:s} seems to be incorrectly installed", + "app_not_installed": "{app:s} is not installed", + "app_not_properly_removed": "{app:s} has not been properly removed", + "app_package_need_update": "The app {app} package needs to be updated to follow YunoHost changes", + "app_removed": "{app:s} has been removed", + "app_requirements_checking": "Checking required packages for {app}...", + "app_requirements_failed": "Unable to meet requirements for {app}: {error}", + "app_requirements_unmeet": "Requirements are not met for {app}, the package {pkgname} ({version}) must be {spec}", + "app_sources_fetch_failed": "Unable to fetch sources files", + "app_unknown": "Unknown app", + "app_unsupported_remote_type": "Unsupported remote type used for the app", + "app_upgrade_app_name": "Upgrading app {app}...", + "app_upgrade_failed": "Unable to upgrade {app:s}", + "app_upgrade_some_app_failed": "Unable to upgrade some applications", + "app_upgraded": "{app:s} has been upgraded", + "appslist_corrupted_json": "Could not load the application lists. It looks like {filename:s} is corrupted.", + "appslist_could_not_migrate": "Could not migrate app list {appslist:s} ! Unable to parse the url... The old cron job has been kept in {bkp_file:s}.", + "appslist_fetched": "The application list {appslist:s} has been fetched", + "appslist_migrating": "Migrating application list {appslist:s} ...", + "appslist_name_already_tracked": "There is already a registered application list with name {name:s}.", + "appslist_removed": "The application list {appslist:s} has been removed", + "appslist_retrieve_bad_format": "Retrieved file for application list {appslist:s} is not valid", + "appslist_retrieve_error": "Unable to retrieve the remote application list {appslist:s}: {error:s}", + "appslist_unknown": "Application list {appslist:s} unknown.", + "appslist_url_already_tracked": "There is already a registered application list with url {url:s}.", + "ask_current_admin_password": "كلمة السر الإدارية الحالية", + "ask_email": "عنوان البريد الإلكتروني", + "ask_firstname": "First name", + "ask_lastname": "Last name", + "ask_list_to_remove": "List to remove", + "ask_main_domain": "النطاق الرئيسي", + "ask_new_admin_password": "كلمة السر الإدارية الجديدة", + "ask_password": "كلمة السر", + "ask_path": "المسار", + "backup_abstract_method": "This backup method hasn't yet been implemented", + "backup_action_required": "You must specify something to save", + "backup_app_failed": "Unable to back up the app '{app:s}'", + "backup_applying_method_borg": "Sending all files to backup into borg-backup repository...", + "backup_applying_method_copy": "Copying all files to backup...", + "backup_applying_method_custom": "Calling the custom backup method '{method:s}'...", + "backup_applying_method_tar": "Creating the backup tar archive...", + "backup_archive_app_not_found": "App '{app:s}' not found in the backup archive", + "backup_archive_broken_link": "Unable to access backup archive (broken link to {path:s})", + "backup_archive_mount_failed": "Mounting the backup archive failed", + "backup_archive_name_exists": "The backup's archive name already exists", + "backup_archive_name_unknown": "Unknown local backup archive named '{name:s}'", + "backup_archive_open_failed": "Unable to open the backup archive", + "backup_archive_system_part_not_available": "System part '{part:s}' not available in this backup", + "backup_archive_writing_error": "Unable to add files to backup into the compressed archive", + "backup_ask_for_copying_if_needed": "Some files couldn't be prepared to be backuped using the method that avoid to temporarily waste space on the system. To perform the backup, {size:s}MB should be used temporarily. Do you agree?", + "backup_borg_not_implemented": "Borg backup method is not yet implemented", + "backup_cant_mount_uncompress_archive": "Unable to mount in readonly mode the uncompress archive directory", + "backup_cleaning_failed": "Unable to clean-up the temporary backup directory", + "backup_copying_to_organize_the_archive": "Copying {size:s}MB to organize the archive", + "backup_couldnt_bind": "Couldn't bind {src:s} to {dest:s}.", + "backup_created": "تم إنشاء النسخة الإحتياطية", + "backup_creating_archive": "Creating the backup archive...", + "backup_creation_failed": "Backup creation failed", + "backup_csv_addition_failed": "Unable to add files to backup into the CSV file", + "backup_csv_creation_failed": "Unable to create the CSV file needed for future restore operations", + "backup_custom_backup_error": "Custom backup method failure on 'backup' step", + "backup_custom_mount_error": "Custom backup method failure on 'mount' step", + "backup_custom_need_mount_error": "Custom backup method failure on 'need_mount' step", + "backup_delete_error": "Unable to delete '{path:s}'", + "backup_deleted": "The backup has been deleted", + "backup_extracting_archive": "Extracting the backup archive...", + "backup_hook_unknown": "Backup hook '{hook:s}' unknown", + "backup_invalid_archive": "Invalid backup archive", + "backup_method_borg_finished": "Backup into borg finished", + "backup_method_copy_finished": "Backup copy finished", + "backup_method_custom_finished": "Custom backup method '{method:s}' finished", + "backup_method_tar_finished": "Backup tar archive created", + "backup_no_uncompress_archive_dir": "Uncompress archive directory doesn't exist", + "backup_nothings_done": "There is nothing to save", + "backup_output_directory_forbidden": "Forbidden output directory. Backups can't be created in /bin, /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var or /home/yunohost.backup/archives sub-folders", + "backup_output_directory_not_empty": "The output directory is not empty", + "backup_output_directory_required": "You must provide an output directory for the backup", + "backup_output_symlink_dir_broken": "You have a broken symlink instead of your archives directory '{path:s}'. You may have a specific setup to backup your data on an other filesystem, in this case you probably forgot to remount or plug your hard dirve or usb key.", + "backup_running_app_script": "Running backup script of app '{app:s}'...", + "backup_running_hooks": "Running backup hooks...", + "backup_system_part_failed": "Unable to backup the '{part:s}' system part", + "backup_unable_to_organize_files": "Unable to organize files in the archive with the quick method", + "backup_with_no_backup_script_for_app": "App {app:s} has no backup script. Ignoring.", + "backup_with_no_restore_script_for_app": "App {app:s} has no restore script, you won't be able to automatically restore the backup of this app.", + "certmanager_acme_not_configured_for_domain": "Certificate for domain {domain:s} does not appear to be correctly installed. Please run cert-install for this domain first.", + "certmanager_attempt_to_renew_nonLE_cert": "The certificate for domain {domain:s} is not issued by Let's Encrypt. Cannot renew it automatically!", + "certmanager_attempt_to_renew_valid_cert": "The certificate for domain {domain:s} is not about to expire! Use --force to bypass", + "certmanager_attempt_to_replace_valid_cert": "You are attempting to overwrite a good and valid certificate for domain {domain:s}! (Use --force to bypass)", + "certmanager_cannot_read_cert": "Something wrong happened when trying to open current certificate for domain {domain:s} (file: {file:s}), reason: {reason:s}", + "certmanager_cert_install_success": "Successfully installed Let's Encrypt certificate for domain {domain:s}!", + "certmanager_cert_install_success_selfsigned": "Successfully installed a self-signed certificate for domain {domain:s}!", + "certmanager_cert_renew_success": "Successfully renewed Let's Encrypt certificate for domain {domain:s}!", + "certmanager_cert_signing_failed": "Signing the new certificate failed", + "certmanager_certificate_fetching_or_enabling_failed": "Sounds like enabling the new certificate for {domain:s} failed somehow...", + "certmanager_conflicting_nginx_file": "Unable to prepare domain for ACME challenge: the nginx configuration file {filepath:s} is conflicting and should be removed first", + "certmanager_couldnt_fetch_intermediate_cert": "Timed out when trying to fetch intermediate certificate from Let's Encrypt. Certificate installation/renewal aborted - please try again later.", + "certmanager_domain_cert_not_selfsigned": "The certificate for domain {domain:s} is not self-signed. Are you sure you want to replace it? (Use --force)", + "certmanager_domain_dns_ip_differs_from_public_ip": "The DNS 'A' record for domain {domain:s} is different from this server IP. If you recently modified your A record, please wait for it to propagate (some DNS propagation checkers are available online). (If you know what you are doing, use --no-checks to disable those checks.)", + "certmanager_domain_http_not_working": "It seems that the domain {domain:s} cannot be accessed through HTTP. Please check your DNS and nginx configuration is okay", + "certmanager_domain_not_resolved_locally": "The domain {domain:s} cannot be resolved from inside your Yunohost server. This might happen if you recently modified your DNS record. If so, please wait a few hours for it to propagate. If the issue persists, consider adding {domain:s} to /etc/hosts. (If you know what you are doing, use --no-checks to disable those checks.)", + "certmanager_domain_unknown": "Unknown domain {domain:s}", + "certmanager_error_no_A_record": "No DNS 'A' record found for {domain:s}. You need to make your domain name point to your machine to be able to install a Let's Encrypt certificate! (If you know what you are doing, use --no-checks to disable those checks.)", + "certmanager_hit_rate_limit": "Too many certificates already issued for exact set of domains {domain:s} recently. Please try again later. See https://letsencrypt.org/docs/rate-limits/ for more details", + "certmanager_http_check_timeout": "Timed out when server tried to contact itself through HTTP using public IP address (domain {domain:s} with ip {ip:s}). You may be experiencing hairpinning issue or the firewall/router ahead of your server is misconfigured.", + "certmanager_no_cert_file": "Unable to read certificate file for domain {domain:s} (file: {file:s})", + "certmanager_old_letsencrypt_app_detected": "\nYunohost detected that the 'letsencrypt' app is installed, which conflits with the new built-in certificate management features in Yunohost. If you wish to use the new built-in features, please run the following commands to migrate your installation:\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B.: this will attempt to re-install certificates for all domains with a Let's Encrypt certificate or self-signed certificate", + "certmanager_self_ca_conf_file_not_found": "Configuration file not found for self-signing authority (file: {file:s})", + "certmanager_unable_to_parse_self_CA_name": "Unable to parse name of self-signing authority (file: {file:s})", + "custom_app_url_required": "You must provide a URL to upgrade your custom app {app:s}", + "custom_appslist_name_required": "You must provide a name for your custom app list", + "diagnosis_debian_version_error": "Can't retrieve the Debian version: {error}", + "diagnosis_kernel_version_error": "Can't retrieve kernel version: {error}", + "diagnosis_monitor_disk_error": "Can't monitor disks: {error}", + "diagnosis_monitor_network_error": "Can't monitor network: {error}", + "diagnosis_monitor_system_error": "Can't monitor system: {error}", + "diagnosis_no_apps": "No installed application", + "dnsmasq_isnt_installed": "dnsmasq does not seem to be installed, please run 'apt-get remove bind9 && apt-get install dnsmasq'", + "domain_cannot_remove_main": "Cannot remove main domain. Set a new main domain first", + "domain_cert_gen_failed": "Unable to generate certificate", + "domain_created": "The domain has been created", + "domain_creation_failed": "Unable to create domain", + "domain_deleted": "The domain has been deleted", + "domain_deletion_failed": "Unable to delete domain", + "domain_dns_conf_is_just_a_recommendation": "This command shows you what is the *recommended* configuration. It does not actually set up the DNS configuration for you. It is your responsability to configure your DNS zone in your registrar according to this recommendation.", + "domain_dyndns_already_subscribed": "You've already subscribed to a DynDNS domain", + "domain_dyndns_dynette_is_unreachable": "Unable to reach YunoHost dynette, either your YunoHost is not correctly connected to the internet or the dynette server is down. Error: {error}", + "domain_dyndns_invalid": "Invalid domain to use with DynDNS", + "domain_dyndns_root_unknown": "Unknown DynDNS root domain", + "domain_exists": "Domain already exists", + "domain_hostname_failed": "Failed to set new hostname", + "domain_uninstall_app_first": "One or more apps are installed on this domain. Please uninstall them before proceeding to domain removal", + "domain_unknown": "النطاق مجهول", + "domain_zone_exists": "DNS zone file already exists", + "domain_zone_not_found": "DNS zone file not found for domain {:s}", + "domains_available": "النطاقات المتوفرة :", + "done": "تم", + "downloading": "عملية التنزيل جارية …", + "dyndns_could_not_check_provide": "Could not check if {provider:s} can provide {domain:s}.", + "dyndns_cron_installed": "The DynDNS cron job has been installed", + "dyndns_cron_remove_failed": "Unable to remove the DynDNS cron job", + "dyndns_cron_removed": "The DynDNS cron job has been removed", + "dyndns_ip_update_failed": "Unable to update IP address on DynDNS", + "dyndns_ip_updated": "Your IP address has been updated on DynDNS", + "dyndns_key_generating": "DNS key is being generated, it may take a while...", + "dyndns_key_not_found": "DNS key not found for the domain", + "dyndns_no_domain_registered": "No domain has been registered with DynDNS", + "dyndns_registered": "The DynDNS domain has been registered", + "dyndns_registration_failed": "Unable to register DynDNS domain: {error:s}", + "dyndns_domain_not_provided": "Dyndns provider {provider:s} cannot provide domain {domain:s}.", + "dyndns_unavailable": "Domain {domain:s} is not available.", + "executing_command": "Executing command '{command:s}'...", + "executing_script": "Executing script '{script:s}'...", + "extracting": "عملية فك الضغط جارية …", + "field_invalid": "Invalid field '{:s}'", + "firewall_reload_failed": "Unable to reload the firewall", + "firewall_reloaded": "The firewall has been reloaded", + "firewall_rules_cmd_failed": "Some firewall rules commands have failed. For more information, see the log.", + "format_datetime_short": "%m/%d/%Y %I:%M %p", + "global_settings_bad_choice_for_enum": "Bad value for setting {setting:s}, received {received_type:s}, except {expected_type:s}", + "global_settings_bad_type_for_setting": "Bad type for setting {setting:s}, received {received_type:s}, except {expected_type:s}", + "global_settings_cant_open_settings": "Failed to open settings file, reason: {reason:s}", + "global_settings_cant_serialize_settings": "Failed to serialize settings data, reason: {reason:s}", + "global_settings_cant_write_settings": "Failed to write settings file, reason: {reason:s}", + "global_settings_key_doesnt_exists": "The key '{settings_key:s}' doesn't exists in the global settings, you can see all the available keys by doing 'yunohost settings list'", + "global_settings_reset_success": "Success. Your previous settings have been backuped in {path:s}", + "global_settings_setting_example_bool": "Example boolean option", + "global_settings_setting_example_enum": "Example enum option", + "global_settings_setting_example_int": "Example int option", + "global_settings_setting_example_string": "Example string option", + "global_settings_unknown_setting_from_settings_file": "Unknown key in settings: '{setting_key:s}', discarding it and save it in /etc/yunohost/unkown_settings.json", + "global_settings_unknown_type": "Unexpected situation, the setting {setting:s} appears to have the type {unknown_type:s} but it's not a type supported by the system.", + "hook_exec_failed": "Script execution failed: {path:s}", + "hook_exec_not_terminated": "Script execution hasn’t terminated: {path:s}", + "hook_list_by_invalid": "Invalid property to list hook by", + "hook_name_unknown": "Unknown hook name '{name:s}'", + "installation_complete": "إكتملت عملية التنصيب", + "installation_failed": "Installation failed", + "invalid_url_format": "Invalid URL format", + "ip6tables_unavailable": "You cannot play with ip6tables here. You are either in a container or your kernel does not support it", + "iptables_unavailable": "You cannot play with iptables here. You are either in a container or your kernel does not support it", + "ldap_init_failed_to_create_admin": "LDAP initialization failed to create admin user", + "ldap_initialized": "LDAP has been initialized", + "license_undefined": "undefined", + "mail_alias_remove_failed": "Unable to remove mail alias '{mail:s}'", + "mail_domain_unknown": "Unknown mail address domain '{domain:s}'", + "mail_forward_remove_failed": "Unable to remove mail forward '{mail:s}'", + "mailbox_used_space_dovecot_down": "Dovecot mailbox service need to be up, if you want to get mailbox used space", + "maindomain_change_failed": "Unable to change the main domain", + "maindomain_changed": "The main domain has been changed", + "migrate_tsig_end": "Migration to hmac-sha512 finished", + "migrate_tsig_failed": "Migrating the dyndns domain {domain} to hmac-sha512 failed, rolling back. Error: {error_code} - {error}", + "migrate_tsig_start": "Not secure enough key algorithm detected for TSIG signature of domain '{domain}', initiating migration to the more secure one hmac-sha512", + "migrate_tsig_wait": "Let's wait 3min for the dyndns server to take the new key into account...", + "migrate_tsig_wait_2": "دقيقتين …", + "migrate_tsig_wait_3": "دقيقة واحدة …", + "migrate_tsig_wait_4": "30 ثانية …", + "migrate_tsig_not_needed": "You do not appear to use a dyndns domain, so no migration is needed !", + "migrations_backward": "Migrating backward.", + "migrations_bad_value_for_target": "Invalide number for target argument, available migrations numbers are 0 or {}", + "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", + "migrations_current_target": "Migration target is {}", + "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {number} {name}", + "migrations_forward": "Migrating forward", + "migrations_loading_migration": "Loading migration {number} {name}...", + "migrations_migration_has_failed": "Migration {number} {name} has failed with exception {exception}, aborting", + "migrations_no_migrations_to_run": "No migrations to run", + "migrations_show_currently_running_migration": "Running migration {number} {name}...", + "migrations_show_last_migration": "Last ran migration is {}", + "migrations_skip_migration": "Skipping migration {number} {name}...", + "monitor_disabled": "The server monitoring has been disabled", + "monitor_enabled": "The server monitoring has been enabled", + "monitor_glances_con_failed": "Unable to connect to Glances server", + "monitor_not_enabled": "Server monitoring is not enabled", + "monitor_period_invalid": "Invalid time period", + "monitor_stats_file_not_found": "Statistics file not found", + "monitor_stats_no_update": "No monitoring statistics to update", + "monitor_stats_period_unavailable": "No available statistics for the period", + "mountpoint_unknown": "Unknown mountpoint", + "mysql_db_creation_failed": "MySQL database creation failed", + "mysql_db_init_failed": "MySQL database init failed", + "mysql_db_initialized": "The MySQL database has been initialized", + "network_check_mx_ko": "DNS MX record is not set", + "network_check_smtp_ko": "Outbound mail (SMTP port 25) seems to be blocked by your network", + "network_check_smtp_ok": "Outbound mail (SMTP port 25) is not blocked", + "new_domain_required": "You must provide the new main domain", + "no_appslist_found": "No app list found", + "no_internet_connection": "Server is not connected to the Internet", + "no_ipv6_connectivity": "IPv6 connectivity is not available", + "no_restore_script": "No restore script found for the app '{app:s}'", + "not_enough_disk_space": "Not enough free disk space on '{path:s}'", + "package_not_installed": "Package '{pkgname}' is not installed", + "package_unexpected_error": "An unexpected error occurred processing the package '{pkgname}'", + "package_unknown": "Unknown package '{pkgname}'", + "packages_no_upgrade": "There is no package to upgrade", + "packages_upgrade_critical_later": "Critical packages ({packages:s}) will be upgraded later", + "packages_upgrade_failed": "Unable to upgrade all of the packages", + "path_removal_failed": "Unable to remove path {:s}", + "pattern_backup_archive_name": "Must be a valid filename with max 30 characters, and alphanumeric and -_. characters only", + "pattern_domain": "Must be a valid domain name (e.g. my-domain.org)", + "pattern_email": "Must be a valid email address (e.g. someone@domain.org)", + "pattern_firstname": "Must be a valid first name", + "pattern_lastname": "Must be a valid last name", + "pattern_listname": "Must be alphanumeric and underscore characters only", + "pattern_mailbox_quota": "Must be a size with b/k/M/G/T suffix or 0 to disable the quota", + "pattern_password": "Must be at least 3 characters long", + "pattern_port": "Must be a valid port number (i.e. 0-65535)", + "pattern_port_or_range": "Must be a valid port number (i.e. 0-65535) or range of ports (e.g. 100:200)", + "pattern_positive_number": "Must be a positive number", + "pattern_username": "Must be lower-case alphanumeric and underscore characters only", + "port_already_closed": "Port {port:d} is already closed for {ip_version:s} connections", + "port_already_opened": "Port {port:d} is already opened for {ip_version:s} connections", + "port_available": "Port {port:d} is available", + "port_unavailable": "Port {port:d} is not available", + "restore_action_required": "You must specify something to restore", + "restore_already_installed_app": "An app is already installed with the id '{app:s}'", + "restore_app_failed": "Unable to restore the app '{app:s}'", + "restore_cleaning_failed": "Unable to clean-up the temporary restoration directory", + "restore_complete": "Restore complete", + "restore_confirm_yunohost_installed": "Do you really want to restore an already installed system? [{answers:s}]", + "restore_extracting": "Extracting needed files from the archive...", + "restore_failed": "Unable to restore the system", + "restore_hook_unavailable": "Restoration script for '{part:s}' not available on your system and not in the archive either", + "restore_may_be_not_enough_disk_space": "Your system seems not to have enough disk space (freespace: {free_space:d} B, needed space: {needed_space:d} B, security margin: {margin:d} B)", + "restore_mounting_archive": "Mounting archive into '{path:s}'", + "restore_not_enough_disk_space": "Not enough disk space (freespace: {free_space:d} B, needed space: {needed_space:d} B, security margin: {margin:d} B)", + "restore_nothings_done": "Nothing has been restored", + "restore_removing_tmp_dir_failed": "Unable to remove an old temporary directory", + "restore_running_app_script": "Running restore script of app '{app:s}'...", + "restore_running_hooks": "Running restoration hooks...", + "restore_system_part_failed": "Unable to restore the '{part:s}' system part", + "server_shutdown": "The server will shutdown", + "server_shutdown_confirm": "The server will shutdown immediatly, are you sure? [{answers:s}]", + "server_reboot": "The server will reboot", + "server_reboot_confirm": "The server will reboot immediatly, are you sure? [{answers:s}]", + "service_add_failed": "Unable to add service '{service:s}'", + "service_added": "The service '{service:s}' has been added", + "service_already_started": "Service '{service:s}' has already been started", + "service_already_stopped": "Service '{service:s}' has already been stopped", + "service_cmd_exec_failed": "Unable to execute command '{command:s}'", + "service_conf_file_backed_up": "The configuration file '{conf}' has been backed up to '{backup}'", + "service_conf_file_copy_failed": "Unable to copy the new configuration file '{new}' to '{conf}'", + "service_conf_file_kept_back": "The configuration file '{conf}' is expected to be deleted by service {service} but has been kept back.", + "service_conf_file_manually_modified": "The configuration file '{conf}' has been manually modified and will not be updated", + "service_conf_file_manually_removed": "The configuration file '{conf}' has been manually removed and will not be created", + "service_conf_file_remove_failed": "Unable to remove the configuration file '{conf}'", + "service_conf_file_removed": "The configuration file '{conf}' has been removed", + "service_conf_file_updated": "The configuration file '{conf}' has been updated", + "service_conf_new_managed_file": "The configuration file '{conf}' is now managed by the service {service}.", + "service_conf_up_to_date": "The configuration is already up-to-date for service '{service}'", + "service_conf_updated": "The configuration has been updated for service '{service}'", + "service_conf_would_be_updated": "The configuration would have been updated for service '{service}'", + "service_disable_failed": "Unable to disable service '{service:s}'", + "service_disabled": "The service '{service:s}' has been disabled", + "service_enable_failed": "Unable to enable service '{service:s}'", + "service_enabled": "The service '{service:s}' has been enabled", + "service_no_log": "No log to display for service '{service:s}'", + "service_regenconf_dry_pending_applying": "Checking pending configuration which would have been applied for service '{service}'...", + "service_regenconf_failed": "Unable to regenerate the configuration for service(s): {services}", + "service_regenconf_pending_applying": "Applying pending configuration for service '{service}'...", + "service_remove_failed": "Unable to remove service '{service:s}'", + "service_removed": "The service '{service:s}' has been removed", + "service_start_failed": "Unable to start service '{service:s}'", + "service_started": "The service '{service:s}' has been started", + "service_status_failed": "Unable to determine status of service '{service:s}'", + "service_stop_failed": "Unable to stop service '{service:s}'", + "service_stopped": "The service '{service:s}' has been stopped", + "service_unknown": "Unknown service '{service:s}'", + "ssowat_conf_generated": "The SSOwat configuration has been generated", + "ssowat_conf_updated": "The SSOwat configuration has been updated", + "ssowat_persistent_conf_read_error": "Error while reading SSOwat persistent configuration: {error:s}. Edit /etc/ssowat/conf.json.persistent file to fix the JSON syntax", + "ssowat_persistent_conf_write_error": "Error while saving SSOwat persistent configuration: {error:s}. Edit /etc/ssowat/conf.json.persistent file to fix the JSON syntax", + "system_upgraded": "The system has been upgraded", + "system_username_exists": "Username already exists in the system users", + "unbackup_app": "App '{app:s}' will not be saved", + "unexpected_error": "An unexpected error occured", + "unit_unknown": "Unknown unit '{unit:s}'", + "unlimit": "No quota", + "unrestore_app": "App '{app:s}' will not be restored", + "update_cache_failed": "Unable to update APT cache", + "updating_apt_cache": "Updating the list of available packages...", + "upgrade_complete": "إكتملت عملية الترقية و التحديث", + "upgrading_packages": "Upgrading packages...", + "upnp_dev_not_found": "No UPnP device found", + "upnp_disabled": "UPnP has been disabled", + "upnp_enabled": "UPnP has been enabled", + "upnp_port_open_failed": "Unable to open UPnP ports", + "user_created": "تم إنشاء المستخدم", + "user_creation_failed": "Unable to create user", + "user_deleted": "The user has been deleted", + "user_deletion_failed": "Unable to delete user", + "user_home_creation_failed": "Unable to create user home folder", + "user_info_failed": "Unable to retrieve user information", + "user_unknown": "Unknown user: {user:s}", + "user_update_failed": "Unable to update user", + "user_updated": "The user has been updated", + "yunohost_already_installed": "YunoHost is already installed", + "yunohost_ca_creation_failed": "Unable to create certificate authority", + "yunohost_ca_creation_success": "The local certification authority has been created.", + "yunohost_configured": "YunoHost has been configured", + "yunohost_installing": "عملية تنصيب يونوهوست جارية …", + "yunohost_not_installed": "YunoHost is not or not correctly installed. Please execute 'yunohost tools postinstall'" } From 165e3e1ca781e084db5a96b904e0531f3f57dd53 Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Thu, 8 Feb 2018 21:28:33 +0000 Subject: [PATCH 074/313] [i18n] Translated using Weblate (Arabic) Currently translated at 99.7% (366 of 367 strings) --- locales/ar.json | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index 81b73f5ec..45a78883d 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -269,13 +269,13 @@ "pattern_listname": "Must be alphanumeric and underscore characters only", "pattern_mailbox_quota": "Must be a size with b/k/M/G/T suffix or 0 to disable the quota", "pattern_password": "Must be at least 3 characters long", - "pattern_port": "Must be a valid port number (i.e. 0-65535)", + "pattern_port": "يجب أن يكون رقم منفذ صالح (مثال 0-65535)", "pattern_port_or_range": "Must be a valid port number (i.e. 0-65535) or range of ports (e.g. 100:200)", - "pattern_positive_number": "Must be a positive number", + "pattern_positive_number": "يجب أن يكون عددا إيجابيا", "pattern_username": "Must be lower-case alphanumeric and underscore characters only", "port_already_closed": "Port {port:d} is already closed for {ip_version:s} connections", "port_already_opened": "Port {port:d} is already opened for {ip_version:s} connections", - "port_available": "Port {port:d} is available", + "port_available": "المنفذ {port:d} متوفر", "port_unavailable": "Port {port:d} is not available", "restore_action_required": "You must specify something to restore", "restore_already_installed_app": "An app is already installed with the id '{app:s}'", @@ -335,33 +335,33 @@ "ssowat_conf_updated": "The SSOwat configuration has been updated", "ssowat_persistent_conf_read_error": "Error while reading SSOwat persistent configuration: {error:s}. Edit /etc/ssowat/conf.json.persistent file to fix the JSON syntax", "ssowat_persistent_conf_write_error": "Error while saving SSOwat persistent configuration: {error:s}. Edit /etc/ssowat/conf.json.persistent file to fix the JSON syntax", - "system_upgraded": "The system has been upgraded", + "system_upgraded": "تمت عملية ترقية النظام", "system_username_exists": "Username already exists in the system users", "unbackup_app": "App '{app:s}' will not be saved", "unexpected_error": "An unexpected error occured", "unit_unknown": "Unknown unit '{unit:s}'", - "unlimit": "No quota", + "unlimit": "دون تحديد الحصة", "unrestore_app": "App '{app:s}' will not be restored", "update_cache_failed": "Unable to update APT cache", - "updating_apt_cache": "Updating the list of available packages...", + "updating_apt_cache": "جارٍ تحديث قائمة الحُزم المتوفرة …", "upgrade_complete": "إكتملت عملية الترقية و التحديث", - "upgrading_packages": "Upgrading packages...", + "upgrading_packages": "عملية ترقية الحُزم جارية …", "upnp_dev_not_found": "No UPnP device found", "upnp_disabled": "UPnP has been disabled", "upnp_enabled": "UPnP has been enabled", "upnp_port_open_failed": "Unable to open UPnP ports", "user_created": "تم إنشاء المستخدم", "user_creation_failed": "Unable to create user", - "user_deleted": "The user has been deleted", - "user_deletion_failed": "Unable to delete user", + "user_deleted": "تم حذف المستخدم", + "user_deletion_failed": "لا يمكن حذف المستخدم", "user_home_creation_failed": "Unable to create user home folder", "user_info_failed": "Unable to retrieve user information", - "user_unknown": "Unknown user: {user:s}", - "user_update_failed": "Unable to update user", - "user_updated": "The user has been updated", + "user_unknown": "المستخدم {user:s} مجهول", + "user_update_failed": "لا يمكن تحديث المستخدم", + "user_updated": "تم تحديث المستخدم", "yunohost_already_installed": "YunoHost is already installed", - "yunohost_ca_creation_failed": "Unable to create certificate authority", - "yunohost_ca_creation_success": "The local certification authority has been created.", + "yunohost_ca_creation_failed": "تعذرت عملية إنشاء هيئة الشهادات", + "yunohost_ca_creation_success": "تم إنشاء هيئة الشهادات المحلية.", "yunohost_configured": "YunoHost has been configured", "yunohost_installing": "عملية تنصيب يونوهوست جارية …", "yunohost_not_installed": "YunoHost is not or not correctly installed. Please execute 'yunohost tools postinstall'" From 9a6d5a4a8bdfc0b2281569d7ad621bd6761168c8 Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Sun, 11 Feb 2018 00:42:53 +0000 Subject: [PATCH 075/313] [i18n] Translated using Weblate (Arabic) Currently translated at 99.7% (366 of 367 strings) --- locales/ar.json | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index 45a78883d..a70ee3975 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -1,9 +1,9 @@ { - "action_invalid": "Invalid action '{action:s}'", + "action_invalid": "إجراء غير صالح '{action:s}'", "admin_password": "كلمة السر الإدارية", - "admin_password_change_failed": "Unable to change password", - "admin_password_changed": "The administration password has been changed", - "app_already_installed": "{app:s} is already installed", + "admin_password_change_failed": "تعذرت عملية تعديل كلمة السر", + "admin_password_changed": "تم تعديل الكلمة السرية الإدارية", + "app_already_installed": "{app:s} تم تنصيبه مِن قبل", "app_already_installed_cant_change_url": "This app is already installed. The url cannot be changed just by this function. Look into `app changeurl` if it's available.", "app_already_up_to_date": "{app:s} is already up to date", "app_argument_choice_invalid": "Invalid choice for argument '{name:s}', it must be one of {choices:s}", @@ -32,28 +32,28 @@ "app_requirements_checking": "Checking required packages for {app}...", "app_requirements_failed": "Unable to meet requirements for {app}: {error}", "app_requirements_unmeet": "Requirements are not met for {app}, the package {pkgname} ({version}) must be {spec}", - "app_sources_fetch_failed": "Unable to fetch sources files", - "app_unknown": "Unknown app", + "app_sources_fetch_failed": "تعذرت عملية جلب مصادر الملفات", + "app_unknown": "برنامج مجهول", "app_unsupported_remote_type": "Unsupported remote type used for the app", - "app_upgrade_app_name": "Upgrading app {app}...", - "app_upgrade_failed": "Unable to upgrade {app:s}", - "app_upgrade_some_app_failed": "Unable to upgrade some applications", + "app_upgrade_app_name": "جارٍ تحديث برنامج {app}...", + "app_upgrade_failed": "تعذرت عملية ترقية {app:s}", + "app_upgrade_some_app_failed": "تعذرت عملية ترقية بعض البرمجيات", "app_upgraded": "{app:s} has been upgraded", "appslist_corrupted_json": "Could not load the application lists. It looks like {filename:s} is corrupted.", "appslist_could_not_migrate": "Could not migrate app list {appslist:s} ! Unable to parse the url... The old cron job has been kept in {bkp_file:s}.", "appslist_fetched": "The application list {appslist:s} has been fetched", "appslist_migrating": "Migrating application list {appslist:s} ...", "appslist_name_already_tracked": "There is already a registered application list with name {name:s}.", - "appslist_removed": "The application list {appslist:s} has been removed", + "appslist_removed": "تم حذف قائمة البرمجيات {appslist:s}", "appslist_retrieve_bad_format": "Retrieved file for application list {appslist:s} is not valid", "appslist_retrieve_error": "Unable to retrieve the remote application list {appslist:s}: {error:s}", - "appslist_unknown": "Application list {appslist:s} unknown.", + "appslist_unknown": "قائمة البرمجيات {appslist:s} مجهولة.", "appslist_url_already_tracked": "There is already a registered application list with url {url:s}.", "ask_current_admin_password": "كلمة السر الإدارية الحالية", "ask_email": "عنوان البريد الإلكتروني", - "ask_firstname": "First name", - "ask_lastname": "Last name", - "ask_list_to_remove": "List to remove", + "ask_firstname": "الإسم", + "ask_lastname": "اللقب", + "ask_list_to_remove": "القائمة المختارة للحذف", "ask_main_domain": "النطاق الرئيسي", "ask_new_admin_password": "كلمة السر الإدارية الجديدة", "ask_password": "كلمة السر", @@ -62,7 +62,7 @@ "backup_action_required": "You must specify something to save", "backup_app_failed": "Unable to back up the app '{app:s}'", "backup_applying_method_borg": "Sending all files to backup into borg-backup repository...", - "backup_applying_method_copy": "Copying all files to backup...", + "backup_applying_method_copy": "جارٍ نسخ كافة الملفات إلى النسخة الإحتياطية …", "backup_applying_method_custom": "Calling the custom backup method '{method:s}'...", "backup_applying_method_tar": "Creating the backup tar archive...", "backup_archive_app_not_found": "App '{app:s}' not found in the backup archive", @@ -113,7 +113,7 @@ "certmanager_attempt_to_renew_valid_cert": "The certificate for domain {domain:s} is not about to expire! Use --force to bypass", "certmanager_attempt_to_replace_valid_cert": "You are attempting to overwrite a good and valid certificate for domain {domain:s}! (Use --force to bypass)", "certmanager_cannot_read_cert": "Something wrong happened when trying to open current certificate for domain {domain:s} (file: {file:s}), reason: {reason:s}", - "certmanager_cert_install_success": "Successfully installed Let's Encrypt certificate for domain {domain:s}!", + "certmanager_cert_install_success": "تمت عملية تنصيب شهادة Let's Encrypt بنجاح على النطاق {domain:s}!", "certmanager_cert_install_success_selfsigned": "Successfully installed a self-signed certificate for domain {domain:s}!", "certmanager_cert_renew_success": "Successfully renewed Let's Encrypt certificate for domain {domain:s}!", "certmanager_cert_signing_failed": "Signing the new certificate failed", @@ -124,17 +124,17 @@ "certmanager_domain_dns_ip_differs_from_public_ip": "The DNS 'A' record for domain {domain:s} is different from this server IP. If you recently modified your A record, please wait for it to propagate (some DNS propagation checkers are available online). (If you know what you are doing, use --no-checks to disable those checks.)", "certmanager_domain_http_not_working": "It seems that the domain {domain:s} cannot be accessed through HTTP. Please check your DNS and nginx configuration is okay", "certmanager_domain_not_resolved_locally": "The domain {domain:s} cannot be resolved from inside your Yunohost server. This might happen if you recently modified your DNS record. If so, please wait a few hours for it to propagate. If the issue persists, consider adding {domain:s} to /etc/hosts. (If you know what you are doing, use --no-checks to disable those checks.)", - "certmanager_domain_unknown": "Unknown domain {domain:s}", + "certmanager_domain_unknown": "النطاق مجهول {domain:s}", "certmanager_error_no_A_record": "No DNS 'A' record found for {domain:s}. You need to make your domain name point to your machine to be able to install a Let's Encrypt certificate! (If you know what you are doing, use --no-checks to disable those checks.)", "certmanager_hit_rate_limit": "Too many certificates already issued for exact set of domains {domain:s} recently. Please try again later. See https://letsencrypt.org/docs/rate-limits/ for more details", "certmanager_http_check_timeout": "Timed out when server tried to contact itself through HTTP using public IP address (domain {domain:s} with ip {ip:s}). You may be experiencing hairpinning issue or the firewall/router ahead of your server is misconfigured.", - "certmanager_no_cert_file": "Unable to read certificate file for domain {domain:s} (file: {file:s})", + "certmanager_no_cert_file": "تعذرت عملية قراءة شهادة نطاق {domain:s} (الملف : {file:s})", "certmanager_old_letsencrypt_app_detected": "\nYunohost detected that the 'letsencrypt' app is installed, which conflits with the new built-in certificate management features in Yunohost. If you wish to use the new built-in features, please run the following commands to migrate your installation:\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B.: this will attempt to re-install certificates for all domains with a Let's Encrypt certificate or self-signed certificate", "certmanager_self_ca_conf_file_not_found": "Configuration file not found for self-signing authority (file: {file:s})", "certmanager_unable_to_parse_self_CA_name": "Unable to parse name of self-signing authority (file: {file:s})", "custom_app_url_required": "You must provide a URL to upgrade your custom app {app:s}", "custom_appslist_name_required": "You must provide a name for your custom app list", - "diagnosis_debian_version_error": "Can't retrieve the Debian version: {error}", + "diagnosis_debian_version_error": "لم نتمكن من العثور على إصدار ديبيان : {error}", "diagnosis_kernel_version_error": "Can't retrieve kernel version: {error}", "diagnosis_monitor_disk_error": "Can't monitor disks: {error}", "diagnosis_monitor_network_error": "Can't monitor network: {error}", From d1cf7abc420bcc98242d638ebba863ecabcf028d Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Sun, 11 Feb 2018 20:32:58 +0000 Subject: [PATCH 076/313] [i18n] Translated using Weblate (Arabic) Currently translated at 97.8% (359 of 367 strings) --- locales/ar.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index a70ee3975..9d2cfe54a 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -4,13 +4,13 @@ "admin_password_change_failed": "تعذرت عملية تعديل كلمة السر", "admin_password_changed": "تم تعديل الكلمة السرية الإدارية", "app_already_installed": "{app:s} تم تنصيبه مِن قبل", - "app_already_installed_cant_change_url": "This app is already installed. The url cannot be changed just by this function. Look into `app changeurl` if it's available.", - "app_already_up_to_date": "{app:s} is already up to date", - "app_argument_choice_invalid": "Invalid choice for argument '{name:s}', it must be one of {choices:s}", - "app_argument_invalid": "Invalid value for argument '{name:s}': {error:s}", - "app_argument_required": "Argument '{name:s}' is required", - "app_change_no_change_url_script": "The application {app_name:s} doesn't support changing it's URL yet, you might need to upgrade it.", - "app_change_url_failed_nginx_reload": "Failed to reload nginx. Here is the output of 'nginx -t':\n{nginx_errors:s}", + "app_already_installed_cant_change_url": "", + "app_already_up_to_date": "", + "app_argument_choice_invalid": "", + "app_argument_invalid": "", + "app_argument_required": "", + "app_change_no_change_url_script": "", + "app_change_url_failed_nginx_reload": "", "app_change_url_identical_domains": "The old and new domain/url_path are identical ('{domain:s}{path:s}'), nothing to do.", "app_change_url_no_script": "This application '{app_name:s}' doesn't support url modification yet. Maybe you should upgrade the application.", "app_change_url_success": "Successfully changed {app:s} url to {domain:s}{path:s}", From 0e2e349d31dccb9d971a183af28860ccfe941047 Mon Sep 17 00:00:00 2001 From: eric g Date: Mon, 26 Feb 2018 07:58:06 +0000 Subject: [PATCH 077/313] [i18n] Translated using Weblate (French) Currently translated at 100.0% (367 of 367 strings) --- locales/fr.json | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/locales/fr.json b/locales/fr.json index dd9c40b34..84601dcb5 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -135,7 +135,7 @@ "mountpoint_unknown": "Point de montage inconnu", "mysql_db_creation_failed": "Impossible de créer la base de données MySQL", "mysql_db_init_failed": "Impossible d'initialiser la base de données MySQL", - "mysql_db_initialized": "La base de donnée MySQL a été initialisée", + "mysql_db_initialized": "La base de données MySQL a été initialisée", "network_check_mx_ko": "L'enregistrement DNS MX n'est pas précisé", "network_check_smtp_ko": "Le trafic courriel sortant (port 25 SMTP) semble bloqué par votre réseau", "network_check_smtp_ok": "Le trafic courriel sortant (port 25 SMTP) n'est pas bloqué", @@ -320,7 +320,7 @@ "backup_archive_system_part_not_available": "La partie « {part:s} » du système n’est pas disponible dans cette sauvegarde", "backup_archive_mount_failed": "Le montage de l’archive de sauvegarde a échoué", "backup_archive_writing_error": "Impossible d’ajouter les fichiers à la sauvegarde dans l’archive compressée", - "backup_ask_for_copying_if_needed": "Certains fichiers n’ont pas pu être préparés pour être sauvegardée en utilisant la méthode qui évite de temporairement gaspiller de l’espace sur le système. Pour mener la sauvegarde, {size:s} Mio doivent être temporairement utilisés. Acceptez-vous ?", + "backup_ask_for_copying_if_needed": "Certains fichiers n’ont pas pu être préparés pour être sauvegardés en utilisant la méthode qui évite temporairement de gaspiller de l’espace sur le système. Pour mener la sauvegarde, {size:s} Mo doivent être temporairement utilisés. Acceptez-vous ?", "backup_borg_not_implemented": "La méthode de sauvegarde Bord n’est pas encore implémentée", "backup_cant_mount_uncompress_archive": "Impossible de monter en lecture seule le dossier de l’archive décompressée", "backup_copying_to_organize_the_archive": "Copie de {size:s} Mio pour organiser l’archive", @@ -378,5 +378,6 @@ "migrate_tsig_wait_2": "2 minutes…", "migrate_tsig_wait_3": "1 minute…", "migrate_tsig_wait_4": "30 secondes…", - "migrate_tsig_not_needed": "Il ne semble pas que vous utilisez un domaine dyndns, donc aucune migration n’est nécessaire !" + "migrate_tsig_not_needed": "Il ne semble pas que vous utilisez un domaine dyndns, donc aucune migration n’est nécessaire !", + "app_checkurl_is_deprecated": "Packagers /!\\ 'app checkurl' est obsolète ! Utilisez 'app register-url' en remplacement !" } From 3094711c8a8660620b34ca95d3d01fbdf01f650c Mon Sep 17 00:00:00 2001 From: Cedric Date: Sun, 15 Apr 2018 15:11:17 +0000 Subject: [PATCH 078/313] [i18n] Translated using Weblate (German) Currently translated at 78.7% (289 of 367 strings) --- locales/de.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/locales/de.json b/locales/de.json index 14a9cb4b9..882f5287c 100644 --- a/locales/de.json +++ b/locales/de.json @@ -10,8 +10,8 @@ "app_extraction_failed": "Installationsdateien konnten nicht entpackt werden", "app_id_invalid": "Falsche App-ID", "app_install_files_invalid": "Ungültige Installationsdateien", - "app_location_already_used": "Eine andere App ist bereits an diesem Ort installiert", - "app_location_install_failed": "Die App kann nicht an diesem Ort installiert werden", + "app_location_already_used": "Eine andere App ({app}) ist bereits an diesem Ort ({path}) installiert", + "app_location_install_failed": "Die App kann nicht an diesem Ort installiert werden, da es mit der App {other_app} die bereits in diesem Pfad ({other_path}) installiert ist Probleme geben würde", "app_manifest_invalid": "Ungültiges App-Manifest", "app_no_upgrade": "Keine Aktualisierungen für Apps verfügbar", "app_not_installed": "{app:s} ist nicht installiert", @@ -219,11 +219,11 @@ "pattern_positive_number": "Muss eine positive Zahl sein", "diagnosis_kernel_version_error": "Kann Kernelversion nicht abrufen: {error}", "package_unexpected_error": "Ein unerwarteter Fehler trat bei der Verarbeitung des Pakets '{pkgname}' auf", - "app_incompatible": "Die Anwendung ist nicht mit deiner YunoHost-Version kompatibel", + "app_incompatible": "Die Anwendung {app} ist nicht mit deiner YunoHost-Version kompatibel", "app_not_correctly_installed": "{app:s} scheint nicht richtig installiert worden zu sein", - "app_requirements_checking": "Überprüfe notwendige Pakete...", - "app_requirements_failed": "Anforderungen werden nicht erfüllt: {error}", - "app_requirements_unmeet": "Anforderungen werden nicht erfüllt, das Paket {pkgname} ({version}) muss {spec} sein", + "app_requirements_checking": "Überprüfe notwendige Pakete für {app}...", + "app_requirements_failed": "Anforderungen für {app} werden nicht erfüllt: {error}", + "app_requirements_unmeet": "Anforderungen für {app} werden nicht erfüllt, das Paket {pkgname} ({version}) muss {spec} sein", "app_unsupported_remote_type": "Für die App wurde ein nicht unterstützer Steuerungstyp verwendet", "backup_archive_broken_link": "Auf das Backup-Archiv konnte nicht zugegriffen werden (ungültiger Link zu {path:s})", "diagnosis_debian_version_error": "Debian Version konnte nicht abgerufen werden: {error}", @@ -272,7 +272,7 @@ "certmanager_self_ca_conf_file_not_found": "Die Konfigurationsdatei der Zertifizierungsstelle für selbstsignierte Zertifikate wurde nicht gefunden (Datei {file:s})", "certmanager_acme_not_configured_for_domain": "Das Zertifikat für die Domain {domain:s} scheint nicht richtig installiert zu sein. Bitte führe den Befehl cert-install für diese Domain nochmals aus.", "certmanager_unable_to_parse_self_CA_name": "Der Name der Zertifizierungsstelle für selbstsignierte Zertifikate konnte nicht analysiert werden (Datei: {file:s})", - "app_package_need_update": "Es ist notwendig das Paket zu aktualisieren, um Aktualisierungen für YunoHost zu erhalten", + "app_package_need_update": "Es ist notwendig das Paket {app} zu aktualisieren, um Aktualisierungen für YunoHost zu erhalten", "service_regenconf_dry_pending_applying": "Überprüfe ausstehende Konfigurationen, die für den Server {service} notwendig sind...", "service_regenconf_pending_applying": "Überprüfe ausstehende Konfigurationen, die für den Server '{service}' notwendig sind...", "certmanager_http_check_timeout": "Eine Zeitüberschreitung ist aufgetreten als der Server versuchte sich selbst über HTTP mit der öffentlichen IP (Domain {domain:s} mit der IP {ip:s}) zu erreichen. Möglicherweise ist dafür hairpinning oder eine falsch konfigurierte Firewall/Router deines Servers dafür verantwortlich.", From 4592b5994d26866060c0f2b0fa9b053f5dd8f3be Mon Sep 17 00:00:00 2001 From: Jeroen Keerl Date: Sun, 15 Apr 2018 15:12:26 +0000 Subject: [PATCH 079/313] [i18n] Translated using Weblate (German) Currently translated at 78.7% (289 of 367 strings) --- locales/de.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/de.json b/locales/de.json index 882f5287c..f93c2eb79 100644 --- a/locales/de.json +++ b/locales/de.json @@ -2,7 +2,7 @@ "action_invalid": "Ungültige Aktion '{action:s}'", "admin_password": "Administrator-Passwort", "admin_password_change_failed": "Passwort kann nicht geändert werden", - "admin_password_changed": "Das Administrator-Passwort wurde erfolgreich geändert", + "admin_password_changed": "Das Administrator-Kennwort wurde erfolgreich geändert", "app_already_installed": "{app:s} ist schon installiert", "app_argument_choice_invalid": "Ungültige Auswahl für Argument '{name:s}'. Es muss einer der folgenden Werte sein {choices:s}", "app_argument_invalid": "Das Argument '{name:s}' hat einen falschen Wert: {error:s}", From 6ae7173073d38fdb4984e325b28f062e0245090c Mon Sep 17 00:00:00 2001 From: Cedric Date: Sun, 15 Apr 2018 15:14:15 +0000 Subject: [PATCH 080/313] [i18n] Translated using Weblate (German) Currently translated at 78.7% (289 of 367 strings) --- locales/de.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/de.json b/locales/de.json index f93c2eb79..d2fc58466 100644 --- a/locales/de.json +++ b/locales/de.json @@ -220,7 +220,7 @@ "diagnosis_kernel_version_error": "Kann Kernelversion nicht abrufen: {error}", "package_unexpected_error": "Ein unerwarteter Fehler trat bei der Verarbeitung des Pakets '{pkgname}' auf", "app_incompatible": "Die Anwendung {app} ist nicht mit deiner YunoHost-Version kompatibel", - "app_not_correctly_installed": "{app:s} scheint nicht richtig installiert worden zu sein", + "app_not_correctly_installed": "{app:s} scheint nicht korrekt installiert zu sein", "app_requirements_checking": "Überprüfe notwendige Pakete für {app}...", "app_requirements_failed": "Anforderungen für {app} werden nicht erfüllt: {error}", "app_requirements_unmeet": "Anforderungen für {app} werden nicht erfüllt, das Paket {pkgname} ({version}) muss {spec} sein", From 1628b248d240ecabb0d57948fae6936211e6f39e Mon Sep 17 00:00:00 2001 From: beyercenter Date: Sun, 15 Apr 2018 15:14:33 +0000 Subject: [PATCH 081/313] [i18n] Translated using Weblate (German) Currently translated at 79.0% (290 of 367 strings) --- locales/de.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/locales/de.json b/locales/de.json index d2fc58466..67cf0c1b2 100644 --- a/locales/de.json +++ b/locales/de.json @@ -299,5 +299,6 @@ "backup_archive_system_part_not_available": "Der System-Teil '{part:s}' ist in diesem Backup nicht enthalten", "backup_archive_mount_failed": "Das Einbinden des Backup-Archives ist fehlgeschlagen", "backup_archive_writing_error": "Die Dateien konnten nicht in der komprimierte Archiv-Backup hinzugefügt werden", - "app_change_url_success": "Erfolgreiche Änderung der URL von {app:s} zu {domain:s}{path:s}" + "app_change_url_success": "Erfolgreiche Änderung der URL von {app:s} zu {domain:s}{path:s}", + "backup_applying_method_borg": "Sende alle Dateien zur Sicherung ins borg-backup" } From 0da8973352812c832d783f7d72d9939a927f66c8 Mon Sep 17 00:00:00 2001 From: Cedric Date: Sun, 15 Apr 2018 15:14:57 +0000 Subject: [PATCH 082/313] [i18n] Translated using Weblate (German) Currently translated at 79.0% (290 of 367 strings) --- locales/de.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/de.json b/locales/de.json index 67cf0c1b2..965650422 100644 --- a/locales/de.json +++ b/locales/de.json @@ -300,5 +300,5 @@ "backup_archive_mount_failed": "Das Einbinden des Backup-Archives ist fehlgeschlagen", "backup_archive_writing_error": "Die Dateien konnten nicht in der komprimierte Archiv-Backup hinzugefügt werden", "app_change_url_success": "Erfolgreiche Änderung der URL von {app:s} zu {domain:s}{path:s}", - "backup_applying_method_borg": "Sende alle Dateien zur Sicherung ins borg-backup" + "backup_applying_method_borg": "Sende alle Dateien zur Sicherung ins borg-backup repository..." } From f21b2749fc3e43a65cafc4b29e77a6b1b614b3ca Mon Sep 17 00:00:00 2001 From: Philip Gatzka Date: Sun, 15 Apr 2018 15:15:20 +0000 Subject: [PATCH 083/313] [i18n] Translated using Weblate (German) Currently translated at 79.0% (290 of 367 strings) --- locales/de.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/de.json b/locales/de.json index 965650422..f043df595 100644 --- a/locales/de.json +++ b/locales/de.json @@ -62,7 +62,7 @@ "domain_creation_failed": "Konnte Domain nicht erzeugen", "domain_deleted": "Die Domain wurde gelöscht", "domain_deletion_failed": "Konnte Domain nicht löschen", - "domain_dyndns_already_subscribed": "Du hast bereits eine DynDNS-Domain abonniert", + "domain_dyndns_already_subscribed": "Du hast dich schon für eine DynDNS-Domain angemeldet", "domain_dyndns_invalid": "Domain nicht mittels DynDNS nutzbar", "domain_dyndns_root_unknown": "Unbekannte DynDNS Hauptdomain", "domain_exists": "Die Domain existiert bereits", From f59d6531f7d960ae19131d31dd63fc8e2b0199fd Mon Sep 17 00:00:00 2001 From: beyercenter Date: Sun, 15 Apr 2018 15:15:25 +0000 Subject: [PATCH 084/313] [i18n] Translated using Weblate (German) Currently translated at 79.2% (291 of 367 strings) --- locales/de.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/locales/de.json b/locales/de.json index f043df595..8174e258e 100644 --- a/locales/de.json +++ b/locales/de.json @@ -300,5 +300,6 @@ "backup_archive_mount_failed": "Das Einbinden des Backup-Archives ist fehlgeschlagen", "backup_archive_writing_error": "Die Dateien konnten nicht in der komprimierte Archiv-Backup hinzugefügt werden", "app_change_url_success": "Erfolgreiche Änderung der URL von {app:s} zu {domain:s}{path:s}", - "backup_applying_method_borg": "Sende alle Dateien zur Sicherung ins borg-backup repository..." + "backup_applying_method_borg": "Sende alle Dateien zur Sicherung ins borg-backup repository...", + "invalid_url_format": "ungültiges URL Format" } From ddc35770bbd47433014fcfe35805fb5b7d62366b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Quent=C3=AD?= Date: Fri, 27 Apr 2018 13:22:51 +0000 Subject: [PATCH 085/313] Added translation using Weblate (Occitan) --- locales/oc.json | 1 + 1 file changed, 1 insertion(+) create mode 100644 locales/oc.json diff --git a/locales/oc.json b/locales/oc.json new file mode 100644 index 000000000..0967ef424 --- /dev/null +++ b/locales/oc.json @@ -0,0 +1 @@ +{} From dc26b1de7c05076111579af32c659ef8a4d026ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Quent=C3=AD?= Date: Fri, 27 Apr 2018 13:49:32 +0000 Subject: [PATCH 086/313] [i18n] Translated using Weblate (Occitan) Currently translated at 1.3% (5 of 367 strings) --- locales/oc.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 0967ef424..35a9e8342 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -1 +1,7 @@ -{} +{ + "admin_password": "Senhal d'administracion", + "admin_password_change_failed": "Impossible de cambiar lo senhal", + "admin_password_changed": "Lo senhal d'administracion es ben estat cambiat", + "app_already_installed": "{app:s} es ja installat", + "app_already_up_to_date": "{app:s} es ja a jorn" +} From 995319d5023d220ffe0dd1d44482a0cbbec39c72 Mon Sep 17 00:00:00 2001 From: bjarkan Date: Sat, 28 Apr 2018 19:54:24 +0000 Subject: [PATCH 087/313] [i18n] Translated using Weblate (Spanish) Currently translated at 82.0% (301 of 367 strings) --- locales/es.json | 50 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 34 insertions(+), 16 deletions(-) diff --git a/locales/es.json b/locales/es.json index eba43fac2..264641065 100644 --- a/locales/es.json +++ b/locales/es.json @@ -9,21 +9,21 @@ "app_argument_required": "Se requiere el argumento '{name:s} 7'", "app_extraction_failed": "No se pudieron extraer los archivos de instalación", "app_id_invalid": "Id de la aplicación no válida", - "app_incompatible": "La aplicación no es compatible con su versión de YunoHost", + "app_incompatible": "La aplicación {app} no es compatible con su versión de YunoHost", "app_install_files_invalid": "Los archivos de instalación no son válidos", - "app_location_already_used": "Una aplicación ya está instalada en esta localización", - "app_location_install_failed": "No se puede instalar la aplicación en esta localización", + "app_location_already_used": "La aplicación {app} ya está instalada en esta localización ({path})", + "app_location_install_failed": "No se puede instalar la aplicación en esta localización porque entra en conflicto con la aplicación '{other_app}' ya instalada en '{other_path}'", "app_manifest_invalid": "El manifiesto de la aplicación no es válido: {error}", "app_no_upgrade": "No hay aplicaciones para actualizar", "app_not_correctly_installed": "La aplicación {app:s} 8 parece estar incorrectamente instalada", "app_not_installed": "{app:s} 9 no está instalada", "app_not_properly_removed": "La {app:s} 0 no ha sido desinstalada correctamente", - "app_package_need_update": "Es necesario actualizar el paquete de la aplicación debido a los cambios en YunoHost", + "app_package_need_update": "El paquete de la aplicación {app} necesita ser actualizada debido a los cambios en YunoHost", "app_recent_version_required": "{:s} requiere una versión más reciente de moulinette ", "app_removed": "{app:s} ha sido eliminada", - "app_requirements_checking": "Comprobando los paquetes requeridos...", - "app_requirements_failed": "No se cumplen los requisitos: {error}", - "app_requirements_unmeet": "No se cumplen los requisitos, el paquete {pkgname} ({version}) debe ser {spec}", + "app_requirements_checking": "Comprobando los paquetes requeridos por {app}...", + "app_requirements_failed": "No se cumplen los requisitos para {app}: {error}", + "app_requirements_unmeet": "No se cumplen los requisitos para {app}, el paquete {pkgname} ({version}) debe ser {spec}", "app_sources_fetch_failed": "No se pudieron descargar los archivos del código fuente", "app_unknown": "Aplicación desconocida", "app_unsupported_remote_type": "Tipo remoto no soportado por la aplicación", @@ -31,8 +31,8 @@ "app_upgraded": "{app:s} ha sido actualizada", "appslist_fetched": "La lista de aplicaciones {appslist:s} ha sido descargada", "appslist_removed": "La lista de aplicaciones {appslist:s} ha sido eliminada", - "appslist_retrieve_error": "No se pudo recuperar la lista remota de aplicaciones {appslist:s} : {error}", - "appslist_unknown": "Lista de aplicaciones desconocida", + "appslist_retrieve_error": "No se pudo recuperar la lista remota de aplicaciones {appslist:s} : {error:s}", + "appslist_unknown": "Lista de aplicaciones {appslist:s} desconocida.", "ask_current_admin_password": "Contraseña administrativa actual", "ask_email": "Dirección de correo electrónico", "ask_firstname": "Nombre", @@ -151,7 +151,7 @@ "packages_upgrade_critical_later": "Los paquetes críticos ({packages:s}) serán actualizados más tarde", "packages_upgrade_failed": "No se pudieron actualizar todos los paquetes", "path_removal_failed": "No se pudo eliminar la ruta {:s}", - "pattern_backup_archive_name": "Debe ser un nombre de archivo válido, solo se admiten caracteres alfanuméricos, los guiones -_ y el punto.", + "pattern_backup_archive_name": "Debe ser un nombre de archivo válido con un máximo de 30 caracteres, solo se admiten caracteres alfanuméricos, los guiones -_ y el punto", "pattern_domain": "El nombre de dominio debe ser válido (por ejemplo mi-dominio.org)", "pattern_email": "Debe ser una dirección de correo electrónico válida (por ejemplo, alguien@dominio.org)", "pattern_firstname": "Debe ser un nombre válido", @@ -277,17 +277,35 @@ "yunohost_ca_creation_success": "Se ha creado la autoridad de certificación local.", "app_already_installed_cant_change_url": "Esta aplicación ya está instalada. No se puede cambiar el URL únicamente mediante esta función. Compruebe si está disponible la opción 'app changeurl'.", "app_change_no_change_url_script": "La aplicacion {app_name:s} aún no permite cambiar su URL, es posible que deba actualizarla.", - "app_change_url_failed_nginx_reload": "No se pudo recargar nginx. Compruebe la salida de 'nginx -t':\n{nginx_error:s}", - "app_change_url_identical_domains": "El antiguo y nuevo dominio/url_path son idénticos ('{domain: s} {path: s}'), no se realizarán cambios.", + "app_change_url_failed_nginx_reload": "No se pudo recargar nginx. Compruebe la salida de 'nginx -t':\n{nginx_errors:s}", + "app_change_url_identical_domains": "El antiguo y nuevo dominio/url_path son idénticos ('{domain:s} {path:s}'), no se realizarán cambios.", "app_change_url_no_script": "Esta aplicación '{app_name:s}' aún no permite modificar su URL. Quizás debería actualizar la aplicación.", "app_change_url_success": "El URL de la aplicación {app:s} ha sido cambiado correctamente a {domain:s} {path:s}", - "app_location_unavailable": "Este URL no está disponible o está en conflicto con otra aplicación instalada.", + "app_location_unavailable": "Este URL no está disponible o está en conflicto con otra aplicación instalada", "app_already_up_to_date": "La aplicación {app:s} ya está actualizada", "appslist_name_already_tracked": "Ya existe una lista de aplicaciones registrada con el nombre {name:s}.", "appslist_url_already_tracked": "Ya existe una lista de aplicaciones registrada con el URL {url:s}.", - "appslist_migrating": "Migrando la lista de aplicaciones {applist:s} ...", + "appslist_migrating": "Migrando la lista de aplicaciones {appslist:s} ...", "appslist_could_not_migrate": "No se pudo migrar la lista de aplicaciones {appslist:s}! No se pudo analizar el URL ... El antiguo cronjob se ha mantenido en {bkp_file:s}.", - "appslist_corrupted_json": "No se pudieron cargar las listas de aplicaciones. Parece que {filename: s} está dañado.", + "appslist_corrupted_json": "No se pudieron cargar las listas de aplicaciones. Parece que {filename:s} está dañado.", "invalid_url_format": "Formato de URL no válido", - "app_upgrade_some_app_failed": "No se pudieron actualizar algunas aplicaciones" + "app_upgrade_some_app_failed": "No se pudieron actualizar algunas aplicaciones", + "app_make_default_location_already_used": "No puede hacer la aplicación '{app}' por defecto en el dominio {domain} dado que está siendo usado por otra aplicación '{other_app}'", + "app_upgrade_app_name": "Actualizando la aplicación {app}...", + "ask_path": "Camino", + "backup_abstract_method": "Este método de backup no ha sido implementado aún", + "backup_applying_method_borg": "Enviando todos los ficheros al backup en el repositorio borg-backup...", + "backup_applying_method_copy": "Copiado todos los ficheros al backup...", + "backup_applying_method_custom": "Llamando el método de backup {method:s} ...", + "backup_applying_method_tar": "Creando el archivo tar de backup...", + "backup_archive_mount_failed": "Fallo en el montado del archivo de backup", + "backup_archive_system_part_not_available": "La parte del sistema {part:s} no está disponible en este backup", + "backup_archive_writing_error": "No se pueden añadir archivos de backup en el archivo comprimido", + "backup_ask_for_copying_if_needed": "Algunos ficheros no pudieron ser preparados para hacer backup usando el método que evita el gasto de espacio temporal en el sistema. Para hacer el backup, {size:s} MB deberían ser usados temporalmente. ¿Está de acuerdo?", + "backup_borg_not_implemented": "Método de backup Borg no está implementado aún", + "backup_cant_mount_uncompress_archive": "No se puede montar en modo solo lectura el directorio del archivo descomprimido", + "backup_copying_to_organize_the_archive": "Copiando {size:s}MB para organizar el archivo", + "backup_couldnt_bind": "No puede enlazar {src:s} con {dest:s}", + "backup_csv_addition_failed": "No puede añadir archivos al backup en el archivo CSV", + "backup_csv_creation_failed": "No se puede crear el archivo CSV necesario para futuras operaciones de restauración" } From 1f4a23aec3998f2b8752cb3c5cd47d2025fb7dcc Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 1 May 2018 22:45:46 +0000 Subject: [PATCH 088/313] Update changelog for 2.7.11 release --- debian/changelog | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/debian/changelog b/debian/changelog index 989419109..9bf2eb579 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,42 @@ +yunohost (2.7.11) testing; urgency=low + + Important changes / fixes + ------------------------- + + * [enh] Add commands to manage user ssh accesses and keys (#403, #445) + * [fix] Fix Lets Encrypt install when an app is installed at root (#428) + * [enh] Improve performances by lazy-loading some modules (#451) + * [enh] Use Mozilla's recommended headers in nginx conf (#399, #456) + * [fix] Fix path traversal issues in yunohost admin nginx conf (#420) + * [helpers] Add nodejs helpers (#441, #446) + + Other changes + ------------- + + * [enh] Enable gzip compression for common text mimetypes in nginx (#356) + * [enh] Add 'post' hooks on app management operations (#360) + * [fix] Fix an issue with custom backup methods and crons (#421) + * [mod] Simplify the way we fetch and test global ip (#424) + * [enh] Manage etckeeper.conf to make etckeeper quiet (#426) + * [fix] Be able to access conf folder in change_url scripts (#427) + * [enh] Verbosify backup/restores that are performed during app upgrades (#432) + * [enh] Display debug information on cert-install/renew failure (#447) + * [fix] Add mailutils and wget as a dependencies + * [mod] Misc tweaks to display more info when some commands fail + * [helpers] More explicit depreciation warning for 'app checkurl' + * [helpers] Fix an issue in ynh_restore_file if destination already exists (#384) + * [helpers] Update php-fpm helpers to handle stretch/php7 and a smooth migration (#373) + * [helpers] Add helper 'ynh_get_debian_release' (#373) + * [helpers] Trigger an error when failing to install dependencies (#381) + * [helpers] Allow for 'or' in dependencies (#381) + * [helpers] Tweak the usage of BACKUP_CORE_ONLY (#398) + * [helpers] Tweak systemd config helpers (optional service name and template name) (#425) + * [i18n] Improve translations for Arabic, French, German, Occitan, Spanish + + Thanks for all contributors (ariasuni, ljf, JimboeJoe, Maniack, Josue, Aleks, Bram, jibec) and the several translators (ButterflyOfFire, J-B Lescher, Eric G., Cedric, J. Keerl, beyercenter, P. Gatzka, Quenti, bjarkan) <3 ! + + -- Alexandre Aubin Tue, 01 May 2018 22:04:40 +0000 + yunohost (2.7.10) stable; urgency=low * [fix] Fail2ban conf/filter was not matching failed login attempts... From ec56b551456926f2fc08ef2222cbc75df670a9ed Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 2 May 2018 01:27:16 +0200 Subject: [PATCH 089/313] Fix a few mistakes in the changelog credits :s --- debian/changelog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index 9bf2eb579..f2dcee401 100644 --- a/debian/changelog +++ b/debian/changelog @@ -33,7 +33,7 @@ yunohost (2.7.11) testing; urgency=low * [helpers] Tweak systemd config helpers (optional service name and template name) (#425) * [i18n] Improve translations for Arabic, French, German, Occitan, Spanish - Thanks for all contributors (ariasuni, ljf, JimboeJoe, Maniack, Josue, Aleks, Bram, jibec) and the several translators (ButterflyOfFire, J-B Lescher, Eric G., Cedric, J. Keerl, beyercenter, P. Gatzka, Quenti, bjarkan) <3 ! + Thanks to all contributors (ariasuni, ljf, JimboJoe, frju365, Maniack, J-B Lescher, Josue, Aleks, Bram, jibec) and the several translators (ButterflyOfFire, Eric G., Cedric, J. Keerl, beyercenter, P. Gatzka, Quenti, bjarkan) <3 ! -- Alexandre Aubin Tue, 01 May 2018 22:04:40 +0000 From 5013965c0e625e317b96561e251846c902912fc7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 2 May 2018 02:10:46 +0200 Subject: [PATCH 090/313] [enh] [wip] Stretch migration (#433) * Add migration skeleton * Clumsy attempt to adapt the upgrade script to python * At the end of the migration, force the regen conf of specific services * Implement the apt clean/autoremove at the end of migration * Attempt to fix the upgrade of yunohost packages * Dumb mistake :| * Adding strings * Add test of free space for /var/ * Fix sources.list patching * Stupid mistake :| * Check system is up to date * Working on disclaimer draft * Add a function to list installed 'unstable' apps * Get actual list of problemtic apps + improve disclaimer message building * Use helper to run the apt update * More simplifications of disclaimer building * Add helper function to get manually modified files * Fetch actuall list of manually modified files to build disclaimer * Internationalize disclaimer * Don't skip stretch migration when running postinstall on jessie * Add a done message at the very end of the migration * Also patch jessie/updates and backports in sources.list * Backup and restore conf files modified during the upgrade to not mess regen-conf * Also check for yunohost being in 2.x at the beginning of upgrade * Fix the check for upgradable packages.. * Try to be more robust if folder already exists (when running multiple times) * I probably meant fail2ban here o.O * Try to improve robustness when running multiple time * Add a check after the main upgrade that we're effectively on stretch * Hold apps equivs packages during the upgrade * Show dist-upgrade logs in the yunohost admin, using call_async_output * Misc fixes because I broke things /o\ * Touch /etc/yunohost/installed at the end, because for some weird reason it get deleted sometimes :| * Removing this unecessary message, especially because it 'hide' the previous one when running from the webadmin * Install php-zip for nextcloud and kanboard * Don't crash if there's no [app]-ynh-deps * Revert previous commit that added this, should be fixed in the stretch branch now * [fix] Unhold metronome for migration (#452) * Let's use forge.yunohost.org as repo now --- locales/en.json | 13 + src/yunohost/app.py | 17 + .../0003_migrate_to_stretch.py | 291 ++++++++++++++++++ src/yunohost/service.py | 22 ++ src/yunohost/tools.py | 2 +- src/yunohost/utils/filesystem.py | 25 ++ 6 files changed, 369 insertions(+), 1 deletion(-) create mode 100644 src/yunohost/data_migrations/0003_migrate_to_stretch.py create mode 100644 src/yunohost/utils/filesystem.py diff --git a/locales/en.json b/locales/en.json index 9957c25a0..0f45c7a8b 100644 --- a/locales/en.json +++ b/locales/en.json @@ -224,6 +224,19 @@ "migrate_tsig_not_needed": "You do not appear to use a dyndns domain, so no migration is needed !", "migration_description_0001_change_cert_group_to_sslcert": "Change certificates group permissions from 'metronome' to 'ssl-cert'", "migration_description_0002_migrate_to_tsig_sha256": "Improve security of dyndns TSIG by using SHA512 instead of MD5", + "migration_description_0003_migrate_to_stretch": "Upgrade the system to Debian Stretch and YunoHost 3.0", + "migration_0003_backward_impossible": "The stretch migration cannot be reverted.", + "migration_0003_start": "Starting migration to Stretch. The logs will be available in {logfile}.", + "migration_0003_patching_sources_list": "Patching the sources.lists ...", + "migration_0003_main_upgrade": "Starting main upgrade ...", + "migration_0003_fail2ban_upgrade": "Starting the fail2ban upgrade ...", + "migration_0003_yunohost_upgrade": "Starting the yunohost package upgrade ... The migration will end, but the actual upgrade will happen right after. After the operation is complete, you might have to re-log on the webadmin.", + "migration_0003_not_jessie": "The current debian distribution is not Jessie !", + "migration_0003_system_not_fully_up_to_date": "Your system is not fully up to date. Please perform a regular upgrade before running the migration to stretch.", + "migration_0003_still_on_jessie_after_main_upgrade": "Something wrong happened during the main upgrade : system is still on Jessie !? To investigate the issue, please look at {log} :s ...", + "migration_0003_general_warning": "Please note that this migration is a delicate operation. While the YunoHost team did its best to review and test it, the migration might still break parts of the system or apps.\n\nTherefore, we recommend you to :\n - Perform a backup of any critical data or app ;\n - Be patient after launching the migration : depending on your internet connection and hardware, it might take up to a few hours for everything to upgrade.", + "migration_0003_problematic_apps_warning": "Please note that the following possibly problematic installed apps were detected. It looks like those were not installed from an applist or are not flagged as 'working'. Consequently, we cannot guarantee that they will still work after the upgrade : {problematic_apps}", + "migration_0003_modified_files": "Please note that the following files were found to be manually modified and might be overwritten at the end of the upgrade : {manually_modified_files}", "migrations_backward": "Migrating backward.", "migrations_bad_value_for_target": "Invalid number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 6ddf08f52..a4ab8db7b 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -2164,3 +2164,20 @@ def normalize_url_path(url_path): return '/' + url_path.strip("/").strip() + '/' return "/" + + +def unstable_apps(): + + raw_app_installed = app_list(installed=True, raw=True) + output = [] + + for app, infos in raw_app_installed.items(): + + repo = infos.get("repository", None) + state = infos.get("state", None) + + if repo is None or state in ["inprogress", "notworking"]: + output.append(app) + + return output + diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py new file mode 100644 index 000000000..5f65dbb89 --- /dev/null +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -0,0 +1,291 @@ +import glob +import os +import requests +import base64 +import time +import json +import errno +import platform +from shutil import copy2 + +from moulinette import m18n, msettings +from moulinette.core import MoulinetteError +from moulinette.utils.log import getActionLogger +from moulinette.utils.process import check_output, call_async_output +from moulinette.utils.filesystem import read_file + +from yunohost.tools import Migration +from yunohost.app import unstable_apps +from yunohost.service import _run_service_command, service_regen_conf, manually_modified_files +from yunohost.utils.filesystem import free_space_in_directory +from yunohost.utils.packages import get_installed_version + +logger = getActionLogger('yunohost.migration') + +YUNOHOST_PACKAGES = ["yunohost", "yunohost-admin", "moulinette", "ssowat" ] + +class MyMigration(Migration): + "Upgrade the system to Debian Stretch and Yunohost 3.0" + + mode = "manual" + + def backward(self): + + raise MoulinetteError(m18n.n("migration_0003_backward_impossible")) + + def migrate(self): + + self.logfile = "/tmp/{}.log".format(self.name) + + self.check_assertions() + + logger.warning(m18n.n("migration_0003_start", logfile=self.logfile)) + + # Preparing the upgrade + logger.warning(m18n.n("migration_0003_patching_sources_list")) + self.patch_apt_sources_list() + self.backup_files_to_keep() + self.apt_update() + apps_packages = self.get_apps_equivs_packages() + self.unhold(["metronome"]) + self.hold(YUNOHOST_PACKAGES + apps_packages + ["fail2ban"]) + + # Main dist-upgrade + logger.warning(m18n.n("migration_0003_main_upgrade")) + _run_service_command("stop", "mysql") + self.apt_dist_upgrade(conf_flags=["old", "def"]) + _run_service_command("start", "mysql") + if self.debian_major_version() == 8: + raise MoulinetteError(m18n.n("migration_0003_still_on_jessie_after_main_upgrade", log=self.logfile)) + + # Specific upgrade for fail2ban... + logger.warning(m18n.n("migration_0003_fail2ban_upgrade")) + self.unhold(["fail2ban"]) + # Don't move this if folder already exists. If it does, we probably are + # running this script a 2nd, 3rd, ... time but /etc/fail2ban will + # be re-created only for the first dist-upgrade of fail2ban + if not os.path.exists("/etc/fail2ban.old"): + os.system("mv /etc/fail2ban /etc/fail2ban.old") + self.apt_dist_upgrade(conf_flags=["new", "miss", "def"]) + _run_service_command("restart", "fail2ban") + + # Clean the mess + os.system("apt autoremove --assume-yes") + os.system("apt clean --assume-yes") + + # Upgrade yunohost packages + logger.warning(m18n.n("migration_0003_yunohost_upgrade")) + self.restore_files_to_keep() + self.unhold(YUNOHOST_PACKAGES + apps_packages) + self.upgrade_yunohost_packages() + + def debian_major_version(self): + return int(platform.dist()[1][0]) + + def yunohost_major_version(self): + return int(get_installed_version("yunohost").split('.')[0]) + + def check_assertions(self): + + # Be on jessie (8.x) and yunohost 2.x + # NB : we do both check to cover situations where the upgrade crashed + # in the middle and debian version could be >= 9.x but yunohost package + # would still be in 2.x... + if not self.debian_major_version() == 8 \ + and not self.yunohost_major_version() == 2: + raise MoulinetteError(m18n.n("migration_0003_not_jessie")) + + # Have > 1 Go free space on /var/ ? + if free_space_in_directory("/var/") / (1024**3) < 1.0: + raise MoulinetteError(m18n.n("migration_0003_not_enough_free_space")) + + # Check system is up to date + # (but we don't if 'stretch' is already in the sources.list ... + # which means maybe a previous upgrade crashed and we're re-running it) + if not " stretch " in read_file("/etc/apt/sources.list"): + self.apt_update() + apt_list_upgradable = check_output("apt list --upgradable -a") + if "upgradable" in apt_list_upgradable: + raise MoulinetteError(m18n.n("migration_0003_system_not_fully_up_to_date")) + + @property + def disclaimer(self): + + # Avoid having a super long disclaimer + uncessary check if we ain't + # on jessie / yunohost 2.x anymore + # NB : we do both check to cover situations where the upgrade crashed + # in the middle and debian version could be >= 9.x but yunohost package + # would still be in 2.x... + if not self.debian_major_version() == 8 \ + and not self.yunohost_major_version() == 2: + return None + + # Get list of problematic apps ? I.e. not official or community+working + problematic_apps = unstable_apps() + problematic_apps = "".join(["\n - "+app for app in problematic_apps ]) + + # Manually modified files ? (c.f. yunohost service regen-conf) + modified_files = manually_modified_files() + modified_files = "".join(["\n - "+f for f in modified_files ]) + + message = m18n.n("migration_0003_general_warning") + + if problematic_apps: + message += "\n\n" + m18n.n("migration_0003_problematic_apps_warning", problematic_apps=problematic_apps) + + if modified_files: + message += "\n\n" + m18n.n("migration_0003_modified_files", manually_modified_files=modified_files) + + return message + + def patch_apt_sources_list(self): + + sources_list = glob.glob("/etc/apt/sources.list.d/*.list") + sources_list.append("/etc/apt/sources.list") + + # This : + # - replace single 'jessie' occurence by 'stretch' + # - comments lines containing "backports" + # - replace 'jessie/updates' by 'strech/updates' + # - switch yunohost's repo to forge + for f in sources_list: + command = "sed -i -e 's@ jessie @ stretch @g' " \ + "-e '/backports/ s@^#*@#@' " \ + "-e 's@ jessie/updates @ stretch/updates @g' " \ + "-e 's@repo.yunohost@forge.yunohost@g' " \ + "{}".format(f) + os.system(command) + + def get_apps_equivs_packages(self): + + command = "dpkg --get-selections" \ + " | grep -v deinstall" \ + " | awk '{print $1}'" \ + " | { grep 'ynh-deps$' || true; }" + + output = check_output(command).strip() + + return output.split('\n') if output else [] + + def hold(self, packages): + for package in packages: + os.system("apt-mark hold {}".format(package)) + + def unhold(self, packages): + for package in packages: + os.system("apt-mark unhold {}".format(package)) + + def apt_update(self): + + command = "apt-get update" + logger.debug("Running apt command :\n{}".format(command)) + command += " 2>&1 | tee -a {}".format(self.logfile) + + os.system(command) + + def upgrade_yunohost_packages(self): + + # + # Here we use a dirty hack to run a command after the current + # "yunohost tools migrations migrate", because the upgrade of + # yunohost will also trigger another "yunohost tools migrations migrate" + # (also the upgrade of the package, if executed from the webadmin, is + # likely to kill/restart the api which is in turn likely to kill this + # command before it ends...) + # + + MOULINETTE_LOCK = "/var/run/moulinette_yunohost.lock" + + upgrade_command = "" + upgrade_command += " DEBIAN_FRONTEND=noninteractive" + upgrade_command += " APT_LISTCHANGES_FRONTEND=none" + upgrade_command += " apt-get install" + upgrade_command += " --assume-yes " + upgrade_command += " ".join(YUNOHOST_PACKAGES) + # We also install php-zip to fix an issue with nextcloud and kanboard + # that need it when on stretch. + upgrade_command += " php-zip" + upgrade_command += " 2>&1 | tee -a {}".format(self.logfile) + + wait_until_end_of_yunohost_command = "(while [ -f {} ]; do sleep 2; done)".format(MOULINETTE_LOCK) + + command = "({} && {}; echo 'Done!') &".format(wait_until_end_of_yunohost_command, + upgrade_command) + + logger.debug("Running command :\n{}".format(command)) + + os.system(command) + + + def apt_dist_upgrade(self, conf_flags): + + # Make apt-get happy + os.system("echo 'libc6 libraries/restart-without-asking boolean true' | debconf-set-selections") + + command = "" + command += " DEBIAN_FRONTEND=noninteractive" + command += " APT_LISTCHANGES_FRONTEND=none" + command += " apt-get" + command += " --fix-broken --show-upgraded --assume-yes" + for conf_flag in conf_flags: + command += ' -o Dpkg::Options::="--force-conf{}"'.format(conf_flag) + command += " dist-upgrade" + + logger.debug("Running apt command :\n{}".format(command)) + + command += " 2>&1 | tee -a {}".format(self.logfile) + + is_api = msettings.get('interface') == 'api' + if is_api: + callbacks = ( + lambda l: logger.info(l.rstrip()), + lambda l: logger.warning(l.rstrip()), + ) + call_async_output(command, callbacks, shell=True) + else: + # We do this when running from the cli to have the output of the + # command showing in the terminal, since 'info' channel is only + # enabled if the user explicitly add --verbose ... + os.system(command) + + + # Those are files that should be kept and restored before the final switch + # to yunohost 3.x... They end up being modified by the various dist-upgrades + # (or need to be taken out momentarily), which then blocks the regen-conf + # as they are flagged as "manually modified"... + files_to_keep = [ + "/etc/mysql/my.cnf", + "/etc/nslcd.conf", + "/etc/postfix/master.cf", + "/etc/fail2ban/filter.d/yunohost.conf" + ] + + def backup_files_to_keep(self): + + logger.debug("Backuping specific files to keep ...") + + # Create tmp directory if it does not exists + tmp_dir = os.path.join("/tmp/", self.name) + if not os.path.exists(tmp_dir): + os.mkdir(tmp_dir, 0700) + + for f in self.files_to_keep: + dest_file = f.strip('/').replace("/", "_") + + # If the file is already there, we might be re-running the migration + # because it previously crashed. Hence we keep the existing file. + if os.path.exists(os.path.join(tmp_dir, dest_file)): + continue + + copy2(f, os.path.join(tmp_dir, dest_file)) + + def restore_files_to_keep(self): + + logger.debug("Restoring specific files to keep ...") + + tmp_dir = os.path.join("/tmp/", self.name) + + for f in self.files_to_keep: + dest_file = f.strip('/').replace("/", "_") + copy2(os.path.join(tmp_dir, dest_file), f) + diff --git a/src/yunohost/service.py b/src/yunohost/service.py index f0948c961..1852259ad 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -26,6 +26,7 @@ import os import time import yaml +import json import glob import subprocess import errno @@ -771,3 +772,24 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): exc_info=1) return False return True + +def manually_modified_files(): + + # We do this to have --quiet, i.e. don't throw a whole bunch of logs + # just to fetch this... + # Might be able to optimize this by looking at what service_regenconf does + # and only do the part that checks file hashes... + cmd = "yunohost service regen-conf --dry-run --output-as json --quiet" + j = json.loads(subprocess.check_output(cmd.split())) + + # j is something like : + # {"postfix": {"applied": {}, "pending": {"/etc/postfix/main.cf": {"status": "modified"}}} + + output = [] + for app, actions in j.items(): + for action, files in actions.items(): + for filename, infos in files.items(): + if infos["status"] == "modified": + output.append(filename) + + return output diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index a60ffa80a..80f7bcaa5 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -395,7 +395,7 @@ def tools_postinstall(domain, password, ignore_dyndns=False): _install_appslist_fetch_cron() # Init migrations (skip them, no need to run them on a fresh system) - tools_migrations_migrate(skip=True, auto=True) + tools_migrations_migrate(target=2, skip=True, auto=True) os.system('touch /etc/yunohost/installed') diff --git a/src/yunohost/utils/filesystem.py b/src/yunohost/utils/filesystem.py new file mode 100644 index 000000000..9b39f5daa --- /dev/null +++ b/src/yunohost/utils/filesystem.py @@ -0,0 +1,25 @@ +# -*- coding: utf-8 -*- + +""" License + + Copyright (C) 2018 YUNOHOST.ORG + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published + by the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program; if not, see http://www.gnu.org/licenses + +""" +import os + +def free_space_in_directory(dirpath): + stat = os.statvfs(dirpath) + return stat.f_frsize * stat.f_bavail From 9ebb082e32922ffb8a199ab81bca2255a42bc5e9 Mon Sep 17 00:00:00 2001 From: frju365 Date: Wed, 2 May 2018 14:10:13 +0200 Subject: [PATCH 091/313] [fix] Nginx Regression typo (#459) --- data/templates/nginx/server.tpl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 861c4b476..df722b526 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -48,7 +48,7 @@ server { # https://wiki.mozilla.org/Security/Guidelines/Web_Security # https://observatory.mozilla.org/ add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header Content-Security-Policy "upgrade-insecure-requests;" + add_header Content-Security-Policy "upgrade-insecure-requests"; add_header Content-Security-Policy-Report-Only "default-src https: data: 'unsafe-inline' 'unsafe-eval'"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; From e13915bffa9fdcdf69e728484f4ae475bce7e5b9 Mon Sep 17 00:00:00 2001 From: frju365 Date: Wed, 2 May 2018 14:10:13 +0200 Subject: [PATCH 092/313] [fix] Nginx Regression typo (#459) --- data/templates/nginx/server.tpl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 495a15bdc..47fd05505 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -46,7 +46,7 @@ server { # https://wiki.mozilla.org/Security/Guidelines/Web_Security # https://observatory.mozilla.org/ add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; - add_header Content-Security-Policy "upgrade-insecure-requests;" + add_header Content-Security-Policy "upgrade-insecure-requests"; add_header Content-Security-Policy-Report-Only "default-src https: data: 'unsafe-inline' 'unsafe-eval'"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; From 1b7bd8124cd8b1cd4d86065ea65e88998b9bc99c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 2 May 2018 12:13:10 +0000 Subject: [PATCH 093/313] Update changelog for 2.7.11.1 release --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/debian/changelog b/debian/changelog index 9bf2eb579..42f50bae8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +yunohost (2.7.11.1) testing; urgency=low + + * [fix] Nginx Regression typo (#459) + + -- Alexandre Aubin Wed, 02 May 2018 12:12:45 +0000 + yunohost (2.7.11) testing; urgency=low Important changes / fixes From 4c79f525a175544bb3fecb06f878dcd8d59b20eb Mon Sep 17 00:00:00 2001 From: ljf Date: Mon, 23 Jan 2017 11:49:09 +0100 Subject: [PATCH 094/313] [enh] Compatibility with debian stretch This reverts commit 3be7aff0655d38d4ceba2f9aa54666c1071769a4. --- debian/control | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/debian/control b/debian/control index d1505994a..61b886d72 100644 --- a/debian/control +++ b/debian/control @@ -16,12 +16,12 @@ Depends: ${python:Depends}, ${misc:Depends} , glances , dnsutils, bind9utils, unzip, git, curl, cron, wget , ca-certificates, netcat-openbsd, iproute - , mariadb-server | mysql-server, php5-mysql | php5-mysqlnd + , mariadb-server | mysql-server, php5-mysql | php5-mysqlnd | php-mysql | php-mysqlnd , slapd, ldap-utils, sudo-ldap, libnss-ldapd, nscd , postfix-ldap, postfix-policyd-spf-perl, postfix-pcre, procmail, mailutils , dovecot-ldap, dovecot-lmtpd, dovecot-managesieved , dovecot-antispam, fail2ban - , nginx-extras (>=1.6.2), php5-fpm, php5-ldap, php5-intl + , nginx-extras (>=1.6.2), php5-fpm | php-fpm, php5-ldap | php-ldap, php5-intl | php-intl , dnsmasq, openssl, avahi-daemon, libnss-mdns, resolvconf, libnss-myhostname , metronome , rspamd (>= 1.2.0), rmilter (>=1.7.0), redis-server, opendkim-tools @@ -29,7 +29,7 @@ Depends: ${python:Depends}, ${misc:Depends} Recommends: yunohost-admin , openssh-server, ntp, inetutils-ping | iputils-ping , bash-completion, rsyslog, etckeeper - , php5-gd, php5-curl, php-gettext, php5-mcrypt + , php5-gd | php-gd, php5-curl | php-curl, php5-gettext | php-gettext, php5-mcrypt | php-mcrypt , python-pip , unattended-upgrades , libdbd-ldap-perl, libnet-dns-perl From 331db9edb65b22442b47928422c377dc04a8774d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 6 Jul 2017 13:36:49 +0000 Subject: [PATCH 095/313] Removing dependency to rmilter, obsolete since rspamd >= 1.6 --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 61b886d72..c13095e80 100644 --- a/debian/control +++ b/debian/control @@ -24,7 +24,7 @@ Depends: ${python:Depends}, ${misc:Depends} , nginx-extras (>=1.6.2), php5-fpm | php-fpm, php5-ldap | php-ldap, php5-intl | php-intl , dnsmasq, openssl, avahi-daemon, libnss-mdns, resolvconf, libnss-myhostname , metronome - , rspamd (>= 1.2.0), rmilter (>=1.7.0), redis-server, opendkim-tools + , rspamd (>= 1.6.0), redis-server, opendkim-tools , haveged Recommends: yunohost-admin , openssh-server, ntp, inetutils-ping | iputils-ping From 786e1d8728d10dad2349b1816090642add5312ad Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 13:57:08 +0000 Subject: [PATCH 096/313] Removing php5 dependencies (generic php deps instead) --- debian/control | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/control b/debian/control index c13095e80..8faa2dc1e 100644 --- a/debian/control +++ b/debian/control @@ -16,7 +16,7 @@ Depends: ${python:Depends}, ${misc:Depends} , glances , dnsutils, bind9utils, unzip, git, curl, cron, wget , ca-certificates, netcat-openbsd, iproute - , mariadb-server | mysql-server, php5-mysql | php5-mysqlnd | php-mysql | php-mysqlnd + , mariadb-server | mysql-server, php-mysql | php-mysqlnd , slapd, ldap-utils, sudo-ldap, libnss-ldapd, nscd , postfix-ldap, postfix-policyd-spf-perl, postfix-pcre, procmail, mailutils , dovecot-ldap, dovecot-lmtpd, dovecot-managesieved @@ -29,7 +29,7 @@ Depends: ${python:Depends}, ${misc:Depends} Recommends: yunohost-admin , openssh-server, ntp, inetutils-ping | iputils-ping , bash-completion, rsyslog, etckeeper - , php5-gd | php-gd, php5-curl | php-curl, php5-gettext | php-gettext, php5-mcrypt | php-mcrypt + , php-gd, php-curl, php-gettext, php-mcrypt , python-pip , unattended-upgrades , libdbd-ldap-perl, libnet-dns-perl From 6fc3f08cdae5d7b6a9a43926700cbd1080135de6 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 14:42:24 +0000 Subject: [PATCH 097/313] Regenerate nslcd config before creating admin in ldap --- src/yunohost/tools.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 80f7bcaa5..75f7223d3 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -295,6 +295,8 @@ def tools_postinstall(domain, password, ignore_dyndns=False): logger.info(m18n.n('yunohost_installing')) + service_regen_conf(['nslcd'], force=True) + # Initialize LDAP for YunoHost # TODO: Improve this part by integrate ldapinit into conf_regen hook auth = tools_ldapinit() From ddebd9f0917eedfe9deefa1574f96396c4781e9a Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 14:51:54 +0000 Subject: [PATCH 098/313] We also need to regen nsswitch before ldapinit otherwise sudo doesnt work --- src/yunohost/tools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 75f7223d3..5571f7c03 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -295,7 +295,7 @@ def tools_postinstall(domain, password, ignore_dyndns=False): logger.info(m18n.n('yunohost_installing')) - service_regen_conf(['nslcd'], force=True) + service_regen_conf(['nslcd', 'nsswitch'], force=True) # Initialize LDAP for YunoHost # TODO: Improve this part by integrate ldapinit into conf_regen hook From da973e69a776a7470d7021a19209af5a8557c467 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 15:28:08 +0000 Subject: [PATCH 099/313] Getting rid of systematic error message during install --- data/hooks/conf_regen/06-slapd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/hooks/conf_regen/06-slapd b/data/hooks/conf_regen/06-slapd index aef47c347..d0a1fad63 100755 --- a/data/hooks/conf_regen/06-slapd +++ b/data/hooks/conf_regen/06-slapd @@ -46,7 +46,7 @@ do_pre_regen() { sudo rm -f "$tmp_backup_dir_file" # retrieve current and new backends - curr_backend=$(grep '^database' /etc/ldap/slapd.conf | awk '{print $2}') + curr_backend=$(grep '^database' /etc/ldap/slapd.conf 2>/dev/null | awk '{print $2}') new_backend=$(grep '^database' slapd.conf | awk '{print $2}') # save current database before any conf changes From a72e7753f8e24f4664e56ce2bf1b7698c926e1e9 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 15:28:48 +0000 Subject: [PATCH 100/313] Remove install flag in /etc/yunohost when uninstall yunohost --- debian/postrm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/debian/postrm b/debian/postrm index 2bbdd496b..cf2b6afe7 100644 --- a/debian/postrm +++ b/debian/postrm @@ -6,6 +6,8 @@ if [ "$1" = "purge" ]; then update-rc.d yunohost-firewall remove >/dev/null fi +rm -f /etc/yunohost/installed + #DEBHELPER# exit 0 From 627edbdf0b09e0698543e606f0d8c0ace3b4145c Mon Sep 17 00:00:00 2001 From: ljf Date: Mon, 23 Jan 2017 11:49:09 +0100 Subject: [PATCH 101/313] [enh] Compatibility with debian stretch This reverts commit 3be7aff0655d38d4ceba2f9aa54666c1071769a4. --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 8faa2dc1e..46c95fb8b 100644 --- a/debian/control +++ b/debian/control @@ -21,7 +21,7 @@ Depends: ${python:Depends}, ${misc:Depends} , postfix-ldap, postfix-policyd-spf-perl, postfix-pcre, procmail, mailutils , dovecot-ldap, dovecot-lmtpd, dovecot-managesieved , dovecot-antispam, fail2ban - , nginx-extras (>=1.6.2), php5-fpm | php-fpm, php5-ldap | php-ldap, php5-intl | php-intl + , nginx-extras (>=1.6.2), php-fpm, php-ldap, php-intl , dnsmasq, openssl, avahi-daemon, libnss-mdns, resolvconf, libnss-myhostname , metronome , rspamd (>= 1.6.0), redis-server, opendkim-tools From 03dac66bcbdbd159ff1ea1a305095348d94a3de3 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 14:42:24 +0000 Subject: [PATCH 102/313] Regenerate nslcd config before creating admin in ldap --- src/yunohost/tools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 5571f7c03..75f7223d3 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -295,7 +295,7 @@ def tools_postinstall(domain, password, ignore_dyndns=False): logger.info(m18n.n('yunohost_installing')) - service_regen_conf(['nslcd', 'nsswitch'], force=True) + service_regen_conf(['nslcd'], force=True) # Initialize LDAP for YunoHost # TODO: Improve this part by integrate ldapinit into conf_regen hook From 59c8c0d100c9f6b044b2faea7040133328707945 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 14:51:54 +0000 Subject: [PATCH 103/313] We also need to regen nsswitch before ldapinit otherwise sudo doesnt work --- src/yunohost/tools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 75f7223d3..5571f7c03 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -295,7 +295,7 @@ def tools_postinstall(domain, password, ignore_dyndns=False): logger.info(m18n.n('yunohost_installing')) - service_regen_conf(['nslcd'], force=True) + service_regen_conf(['nslcd', 'nsswitch'], force=True) # Initialize LDAP for YunoHost # TODO: Improve this part by integrate ldapinit into conf_regen hook From 078dbaf2d36bedeb430f88756dccc68b2aeb7f4d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 23:50:33 +0000 Subject: [PATCH 104/313] Fully execute the regen conf as root --- src/yunohost/service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 1852259ad..4a4574d65 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -322,7 +322,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, def _pre_call(name, priority, path, args): # create the pending conf directory for the service service_pending_path = os.path.join(PENDING_CONF_DIR, name) - filesystem.mkdir(service_pending_path, 0755, True, uid='admin') + filesystem.mkdir(service_pending_path, 0755, True, uid='root') # return the arguments to pass to the script return pre_args + [service_pending_path, ] pre_result = hook_callback('conf_regen', names, pre_callback=_pre_call) From bde8b02fef54d0d8a9c622b2132cb0b6f981674e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 7 Jul 2017 23:56:02 +0000 Subject: [PATCH 105/313] Removing some rmilter-related conf --- data/hooks/conf_regen/28-rmilter | 80 ---------------------------- data/templates/rmilter/rmilter.conf | 28 ---------- data/templates/yunohost/services.yml | 4 +- 3 files changed, 1 insertion(+), 111 deletions(-) delete mode 100755 data/hooks/conf_regen/28-rmilter delete mode 100644 data/templates/rmilter/rmilter.conf diff --git a/data/hooks/conf_regen/28-rmilter b/data/hooks/conf_regen/28-rmilter deleted file mode 100755 index f505b6d99..000000000 --- a/data/hooks/conf_regen/28-rmilter +++ /dev/null @@ -1,80 +0,0 @@ -#!/bin/bash - -set -e - -do_pre_regen() { - pending_dir=$1 - - cd /usr/share/yunohost/templates/rmilter - - # Install main configuration - install -D -m 644 rmilter.conf \ - "${pending_dir}/etc/rmilter.conf" - - # Install DKIM specific configuration - install -D -m 644 ynh_dkim.conf \ - "${pending_dir}/etc/rmilter.conf.d/ynh_dkim.conf" - - # Remove old socket file (we stopped using it, since rspamd 1.3.1) - # Regen-conf system need an empty file to delete it - install -D -m 644 /dev/null \ - "${pending_dir}/etc/systemd/system/rmilter.socket" -} - -do_post_regen() { - regen_conf_files=$1 - - # retrieve variables - domain_list=$(sudo yunohost domain list --output-as plain --quiet) - - # create DKIM directory with proper permission - sudo mkdir -p /etc/dkim - sudo chown _rmilter /etc/dkim - - # create DKIM key for domains - for domain in $domain_list; do - domain_key="/etc/dkim/${domain}.mail.key" - [ ! -f $domain_key ] && { - sudo opendkim-genkey --domain="$domain" \ - --selector=mail --directory=/etc/dkim - sudo mv /etc/dkim/mail.private "$domain_key" - sudo mv /etc/dkim/mail.txt "/etc/dkim/${domain}.mail.txt" - } - done - - # fix DKIM keys permissions - sudo chown _rmilter /etc/dkim/*.mail.key - sudo chmod 400 /etc/dkim/*.mail.key - - # fix rmilter socket permission (postfix is chrooted in /var/spool/postfix ) - sudo mkdir -p /var/spool/postfix/run/rmilter - sudo chown -R postfix:_rmilter /var/spool/postfix/run/rmilter - sudo chmod g+w /var/spool/postfix/run/rmilter - - [ -z "$regen_conf_files" ] && exit 0 - - # reload systemd daemon - sudo systemctl -q daemon-reload - - # Restart rmilter due to the rspamd update - # https://rspamd.com/announce/2016/08/01/rspamd-1.3.1.html - sudo systemctl -q restart rmilter.service -} - -FORCE=${2:-0} -DRY_RUN=${3:-0} - -case "$1" in - pre) - do_pre_regen $4 - ;; - post) - do_post_regen $4 - ;; - *) - echo "hook called with unknown argument \`$1'" >&2 - exit 1 - ;; -esac - -exit 0 diff --git a/data/templates/rmilter/rmilter.conf b/data/templates/rmilter/rmilter.conf deleted file mode 100644 index dcd13e9b7..000000000 --- a/data/templates/rmilter/rmilter.conf +++ /dev/null @@ -1,28 +0,0 @@ -# systemd-specific settings for rmilter - -# DKIM signing -# Defined before including /etc/rmilter.conf.common because rmilter seems to be -# unable to override dkim{} settings, even if it's already defined in -# /etc/rmilter.conf.d/ynh_dkim.conf -dkim { - enable = true; - domain { - key = /etc/dkim; - domain = "*"; - selector = "mail"; - }; - header_canon = relaxed; - body_canon = relaxed; - sign_alg = sha256; -}; - -.include /etc/rmilter.conf.common - -# pidfile - path to pid file -pidfile = /run/rmilter/rmilter.pid; - -bind_socket = unix:/var/spool/postfix/run/rmilter/rmilter.sock; - -# include user's configuration -.try_include /etc/rmilter.conf.local -.try_include /etc/rmilter.conf.d/*.conf diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index fb8c076f9..e3900f87e 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -16,9 +16,6 @@ dovecot: postfix: status: service log: [/var/log/mail.log,/var/log/mail.err] -rmilter: - status: systemctl status rmilter.service - log: /var/log/mail.log rspamd: status: systemctl status rspamd.service log: /var/log/mail.log @@ -60,3 +57,4 @@ udisk-glue: null amavis: null postgrey: null spamassassin: null +rmilter: null From f221c2f06c96c95cb0bd1e425b76e5227b5c254f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 8 Jul 2017 00:09:32 +0000 Subject: [PATCH 106/313] Fail2ban was unhappy because port was present two times --- data/templates/fail2ban/jail.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/fail2ban/jail.conf b/data/templates/fail2ban/jail.conf index 648d44fa8..4047306a7 100644 --- a/data/templates/fail2ban/jail.conf +++ b/data/templates/fail2ban/jail.conf @@ -152,7 +152,7 @@ filter = pam-generic # port actually must be irrelevant but lets leave it all for some possible uses port = all banaction = iptables-allports -port = anyport +#port = anyport logpath = /var/log/auth.log maxretry = 6 From 0373da4a467a62b76f1b50e24d97db6f31c97fca Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 8 Jul 2017 00:44:00 +0000 Subject: [PATCH 107/313] Hiding useless message (?) --- src/yunohost/tools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 5571f7c03..bcca5b0e9 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -104,7 +104,7 @@ def tools_ldapinit(): auth.update('cn=admin', admin_dict) # Force nscd to refresh cache to take admin creation into account - subprocess.call(['nscd', '-i', 'passwd']) + subprocess.call(['nscd', '-i', 'passwd'], stderr=open(os.devnull, 'wb')) # Check admin actually exists now try: @@ -203,7 +203,7 @@ def _set_hostname(hostname, pretty_hostname=None): pretty_hostname = "(YunoHost/%s)" % hostname # First clear nsswitch cache for hosts to make sure hostname is resolved... - subprocess.call(['nscd', '-i', 'hosts']) + subprocess.call(['nscd', '-i', 'hosts'], stderr=open(os.devnull, 'wb')) # Then call hostnamectl commands = [ From 1839fa44d0fc5ff796689131bd9f2dd78e30f227 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 8 Jul 2017 11:05:08 +0000 Subject: [PATCH 108/313] Also remove useless nscd warning in user.py --- src/yunohost/user.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/yunohost/user.py b/src/yunohost/user.py index bed5fb8c8..740258256 100644 --- a/src/yunohost/user.py +++ b/src/yunohost/user.py @@ -194,7 +194,7 @@ def user_create(auth, username, firstname, lastname, mail, password, if auth.add('uid=%s,ou=users' % username, attr_dict): # Invalidate passwd to take user creation into account - subprocess.call(['nscd', '-i', 'passwd']) + subprocess.call(['nscd', '-i', 'passwd'], stderr=open(os.devnull, 'wb')) # Update SFTP user group memberlist = auth.search(filter='cn=sftpusers', attrs=['memberUid'])[0]['memberUid'] @@ -233,7 +233,7 @@ def user_delete(auth, username, purge=False): if auth.remove('uid=%s,ou=users' % username): # Invalidate passwd to take user deletion into account - subprocess.call(['nscd', '-i', 'passwd']) + subprocess.call(['nscd', '-i', 'passwd'], stderr=open(os.devnull, 'wb')) # Update SFTP user group memberlist = auth.search(filter='cn=sftpusers', attrs=['memberUid'])[0]['memberUid'] From b2648584ab2feebfa7f950cc619f370156ab2c4e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 8 Jul 2017 16:02:16 +0000 Subject: [PATCH 109/313] Updating fail2ban conf --- data/hooks/conf_regen/52-fail2ban | 2 + data/templates/fail2ban/jail.conf | 957 +++++++++++++------- data/templates/fail2ban/yunohost-jails.conf | 32 + 3 files changed, 647 insertions(+), 344 deletions(-) create mode 100644 data/templates/fail2ban/yunohost-jails.conf diff --git a/data/hooks/conf_regen/52-fail2ban b/data/hooks/conf_regen/52-fail2ban index 1c262078b..950f27b5b 100755 --- a/data/hooks/conf_regen/52-fail2ban +++ b/data/hooks/conf_regen/52-fail2ban @@ -9,9 +9,11 @@ do_pre_regen() { fail2ban_dir="${pending_dir}/etc/fail2ban" mkdir -p "${fail2ban_dir}/filter.d" + mkdir -p "${fail2ban_dir}/jail.d" cp yunohost.conf "${fail2ban_dir}/filter.d/yunohost.conf" cp jail.conf "${fail2ban_dir}/jail.conf" + cp yunohost-jails.conf "${fail2ban_dir}/jail.d/" } do_post_regen() { diff --git a/data/templates/fail2ban/jail.conf b/data/templates/fail2ban/jail.conf index 4047306a7..d80e3d0af 100644 --- a/data/templates/fail2ban/jail.conf +++ b/data/templates/fail2ban/jail.conf @@ -1,23 +1,52 @@ -# Fail2Ban configuration file. # -# This file was composed for Debian systems from the original one -# provided now under /usr/share/doc/fail2ban/examples/jail.conf -# for additional examples. +# WARNING: heavily refactored in 0.9.0 release. Please review and +# customize settings for your setup. # -# Comments: use '#' for comment lines and ';' for inline comments +# Changes: in most of the cases you should not modify this +# file, but provide customizations in jail.local file, +# or separate .conf files under jail.d/ directory, e.g.: # -# To avoid merges during upgrades DO NOT MODIFY THIS FILE -# and rather provide your changes in /etc/fail2ban/jail.local +# HOW TO ACTIVATE JAILS: # +# YOU SHOULD NOT MODIFY THIS FILE. +# +# It will probably be overwritten or improved in a distribution update. +# +# Provide customizations in a jail.local file or a jail.d/customisation.local. +# For example to change the default bantime for all jails and to enable the +# ssh-iptables jail the following (uncommented) would appear in the .local file. +# See man 5 jail.conf for details. +# +# [DEFAULT] +# bantime = 3600 +# +# [sshd] +# enabled = true +# +# See jail.conf(5) man page for more information + + + +# Comments: use '#' for comment lines and ';' (following a space) for inline comments + + +[INCLUDES] + +#before = paths-distro.conf +before = paths-debian.conf # The DEFAULT allows a global definition of the options. They can be overridden # in each jail afterwards. [DEFAULT] +# +# MISCELLANEOUS OPTIONS +# + # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be -# defined using space separator. +# defined using space (and/or comma) separator. ignoreip = 127.0.0.1/8 # External command that will take an tagged arguments to ignore, e.g. , @@ -31,57 +60,81 @@ bantime = 600 # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. -findtime = 600 -maxretry = 3 +findtime = 600 + +# "maxretry" is the number of failures before a host get banned. +maxretry = 5 # "backend" specifies the backend used to get files modification. -# Available options are "pyinotify", "gamin", "polling" and "auto". +# Available options are "pyinotify", "gamin", "polling", "systemd" and "auto". # This option can be overridden in each jail as well. # # pyinotify: requires pyinotify (a file alteration monitor) to be installed. -# If pyinotify is not installed, Fail2ban will use auto. +# If pyinotify is not installed, Fail2ban will use auto. # gamin: requires Gamin (a file alteration monitor) to be installed. -# If Gamin is not installed, Fail2ban will use auto. +# If Gamin is not installed, Fail2ban will use auto. # polling: uses a polling algorithm which does not require external libraries. +# systemd: uses systemd python library to access the systemd journal. +# Specifying "logpath" is not valid for this backend. +# See "journalmatch" in the jails associated filter config # auto: will try to use the following backends, in order: -# pyinotify, gamin, polling. +# pyinotify, gamin, polling. +# +# Note: if systemd backend is chosen as the default but you enable a jail +# for which logs are present only in its own log files, specify some other +# backend for that jail (e.g. polling) and provide empty value for +# journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200 backend = auto # "usedns" specifies if jails should trust hostnames in logs, -# warn when reverse DNS lookups are performed, or ignore all hostnames in logs +# warn when DNS lookups are performed, or ignore all hostnames in logs # -# yes: if a hostname is encountered, a reverse DNS lookup will be performed. -# warn: if a hostname is encountered, a reverse DNS lookup will be performed, +# yes: if a hostname is encountered, a DNS lookup will be performed. +# warn: if a hostname is encountered, a DNS lookup will be performed, # but it will be logged as a warning. # no: if a hostname is encountered, will not be used for banning, # but it will be logged as info. +# raw: use raw value (no hostname), allow use it for no-host filters/actions (example user) usedns = warn +# "logencoding" specifies the encoding of the log files handled by the jail +# This is used to decode the lines from the log file. +# Typical examples: "ascii", "utf-8" # -# Destination email address used solely for the interpolations in -# jail.{conf,local} configuration files. -destemail = root@localhost +# auto: will use the system locale setting +logencoding = auto +# "enabled" enables the jails. +# By default all jails are disabled, and it should stay this way. +# Enable only relevant to your setup jails in your .local or jail.d/*.conf # -# Name of the sender for mta actions -sendername = Fail2Ban +# true: jail will be enabled and log files will get monitored for changes +# false: jail is not enabled +enabled = false + + +# "filter" defines the filter to use by the jail. +# By default jails have names matching their filter name +# +filter = %(__name__)s -# Email address of the sender -sender = fail2ban@localhost # # ACTIONS # -# Default banning action (e.g. iptables, iptables-new, -# iptables-multiport, shorewall, etc) It is used to define -# action_* variables. Can be overridden globally or per -# section within jail.local file -banaction = iptables-multiport +# Some options used for actions -# email action. Since 0.8.1 upstream fail2ban uses sendmail -# MTA for the mailing. Change mta configuration parameter to mail -# if you want to revert to conventional 'mail'. +# Destination email address used solely for the interpolations in +# jail.{conf,local,d/*} configuration files. +destemail = root@localhost + +# Sender email address used solely for some actions +sender = root@localhost + +# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the +# mailing. Change mta configuration parameter to mail if you want to +# revert to conventional 'mail'. mta = sendmail # Default protocol @@ -90,303 +143,461 @@ protocol = tcp # Specify chain where jumps would need to be added in iptables-* actions chain = INPUT +# Ports to be banned +# Usually should be overridden in a particular jail +port = 0:65535 + +# Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3 +fail2ban_agent = Fail2Ban/%(fail2ban_version)s + # # Action shortcuts. To be used to define action parameter +# Default banning action (e.g. iptables, iptables-new, +# iptables-multiport, shorewall, etc) It is used to define +# action_* variables. Can be overridden globally or per +# section within jail.local file +banaction = iptables-multiport +banaction_allports = iptables-allports + # The simplest action to take: ban only -action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] +action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report to the destemail. -action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] - %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"] +action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report and relevant log lines # to the destemail. -action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] - %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"] +action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] + +# See the IMPORTANT note in action.d/xarf-login-attack for when to use this action +# +# ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines +# to the destemail. +action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"] + +# ban IP on CloudFlare & send an e-mail with whois report and relevant log lines +# to the destemail. +action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"] + %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] + +# Report block via blocklist.de fail2ban reporting service API +# +# See the IMPORTANT note in action.d/blocklist_de.conf for when to +# use this action. Create a file jail.d/blocklist_de.local containing +# [Init] +# blocklist_de_apikey = {api key from registration] +# +action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"] + +# Report ban via badips.com, and use as blacklist +# +# See BadIPsAction docstring in config/action.d/badips.py for +# documentation for this action. +# +# NOTE: This action relies on banaction being present on start and therefore +# should be last action defined for a jail. +# +action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"] +# +# Report ban via badips.com (uses action.d/badips.conf for reporting only) +# +action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"] # Choose default action. To change, just override value of 'action' with the # interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local # globally (section [DEFAULT]) or per specific section action = %(action_)s + # # JAILS # -# Next jails corresponds to the standard configuration in Fail2ban 0.6 which -# was shipped in Debian. Enable any defined here jail by including # -# [SECTION_NAME] -# enabled = true - +# SSH servers # -# in /etc/fail2ban/jail.local. -# -# Optionally you may override any other parameter (e.g. banaction, -# action, port, logpath, etc) in that section within jail.local -[ssh] +[sshd] + +port = ssh +logpath = %(sshd_log)s +backend = %(sshd_backend)s + + +[sshd-ddos] +# This jail corresponds to the standard configuration in Fail2ban. +# The mail-whois action send a notification e-mail with a whois request +# in the body. +port = ssh +logpath = %(sshd_log)s +backend = %(sshd_backend)s -enabled = true -port = ssh -filter = sshd -logpath = /var/log/auth.log -maxretry = 6 [dropbear] -enabled = false port = ssh -filter = dropbear -logpath = /var/log/auth.log -maxretry = 6 - -# Generic filter for pam. Has to be used with action which bans all ports -# such as iptables-allports, shorewall -[pam-generic] - -enabled = true -# pam-generic filter can be customized to monitor specific subset of 'tty's -filter = pam-generic -# port actually must be irrelevant but lets leave it all for some possible uses -port = all -banaction = iptables-allports -#port = anyport -logpath = /var/log/auth.log -maxretry = 6 - -[xinetd-fail] - -enabled = false -filter = xinetd-fail -port = all -banaction = iptables-multiport-log -logpath = /var/log/daemon.log -maxretry = 2 +logpath = %(dropbear_log)s +backend = %(dropbear_backend)s -[ssh-ddos] +[selinux-ssh] -enabled = false port = ssh -filter = sshd-ddos -logpath = /var/log/auth.log -maxretry = 6 - - -# Here we use blackhole routes for not requiring any additional kernel support -# to store large volumes of banned IPs - -[ssh-route] - -enabled = false -filter = sshd -action = route -logpath = /var/log/sshd.log -maxretry = 6 - -# Here we use a combination of Netfilter/Iptables and IPsets -# for storing large volumes of banned IPs -# -# IPset comes in two versions. See ipset -V for which one to use -# requires the ipset package and kernel support. -[ssh-iptables-ipset4] - -enabled = false -port = ssh -filter = sshd -banaction = iptables-ipset-proto4 -logpath = /var/log/sshd.log -maxretry = 6 - -[ssh-iptables-ipset6] - -enabled = false -port = ssh -filter = sshd -banaction = iptables-ipset-proto6 -logpath = /var/log/sshd.log -maxretry = 6 +logpath = %(auditd_log)s # # HTTP servers # -[apache] +[apache-auth] -enabled = false port = http,https -filter = apache-auth -logpath = /var/log/apache*/*error.log -maxretry = 6 +logpath = %(apache_error_log)s -# default action is now multiport, so apache-multiport jail was left -# for compatibility with previous (<0.7.6-2) releases -[apache-multiport] -enabled = false -port = http,https -filter = apache-auth -logpath = /var/log/apache*/*error.log -maxretry = 6 +[apache-badbots] +# Ban hosts which agent identifies spammer robots crawling the web +# for email addresses. The mail outputs are buffered. +port = http,https +logpath = %(apache_access_log)s +bantime = 172800 +maxretry = 1 + [apache-noscript] -enabled = false port = http,https -filter = apache-noscript -logpath = /var/log/apache*/*error.log -maxretry = 6 +logpath = %(apache_error_log)s + [apache-overflows] -enabled = false port = http,https -filter = apache-overflows -logpath = /var/log/apache*/*error.log +logpath = %(apache_error_log)s maxretry = 2 -[apache-modsecurity] - -enabled = false -filter = apache-modsecurity -port = http,https -logpath = /var/log/apache*/*error.log -maxretry = 2 [apache-nohome] -enabled = false -filter = apache-nohome port = http,https -logpath = /var/log/apache*/*error.log +logpath = %(apache_error_log)s maxretry = 2 + +[apache-botsearch] + +port = http,https +logpath = %(apache_error_log)s +maxretry = 2 + + +[apache-fakegooglebot] + +port = http,https +logpath = %(apache_access_log)s +maxretry = 1 +ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot + + +[apache-modsecurity] + +port = http,https +logpath = %(apache_error_log)s +maxretry = 2 + + +[apache-shellshock] + +port = http,https +logpath = %(apache_error_log)s +maxretry = 1 + + +[openhab-auth] + +filter = openhab +action = iptables-allports[name=NoAuthFailures] +logpath = /opt/openhab/logs/request.log + + +[nginx-http-auth] + +port = http,https +logpath = %(nginx_error_log)s + +# To use 'nginx-limit-req' jail you should have `ngx_http_limit_req_module` +# and define `limit_req` and `limit_req_zone` as described in nginx documentation +# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html +# or for example see in 'config/filter.d/nginx-limit-req.conf' +[nginx-limit-req] +port = http,https +logpath = %(nginx_error_log)s + +[nginx-botsearch] + +port = http,https +logpath = %(nginx_error_log)s +maxretry = 2 + + # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year # of usage in production environments. [php-url-fopen] -enabled = false port = http,https -filter = php-url-fopen -logpath = /var/www/*/logs/access_log +logpath = %(nginx_access_log)s + %(apache_access_log)s -# A simple PHP-fastcgi jail which works with lighttpd. -# If you run a lighttpd server, then you probably will -# find these kinds of messages in your error_log: -# ALERT – tried to register forbidden variable ‘GLOBALS’ -# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php') -[lighttpd-fastcgi] +[suhosin] -enabled = false port = http,https -filter = lighttpd-fastcgi -logpath = /var/log/lighttpd/error.log +logpath = %(suhosin_log)s -# Same as above for mod_auth -# It catches wrong authentifications [lighttpd-auth] - -enabled = false +# Same as above for Apache's mod_auth +# It catches wrong authentifications port = http,https -filter = suhosin -logpath = /var/log/lighttpd/error.log +logpath = %(lighttpd_error_log)s -[nginx-http-auth] -enabled = false -filter = nginx-http-auth -port = http,https -logpath = /var/log/nginx/error.log - -# Monitor roundcube server +# +# Webmail and groupware servers +# [roundcube-auth] -enabled = false -filter = roundcube-auth port = http,https -logpath = /var/log/roundcube/userlogins +logpath = %(roundcube_errors_log)s + + +[openwebmail] + +port = http,https +logpath = /var/log/openwebmail.log + + +[horde] + +port = http,https +logpath = /var/log/horde/horde.log + + +[groupoffice] + +port = http,https +logpath = /home/groupoffice/log/info.log [sogo-auth] - -enabled = false -filter = sogo-auth -port = http, https +# Monitor SOGo groupware server # without proxy this would be: # port = 20000 +port = http,https logpath = /var/log/sogo/sogo.log +[tine20] + +logpath = /var/log/tine20/tine20.log +port = http,https + + +# +# Web Applications +# +# + +[drupal-auth] + +port = http,https +logpath = %(syslog_daemon)s +backend = %(syslog_backend)s + +[guacamole] + +port = http,https +logpath = /var/log/tomcat*/catalina.out + +[monit] +#Ban clients brute-forcing the monit gui login +port = 2812 +logpath = /var/log/monit + + +[webmin-auth] + +port = 10000 +logpath = %(syslog_authpriv)s +backend = %(syslog_backend)s + + +[froxlor-auth] + +port = http,https +logpath = %(syslog_authpriv)s +backend = %(syslog_backend)s + + +# +# HTTP Proxy servers +# +# + +[squid] + +port = 80,443,3128,8080 +logpath = /var/log/squid/access.log + + +[3proxy] + +port = 3128 +logpath = /var/log/3proxy.log + + # # FTP servers # -[vsftpd] - -enabled = false -port = ftp,ftp-data,ftps,ftps-data -filter = vsftpd -logpath = /var/log/vsftpd.log -# or overwrite it in jails.local to be -# logpath = /var/log/auth.log -# if you want to rely on PAM failed login attempts -# vsftpd's failregex should match both of those formats -maxretry = 6 - [proftpd] -enabled = false port = ftp,ftp-data,ftps,ftps-data -filter = proftpd -logpath = /var/log/proftpd/proftpd.log -maxretry = 6 +logpath = %(proftpd_log)s +backend = %(proftpd_backend)s [pure-ftpd] -enabled = false port = ftp,ftp-data,ftps,ftps-data -filter = pure-ftpd -logpath = /var/log/syslog -maxretry = 6 +logpath = %(pureftpd_log)s +backend = %(pureftpd_backend)s + + +[gssftpd] + +port = ftp,ftp-data,ftps,ftps-data +logpath = %(syslog_daemon)s +backend = %(syslog_backend)s [wuftpd] -enabled = false port = ftp,ftp-data,ftps,ftps-data -filter = wuftpd -logpath = /var/log/syslog -maxretry = 6 +logpath = %(wuftpd_log)s +backend = %(wuftpd_backend)s + + +[vsftpd] +# or overwrite it in jails.local to be +# logpath = %(syslog_authpriv)s +# if you want to rely on PAM failed login attempts +# vsftpd's failregex should match both of those formats +port = ftp,ftp-data,ftps,ftps-data +logpath = %(vsftpd_log)s # # Mail servers # +# ASSP SMTP Proxy Jail +[assp] + +port = smtp,465,submission +logpath = /root/path/to/assp/logs/maillog.txt + + +[courier-smtp] + +port = smtp,465,submission +logpath = %(syslog_mail)s +backend = %(syslog_backend)s + + [postfix] -enabled = true -port = smtp,ssmtp,submission -filter = postfix -logpath = /var/log/mail.log +port = smtp,465,submission +logpath = %(postfix_log)s +backend = %(postfix_backend)s -[couriersmtp] +[postfix-rbl] -enabled = false -port = smtp,ssmtp,submission -filter = couriersmtp -logpath = /var/log/mail.log +port = smtp,465,submission +logpath = %(postfix_log)s +backend = %(postfix_backend)s +maxretry = 1 + + +[sendmail-auth] + +port = submission,465,smtp +logpath = %(syslog_mail)s +backend = %(syslog_backend)s + + +[sendmail-reject] + +port = smtp,465,submission +logpath = %(syslog_mail)s +backend = %(syslog_backend)s + + +[qmail-rbl] + +filter = qmail +port = smtp,465,submission +logpath = /service/qmail/log/main/current + + +# dovecot defaults to logging to the mail syslog facility +# but can be set by syslog_facility in the dovecot configuration. +[dovecot] + +port = pop3,pop3s,imap,imaps,submission,465,sieve +logpath = %(dovecot_log)s +backend = %(dovecot_backend)s + + +[sieve] + +port = smtp,465,submission +logpath = %(dovecot_log)s +backend = %(dovecot_backend)s + + +[solid-pop3d] + +port = pop3,pop3s +logpath = %(solidpop3d_log)s + + +[exim] + +port = smtp,465,submission +logpath = %(exim_main_log)s + + +[exim-spam] + +port = smtp,465,submission +logpath = %(exim_main_log)s + + +[kerio] + +port = imap,smtp,imaps,465 +logpath = /opt/kerio/mailserver/store/logs/security.log # @@ -394,60 +605,55 @@ logpath = /var/log/mail.log # all relevant ports get banned # -[courierauth] +[courier-auth] -enabled = false -port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -filter = courierlogin -logpath = /var/log/mail.log +port = smtp,465,submission,imap3,imaps,pop3,pop3s +logpath = %(syslog_mail)s +backend = %(syslog_backend)s -[sasl] +[postfix-sasl] -enabled = true -port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -filter = postfix-sasl +port = smtp,465,submission,imap3,imaps,pop3,pop3s # You might consider monitoring /var/log/mail.warn instead if you are # running postfix since it would provide the same log lines at the # "warn" level but overall at the smaller filesize. -logpath = /var/log/mail.log - -[dovecot] - -enabled = true -port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -filter = dovecot -logpath = /var/log/mail.log - -# To log wrong MySQL access attempts add to /etc/my.cnf: -# log-error=/var/log/mysqld.log -# log-warning = 2 -[mysqld-auth] - -enabled = false -filter = mysqld-auth -port = 3306 -logpath = /var/log/mysqld.log +logpath = %(postfix_log)s +backend = %(postfix_backend)s -# DNS Servers +[perdition] + +port = imap3,imaps,pop3,pop3s +logpath = %(syslog_mail)s +backend = %(syslog_backend)s + + +[squirrelmail] + +port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks +logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log + + +[cyrus-imap] + +port = imap3,imaps +logpath = %(syslog_mail)s +backend = %(syslog_backend)s + + +[uwimap-auth] + +port = imap3,imaps +logpath = %(syslog_mail)s +backend = %(syslog_backend)s -# These jails block attacks against named (bind9). By default, logging is off -# with bind9 installation. You will need something like this: # -# logging { -# channel security_file { -# file "/var/log/named/security.log" versions 3 size 30m; -# severity dynamic; -# print-time yes; -# }; -# category security { -# security_file; -# }; -# }; # -# in your named.conf to provide proper logging +# DNS servers +# + # !!! WARNING !!! # Since UDP is connection-less protocol, spoofing of IP and imitation @@ -456,131 +662,194 @@ logpath = /var/log/mysqld.log # victim. See # http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html # Please DO NOT USE this jail unless you know what you are doing. -#[named-refused-udp] # -#enabled = false -#port = domain,953 -#protocol = udp -#filter = named-refused -#logpath = /var/log/named/security.log +# IMPORTANT: see filter.d/named-refused for instructions to enable logging +# This jail blocks UDP traffic for DNS requests. +# [named-refused-udp] +# +# filter = named-refused +# port = domain,953 +# protocol = udp +# logpath = /var/log/named/security.log -[named-refused-tcp] +# IMPORTANT: see filter.d/named-refused for instructions to enable logging +# This jail blocks TCP traffic for DNS requests. + +[named-refused] -enabled = false port = domain,953 -protocol = tcp -filter = named-refused logpath = /var/log/named/security.log + +[nsd] + +port = 53 +action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] + %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] +logpath = /var/log/nsd.log + + +# +# Miscellaneous +# + +[asterisk] + +port = 5060,5061 +action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] + %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] + %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] +logpath = /var/log/asterisk/messages +maxretry = 10 + + [freeswitch] -enabled = false -filter = freeswitch +port = 5060,5061 +action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] + %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] + %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] logpath = /var/log/freeswitch.log maxretry = 10 -action = iptables-multiport[name=freeswitch-tcp, port="5060,5061,5080,5081", protocol=tcp] - iptables-multiport[name=freeswitch-udp, port="5060,5061,5080,5081", protocol=udp] - -[ejabberd-auth] - -enabled = false -filter = ejabberd-auth -port = xmpp-client -protocol = tcp -logpath = /var/log/ejabberd/ejabberd.log -# Multiple jails, 1 per protocol, are necessary ATM: -# see https://github.com/fail2ban/fail2ban/issues/37 -[asterisk-tcp] +# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or +# equivalent section: +# log-warning = 2 +# +# for syslog (daemon facility) +# [mysqld_safe] +# syslog +# +# for own logfile +# [mysqld] +# log-error=/var/log/mysqld.log +[mysqld-auth] -enabled = false -filter = asterisk -port = 5060,5061 -protocol = tcp -logpath = /var/log/asterisk/messages +port = 3306 +logpath = %(mysql_log)s +backend = %(mysql_backend)s -[asterisk-udp] -enabled = false -filter = asterisk -port = 5060,5061 -protocol = udp -logpath = /var/log/asterisk/messages +# Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf') +[mongodb-auth] +# change port when running with "--shardsvr" or "--configsvr" runtime operation +port = 27017 +logpath = /var/log/mongodb/mongodb.log # Jail for more extended banning of persistent abusers -# !!! WARNING !!! -# Make sure that your loglevel specified in fail2ban.conf/.local -# is not at DEBUG level -- which might then cause fail2ban to fall into -# an infinite loop constantly feeding itself with non-informative lines +# !!! WARNINGS !!! +# 1. Make sure that your loglevel specified in fail2ban.conf/.local +# is not at DEBUG level -- which might then cause fail2ban to fall into +# an infinite loop constantly feeding itself with non-informative lines +# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days) +# to maintain entries for failed logins for sufficient amount of time [recidive] -enabled = false -filter = recidive logpath = /var/log/fail2ban.log -action = iptables-allports[name=recidive] - sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] +banaction = %(banaction_allports)s bantime = 604800 ; 1 week findtime = 86400 ; 1 day -maxretry = 5 -# See the IMPORTANT note in action.d/blocklist_de.conf for when to -# use this action -# -# Report block via blocklist.de fail2ban reporting service API -# See action.d/blocklist_de.conf for more information -[ssh-blocklist] -enabled = false -filter = sshd -action = iptables[name=SSH, port=ssh, protocol=tcp] - sendmail-whois[name=SSH, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"] - blocklist_de[email="%(sender)s", apikey="xxxxxx", service="%(filter)s"] -logpath = /var/log/sshd.log -maxretry = 20 +# Generic filter for PAM. Has to be used with action which bans all +# ports such as iptables-allports, shorewall +[pam-generic] +# pam-generic filter can be customized to monitor specific subset of 'tty's +banaction = %(banaction_allports)s +logpath = %(syslog_authpriv)s +backend = %(syslog_backend)s + + +[xinetd-fail] + +banaction = iptables-multiport-log +logpath = %(syslog_daemon)s +backend = %(syslog_backend)s +maxretry = 2 + + +# stunnel - need to set port for this +[stunnel] + +logpath = /var/log/stunnel4/stunnel.log + + +[ejabberd-auth] + +port = 5222 +logpath = /var/log/ejabberd/ejabberd.log + + +[counter-strike] + +logpath = /opt/cstrike/logs/L[0-9]*.log +# Firewall: http://www.cstrike-planet.com/faq/6 +tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039 +udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015 +action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] + %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] # consider low maxretry and a long bantime # nobody except your own Nagios server should ever probe nrpe [nagios] -enabled = false -filter = nagios -action = iptables[name=Nagios, port=5666, protocol=tcp] - sendmail-whois[name=Nagios, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"] -logpath = /var/log/messages ; nrpe.cfg may define a different log_facility + +logpath = %(syslog_daemon)s ; nrpe.cfg may define a different log_facility +backend = %(syslog_backend)s maxretry = 1 -[nginx] -enabled = true -port = http,https -filter = apache-auth -logpath = /var/log/nginx*/*error.log -maxretry = 6 +[oracleims] +# see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above +logpath = /opt/sun/comms/messaging64/log/mail.log_current +banaction = %(banaction_allports)s -[nginx-noscript] +[directadmin] +logpath = /var/log/directadmin/login.log +port = 2222 -enabled = false -port = http,https -filter = apache-noscript -logpath = /var/log/nginx*/*error.log -maxretry = 6 +[portsentry] +logpath = /var/lib/portsentry/portsentry.history +maxretry = 1 -[nginx-overflows] +[pass2allow-ftp] +# this pass2allow example allows FTP traffic after successful HTTP authentication +port = ftp,ftp-data,ftps,ftps-data +# knocking_url variable must be overridden to some secret value in jail.local +knocking_url = /knocking/ +filter = apache-pass[knocking_url="%(knocking_url)s"] +# access log of the website with HTTP auth +logpath = %(apache_access_log)s +blocktype = RETURN +returntype = DROP +bantime = 3600 +maxretry = 1 +findtime = 1 -enabled = false -port = http,https -filter = apache-overflows -logpath = /var/log/nginx*/*error.log -maxretry = 4 -[yunohost] +[murmur] +# AKA mumble-server +port = 64738 +action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol=tcp, chain="%(chain)s", actname=%(banaction)s-tcp] + %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol=udp, chain="%(chain)s", actname=%(banaction)s-udp] +logpath = /var/log/mumble-server/mumble-server.log -enabled = true -port = http,https -protocol = tcp -filter = yunohost -logpath = /var/log/nginx/*error.log - /var/log/nginx/*access.log -maxretry = 6 + +[screensharingd] +# For Mac OS Screen Sharing Service (VNC) +logpath = /var/log/system.log +logencoding = utf-8 + +[haproxy-http-auth] +# HAProxy by default doesn't log to file you'll need to set it up to forward +# logs to a syslog server which would then write them to disk. +# See "haproxy-http-auth" filter for a brief cautionary note when setting +# maxretry and findtime. +logpath = /var/log/haproxy.log + +[slapd] +port = ldap,ldaps +filter = slapd +logpath = /var/log/slapd.log diff --git a/data/templates/fail2ban/yunohost-jails.conf b/data/templates/fail2ban/yunohost-jails.conf new file mode 100644 index 000000000..e0d7fd7c2 --- /dev/null +++ b/data/templates/fail2ban/yunohost-jails.conf @@ -0,0 +1,32 @@ +[sshd] +enabled = true + +[sshd-ddos] +enabled = true + +[nginx-http-auth] +enabled = true + +[postfix] +enabled = true + +[dovecot] +enabled = true + +[postfix-sasl] +enable = true + +[recidive] +enable = true + +[pam-generic] +enabled = true + +[yunohost] +enabled = true +port = http,https +protocol = tcp +filter = yunohost +logpath = /var/log/nginx/*error.log + /var/log/nginx/*access.log +maxretry = 6 From c763aae4538f5966985681d3c3fdaa4d5ede4762 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jul 2017 17:50:23 +0000 Subject: [PATCH 110/313] Removing 'hostname -d' output from stdout during postinstall --- src/yunohost/tools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index bcca5b0e9..1ac123a9d 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -320,7 +320,7 @@ def tools_postinstall(domain, password, ignore_dyndns=False): os.system('chmod 755 /home/yunohost.app') # Set hostname to avoid amavis bug - if os.system('hostname -d') != 0: + if os.system('hostname -d >/dev/null') != 0: os.system('hostname yunohost.yunohost.org') # Add a temporary SSOwat rule to redirect SSO to admin page From efc201c9b06c80ed9f270cae1b137acf9a59ad95 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jul 2017 17:51:18 +0000 Subject: [PATCH 111/313] Remove messy openssl output during package install --- data/hooks/conf_regen/02-ssl | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/data/hooks/conf_regen/02-ssl b/data/hooks/conf_regen/02-ssl index 9f45f1554..555ef3cf8 100755 --- a/data/hooks/conf_regen/02-ssl +++ b/data/hooks/conf_regen/02-ssl @@ -10,6 +10,14 @@ do_init_regen() { exit 1 fi + LOGFILE="/tmp/yunohost-ssl-init" + + echo "Initializing a local SSL certification authority ..." + echo "(logs available in $LOGFILE)" + + rm -f $LOGFILE + touch $LOGFILE + # create certs and SSL directories mkdir -p "/etc/yunohost/certs/yunohost.org" mkdir -p "${ssl_dir}/"{ca,certs,crl,newcerts} @@ -24,9 +32,10 @@ do_init_regen() { # create default certificates if [[ ! -f /etc/yunohost/certs/yunohost.org/ca.pem ]]; then + echo -e "\n# Creating the CA key (?)\n" >>$LOGFILE openssl req -x509 -new -config "$openssl_conf" \ -days 3650 -out "${ssl_dir}/ca/cacert.pem" \ - -keyout "${ssl_dir}/ca/cakey.pem" -nodes -batch 2>&1 + -keyout "${ssl_dir}/ca/cakey.pem" -nodes -batch >>$LOGFILE 2>&1 cp "${ssl_dir}/ca/cacert.pem" \ /etc/yunohost/certs/yunohost.org/ca.pem ln -sf /etc/yunohost/certs/yunohost.org/ca.pem \ @@ -35,12 +44,13 @@ do_init_regen() { fi if [[ ! -f /etc/yunohost/certs/yunohost.org/crt.pem ]]; then + echo -e "\n# Creating initial key and certificate (?)\n" >>$LOGFILE openssl req -new -config "$openssl_conf" \ -days 730 -out "${ssl_dir}/certs/yunohost_csr.pem" \ - -keyout "${ssl_dir}/certs/yunohost_key.pem" -nodes -batch 2>&1 + -keyout "${ssl_dir}/certs/yunohost_key.pem" -nodes -batch >>$LOGFILE 2>&1 openssl ca -config "$openssl_conf" \ -days 730 -in "${ssl_dir}/certs/yunohost_csr.pem" \ - -out "${ssl_dir}/certs/yunohost_crt.pem" -batch 2>&1 + -out "${ssl_dir}/certs/yunohost_crt.pem" -batch >>$LOGFILE 2>&1 last_cert=$(ls $ssl_dir/newcerts/*.pem | sort -V | tail -n 1) chmod 640 "${ssl_dir}/certs/yunohost_key.pem" From f25a487c1965ee93596fa4ed27387734ced0359b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jul 2017 18:15:52 +0000 Subject: [PATCH 112/313] nscd service is now unscd --- data/hooks/conf_regen/46-nsswitch | 2 +- debian/control | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/hooks/conf_regen/46-nsswitch b/data/hooks/conf_regen/46-nsswitch index db3a2199a..06a596e44 100755 --- a/data/hooks/conf_regen/46-nsswitch +++ b/data/hooks/conf_regen/46-nsswitch @@ -14,7 +14,7 @@ do_post_regen() { regen_conf_files=$1 [[ -z "$regen_conf_files" ]] \ - || sudo service nscd restart + || sudo service unscd restart } FORCE=${2:-0} diff --git a/debian/control b/debian/control index 46c95fb8b..6d8848e86 100644 --- a/debian/control +++ b/debian/control @@ -17,7 +17,7 @@ Depends: ${python:Depends}, ${misc:Depends} , dnsutils, bind9utils, unzip, git, curl, cron, wget , ca-certificates, netcat-openbsd, iproute , mariadb-server | mysql-server, php-mysql | php-mysqlnd - , slapd, ldap-utils, sudo-ldap, libnss-ldapd, nscd + , slapd, ldap-utils, sudo-ldap, libnss-ldapd, unscd , postfix-ldap, postfix-policyd-spf-perl, postfix-pcre, procmail, mailutils , dovecot-ldap, dovecot-lmtpd, dovecot-managesieved , dovecot-antispam, fail2ban From 4595dd2be4998e54af2d8fba9ed2999e3076b38b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jul 2017 21:26:31 +0000 Subject: [PATCH 113/313] Updating master.cf for postfix to avoid a few warnings --- data/templates/postfix/plain/master.cf | 90 ++++++++++++++------------ 1 file changed, 50 insertions(+), 40 deletions(-) diff --git a/data/templates/postfix/plain/master.cf b/data/templates/postfix/plain/master.cf index ed6d87bd3..98652f097 100644 --- a/data/templates/postfix/plain/master.cf +++ b/data/templates/postfix/plain/master.cf @@ -1,53 +1,67 @@ # # Postfix master process configuration file. For details on the format -# of the file, see the master(5) manual page (command: "man 5 master"). +# of the file, see the master(5) manual page (command: "man 5 master" or +# on-line: http://www.postfix.org/master.5.html). # # Do not forget to execute "postfix reload" after editing this file. # # ========================================================================== # service type private unpriv chroot wakeup maxproc command + args -# (yes) (yes) (yes) (never) (100) +# (yes) (yes) (no) (never) (100) # ========================================================================== -smtp inet n - - - - smtpd -submission inet n - - - - smtpd - -o smtpd_tls_security_level=encrypt - -o smtpd_sasl_auth_enable=yes - -o smtpd_client_restrictions=permit_sasl_authenticated,reject +smtp inet n - y - - smtpd +#smtp inet n - y - 1 postscreen +#smtpd pass - - y - - smtpd +#dnsblog unix - - y - 0 dnsblog +#tlsproxy unix - - y - 0 tlsproxy +#submission inet n - y - - smtpd +# -o syslog_name=postfix/submission +# -o smtpd_tls_security_level=encrypt +# -o smtpd_sasl_auth_enable=yes +# -o smtpd_reject_unlisted_recipient=no +# -o smtpd_client_restrictions=$mua_client_restrictions +# -o smtpd_helo_restrictions=$mua_helo_restrictions +# -o smtpd_sender_restrictions=$mua_sender_restrictions +# -o smtpd_recipient_restrictions= +# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject # -o milter_macro_daemon_name=ORIGINATING -smtps inet n - - - - smtpd - -o header_checks=pcre:/etc/postfix/header_checks - -o smtpd_tls_wrappermode=yes - -o smtpd_sasl_auth_enable=yes -# -o smtpd_client_restrictions=permit_sasl_authenticated,reject +#smtps inet n - y - - smtpd +# -o syslog_name=postfix/smtps +# -o smtpd_tls_wrappermode=yes +# -o smtpd_sasl_auth_enable=yes +# -o smtpd_reject_unlisted_recipient=no +# -o smtpd_client_restrictions=$mua_client_restrictions +# -o smtpd_helo_restrictions=$mua_helo_restrictions +# -o smtpd_sender_restrictions=$mua_sender_restrictions +# -o smtpd_recipient_restrictions= +# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject # -o milter_macro_daemon_name=ORIGINATING -#628 inet n - - - - qmqpd -pickup fifo n - - 60 1 pickup -cleanup unix n - - - 0 cleanup -qmgr fifo n - n 300 1 qmgr -#qmgr fifo n - - 300 1 oqmgr -tlsmgr unix - - - 1000? 1 tlsmgr -rewrite unix - - - - - trivial-rewrite -bounce unix - - - - 0 bounce -defer unix - - - - 0 bounce -trace unix - - - - 0 bounce -verify unix - - - - 1 verify -flush unix n - - 1000? 0 flush +#628 inet n - y - - qmqpd +pickup unix n - y 60 1 pickup +cleanup unix n - y - 0 cleanup +qmgr unix n - n 300 1 qmgr +#qmgr unix n - n 300 1 oqmgr +tlsmgr unix - - y 1000? 1 tlsmgr +rewrite unix - - y - - trivial-rewrite +bounce unix - - y - 0 bounce +defer unix - - y - 0 bounce +trace unix - - y - 0 bounce +verify unix - - y - 1 verify +flush unix n - y 1000? 0 flush proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap -smtp unix - - - - - smtp -# When relaying mail as backup MX, disable fallback_relay to avoid MX loops -relay unix - - - - - smtp - -o smtp_fallback_relay= +smtp unix - - y - - smtp +relay unix - - y - - smtp # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 -showq unix n - - - - showq -error unix - - - - - error -retry unix - - - - - error -discard unix - - - - - discard +showq unix n - y - - showq +error unix - - y - - error +retry unix - - y - - error +discard unix - - y - - discard local unix - n n - - local virtual unix - n n - - virtual -lmtp unix - - - - - lmtp -anvil unix - - - - 1 anvil -scache unix - - - - 1 scache +lmtp unix - - y - - lmtp +anvil unix - - y - 1 anvil +scache unix - - y - 1 scache # # ==================================================================== # Interfaces to non-Postfix software. Be sure to examine the manual @@ -111,8 +125,4 @@ mailman unix - n n - - pipe # Dovecot LDA dovecot unix - n n - - pipe flags=DRhu user=vmail:mail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -m ${extension} -# ========================================================================== -# service type private unpriv chroot wakeup maxproc command + args -# (yes) (yes) (yes) (never) (100) -# ========================================================================== -# Added using postfix-add-filter script: + From e85421721a8358135e56077192b7273b89cca0e0 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jul 2017 21:27:09 +0000 Subject: [PATCH 114/313] Now using rspamd as milter in postfix --- data/templates/postfix/main.cf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/postfix/main.cf b/data/templates/postfix/main.cf index bdd364250..04726962d 100644 --- a/data/templates/postfix/main.cf +++ b/data/templates/postfix/main.cf @@ -143,7 +143,7 @@ smtp_reply_filter = pcre:/etc/postfix/smtp_reply_filter # Rmilter milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen} milter_protocol = 6 -smtpd_milters = unix:/run/rmilter/rmilter.sock +smtpd_milters = inet:localhost:11332 # Skip email without checking if milter has died milter_default_action = accept From 29e48965bb14194fd4e209587178f890cc6c070b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 11 Jul 2017 21:28:46 +0000 Subject: [PATCH 115/313] Rspamd now have a dedicated log file apparently --- data/templates/yunohost/services.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index e3900f87e..0544c7e5e 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -18,7 +18,7 @@ postfix: log: [/var/log/mail.log,/var/log/mail.err] rspamd: status: systemctl status rspamd.service - log: /var/log/mail.log + log: /var/log/rspamd/rspamd.log redis-server: status: service log: /var/log/redis/redis-server.log From 291c8747f1460462ff84c608fd25a5fc68016eab Mon Sep 17 00:00:00 2001 From: root Date: Sun, 27 Aug 2017 11:48:51 +0000 Subject: [PATCH 116/313] Adding DKIM key generation back from rmilter to rspamd --- data/hooks/conf_regen/31-rspamd | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/data/hooks/conf_regen/31-rspamd b/data/hooks/conf_regen/31-rspamd index afdfc1bf1..1aa38562d 100755 --- a/data/hooks/conf_regen/31-rspamd +++ b/data/hooks/conf_regen/31-rspamd @@ -18,6 +18,28 @@ do_post_regen() { [ -z "$regen_conf_files" ] && exit 0 + # retrieve variables + domain_list=$(sudo yunohost domain list --output-as plain --quiet) + + # create DKIM directory with proper permission + sudo mkdir -p /etc/dkim + sudo chown _rspamd /etc/dkim + + # create DKIM key for domains + for domain in "$domain_list"; do + domain_key="/etc/dkim/${domain}.mail.key" + [ ! -f $domain_key ] && { + sudo opendkim-genkey --domain="$domain" \ + --selector=mail --directory=/etc/dkim + sudo mv /etc/dkim/mail.private "$domain_key" + sudo mv /etc/dkim/mail.txt "/etc/dkim/${domain}.mail.txt" + } + done + + # fix DKIM keys permissions + sudo chown _rspamd /etc/dkim/*.mail.key + sudo chmod 400 /etc/dkim/*.mail.key + # compile sieve script [[ "$regen_conf_files" =~ rspamd\.sieve ]] && { sudo sievec /etc/dovecot/global_script/rspamd.sieve From a05d7b1e20ce459530b94122024378d76aa2c640 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 27 Aug 2017 14:25:15 +0200 Subject: [PATCH 117/313] Fixes in DKIM generation in rspamd regen-conf --- data/hooks/conf_regen/31-rspamd | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/data/hooks/conf_regen/31-rspamd b/data/hooks/conf_regen/31-rspamd index 1aa38562d..57bac110c 100755 --- a/data/hooks/conf_regen/31-rspamd +++ b/data/hooks/conf_regen/31-rspamd @@ -14,21 +14,22 @@ do_pre_regen() { } do_post_regen() { - regen_conf_files=$1 - [ -z "$regen_conf_files" ] && exit 0 - - # retrieve variables - domain_list=$(sudo yunohost domain list --output-as plain --quiet) + ## + ## DKIM key generation + ## # create DKIM directory with proper permission sudo mkdir -p /etc/dkim sudo chown _rspamd /etc/dkim + # retrieve domain list + domain_list=$(sudo yunohost domain list --output-as plain --quiet) + # create DKIM key for domains - for domain in "$domain_list"; do + for domain in $domain_list; do domain_key="/etc/dkim/${domain}.mail.key" - [ ! -f $domain_key ] && { + [ ! -f "$domain_key" ] && { sudo opendkim-genkey --domain="$domain" \ --selector=mail --directory=/etc/dkim sudo mv /etc/dkim/mail.private "$domain_key" @@ -40,6 +41,9 @@ do_post_regen() { sudo chown _rspamd /etc/dkim/*.mail.key sudo chmod 400 /etc/dkim/*.mail.key + regen_conf_files=$1 + [ -z "$regen_conf_files" ] && exit 0 + # compile sieve script [[ "$regen_conf_files" =~ rspamd\.sieve ]] && { sudo sievec /etc/dovecot/global_script/rspamd.sieve From 862f8e96978126eb02d1591f2196cd172284ddff Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 27 Aug 2017 17:29:56 +0200 Subject: [PATCH 118/313] Handle new DKIM record format --- src/yunohost/domain.py | 60 +++++++++++++++++++++++++++++++++++------- 1 file changed, 50 insertions(+), 10 deletions(-) diff --git a/src/yunohost/domain.py b/src/yunohost/domain.py index 354df2887..206cd6090 100644 --- a/src/yunohost/domain.py +++ b/src/yunohost/domain.py @@ -384,17 +384,57 @@ def _get_DKIM(domain): with open(DKIM_file) as f: dkim_content = f.read() - dkim = re.match(( - r'^(?P[a-z_\-\.]+)[\s]+([0-9]+[\s]+)?IN[\s]+TXT[\s]+[^"]*' - '(?=.*(;[\s]*|")v=(?P[^";]+))' - '(?=.*(;[\s]*|")k=(?P[^";]+))' - '(?=.*(;[\s]*|")p=(?P

[^";]+))'), dkim_content, re.M | re.S - ) + # Gotta manage two formats : + # + # Legacy + # ----- + # + # mail._domainkey IN TXT ( "v=DKIM1; k=rsa; " + # "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCYhnvJ+JgF9tfVbUVy6L20b2IVHygZD1GjY6k+/je+3y3C9BzPAlEitL4s2vkQpPfAevw8P6uE7s1usCa/tnTzmq4r6Q/9YRf+Wx5e79XuIY5/ZKJw1YKkDWRlGzpenu8i+6kssaPqPmtmQaYuoOwTlcpXcN9qKNIodDsaWOxBwIDAQAB" ) + # + # New + # ------ + # mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; " + # "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxWIw/R6QIL7nbJr+yX4cS8TfFx1POMvnzbsDWAFG5U4aPqLwCkJNqrum1hG9rzCb43pGkNy5JNAh0tTZpxq+S1kBAu+DAOSHgbYVg2Tr6zTm9YNL1n/thjKB9U/dyaCzWnxlMFJYkXNlDICtSSf47ZWqcrurkAOfmtmGYQivoz8ipXMvou4t22W9DbZR+XpPbtc3RkCKK32E8O" + # "02OT9PHbsBCOakb+W1vkocVZpZo78eu5Q2phOntE9Vl2MXtd54+TEdWv6zPcGrHrF9aazEuGcNQwSUgJaHlEceT2u8X+sliwIr0on3Om2NMaTDkPgZzg2poQIDPkyxDQire7jGBwIDAQAB" + # ) + + is_legacy_format = " h=sha256; " not in dkim_content + + # Legacy DKIM format + if is_legacy_format: + dkim = re.match(( + r'^(?P[a-z_\-\.]+)[\s]+([0-9]+[\s]+)?IN[\s]+TXT[\s]+' + '[^"]*"v=(?P[^";]+);' + '[\s"]*k=(?P[^";]+);' + '[\s"]*p=(?P

[^";]+)'), dkim_content, re.M | re.S + ) + else: + dkim = re.match(( + r'^(?P[a-z_\-\.]+)[\s]+([0-9]+[\s]+)?IN[\s]+TXT[\s]+' + '[^"]*"v=(?P[^";]+);' + '[\s"]*h=(?P[^";]+);' + '[\s"]*k=(?P[^";]+);' + '[\s"]*p=(?P

[^";]+)' + '[\s"]*(?P[^";]+)'), dkim_content, re.M | re.S + ) if not dkim: return (None, None) - return ( - dkim.group('host'), - '"v={v}; k={k}; p={p}"'.format(v=dkim.group('v'), k=dkim.group('k'), p=dkim.group('p')) - ) + if is_legacy_format: + return ( + dkim.group('host'), + '"v={v}; k={k}; p={p}"'.format(v=dkim.group('v'), + k=dkim.group('k'), + p=dkim.group('p')) + ) + else: + return ( + dkim.group('host'), + '"v={v}; h={h}; k={k}; p={p}"'.format(v=dkim.group('v'), + h=dkim.group('h'), + k=dkim.group('k'), + p=dkim.group('p') + +dkim.group('p2')) + ) From 34451babe3463628848e89b53bb2c6dcc53af591 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 27 Aug 2017 19:16:25 +0200 Subject: [PATCH 119/313] Fall back to 1024 for the DKIM key size because nsupdate is stupid --- data/hooks/conf_regen/31-rspamd | 4 +++- src/yunohost/domain.py | 13 +++++-------- src/yunohost/dyndns.py | 1 + 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/data/hooks/conf_regen/31-rspamd b/data/hooks/conf_regen/31-rspamd index 57bac110c..2a065e735 100755 --- a/data/hooks/conf_regen/31-rspamd +++ b/data/hooks/conf_regen/31-rspamd @@ -30,8 +30,10 @@ do_post_regen() { for domain in $domain_list; do domain_key="/etc/dkim/${domain}.mail.key" [ ! -f "$domain_key" ] && { + # We use a 1024 bit size because nsupdate doesn't seem to be able to + # handle 2048... sudo opendkim-genkey --domain="$domain" \ - --selector=mail --directory=/etc/dkim + --selector=mail --directory=/etc/dkim -b 1024 sudo mv /etc/dkim/mail.private "$domain_key" sudo mv /etc/dkim/mail.txt "/etc/dkim/${domain}.mail.txt" } diff --git a/src/yunohost/domain.py b/src/yunohost/domain.py index 206cd6090..5196d107a 100644 --- a/src/yunohost/domain.py +++ b/src/yunohost/domain.py @@ -390,14 +390,13 @@ def _get_DKIM(domain): # ----- # # mail._domainkey IN TXT ( "v=DKIM1; k=rsa; " - # "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCYhnvJ+JgF9tfVbUVy6L20b2IVHygZD1GjY6k+/je+3y3C9BzPAlEitL4s2vkQpPfAevw8P6uE7s1usCa/tnTzmq4r6Q/9YRf+Wx5e79XuIY5/ZKJw1YKkDWRlGzpenu8i+6kssaPqPmtmQaYuoOwTlcpXcN9qKNIodDsaWOxBwIDAQAB" ) + # "p=" ) # # New # ------ + # # mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; " - # "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxWIw/R6QIL7nbJr+yX4cS8TfFx1POMvnzbsDWAFG5U4aPqLwCkJNqrum1hG9rzCb43pGkNy5JNAh0tTZpxq+S1kBAu+DAOSHgbYVg2Tr6zTm9YNL1n/thjKB9U/dyaCzWnxlMFJYkXNlDICtSSf47ZWqcrurkAOfmtmGYQivoz8ipXMvou4t22W9DbZR+XpPbtc3RkCKK32E8O" - # "02OT9PHbsBCOakb+W1vkocVZpZo78eu5Q2phOntE9Vl2MXtd54+TEdWv6zPcGrHrF9aazEuGcNQwSUgJaHlEceT2u8X+sliwIr0on3Om2NMaTDkPgZzg2poQIDPkyxDQire7jGBwIDAQAB" - # ) + # "p=" ) is_legacy_format = " h=sha256; " not in dkim_content @@ -415,8 +414,7 @@ def _get_DKIM(domain): '[^"]*"v=(?P[^";]+);' '[\s"]*h=(?P[^";]+);' '[\s"]*k=(?P[^";]+);' - '[\s"]*p=(?P

[^";]+)' - '[\s"]*(?P[^";]+)'), dkim_content, re.M | re.S + '[\s"]*p=(?P

[^";]+)'), dkim_content, re.M | re.S ) if not dkim: @@ -435,6 +433,5 @@ def _get_DKIM(domain): '"v={v}; h={h}; k={k}; p={p}"'.format(v=dkim.group('v'), h=dkim.group('h'), k=dkim.group('k'), - p=dkim.group('p') - +dkim.group('p2')) + p=dkim.group('p')) ) diff --git a/src/yunohost/dyndns.py b/src/yunohost/dyndns.py index f564479fe..aaf86decd 100644 --- a/src/yunohost/dyndns.py +++ b/src/yunohost/dyndns.py @@ -273,6 +273,7 @@ def dyndns_update(dyn_host="dyndns.yunohost.org", domain=None, key=None, # should be muc.the.domain.tld. or the.domain.tld if record["value"] == "@": record["value"] = domain + record["value"] = record["value"].replace(";","\;") action = "update add {name}.{domain}. {ttl} {type} {value}".format(domain=domain, **record) action = action.replace(" @.", " ") From 3f64374f9d3566522bdf1936e11366fbe107684d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 27 Aug 2017 22:37:04 +0000 Subject: [PATCH 120/313] Move DKIM from rmilter to rspamd --- data/hooks/conf_regen/31-rspamd | 2 ++ data/templates/rmilter/ynh_dkim.conf | 14 -------------- data/templates/rspamd/dkim_signing.conf | 16 ++++++++++++++++ 3 files changed, 18 insertions(+), 14 deletions(-) delete mode 100644 data/templates/rmilter/ynh_dkim.conf create mode 100644 data/templates/rspamd/dkim_signing.conf diff --git a/data/hooks/conf_regen/31-rspamd b/data/hooks/conf_regen/31-rspamd index 2a065e735..d263d9cc9 100755 --- a/data/hooks/conf_regen/31-rspamd +++ b/data/hooks/conf_regen/31-rspamd @@ -9,6 +9,8 @@ do_pre_regen() { install -D -m 644 metrics.local.conf \ "${pending_dir}/etc/rspamd/local.d/metrics.conf" + install -D -m 644 dkim_signing.conf \ + "${pending_dir}/etc/rspamd/local.d/dkim_signing.conf" install -D -m 644 rspamd.sieve \ "${pending_dir}/etc/dovecot/global_script/rspamd.sieve" } diff --git a/data/templates/rmilter/ynh_dkim.conf b/data/templates/rmilter/ynh_dkim.conf deleted file mode 100644 index 1e5598d06..000000000 --- a/data/templates/rmilter/ynh_dkim.conf +++ /dev/null @@ -1,14 +0,0 @@ -# DKIM signing -# Note that DKIM signing should be done by rspamd in the near future -# See https://github.com/vstakhov/rmilter/issues/174 -dkim { - enable = true; - domain { - key = /etc/dkim; - domain = "*"; - selector = "mail"; - }; - header_canon = relaxed; - body_canon = relaxed; - sign_alg = sha256; -}; diff --git a/data/templates/rspamd/dkim_signing.conf b/data/templates/rspamd/dkim_signing.conf new file mode 100644 index 000000000..26718e021 --- /dev/null +++ b/data/templates/rspamd/dkim_signing.conf @@ -0,0 +1,16 @@ +allow_envfrom_empty = true; +allow_hdrfrom_mismatch = false; +allow_hdrfrom_multiple = false; +allow_username_mismatch = true; + +auth_only = true; +path = "/etc/dkim/$domain.$selector.key"; +selector = "mail"; +sign_local = true; +symbol = "DKIM_SIGNED"; +try_fallback = true; +use_domain = "header"; +use_esld = false; +use_redis = false; +key_prefix = "DKIM_KEYS"; + From 7d36869fe0607cac17e12b5bc046414e4392ba87 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 28 Aug 2017 03:12:51 +0200 Subject: [PATCH 121/313] Updating acme-tiny to 7ef9164, include fixes for OpenSSL 1.1 --- src/yunohost/vendor/acme_tiny/acme_tiny.py | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) diff --git a/src/yunohost/vendor/acme_tiny/acme_tiny.py b/src/yunohost/vendor/acme_tiny/acme_tiny.py index 6fd8558d5..fa1ee4dc5 100644 --- a/src/yunohost/vendor/acme_tiny/acme_tiny.py +++ b/src/yunohost/vendor/acme_tiny/acme_tiny.py @@ -1,21 +1,9 @@ #!/usr/bin/env python -import argparse -import subprocess -import json -import os -import sys -import base64 -import binascii -import time -import hashlib -import re -import copy -import textwrap -import logging +import argparse, subprocess, json, os, sys, base64, binascii, time, hashlib, re, copy, textwrap, logging try: - from urllib.request import urlopen # Python 3 + from urllib.request import urlopen # Python 3 except ImportError: - from urllib2 import urlopen # Python 2 + from urllib2 import urlopen # Python 2 #DEFAULT_CA = "https://acme-staging.api.letsencrypt.org" DEFAULT_CA = "https://acme-v01.api.letsencrypt.org" @@ -24,7 +12,6 @@ LOGGER = logging.getLogger(__name__) LOGGER.addHandler(logging.StreamHandler()) LOGGER.setLevel(logging.INFO) - def get_crt(account_key, csr, acme_dir, log=LOGGER, CA=DEFAULT_CA): # helper function base64 encode for jose spec def _b64(b): @@ -178,7 +165,6 @@ def get_crt(account_key, csr, acme_dir, log=LOGGER, CA=DEFAULT_CA): return """-----BEGIN CERTIFICATE-----\n{0}\n-----END CERTIFICATE-----\n""".format( "\n".join(textwrap.wrap(base64.b64encode(result).decode('utf8'), 64))) - def main(argv): parser = argparse.ArgumentParser( formatter_class=argparse.RawDescriptionHelpFormatter, @@ -208,5 +194,5 @@ def main(argv): signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca) sys.stdout.write(signed_crt) -if __name__ == "__main__": # pragma: no cover +if __name__ == "__main__": # pragma: no cover main(sys.argv[1:]) From 10546333101c2092898ec5a443ff446078892418 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 28 Aug 2017 20:12:33 +0200 Subject: [PATCH 122/313] Add dirty trick to be able to install php5 apps --- src/yunohost/app.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index a4ab8db7b..d6ce3747c 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -743,6 +743,9 @@ def app_install(auth, app, label=None, args=None, no_remove_on_failure=False): app_settings['install_time'] = status['installed_at'] _set_app_settings(app_instance_name, app_settings) + # Apply dirty patch to make php5 apps compatible with php7 + _patch_php5(extracted_app_folder) + os.system('chown -R admin: ' + extracted_app_folder) # Execute App install script @@ -2181,3 +2184,14 @@ def unstable_apps(): return output + +def _patch_php5(app_folder): + + files_to_patch = [] + files_to_patch.extend(glob.glob("%s/conf/*" % app_folder)) + files_to_patch.extend(glob.glob("%s/scripts/*" % app_folder)) + files_to_patch.append("%s/manifest.json" % app_folder) + + for filename in files_to_patch: + c = "sed -i -e 's@/etc/php5@/etc/php/7.0@g' -e 's@php5@php7.0@g' %s" % filename + os.system(c) From 25cef3604939c06e4a8b6933c73f065da5d36950 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 4 Nov 2017 22:58:17 +0100 Subject: [PATCH 123/313] Set version in changelog as 3.0.0 so that 3.0.0~timestamp will be higher than 2.7.2 --- debian/changelog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/debian/changelog b/debian/changelog index 6c671fee5..2cc315c47 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,7 @@ +yunohost (3.0.0) testing; urgency=low + + (to be removed) Dummy version to work around version comparison issues + yunohost (2.7.11.1) testing; urgency=low * [fix] Nginx Regression typo (#459) From 10c83f85c50c0fbbe6e554119c985dc8505c112d Mon Sep 17 00:00:00 2001 From: taziden Date: Mon, 2 Oct 2017 13:44:41 +0200 Subject: [PATCH 124/313] Create milter_headers.conf This file define a header : X-Spam which will be added to mail considered as spam by rspamd. This configuration is defined here : https://rspamd.com/doc/modules/milter_headers.html and as of the time I'm creating this PR, this documentation page is not up-to-date because X-Spam was supposed to be added when extended_spam_headers is set to True and it's not the case anymore since 1.6.2. This header is being used by rspamd.sieve which we push into dovecot in order to put spammy e-mails in Junk folder automatically. --- data/templates/rspamd/milter_headers.conf | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 data/templates/rspamd/milter_headers.conf diff --git a/data/templates/rspamd/milter_headers.conf b/data/templates/rspamd/milter_headers.conf new file mode 100644 index 000000000..d57aa6958 --- /dev/null +++ b/data/templates/rspamd/milter_headers.conf @@ -0,0 +1,9 @@ +use = ["spam-header"]; + +routines { + spam-header { + header = "X-Spam"; + value = "Yes"; + remove = 1; + } +} From 1eb5c6131aedcb96bc2d87d7a38d460669767c85 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 26 Dec 2017 17:40:49 +0100 Subject: [PATCH 125/313] Apply the php5 path also for upgrades --- src/yunohost/app.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index d6ce3747c..f953c982c 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -613,6 +613,9 @@ def app_upgrade(auth, app=[], url=None, file=None): env_dict["YNH_APP_INSTANCE_NAME"] = app_instance_name env_dict["YNH_APP_INSTANCE_NUMBER"] = str(app_instance_nb) + # Apply dirty patch to make php5 apps compatible with php7 + _patch_php5(extracted_app_folder) + # Execute App upgrade script os.system('chown -hR admin: %s' % INSTALL_TMP) if hook_exec(extracted_app_folder + '/scripts/upgrade', args=args_list, env=env_dict, user="root") != 0: From 7cf64bb1c7d3cc8bdf20b447a7f2df5563dd899f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 16 Jan 2018 18:08:14 +0100 Subject: [PATCH 126/313] Also apply the php5/php7 patch for 'hidden' files (e.g. .functions) --- src/yunohost/app.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index f953c982c..39da58180 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -2193,6 +2193,7 @@ def _patch_php5(app_folder): files_to_patch = [] files_to_patch.extend(glob.glob("%s/conf/*" % app_folder)) files_to_patch.extend(glob.glob("%s/scripts/*" % app_folder)) + files_to_patch.extend(glob.glob("%s/scripts/.*" % app_folder)) files_to_patch.append("%s/manifest.json" % app_folder) for filename in files_to_patch: From fb01deb990812309615cf13c9063fdd9ac2604b4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 16 Jan 2018 19:08:19 +0100 Subject: [PATCH 127/313] Don't try to patch folders --- src/yunohost/app.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 39da58180..f07e34783 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -2197,5 +2197,10 @@ def _patch_php5(app_folder): files_to_patch.append("%s/manifest.json" % app_folder) for filename in files_to_patch: + + # Ignore non-regular files + if not os.path.isfile(filename): + continue + c = "sed -i -e 's@/etc/php5@/etc/php/7.0@g' -e 's@php5@php7.0@g' %s" % filename os.system(c) From 16166917cbe36b8b62c49652dd91b01342845d8f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 17 Jan 2018 18:51:58 +0100 Subject: [PATCH 128/313] Also patch the php socket path --- src/yunohost/app.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index f07e34783..8b9f699d4 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -2202,5 +2202,8 @@ def _patch_php5(app_folder): if not os.path.isfile(filename): continue - c = "sed -i -e 's@/etc/php5@/etc/php/7.0@g' -e 's@php5@php7.0@g' %s" % filename + c = "sed -i -e 's@/etc/php5@/etc/php/7.0@g' " \ + "-e 's@/var/run/php5-fpm@/var/run/php/php7.0-fpm@g' " \ + "-e 's@php5@php7.0@g' " \ + "%s" % filename os.system(c) From 30ad9a95476ae78d05592a1597bb64d7b769f8a1 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 17 Jan 2018 23:03:00 +0100 Subject: [PATCH 129/313] Nscd version fixed at deb repo level, so this isn't needed anymore --- src/yunohost/tools.py | 4 ++-- src/yunohost/user.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 1ac123a9d..99ae5e636 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -104,7 +104,7 @@ def tools_ldapinit(): auth.update('cn=admin', admin_dict) # Force nscd to refresh cache to take admin creation into account - subprocess.call(['nscd', '-i', 'passwd'], stderr=open(os.devnull, 'wb')) + subprocess.call(['nscd', '-i', 'passwd']) # Check admin actually exists now try: @@ -203,7 +203,7 @@ def _set_hostname(hostname, pretty_hostname=None): pretty_hostname = "(YunoHost/%s)" % hostname # First clear nsswitch cache for hosts to make sure hostname is resolved... - subprocess.call(['nscd', '-i', 'hosts'], stderr=open(os.devnull, 'wb')) + subprocess.call(['nscd', '-i', 'hosts']) # Then call hostnamectl commands = [ diff --git a/src/yunohost/user.py b/src/yunohost/user.py index 740258256..bed5fb8c8 100644 --- a/src/yunohost/user.py +++ b/src/yunohost/user.py @@ -194,7 +194,7 @@ def user_create(auth, username, firstname, lastname, mail, password, if auth.add('uid=%s,ou=users' % username, attr_dict): # Invalidate passwd to take user creation into account - subprocess.call(['nscd', '-i', 'passwd'], stderr=open(os.devnull, 'wb')) + subprocess.call(['nscd', '-i', 'passwd']) # Update SFTP user group memberlist = auth.search(filter='cn=sftpusers', attrs=['memberUid'])[0]['memberUid'] @@ -233,7 +233,7 @@ def user_delete(auth, username, purge=False): if auth.remove('uid=%s,ou=users' % username): # Invalidate passwd to take user deletion into account - subprocess.call(['nscd', '-i', 'passwd'], stderr=open(os.devnull, 'wb')) + subprocess.call(['nscd', '-i', 'passwd']) # Update SFTP user group memberlist = auth.search(filter='cn=sftpusers', attrs=['memberUid'])[0]['memberUid'] From 441eeb46800b77a5ecdfafb7348dbb7ade8bd2c2 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 26 Jan 2018 21:14:26 +0100 Subject: [PATCH 130/313] Update the php-fpm service --- data/templates/yunohost/services.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index 0544c7e5e..ada80b980 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -36,9 +36,9 @@ metronome: slapd: status: service log: /var/log/syslog -php5-fpm: +php-fpm: status: service - log: /var/log/php5-fpm.log + log: /var/log/php7.0-fpm.log yunohost-api: status: service log: /var/log/yunohost/yunohost-api.log @@ -58,3 +58,4 @@ amavis: null postgrey: null spamassassin: null rmilter: null +php5-fpm: null From 8fe57fbbc5764d3e13c3513afcdb2c49d04b117e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 26 Jan 2018 21:18:31 +0100 Subject: [PATCH 131/313] Add a migration for php5-fpm pools to php7 --- .../0003_php5_to_php7_pools.py | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 src/yunohost/data_migrations/0003_php5_to_php7_pools.py diff --git a/src/yunohost/data_migrations/0003_php5_to_php7_pools.py b/src/yunohost/data_migrations/0003_php5_to_php7_pools.py new file mode 100644 index 000000000..55c8ef08d --- /dev/null +++ b/src/yunohost/data_migrations/0003_php5_to_php7_pools.py @@ -0,0 +1,67 @@ +import os +import glob +from shutil import copy2 + +from moulinette.utils.log import getActionLogger + +from yunohost.tools import Migration +from yunohost.service import _run_service_command + +logger = getActionLogger('yunohost.migration') + +PHP5_POOLS = "/etc/php5/fpm/pool.d" +PHP7_POOLS = "/etc/php/7.0/fpm/pool.d" + +PHP5_SOCKETS_PREFIX = "/var/run/php5-fpm" +PHP7_SOCKETS_PREFIX = "/run/php/php7.0-fpm" + +MIGRATION_COMMENT = "; YunoHost note : this file was automatically moved from {}".format(PHP5_POOLS) + + +class MyMigration(Migration): + "Migrate php5-fpm 'pool' conf files to php7 stuff" + + def migrate(self): + + # Get list of php5 pool files + php5_pool_files = glob.glob("{}/*.conf".format(PHP5_POOLS)) + + # Keep only basenames + php5_pool_files = [os.path.basename(f) for f in php5_pool_files] + + # Ignore the "www.conf" (default stuff, probably don't want to touch it ?) + php5_pool_files = [f for f in php5_pool_files if f != "www.conf"] + + for f in php5_pool_files: + + # Copy the files to the php7 pool + src = "{}/{}".format(PHP5_POOLS, f) + dest = "{}/{}".format(PHP7_POOLS, f) + copy2(src, dest) + + # Replace the socket prefix if it's found + c = "sed -i -e 's@{}@{}@g' {}".format(PHP5_SOCKETS_PREFIX, PHP7_SOCKETS_PREFIX, dest) + os.system(c) + + # Also add a comment that it was automatically moved from php5 + # (for human traceability and backward migration) + c = "sed -i '1i {}' {}".format(MIGRATION_COMMENT, dest) + os.system(c) + + # Reload/restart the php pools + _run_service_command("restart", "php-fpm") + + def backward(self): + + # Get list of php7 pool files + php7_pool_files = glob.glob("{}/*.conf".format(PHP7_POOLS)) + + # Keep only files which have the migration comment + php7_pool_files = [f for f in php7_pool_files if open(f).readline().strip() == MIGRATION_COMMENT] + + # Delete those files + for f in php7_pool_files: + os.remove(f) + + # Reload/restart the php pools + _run_service_command("restart", "php-fpm") From 0877901d8811e7cc81ad3ca5d3765813109a55b4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 31 Jan 2018 15:39:12 +0100 Subject: [PATCH 132/313] Can't name this service php-fpm, gotta stick to php7.0-fpm... --- data/templates/yunohost/services.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index ada80b980..8d640dbbf 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -36,7 +36,7 @@ metronome: slapd: status: service log: /var/log/syslog -php-fpm: +php7.0-fpm: status: service log: /var/log/php7.0-fpm.log yunohost-api: From ab96c7948faff30de7acc67d6d855be139a36c91 Mon Sep 17 00:00:00 2001 From: Jean-Baptiste Date: Sat, 3 Feb 2018 23:54:02 +0100 Subject: [PATCH 133/313] typo enable/enabled --- data/templates/fail2ban/yunohost-jails.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/templates/fail2ban/yunohost-jails.conf b/data/templates/fail2ban/yunohost-jails.conf index e0d7fd7c2..bf3bcb6e3 100644 --- a/data/templates/fail2ban/yunohost-jails.conf +++ b/data/templates/fail2ban/yunohost-jails.conf @@ -14,10 +14,10 @@ enabled = true enabled = true [postfix-sasl] -enable = true +enabled = true [recidive] -enable = true +enabled = true [pam-generic] enabled = true From 4baa01143e47f88d1dbdfe8336818f8292ba008b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 9 Feb 2018 21:03:40 +0100 Subject: [PATCH 134/313] Move php5/7 migration as number 4 --- .../{0003_php5_to_php7_pools.py => 0004_php5_to_php7_pools.py} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename src/yunohost/data_migrations/{0003_php5_to_php7_pools.py => 0004_php5_to_php7_pools.py} (100%) diff --git a/src/yunohost/data_migrations/0003_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py similarity index 100% rename from src/yunohost/data_migrations/0003_php5_to_php7_pools.py rename to src/yunohost/data_migrations/0004_php5_to_php7_pools.py From d597f31e13ebbf31828645e2764d0013188d59af Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 10 Feb 2018 00:32:32 +0100 Subject: [PATCH 135/313] Forgot to fix the php service name in the migration... --- src/yunohost/data_migrations/0004_php5_to_php7_pools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py index 55c8ef08d..ad659b5cf 100644 --- a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py +++ b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py @@ -49,7 +49,7 @@ class MyMigration(Migration): os.system(c) # Reload/restart the php pools - _run_service_command("restart", "php-fpm") + _run_service_command("restart", "php7.0-fpm") def backward(self): From fbc18c56aa043fba75e864cae6e0d281ec8ed031 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 6 Mar 2018 00:35:19 +0100 Subject: [PATCH 136/313] Typo for php-fpm service --- src/yunohost/data_migrations/0004_php5_to_php7_pools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py index ad659b5cf..0ff9b77c8 100644 --- a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py +++ b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py @@ -64,4 +64,4 @@ class MyMigration(Migration): os.remove(f) # Reload/restart the php pools - _run_service_command("restart", "php-fpm") + _run_service_command("restart", "php7.0-fpm") From e0ac622ffcaf9fbbb9b5ee827d5c92334893f588 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 6 Mar 2018 13:54:16 +0100 Subject: [PATCH 137/313] Skip all migrations during postinstall --- src/yunohost/tools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 99ae5e636..ba90b0002 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -397,7 +397,7 @@ def tools_postinstall(domain, password, ignore_dyndns=False): _install_appslist_fetch_cron() # Init migrations (skip them, no need to run them on a fresh system) - tools_migrations_migrate(target=2, skip=True, auto=True) + tools_migrations_migrate(skip=True, auto=True) os.system('touch /etc/yunohost/installed') From 45bc155921d52ef980e38d161271e1c72217e106 Mon Sep 17 00:00:00 2001 From: kitoy Date: Tue, 19 Dec 2017 19:00:03 +0100 Subject: [PATCH 138/313] Bug connu sur bug.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=844271 --- data/templates/dovecot/dovecot.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/templates/dovecot/dovecot.conf b/data/templates/dovecot/dovecot.conf index 5ea10ea79..116bb2db7 100644 --- a/data/templates/dovecot/dovecot.conf +++ b/data/templates/dovecot/dovecot.conf @@ -16,7 +16,7 @@ mail_plugins = $mail_plugins quota ssl = yes ssl_cert = Date: Thu, 15 Mar 2018 01:06:50 +0100 Subject: [PATCH 139/313] Also patch nginx conf for the php5/7 migration --- .../0004_php5_to_php7_pools.py | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py index 0ff9b77c8..560b7a25c 100644 --- a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py +++ b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py @@ -51,6 +51,16 @@ class MyMigration(Migration): # Reload/restart the php pools _run_service_command("restart", "php7.0-fpm") + # Get list of nginx conf file + nginx_conf_files = glob.glob("/etc/nginx/conf.d/*.d/*.conf") + for f in nginx_conf_files: + # Replace the socket prefix if it's found + c = "sed -i -e 's@{}@{}@g' {}".format(PHP5_SOCKETS_PREFIX, PHP7_SOCKETS_PREFIX, f) + os.system(c) + + # Reload nginx + _run_service_command("reload", "nginx") + def backward(self): # Get list of php7 pool files @@ -65,3 +75,13 @@ class MyMigration(Migration): # Reload/restart the php pools _run_service_command("restart", "php7.0-fpm") + + # Get list of nginx conf file + nginx_conf_files = glob.glob("/etc/nginx/conf.d/*.d/*.conf") + for f in nginx_conf_files: + # Replace the socket prefix if it's found + c = "sed -i -e 's@{}@{}@g' {}".format(PHP7_SOCKETS_PREFIX, PHP5_SOCKETS_PREFIX, f) + os.system(c) + + # Reload nginx + _run_service_command("reload", "nginx") From 696ab8a98955f3c955c71f3f67e28e2e797acf84 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 16 Mar 2018 17:43:22 +0100 Subject: [PATCH 140/313] Stop dis php5 fpm old guy --- src/yunohost/data_migrations/0004_php5_to_php7_pools.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py index 560b7a25c..90023bcd4 100644 --- a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py +++ b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py @@ -50,6 +50,7 @@ class MyMigration(Migration): # Reload/restart the php pools _run_service_command("restart", "php7.0-fpm") + os.system("systemctl stop php5-fpm") # Get list of nginx conf file nginx_conf_files = glob.glob("/etc/nginx/conf.d/*.d/*.conf") @@ -74,7 +75,8 @@ class MyMigration(Migration): os.remove(f) # Reload/restart the php pools - _run_service_command("restart", "php7.0-fpm") + _run_service_command("stop", "php7.0-fpm") + os.system("systemctl start php5-fpm") # Get list of nginx conf file nginx_conf_files = glob.glob("/etc/nginx/conf.d/*.d/*.conf") From 1d7171543688497ba92d14ff4650ea869c53dfe7 Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Thu, 8 Mar 2018 18:53:21 +0100 Subject: [PATCH 141/313] [fix] Remove warning from equivs --- data/helpers.d/package | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/data/helpers.d/package b/data/helpers.d/package index a1d29651e..71771a568 100644 --- a/data/helpers.d/package +++ b/data/helpers.d/package @@ -101,6 +101,10 @@ ynh_package_install_from_equivs () { # Build and install the package local TMPDIR=$(mktemp -d) + + # Force the compatibility level at 10, levels below are deprecated + echo 10 > /usr/share/equivs/template/debian/compat + # Note that the cd executes into a sub shell # Create a fake deb package with equivs-build and the given control file # Install the fake package without its dependencies with dpkg From e36c7daa99238dfdaeb93f2ecd5d1b8b02682412 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 17 Apr 2018 18:57:01 +0200 Subject: [PATCH 142/313] Apply the dirty php5/php7 patch to scripts/conf when restoring an app --- src/yunohost/backup.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index 15c793802..f8176e79b 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -43,7 +43,7 @@ from moulinette.utils.log import getActionLogger from moulinette.utils.filesystem import read_file from yunohost.app import ( - app_info, _is_installed, _parse_app_instance_name + app_info, _is_installed, _parse_app_instance_name, _patch_php5 ) from yunohost.hook import ( hook_list, hook_info, hook_callback, hook_exec, CUSTOM_HOOK_FOLDER @@ -1199,6 +1199,9 @@ class RestoreManager(): app_settings_in_archive = os.path.join(app_dir_in_archive, 'settings') app_scripts_in_archive = os.path.join(app_settings_in_archive, 'scripts') + # Apply dirty patch to make php5 apps compatible with php7 + _patch_php5(app_settings_in_archive) + # Check if the app has a restore script app_restore_script_in_archive = os.path.join(app_scripts_in_archive, 'restore') From f846f5b7f8df5e64e2d32e7b18178437da70aeb1 Mon Sep 17 00:00:00 2001 From: kitoy Date: Tue, 19 Dec 2017 19:02:15 +0100 Subject: [PATCH 143/313] Ajout de connexion smtp over tls et STARTTLS --- data/templates/postfix/plain/master.cf | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/data/templates/postfix/plain/master.cf b/data/templates/postfix/plain/master.cf index 98652f097..cf6b4bcae 100644 --- a/data/templates/postfix/plain/master.cf +++ b/data/templates/postfix/plain/master.cf @@ -10,6 +10,16 @@ # (yes) (yes) (no) (never) (100) # ========================================================================== smtp inet n - y - - smtpd + +smtps inet n - y - - smtpd + -o header_checks=pcre:/etc/postfix/header_checks + -o smtpd_tls_wrappermode=yes + -o smtpd_sasl_auth_enable=yes + +submission inet n - y - - smtpd + -o smtpd_tls_security_level=encrypt + -o smtpd_sasl_auth_enable=yes + -o smtpd_client_restrictions=permit_sasl_authenticated,reject #smtp inet n - y - 1 postscreen #smtpd pass - - y - - smtpd #dnsblog unix - - y - 0 dnsblog @@ -122,7 +132,6 @@ mailman unix - n n - - pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user} -# Dovecot LDA -dovecot unix - n n - - pipe +# Dovecot LDA +dovecot unix - n n - - pipe flags=DRhu user=vmail:mail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -m ${extension} - From 6d158aae194c1621271d28f9d48873feb273e759 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 17 Apr 2018 16:25:37 +0200 Subject: [PATCH 144/313] master.cf : comment smtps and tweak submission --- data/templates/postfix/plain/master.cf | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/data/templates/postfix/plain/master.cf b/data/templates/postfix/plain/master.cf index cf6b4bcae..2d8712604 100644 --- a/data/templates/postfix/plain/master.cf +++ b/data/templates/postfix/plain/master.cf @@ -10,24 +10,14 @@ # (yes) (yes) (no) (never) (100) # ========================================================================== smtp inet n - y - - smtpd - -smtps inet n - y - - smtpd - -o header_checks=pcre:/etc/postfix/header_checks - -o smtpd_tls_wrappermode=yes - -o smtpd_sasl_auth_enable=yes - -submission inet n - y - - smtpd - -o smtpd_tls_security_level=encrypt - -o smtpd_sasl_auth_enable=yes - -o smtpd_client_restrictions=permit_sasl_authenticated,reject #smtp inet n - y - 1 postscreen #smtpd pass - - y - - smtpd #dnsblog unix - - y - 0 dnsblog #tlsproxy unix - - y - 0 tlsproxy -#submission inet n - y - - smtpd -# -o syslog_name=postfix/submission -# -o smtpd_tls_security_level=encrypt -# -o smtpd_sasl_auth_enable=yes +submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt + -o smtpd_sasl_auth_enable=yes # -o smtpd_reject_unlisted_recipient=no # -o smtpd_client_restrictions=$mua_client_restrictions # -o smtpd_helo_restrictions=$mua_helo_restrictions @@ -132,6 +122,6 @@ mailman unix - n n - - pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user} -# Dovecot LDA -dovecot unix - n n - - pipe +# Dovecot LDA +dovecot unix - n n - - pipe flags=DRhu user=vmail:mail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -m ${extension} From cc3c704ba84c3ed6260153ebd88aa4332ee3c620 Mon Sep 17 00:00:00 2001 From: frju365 Date: Mon, 23 Apr 2018 22:05:39 +0200 Subject: [PATCH 145/313] [enh] Enable HTTP2 protocol in nginx conf (#448) * [Add] http2 * Update yunohost_admin.conf --- data/templates/nginx/plain/yunohost_admin.conf | 4 ++-- data/templates/nginx/server.tpl.conf | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index b1fb0d2ef..85e29e556 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -12,8 +12,8 @@ server { } server { - listen 443 ssl default_server; - listen [::]:443 ssl default_server; + listen 443 ssl http2 default_server; + listen [::]:443 ssl http2 default_server; ssl_certificate /etc/yunohost/certs/yunohost.org/crt.pem; ssl_certificate_key /etc/yunohost/certs/yunohost.org/key.pem; diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index df722b526..1a5e21502 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -16,8 +16,8 @@ server { } server { - listen 443 ssl; - listen [::]:443 ssl; + listen 443 ssl http2; + listen [::]:443 ssl http2; server_name {{ domain }}; ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem; From 13d50734167239702b7fe5059a61b5214862e4e1 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 24 Apr 2018 17:17:27 +0200 Subject: [PATCH 146/313] [fix] postrm is called in a lot of various way, deleting the installed flag when it shouldnt --- debian/postrm | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/debian/postrm b/debian/postrm index cf2b6afe7..93338c4ff 100644 --- a/debian/postrm +++ b/debian/postrm @@ -1,12 +1,19 @@ #!/bin/bash +# See https://manpages.debian.org/testing/dpkg-dev/deb-postrm.5.en.html +# to understand when / how this script is called... + set -e if [ "$1" = "purge" ]; then update-rc.d yunohost-firewall remove >/dev/null + rm -f /etc/yunohost/installed +fi + +if [ "$1" = "remove" ]; then + rm -f /etc/yunohost/installed fi -rm -f /etc/yunohost/installed #DEBHELPER# From c5d4ab5d79fbe549b07a03f0ab6a8c664707242c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 24 Apr 2018 18:41:01 +0200 Subject: [PATCH 147/313] Remove imap3 things in fail2ban conf, c.f. https://github.com/fail2ban/fail2ban/issues/1942 --- data/templates/fail2ban/jail.conf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/data/templates/fail2ban/jail.conf b/data/templates/fail2ban/jail.conf index d80e3d0af..05eb7e7a8 100644 --- a/data/templates/fail2ban/jail.conf +++ b/data/templates/fail2ban/jail.conf @@ -607,14 +607,14 @@ logpath = /opt/kerio/mailserver/store/logs/security.log [courier-auth] -port = smtp,465,submission,imap3,imaps,pop3,pop3s +port = smtp,465,submission,imaps,pop3,pop3s logpath = %(syslog_mail)s backend = %(syslog_backend)s [postfix-sasl] -port = smtp,465,submission,imap3,imaps,pop3,pop3s +port = smtp,465,submission,imap,imaps,pop3,pop3s # You might consider monitoring /var/log/mail.warn instead if you are # running postfix since it would provide the same log lines at the # "warn" level but overall at the smaller filesize. @@ -624,27 +624,27 @@ backend = %(postfix_backend)s [perdition] -port = imap3,imaps,pop3,pop3s +port = imap,imaps,pop3,pop3s logpath = %(syslog_mail)s backend = %(syslog_backend)s [squirrelmail] -port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks +port = smtp,465,submission,imap,imap2,imaps,pop3,pop3s,http,https,socks logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log [cyrus-imap] -port = imap3,imaps +port = imap,imaps logpath = %(syslog_mail)s backend = %(syslog_backend)s [uwimap-auth] -port = imap3,imaps +port = imap,imaps logpath = %(syslog_mail)s backend = %(syslog_backend)s From 922821418e174e3208504615003bb2d67f0226ba Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 25 Apr 2018 19:18:17 +0200 Subject: [PATCH 148/313] Draft of DB migration from Postgresql 9.4 to 9.6 --- locales/en.json | 3 ++ .../0005_postgresql_9p4_to_9p6.py | 44 +++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py diff --git a/locales/en.json b/locales/en.json index 0f45c7a8b..7efe0df97 100644 --- a/locales/en.json +++ b/locales/en.json @@ -225,6 +225,7 @@ "migration_description_0001_change_cert_group_to_sslcert": "Change certificates group permissions from 'metronome' to 'ssl-cert'", "migration_description_0002_migrate_to_tsig_sha256": "Improve security of dyndns TSIG by using SHA512 instead of MD5", "migration_description_0003_migrate_to_stretch": "Upgrade the system to Debian Stretch and YunoHost 3.0", + "migration_description_0005_postgresql_9p4_to_9p6": "Migrate databases from postgresql 9.4 to 9.6", "migration_0003_backward_impossible": "The stretch migration cannot be reverted.", "migration_0003_start": "Starting migration to Stretch. The logs will be available in {logfile}.", "migration_0003_patching_sources_list": "Patching the sources.lists ...", @@ -237,6 +238,8 @@ "migration_0003_general_warning": "Please note that this migration is a delicate operation. While the YunoHost team did its best to review and test it, the migration might still break parts of the system or apps.\n\nTherefore, we recommend you to :\n - Perform a backup of any critical data or app ;\n - Be patient after launching the migration : depending on your internet connection and hardware, it might take up to a few hours for everything to upgrade.", "migration_0003_problematic_apps_warning": "Please note that the following possibly problematic installed apps were detected. It looks like those were not installed from an applist or are not flagged as 'working'. Consequently, we cannot guarantee that they will still work after the upgrade : {problematic_apps}", "migration_0003_modified_files": "Please note that the following files were found to be manually modified and might be overwritten at the end of the upgrade : {manually_modified_files}", + "migration_0005_postgresql_94_not_installed": "Postgresql was not installed on your system. Nothing to do!", + "migration_0005_postgresql_96_not_installed": "Postgresql 9.4 has been found to be installed, but not postgresql 9.6 !? Something weird might have happened on your system :( ...", "migrations_backward": "Migrating backward.", "migrations_bad_value_for_target": "Invalid number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", diff --git a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py new file mode 100644 index 000000000..d71a356ed --- /dev/null +++ b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py @@ -0,0 +1,44 @@ +import subprocess + +from moulinette.core import MoulinetteError +from moulinette.utils.log import getActionLogger + +from yunohost.tools import Migration +from yunohost.service import _run_service_command + +logger = getActionLogger('yunohost.migration') + + +class MyMigration(Migration): + "Migrate DBs from Postgresql 9.4 to 9.6 after migrating to Stretch" + + + def migrate(self): + + if not self.package_is_installed("postgresql-9.4"): + logger.warning(m18n.n("migration_0005_postgresql_94_not_installed")) + return + + if not self.package_is_installed("postgresql-9.6"): + raise MoulinetteError(m18n.n("migration_0005_postgresql_96_not_installed")) + + # FIXME / TODO : maybe add checks about the size of + # /var/lib/postgresql/9.4/main/base/ compared to available space ? + + subprocess.check_call("service postgresql stop", shell=True) + subprocess.check_call("pg_dropcluster --stop 9.6 main", shell=True) + subprocess.check_call("pg_upgradecluster -m upgrade 9.4 main", shell=True) + subprocess.check_call("pg_dropcluster --stop 9.4 main", shell=True) + subprocess.check_call("service postgresql start", shell=True) + + def backward(self): + + pass + + + def package_is_installed(self, package_name): + + p = subprocess.Popen("dpkg --list | grep -q -w {}".format(package_name), shell=True) + p.communicate() + return p.returncode == 0 + From 3955aee5ca789312f69cb171941bfa2924202b2c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 25 Apr 2018 19:22:20 +0200 Subject: [PATCH 149/313] Add missing description for PHP5->7 migration --- locales/en.json | 1 + 1 file changed, 1 insertion(+) diff --git a/locales/en.json b/locales/en.json index 7efe0df97..b7a2190df 100644 --- a/locales/en.json +++ b/locales/en.json @@ -225,6 +225,7 @@ "migration_description_0001_change_cert_group_to_sslcert": "Change certificates group permissions from 'metronome' to 'ssl-cert'", "migration_description_0002_migrate_to_tsig_sha256": "Improve security of dyndns TSIG by using SHA512 instead of MD5", "migration_description_0003_migrate_to_stretch": "Upgrade the system to Debian Stretch and YunoHost 3.0", + "migration_description_0004_php5_to_php7_pools": "Reconfigure the PHP pools to use PHP 7 instead of 5", "migration_description_0005_postgresql_9p4_to_9p6": "Migrate databases from postgresql 9.4 to 9.6", "migration_0003_backward_impossible": "The stretch migration cannot be reverted.", "migration_0003_start": "Starting migration to Stretch. The logs will be available in {logfile}.", From cc4a2f2f2edff2b8e78808a095b7580f62a88c53 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 30 Apr 2018 02:12:48 +0200 Subject: [PATCH 150/313] Also patch php5 app when calling remove --- src/yunohost/app.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 8b9f699d4..20997de77 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -843,6 +843,10 @@ def app_remove(auth, app): except: pass + # Apply dirty patch to make php5 apps compatible with php7 (e.g. the remove + # script might date back from jessie install) + _patch_php5(app_setting_path) + os.system('cp -a %s /tmp/yunohost_remove && chown -hR admin: /tmp/yunohost_remove' % app_setting_path) os.system('chown -R admin: /tmp/yunohost_remove') os.system('chmod -R u+rX /tmp/yunohost_remove') From 25bd5648a790caf2884adfa916fd220f3dd1e64b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 2 May 2018 18:16:08 +0200 Subject: [PATCH 151/313] Disabling http2 for now as it's causing weird issues with curl --- data/templates/nginx/server.tpl.conf | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index 1a5e21502..cfead0c0f 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -16,8 +16,11 @@ server { } server { - listen 443 ssl http2; - listen [::]:443 ssl http2; + # Disabling http2 for now as it's causing weird issues with curl + #listen 443 ssl http2; + #listen [::]:443 ssl http2; + listen 443 ssl; + listen [::]:443 ssl; server_name {{ domain }}; ssl_certificate /etc/yunohost/certs/{{ domain }}/crt.pem; From 3feae2e87768c05d7c74e1ca3a2abb75fb10c6dd Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 2 May 2018 19:43:33 +0200 Subject: [PATCH 152/313] Some ecdh_curve don't work on jessie --- data/templates/nginx/plain/yunohost_admin.conf | 7 ++++++- data/templates/nginx/server.tpl.conf | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index b1fb0d2ef..dff6d0636 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -19,8 +19,13 @@ server { ssl_certificate_key /etc/yunohost/certs/yunohost.org/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; + # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 - ssl_ecdh_curve secp521r1:secp384r1:prime256v1; + # (this doesn't work on jessie though ...?) + # ssl_ecdh_curve secp521r1:secp384r1:prime256v1; + + # As suggested by https://cipherli.st/ + ssl_ecdh_curve secp384r1; ssl_prefer_server_ciphers on; diff --git a/data/templates/nginx/server.tpl.conf b/data/templates/nginx/server.tpl.conf index df722b526..f55df65f1 100644 --- a/data/templates/nginx/server.tpl.conf +++ b/data/templates/nginx/server.tpl.conf @@ -24,8 +24,13 @@ server { ssl_certificate_key /etc/yunohost/certs/{{ domain }}/key.pem; ssl_session_timeout 5m; ssl_session_cache shared:SSL:50m; + # As suggested by Mozilla : https://wiki.mozilla.org/Security/Server_Side_TLS and https://en.wikipedia.org/wiki/Curve25519 - ssl_ecdh_curve secp521r1:secp384r1:prime256v1; + # (this doesn't work on jessie though ...?) + # ssl_ecdh_curve secp521r1:secp384r1:prime256v1; + + # As suggested by https://cipherli.st/ + ssl_ecdh_curve secp384r1; ssl_prefer_server_ciphers on; From 906ea985928d5082fb5170a3a94107b9f9a101ff Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 3 May 2018 01:15:55 +0200 Subject: [PATCH 153/313] Update changelog for Stretch beta 3.0.0~beta1 --- debian/changelog | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/debian/changelog b/debian/changelog index 2cc315c47..39a202dc8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,8 @@ -yunohost (3.0.0) testing; urgency=low +yunohost (3.0.0~beta1) testing; urgency=low - (to be removed) Dummy version to work around version comparison issues + Beta release for Stretch + + -- Alexandre Aubin Thu, 03 May 2018 03:04:45 +0000 yunohost (2.7.11.1) testing; urgency=low From 51fdef0c537f1239d105539bb19bbc66484d7b27 Mon Sep 17 00:00:00 2001 From: Josue-T Date: Sat, 5 May 2018 10:32:43 +0200 Subject: [PATCH 154/313] Helper - Add no_extract_option --- data/helpers.d/utils | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index cc057eb0b..1cbc7d23c 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -109,6 +109,10 @@ ynh_backup_before_upgrade () { # # (Optionnal) Name of the local archive (offline setup support) # # default: ${src_id}.${src_format} # SOURCE_FILENAME=example.tar.gz +# # (Optional) If it set as false don't extract the source. +# # (Usefull to get a debian package of a python wheel.) +# # default: true +# SOURCE_EXTRACT=(true|false) # # Details: # This helper downloads sources from SOURCE_URL if there is no local source @@ -137,6 +141,7 @@ ynh_setup_source () { local src_sum=$(grep 'SOURCE_SUM=' "$YNH_CWD/../conf/${src_id}.src" | cut -d= -f2-) local src_sumprg=$(grep 'SOURCE_SUM_PRG=' "$YNH_CWD/../conf/${src_id}.src" | cut -d= -f2-) local src_format=$(grep 'SOURCE_FORMAT=' "$YNH_CWD/../conf/${src_id}.src" | cut -d= -f2-) + local src_extract=$(grep 'SOURCE_EXTRACT=' "$YNH_CWD/../conf/${src_id}.src" | cut -d= -f2-) local src_in_subdir=$(grep 'SOURCE_IN_SUBDIR=' "$YNH_CWD/../conf/${src_id}.src" | cut -d= -f2-) local src_filename=$(grep 'SOURCE_FILENAME=' "$YNH_CWD/../conf/${src_id}.src" | cut -d= -f2-) @@ -145,6 +150,7 @@ ynh_setup_source () { src_in_subdir=${src_in_subdir:-true} src_format=${src_format:-tar.gz} src_format=$(echo "$src_format" | tr '[:upper:]' '[:lower:]') + src_extract=${src_extract:-true} if [ "$src_filename" = "" ] ; then src_filename="${src_id}.${src_format}" fi @@ -163,7 +169,11 @@ ynh_setup_source () { # Extract source into the app dir mkdir -p "$dest_dir" - if [ "$src_format" = "zip" ] + + if ! "$src_extract" + then + mv $src_filename $dest_dir + elif [ "$src_format" = "zip" ] then # Zip format # Using of a temp directory, because unzip doesn't manage --strip-components From 9d5b918929aafd525e95af454e62d40ffdcf006e Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 5 May 2018 12:25:19 +0200 Subject: [PATCH 155/313] [mod] remove useless import --- src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py index d71a356ed..0e6edf5e6 100644 --- a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py +++ b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py @@ -4,7 +4,6 @@ from moulinette.core import MoulinetteError from moulinette.utils.log import getActionLogger from yunohost.tools import Migration -from yunohost.service import _run_service_command logger = getActionLogger('yunohost.migration') @@ -41,4 +40,3 @@ class MyMigration(Migration): p = subprocess.Popen("dpkg --list | grep -q -w {}".format(package_name), shell=True) p.communicate() return p.returncode == 0 - From a9b931b622c05033d660a7dc753ebaba0b721533 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 5 May 2018 12:25:36 +0200 Subject: [PATCH 156/313] [fix] missing import --- src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py index 0e6edf5e6..a6bfafcf2 100644 --- a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py +++ b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py @@ -1,5 +1,6 @@ import subprocess +from moulinette import m18n from moulinette.core import MoulinetteError from moulinette.utils.log import getActionLogger From 87624d1327485ef4ce04dd5f2b83679f96a4ecc2 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 6 May 2018 03:06:58 +0200 Subject: [PATCH 157/313] Updating changelog --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/debian/changelog b/debian/changelog index 39a202dc8..36168f6c5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +yunohost (3.0.0~beta1.1) testing; urgency=low + + Fixes in the postgresql migration + + -- Alexandre Aubin Sun, 06 May 2018 03:06:00 +0000 + yunohost (3.0.0~beta1) testing; urgency=low Beta release for Stretch From e66a9d5e34d36f0a1e9322b65f9dd73ab57432da Mon Sep 17 00:00:00 2001 From: YunoHost Bot Date: Sun, 6 May 2018 18:02:41 +0200 Subject: [PATCH 158/313] [i18n] Translated using Weblate (Portuguese) (#461) Currently translated at 28.8% (111 of 385 strings) --- locales/pt.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/locales/pt.json b/locales/pt.json index b0260b73a..88690249c 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -162,5 +162,10 @@ "backup_extracting_archive": "Extraindo arquivo de backup...", "backup_hook_unknown": "Gancho de backup '{hook:s}' desconhecido", "backup_nothings_done": "Não há nada para guardar", - "backup_output_directory_forbidden": "Diretório de saída proibido. Os backups não podem ser criados em /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var ou /home/yunohost.backup/archives subpastas" + "backup_output_directory_forbidden": "Diretório de saída proibido. Os backups não podem ser criados em /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var ou /home/yunohost.backup/archives subpastas", + "app_already_installed_cant_change_url": "Este aplicativo já está instalado. A URL não pode ser alterada apenas por esta função. Olhe para o `app changeurl` se estiver disponível.", + "app_already_up_to_date": "{app:s} já está atualizado", + "app_argument_choice_invalid": "Escolha inválida para o argumento '{name:s}', deve ser um dos {choices:s}", + "app_argument_invalid": "Valor inválido de argumento '{name:s}': {error:s}", + "app_argument_required": "O argumento '{name:s}' é obrigatório" } From 460a40e61d1d791ed165744a94989efc0986dd77 Mon Sep 17 00:00:00 2001 From: YunoHost Bot Date: Sun, 6 May 2018 18:02:41 +0200 Subject: [PATCH 159/313] [i18n] Translated using Weblate (Portuguese) (#461) Currently translated at 28.8% (111 of 385 strings) --- locales/pt.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/locales/pt.json b/locales/pt.json index b0260b73a..88690249c 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -162,5 +162,10 @@ "backup_extracting_archive": "Extraindo arquivo de backup...", "backup_hook_unknown": "Gancho de backup '{hook:s}' desconhecido", "backup_nothings_done": "Não há nada para guardar", - "backup_output_directory_forbidden": "Diretório de saída proibido. Os backups não podem ser criados em /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var ou /home/yunohost.backup/archives subpastas" + "backup_output_directory_forbidden": "Diretório de saída proibido. Os backups não podem ser criados em /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var ou /home/yunohost.backup/archives subpastas", + "app_already_installed_cant_change_url": "Este aplicativo já está instalado. A URL não pode ser alterada apenas por esta função. Olhe para o `app changeurl` se estiver disponível.", + "app_already_up_to_date": "{app:s} já está atualizado", + "app_argument_choice_invalid": "Escolha inválida para o argumento '{name:s}', deve ser um dos {choices:s}", + "app_argument_invalid": "Valor inválido de argumento '{name:s}': {error:s}", + "app_argument_required": "O argumento '{name:s}' é obrigatório" } From 34838d53f868851da52ff79362b41ddeda1abda0 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 6 May 2018 16:41:18 +0000 Subject: [PATCH 160/313] Update changelog for 2.7.12 release --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian/changelog b/debian/changelog index 42f50bae8..bc20b60dc 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +yunohost (2.7.12) stable; urgency=low + + * [i18n] Improve translation for Portuguese + * Bump version number for stable release + + -- Alexandre Aubin Sun, 06 May 2018 16:40:11 +0000 + yunohost (2.7.11.1) testing; urgency=low * [fix] Nginx Regression typo (#459) From 6d8dd984982a19ee698d573dc6e45264af0e54bc Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 6 May 2018 23:13:01 +0000 Subject: [PATCH 161/313] Update changelog for 2.7.13 release --- debian/changelog | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/debian/changelog b/debian/changelog index 2d15bd795..a935b1b20 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +yunohost (2.7.13) testing; urgency=low + + * [enh] Add 'manual migration' mechanism to the migration framework (#429) + * [enh] Add Stretch migration (#433) + * [enh] Use recommended ECDH curves (#454) + + -- Alexandre Aubin Sun, 06 May 2018 23:10:13 +0000 + yunohost (2.7.12) stable; urgency=low * [i18n] Improve translation for Portuguese From c75a3f1b4480cb1bd47917af1b80f39eaae341ba Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 May 2018 05:50:39 +0200 Subject: [PATCH 162/313] Also disabling httpt2 in yunohost_admin.conf --- data/templates/nginx/plain/yunohost_admin.conf | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/data/templates/nginx/plain/yunohost_admin.conf b/data/templates/nginx/plain/yunohost_admin.conf index 85e29e556..f7b46e767 100644 --- a/data/templates/nginx/plain/yunohost_admin.conf +++ b/data/templates/nginx/plain/yunohost_admin.conf @@ -12,8 +12,11 @@ server { } server { - listen 443 ssl http2 default_server; - listen [::]:443 ssl http2 default_server; + # Disabling http2 for now as it's causing weird issues with curl + #listen 443 ssl http2 default_server; + #listen [::]:443 ssl http2 default_server; + listen 443 ssl default_server; + listen [::]:443 ssl default_server; ssl_certificate /etc/yunohost/certs/yunohost.org/crt.pem; ssl_certificate_key /etc/yunohost/certs/yunohost.org/key.pem; From 75513f4d297bf437bd0cb8b3c50330ce0732ac2e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 May 2018 05:52:19 +0200 Subject: [PATCH 163/313] Updating changelog --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian/changelog b/debian/changelog index 36168f6c5..a00fcceed 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +yunohost (3.0.0~beta1.2) testing; urgency=low + + Removing http2 also from yunohost_admin.conf since there still are some + issues with wordpress ? + + -- Alexandre Aubin Tue, 08 May 2018 05:52:00 +0000 + yunohost (3.0.0~beta1.1) testing; urgency=low Fixes in the postgresql migration From a3c6cc2ca8aaa322d8667ea54edb3ab63abd4922 Mon Sep 17 00:00:00 2001 From: JimboJoe Date: Tue, 8 May 2018 18:21:52 +0200 Subject: [PATCH 164/313] Typo fix --- data/helpers.d/utils | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index 1cbc7d23c..51edf45f0 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -110,7 +110,7 @@ ynh_backup_before_upgrade () { # # default: ${src_id}.${src_format} # SOURCE_FILENAME=example.tar.gz # # (Optional) If it set as false don't extract the source. -# # (Usefull to get a debian package of a python wheel.) +# # (Useful to get a debian package or a python wheel.) # # default: true # SOURCE_EXTRACT=(true|false) # From 7de61ce8ab754426f3036ac205c0eef4db510d74 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 May 2018 19:00:55 +0200 Subject: [PATCH 165/313] mysql-server can be removed now, it's a meta-package that depends on mariadb --- debian/control | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/control b/debian/control index 6d8848e86..c60b62689 100644 --- a/debian/control +++ b/debian/control @@ -16,7 +16,7 @@ Depends: ${python:Depends}, ${misc:Depends} , glances , dnsutils, bind9utils, unzip, git, curl, cron, wget , ca-certificates, netcat-openbsd, iproute - , mariadb-server | mysql-server, php-mysql | php-mysqlnd + , mariadb-server, php-mysql | php-mysqlnd , slapd, ldap-utils, sudo-ldap, libnss-ldapd, unscd , postfix-ldap, postfix-policyd-spf-perl, postfix-pcre, procmail, mailutils , dovecot-ldap, dovecot-lmtpd, dovecot-managesieved From 2f0db53d8c99a6d222f1c070d0b335c97ac25344 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 May 2018 19:01:25 +0200 Subject: [PATCH 166/313] We have mariadb-server-10.1 now --- data/hooks/conf_regen/34-mysql | 12 ++++-------- data/hooks/restore/11-conf_ynh_mysql | 12 ++++-------- 2 files changed, 8 insertions(+), 16 deletions(-) diff --git a/data/hooks/conf_regen/34-mysql b/data/hooks/conf_regen/34-mysql index bda1859d8..5ee91827b 100755 --- a/data/hooks/conf_regen/34-mysql +++ b/data/hooks/conf_regen/34-mysql @@ -1,6 +1,7 @@ #!/bin/bash set -e +MYSQL_PKG="mariadb-server-10.1" do_pre_regen() { pending_dir=$1 @@ -31,19 +32,14 @@ do_post_regen() { "applications, and is going to reset the MySQL root password." \ "You can find this new password in /etc/yunohost/mysql." >&2 - # retrieve MySQL package provider - ynh_package_is_installed "mariadb-server-10.0" \ - && mysql_pkg="mariadb-server-10.0" \ - || mysql_pkg="mysql-server-5.5" - # set new password with debconf sudo debconf-set-selections << EOF -$mysql_pkg mysql-server/root_password password $mysql_password -$mysql_pkg mysql-server/root_password_again password $mysql_password +$MYSQL_PKG mysql-server/root_password password $mysql_password +$MYSQL_PKG mysql-server/root_password_again password $mysql_password EOF # reconfigure Debian package - sudo dpkg-reconfigure -freadline -u "$mysql_pkg" 2>&1 + sudo dpkg-reconfigure -freadline -u "$MYSQL_PKG" 2>&1 else echo "It seems that you have already configured MySQL." \ "YunoHost needs to have a root access to MySQL to runs its" \ diff --git a/data/hooks/restore/11-conf_ynh_mysql b/data/hooks/restore/11-conf_ynh_mysql index 8b8438c0e..0aaaccd54 100644 --- a/data/hooks/restore/11-conf_ynh_mysql +++ b/data/hooks/restore/11-conf_ynh_mysql @@ -1,4 +1,5 @@ backup_dir="$1/conf/ynh/mysql" +MYSQL_PKG="mariadb-server-10.1" # ensure that mysql is running service mysql status >/dev/null 2>&1 \ @@ -23,19 +24,14 @@ sudo mysqladmin -s -u root -p"$curr_pwd" password "$new_pwd" || { "applications, and is going to reset the MySQL root password." \ "You can find this new password in /etc/yunohost/mysql." >&2 - # retrieve MySQL package provider - ynh_package_is_installed "mariadb-server-10.0" \ - && mysql_pkg="mariadb-server-10.0" \ - || mysql_pkg="mysql-server-5.5" - # set new password with debconf sudo debconf-set-selections << EOF -$mysql_pkg mysql-server/root_password password $new_pwd -$mysql_pkg mysql-server/root_password_again password $new_pwd +$MYSQL_PKG mysql-server/root_password password $new_pwd +$MYSQL_PKG mysql-server/root_password_again password $new_pwd EOF # reconfigure Debian package - sudo dpkg-reconfigure -freadline -u "$mysql_pkg" 2>&1 + sudo dpkg-reconfigure -freadline -u "$MYSQL_PKG" 2>&1 } # store new root password From 75fc1c03c59e6ca8d36d6728f3e7d3376819aeb5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 8 May 2018 20:32:34 +0200 Subject: [PATCH 167/313] Factorize the building of the logo at the top of the script --- bin/yunoprompt | 88 +++++++++++++++++++------------------------------- 1 file changed, 34 insertions(+), 54 deletions(-) mode change 100644 => 100755 bin/yunoprompt diff --git a/bin/yunoprompt b/bin/yunoprompt old mode 100644 new mode 100755 index 83b28296f..bb71e96b9 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -1,7 +1,9 @@ #!/bin/bash +# Fetch ips ip=$(hostname --all-ip-address) +# Fetch SSH fingerprints i=0 for key in /etc/ssh/ssh_host_*_key.pub ; do output=$(ssh-keygen -l -f $key) @@ -9,7 +11,11 @@ for key in /etc/ssh/ssh_host_*_key.pub ; do i=$(($i + 1)) done -cat > /etc/issue.net << EOF +# +# Build the logo +# + +LOGO=$(cat << 'EOF' '. ' '' -d. /M+ h- .shh/ // /NMy- hMdosso 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ @@ -19,7 +25,18 @@ cat > /etc/issue.net << EOF 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - hy /yy: :- -. -Nh ' . - +EOF +) + +# ' Put a quote in comment to make vim happy about syntax highlighting :s + +# +# Build the actual message +# + +LOGO_AND_FINGERPRINTS=$(cat << EOF +"$LOGO" + IP: ${ip} SSH fingerprints: ${fingerprint[0]} @@ -28,38 +45,22 @@ ${fingerprint[2]} ${fingerprint[3]} ${fingerprint[4]} EOF +) + + +echo "$LOGO_AND_FINGERPRINTS" > /etc/issue.net + if [[ ! -f /etc/yunohost/installed ]] then - if [[ ! -f /etc/yunohost/from_script ]] - then -sleep 5 -chvt 2 -cat << EOF - '. ' '' -d. - /M+ h- .shh/ // /NMy- hMdosso - 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ - sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' - .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. - mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: - 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - - hy /yy: :- -. -Nh ' - . - -IP: ${ip} -SSH fingerprints*: -${fingerprint[0]} -${fingerprint[1]} -${fingerprint[2]} -${fingerprint[3]} -${fingerprint[4]} -EOF - -echo -e "\e[m Post-installation \e[0m" -cat << EOF -Congratulations! YunoHost has been successfully installed. -Two more steps are required to activate the services of your server. -EOF -read -p "Proceed to post-installation? (y/n) " -n 1 + if [[ ! -f /etc/yunohost/from_script ]] + then + sleep 5 + chvt 2 + echo "$LOGO_AND_FINGERPRINTS" + echo -e "\e[m Post-installation \e[0m" + echo "Congratulations! YunoHost has been successfully installed. + Two more steps are required to activate the services of your server." + read -p "Proceed to post-installation? (y/n) " -n 1 RESULT=1 while [ $RESULT -gt 0 ]; do if [[ $REPLY =~ ^[Nn]$ ]]; then @@ -76,27 +77,6 @@ read -p "Proceed to post-installation? (y/n) " -n 1 done fi else # YunoHost is already post-installed - -cat > /etc/issue << EOF - '. ' '' -d. - /M+ h- .shh/ // /NMy- hMdosso - 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ - sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' - .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. - mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: - 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - - hy /yy: :- -. -Nh ' - . - -IP: ${ip} -SSH fingerprints: -${fingerprint[0]} -${fingerprint[1]} -${fingerprint[2]} -${fingerprint[3]} -${fingerprint[4]} -EOF - - + echo "$LOGO_AND_FINGERPRINTS" > /etc/issue fi From e8f97e7b3ef2dc0a107d24f4dbff9f27fea4482f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 9 May 2018 00:25:11 +0200 Subject: [PATCH 168/313] Also patch jessie-updates in sources.list --- src/yunohost/data_migrations/0003_migrate_to_stretch.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index 5f65dbb89..5a5240507 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -146,12 +146,13 @@ class MyMigration(Migration): # This : # - replace single 'jessie' occurence by 'stretch' # - comments lines containing "backports" - # - replace 'jessie/updates' by 'strech/updates' + # - replace 'jessie/updates' by 'strech/updates' (or same with a -) # - switch yunohost's repo to forge for f in sources_list: command = "sed -i -e 's@ jessie @ stretch @g' " \ "-e '/backports/ s@^#*@#@' " \ "-e 's@ jessie/updates @ stretch/updates @g' " \ + "-e 's@ jessie-updates @ stretch-updates @g' " \ "-e 's@repo.yunohost@forge.yunohost@g' " \ "{}".format(f) os.system(command) From 4f9901c8617922c623b544d85080d14fd89ddac5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 9 May 2018 01:32:26 +0200 Subject: [PATCH 169/313] Use lsb_release instead of platform to check debian version during migration --- src/yunohost/data_migrations/0003_migrate_to_stretch.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index 5a5240507..cfecad6b6 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -5,7 +5,6 @@ import base64 import time import json import errno -import platform from shutil import copy2 from moulinette import m18n, msettings @@ -80,7 +79,11 @@ class MyMigration(Migration): self.upgrade_yunohost_packages() def debian_major_version(self): - return int(platform.dist()[1][0]) + # We rely on lsb_release instead of the python module "platform", + # because "platform" relies on uname, which on some weird setups does + # not behave correctly (still says running Jessie when lsb_release says + # Stretch...) + return int(check_output("lsb_release -r").split("\t")[1][0]) def yunohost_major_version(self): return int(get_installed_version("yunohost").split('.')[0]) From a00e8a02a5e8bab32da48535dc1063530f0aa0af Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 9 May 2018 02:41:56 +0200 Subject: [PATCH 170/313] Bit cooler message at the end of the migration --- src/yunohost/data_migrations/0003_migrate_to_stretch.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index cfecad6b6..ab4974e2e 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -213,8 +213,8 @@ class MyMigration(Migration): wait_until_end_of_yunohost_command = "(while [ -f {} ]; do sleep 2; done)".format(MOULINETTE_LOCK) - command = "({} && {}; echo 'Done!') &".format(wait_until_end_of_yunohost_command, - upgrade_command) + command = "({} && {}; echo 'Migration complete!') &".format(wait_until_end_of_yunohost_command, + upgrade_command) logger.debug("Running command :\n{}".format(command)) From 9570832f42c62c3afabb1631511c12ab1306320c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 9 May 2018 00:45:26 +0000 Subject: [PATCH 171/313] Update changelog for 2.7.13.1 release --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/debian/changelog b/debian/changelog index a935b1b20..1fa1544ad 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +yunohost (2.7.13.1) testing; urgency=low + + * [fix] Misc fixes on stretch migration following feedback + + -- Alexandre Aubin Wed, 09 May 2018 00:44:50 +0000 + yunohost (2.7.13) testing; urgency=low * [enh] Add 'manual migration' mechanism to the migration framework (#429) From 0f8cef9cf843d30fdfcda93642a66b4d35fdcbb1 Mon Sep 17 00:00:00 2001 From: Josue-T Date: Thu, 10 May 2018 00:05:46 +0200 Subject: [PATCH 172/313] Helper - improve ynh_add_nginx_config Add 2 new features : - Permit to replace some others variables in the template - Manage automatically the redirection (alias_transversal issue fix) --- data/helpers.d/backend | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/data/helpers.d/backend b/data/helpers.d/backend index 28c5b8e91..a912cd337 100644 --- a/data/helpers.d/backend +++ b/data/helpers.d/backend @@ -117,7 +117,10 @@ ynh_remove_systemd_config () { # Create a dedicated nginx config # -# usage: ynh_add_nginx_config +# usage: ynh_add_nginx_config "list of others variables to replace" +# +# | arg: list of others variables to replace separeted by a space +# | for example : 'path_2 port_2 ...' # # This will use a template in ../conf/nginx.conf # __PATH__ by $path_url @@ -126,8 +129,13 @@ ynh_remove_systemd_config () { # __NAME__ by $app # __FINALPATH__ by $final_path # +# And dynamic variables (from the last example) : +# __PATH_2__ by $path_2 +# __PORT_2__ by $port_2 +# ynh_add_nginx_config () { - finalnginxconf="/etc/nginx/conf.d/$domain.d/$app.conf" + local finalnginxconf="/etc/nginx/conf.d/$domain.d/$app.conf" + local others_var=${1:-} ynh_backup_if_checksum_is_different "$finalnginxconf" sudo cp ../conf/nginx.conf "$finalnginxconf" @@ -151,6 +159,18 @@ ynh_add_nginx_config () { if test -n "${final_path:-}"; then ynh_replace_string "__FINALPATH__" "$final_path" "$finalnginxconf" fi + + # Replace all other variable given as arguments + for v in $others_var + do + ynh_replace_string "__${v^^}__" "${!v}" "$finalnginxconf" + done + + if [ "${path_url:-}" != "/" ] + then + ynh_replace_string "^#sub_path_only" "" "$finalnginxconf" + fi + ynh_store_file_checksum "$finalnginxconf" sudo systemctl reload nginx From 77fcb6ad1285f61424190efd5ab12c5de3bd38eb Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 10 May 2018 03:26:52 +0200 Subject: [PATCH 173/313] Squashed 'src/yunohost/vendor/spectre-meltdown-checker/' changes from 7f92717..edebe4d edebe4d bump to v0.37 83ea78f fix: arm: also detect variant 1 mitigation when using native objdump 602b68d fix(spectrev2): explain that retpoline is possible for Skylake+ if there is RSB filling, even if IBRS is still better 97bccaa feat: rephrase IBPB warning when only retpoline is enabled in non-paranoid mode 68e619b feat: show RSB filling capability for non-Skylake in verbose mode a6f4475 feat: make IBRS_FW blue instead of green 223f502 feat: add --paranoid to choose whether we require IBPB c0108b9 fix(spectre2): don't explain how to fix when NOT VULNERABLE a301613 feat: make RSB filling support mandatory for Skylake+ CPUs 59d85b3 feat: detect RSB filling capability in the kernel baaefb0 fix: remove shellcheck warnings d452aca fix: invalid bash syntax when ibpb_enabled or ibrs_enabled are empty 10b8d94 feat: detect latest Red Hat kernels' RO ibpb_enabled knob 8606e60 refactor: no longer display the retoline-aware compiler test when we can't tell for sure 6a48251 fix: regression in 51aeae25, when retpoline & ibpb are enabled f4bf5e9 fix: typos 60eac1a feat: also do PTI performance check with (inv)pcid for BSD b3cc06a fix regression introduced by 82c25dc 5553576 feat(amd/zen): re-introduce IBRS for AMD except ZEN family e16ad80 feat(ibpb=2): add detection of SMT before concluding the system is not vulnerable 29c294e feat(bsd): explain how to mitigate variant2 5971401 refactor: IBRS_ALL & RDCL_NO are Intel-only 51e8261 refactor: separate hw checks for Intel & AMD 2a4bfad refactor: add is_amd and is_intel funcs 7e52cea feat(spectre2): refined how status of this vuln is decided and more precise explanations on how to fix 417d7aa Fix trailing whitespace and mixed indent styles; 67bf761 Fix some user facing typos with codespell -w -q3 . 0eabd26 refactor: decrease default verbosity for some tests b77fb0f fix: don't override ibrs/ibpb results with later tests 89c2e0f fix(amd): show cpuinfo and ucode details b88f32e feat: print raw cpuid, and fetch ucode version under BSD 7a4ebe8 refactor: rewrite read_cpuid to get more common code parts between BSD and Linux 0919f5c feat: add explanations of what to do when a vulnerability is not mitigated de02dad feat: rework Spectre V2 mitigations detection w/ latest vanilla & Red Hat 7 kernels 07484d0 add dump of variables at end of script in debug mode a8b557b fix(cpu): skip CPU checks if asked to (--no-hw) or if inspecting a kernel of another architecture 619b274 fix(sysfs): only check for sysfs for spectre2 when in live mode 94857c9 update readme 056ed00 feat(arm): detect spectre variant 1 mitigation aef99d2 fix(pti): when PTI activation is unknown, don't say we're vulnerable e2d7ed2 feat(arm): support for variant2 and meltdown mitigation detection eeaeff8 set version to v0.36+ for master branch between releases f5269a3 feat(bsd): add retpoline detection for BSD f3883a3 fix(xen): adjust message for DomUs w/ sysfs b6fd69a release: v0.36 7adb766 enh: change colors and use red only to report vulnerability c7892e3 update README.md aa74315 feat: speed up kernel version detection 0b8a09e fix: mis adjustments for BSD compat b42d8f2 fix(write_msr): use /dev/zero instead of manually echoing zeroes f191ec7 feat: add --hw-only to only show CPU microcode/cpuid/msr details 28da7a0 misc: message clarifications ece25b9 feat: implement support for NetBSD/FreeBSD/DragonFlyBSD 889172d feat: add special extract_vmlinux mode for old RHEL kernels 37ce032 fix: bypass MSR/CPUID checks for non-x86 CPUs 701cf88 feat: more robust validation of extracted kernel image 6a94c3f feat(extract_vmlinux): look for ELF magic in decompressed blob and cut at found offset 2d99381 feat: add --prefix-arch for cross-arch kernel inspection 4961f83 fix(ucode): fix blacklist detection for some ucode versions ecdc448 Check MSR in each CPU/Thread (#136) 12ea49f fix(kvm): properly detect PVHVM mode (fixes #163) 053f161 fix(doc): use https:// URLs in the script comment header bda18d0 fix: pine64: re-add vmlinuz location and some error checks 2551295 doc: use https URLs d5832dc feat: add ELF magic detection on kernel image blob for some arm64 systems d2f4674 feat: enhance kernel image version detection for some old kernels 2f6a655 Produce output for consumption by prometheus-node-exporter 30842dd release: bump to v0.35 b4ac5fc feat(variant2): better explanation when kernel supports IBRS but CPU does not fef380d feat(readme): add quick run section 55a6fd3 feat(variant1): better detection for Red Hat/Ubuntu patch 35c8a63 Remove the color in the title 5f914e5 fix(xen): declare Xen's PTI patch as a valid mitigation for variant3 66dce2c fix(ucode): update blacklisted ucodes list from latest Intel info 155cac2 Teach checker how to find kernels installed by systemd kernel-install 22cae60 fix(retpoline): remove the "retpoline enabled" test eb75e51 fix(ucode): update list of blacklisted ucodes from 2018-02-08 Intel document 253e180 Update spectre-meltdown-checker.sh 5d6102a enh: show kernel version in offline mode a2dfca6 feat: detect disrepancy between found kernel image and running kernel 36bd80d enh: speedup by not decompressing kernel on --sysfs-only 1834dd6 feat: add skylake era cpu detection routine 3d765bc enh: lazy loading of cpu informations 07afd95 feat: better cleanup routine on exit & interrupt b7a1012 fix: ARM CPU display name & detection 6346a0d fix: --no-color workaround for android's sed 8106f91 release: bump to v0.34 b1fdf88 enh: display ucode info even when not blacklisted 4d29607 cleanup: shellcheck pass 0267659 cleanup: remove superseded atom detection code 247b176 feat: detect known speculative-execution free CPUs bcae882 refacto: create a dedicated func to read cpuid bits 71e7109 refacto: move cpu discovery bits to a dedicated function aa18b51 fix(variant1): smarter lfence check b738ac4 fix: regression introduced by previous commit 799ce3e update blacklisted ucode list from kernel source f1e18c1 doc(disclaimer): Spectre affects all software e05ec5c feat(variant1): detect vanilla mitigation 6e544d6 fix(cpu): Pentium Exxxx are vulnerable to Meltdown 90a6596 adjust: show how to enable IBRS/IBPB in -v only 9b53635 refacto: fix shellcheck warnings for better compat 7404929 Fix printing of microcode to use cpuinfo values bf46fd5 update: new screenshots for README.md 0798bd4 fix: report arch_capabilities as NO when no MSR 42094c4 release: v0.33 03d2dfe feat: add blacklisted Intel ucode detection 9f00ffa fix: fallback to UNKNOWN when we get -EACCES 7f0d80b xen: detect if the host is a Xen Dom0 or PV DomU (fixes #83) d1c1f0f fix(batch): fix regression introduced by acf12a6 acf12a6 feat(cpu) add STIBP, RDCL_NO, IBRS_ALL checks b45e40b feat(stibp): add STIBP cpuid feature check 3c1d452 fix(cpuid): fix off-by-one SPEC_CTRL bit check 53b9eda fix: don't make IBPB mandatory when it's not there 3b0ec99 fix(cosmetic): tiny msg fixes d55bafd fix(cpu): trust is_cpu_vulnerable even w/ debugfs 147462c fix(variant3): do our checks even if sysfs is here ddc7197 fix(retpoline): retpoline-compiler detection e7aa3b9 feat(retpoline): check if retpoline is enabled ff5c92f feat(sysfs): print details even with sysfs 443d9a2 feat(ibpb): now also check for IBPB on variant 2 3e454f1 fix(offline): report unknown when too few info c8a25c5 feat: detect invalid kconfig files 4038134 fix(dmesg): detect when dmesg is truncated 0aa5857 fix(cpu): Pentium Exxxx series are not vulnerable b3b7f63 fix(display): use text-mode compatible colors 263ef65 bump to v0.32 a1bd233 revert to a simpler check_vmlinux() de6590c cache is_cpu_vulnerable result for performance 56d4f82 is_cpu_vulnerable: implement check for multi-arm systems 7fa2d63 check_vmlinux: when readelf doesn't work, try harder with another way 3be5e90 be smarter to find a usable echo command 995620a add pine64 vmlinuz location 193e0d8 arm: cosmetic fix for name and handle aarch64 72ef94a ARM: display a friendly name instead of empty string ccc0453 search in /lib/modules/$(uname -r) for vmlinuz, config, System.map 14ca49a Atom N270: implement another variation db357b8 CoreOS: remove ephemeral install of a non-used package 42a57dd add kern.log as another backend of dmesg output 5ab95f3 fix(atom): don't use a pcre regex, only an extended one 5b6e399 fix(atom): properly detect Nxxx Atom series 556951d Add Support for Slackware. 7a88aec Implement CoreOS compatibility mode (#84) bd18323 bump to v0.31 to reflect changes b89d67d meltdown: detecting Xen PV, reporting as not vulnerable 704e540 is_cpu_vulnerable: add check for old Atoms d960931 verbose: add PCID check for performance impact of PTI dcc4488 Merge pull request #80 from speed47/cpuid_spec_ctrl 32e3fe6 bump to v0.30 to reflect changes f488947 Merge pull request #79 from andir/add-nixos 71213c1 ibrs: check for spec_ctrl_ibrs in cpuinfo 2964c4a add support for NixOS kernel 749f432 also check for spec_ctrl flag in cpuinfo a422b53 also check for cpuinfo flag c483a2c check spec_ctrl support using cpuid dead005 fix: proper detail msg in vuln status 8ed7d46 Merge pull request #77 from speed47/exitcode e5e4851 proper return codes regardless of the batch mode git-subtree-dir: src/yunohost/vendor/spectre-meltdown-checker git-subtree-split: edebe4dcd47cb8457d778406ed9de7670d6d8eb5 --- README.md | 55 +- spectre-meltdown-checker.sh | 2791 +++++++++++++++++++++++++++++------ 2 files changed, 2381 insertions(+), 465 deletions(-) diff --git a/README.md b/README.md index 518b3ec9b..4a9c71828 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,57 @@ Spectre & Meltdown Checker ========================== -A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018. +A shell script to tell if your system is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018. -Without options, it'll inspect your currently running kernel. -You can also specify a kernel image on the command line, if you'd like to inspect a kernel you're not running. +Supported operating systems: +- Linux (all versions, flavors and distros) +- BSD (FreeBSD, NetBSD, DragonFlyBSD) -The script will do its best to detect mitigations, including backported non-vanilla patches, regardless of the advertised kernel version number. +Supported architectures: +- x86 (32 bits) +- amd64/x86_64 (64 bits) +- ARM and ARM64 +- other architectures will work, but mitigations (if they exist) might not always be detected + +For Linux systems, the script will detect mitigations, including backported non-vanilla patches, regardless of the advertised kernel version number and the distribution (such as Debian, Ubuntu, CentOS, RHEL, Fedora, openSUSE, Arch, ...), it also works if you've compiled your own kernel. + +For BSD systems, the detection will work as long as the BSD you're using supports `cpuctl` and `linprocfs` (this is not the case of OpenBSD for example). + +## Easy way to run the script + +- Get the latest version of the script using `curl` *or* `wget` + +```bash +curl -L https://meltdown.ovh -o spectre-meltdown-checker.sh +wget https://meltdown.ovh -O spectre-meltdown-checker.sh +``` + +- Inspect the script. You never blindly run scripts you downloaded from the Internet, do you? + +```bash +vim spectre-meltdown-checker.sh +``` + +- When you're ready, run the script as root + +```bash +chmod +x spectre-meltdown-checker.sh +sudo ./spectre-meltdown-checker.sh +``` ## Example of script output -![checker](https://framapic.org/6O4v4AAwMenv/M6J4CFWwsB3z.png) +- Intel Haswell CPU running under Ubuntu 16.04 LTS + +![haswell](https://framapic.org/1kWmNwE6ll0p/ayTRX9JRlHJ7.png) + +- AMD Ryzen running under OpenSUSE Tumbleweed + +![ryzen](https://framapic.org/TkWbuh421YQR/6MAGUP3lL6Ne.png) + +- Batch mode (JSON flavor) + +![batch](https://framapic.org/HEcWFPrLewbs/om1LdufspWTJ.png) ## Quick summary of the CVEs @@ -38,8 +79,10 @@ The script will do its best to detect mitigations, including backported non-vani This tool does its best to determine whether your system is immune (or has proper mitigations in place) for the collectively named "speculative execution" vulnerabilities. It doesn't attempt to run any kind of exploit, and can't guarantee that your system is secure, but rather helps you verifying whether your system has the known correct mitigations in place. However, some mitigations could also exist in your kernel that this script doesn't know (yet) how to detect, or it might falsely detect mitigations that in the end don't work as expected (for example, on backported or modified kernels). -Your system exposure also depends on your CPU. As of now, AMD and ARM processors are marked as immune to some or all of these vulnerabilities (except some specific ARM models). All Intel processors manufactured since circa 1995 are thought to be vulnerable. Whatever processor one uses, one might seek more information from the manufacturer of that processor and/or of the device in which it runs. +Your system exposure also depends on your CPU. As of now, AMD and ARM processors are marked as immune to some or all of these vulnerabilities (except some specific ARM models). All Intel processors manufactured since circa 1995 are thought to be vulnerable, except some specific/old models, such as some early Atoms. Whatever processor one uses, one might seek more information from the manufacturer of that processor and/or of the device in which it runs. The nature of the discovered vulnerabilities being quite new, the landscape of vulnerable processors can be expected to change over time, which is why this script makes the assumption that all CPUs are vulnerable, except if the manufacturer explicitly stated otherwise in a verifiable public announcement. +Please also note that for Spectre vulnerabilities, all software can possibly be exploited, this tool only verifies that the kernel (which is the core of the system) you're using has the proper protections in place. Verifying all the other software is out of the scope of this tool. As a general measure, ensure you always have the most up to date stable versions of all the software you use, especially for those who are exposed to the world, such as network daemons and browsers. + This tool has been released in the hope that it'll be useful, but don't use it to jump to conclusions about your security. diff --git a/spectre-meltdown-checker.sh b/spectre-meltdown-checker.sh index f71deb5bf..0f3c10575 100755 --- a/spectre-meltdown-checker.sh +++ b/spectre-meltdown-checker.sh @@ -4,19 +4,35 @@ # Check for the latest version at: # https://github.com/speed47/spectre-meltdown-checker # git clone https://github.com/speed47/spectre-meltdown-checker.git -# or wget https://raw.githubusercontent.com/speed47/spectre-meltdown-checker/master/spectre-meltdown-checker.sh +# or wget https://meltdown.ovh -O spectre-meltdown-checker.sh +# or curl -L https://meltdown.ovh -o spectre-meltdown-checker.sh # # Stephane Lesimple # -VERSION=0.29 +VERSION='0.37' + +trap 'exit_cleanup' EXIT +trap '_warn "interrupted, cleaning up..."; exit_cleanup; exit 1' INT +exit_cleanup() +{ + # cleanup the temp decompressed config & kernel image + [ -n "$dumped_config" ] && [ -f "$dumped_config" ] && rm -f "$dumped_config" + [ -n "$kerneltmp" ] && [ -f "$kerneltmp" ] && rm -f "$kerneltmp" + [ -n "$kerneltmp2" ] && [ -f "$kerneltmp2" ] && rm -f "$kerneltmp2" + [ "$mounted_debugfs" = 1 ] && umount /sys/kernel/debug 2>/dev/null + [ "$mounted_procfs" = 1 ] && umount "$procfs" 2>/dev/null + [ "$insmod_cpuid" = 1 ] && rmmod cpuid 2>/dev/null + [ "$insmod_msr" = 1 ] && rmmod msr 2>/dev/null + [ "$kldload_cpuctl" = 1 ] && kldunload cpuctl 2>/dev/null +} -# Script configuration show_usage() { + # shellcheck disable=SC2086 cat <] [--config ] [--map ] + Live mode: $(basename $0) [options] [--live] + Offline mode: $(basename $0) [options] [--kernel ] [--config ] [--map ] Modes: Two modes are available. @@ -25,22 +41,36 @@ show_usage() To run under this mode, just start the script without any option (you can also use --live explicitly) Second mode is the "offline" mode, where you can inspect a non-running kernel. - You'll need to specify the location of the vmlinux file, and if possible, the corresponding config and System.map files: + You'll need to specify the location of the kernel file, config and System.map files: - --kernel vmlinux_file Specify a (possibly compressed) vmlinux file - --config kernel_config Specify a kernel config file - --map kernel_map_file Specify a kernel System.map file + --kernel kernel_file specify a (possibly compressed) Linux or BSD kernel file + --config kernel_config specify a kernel config file (Linux only) + --map kernel_map_file specify a kernel System.map file (Linux only) Options: - --no-color Don't use color codes - --verbose, -v Increase verbosity level - --no-sysfs Don't use the /sys interface even if present - --batch text Produce machine readable output, this is the default if --batch is specified alone - --batch json Produce JSON output formatted for Puppet, Ansible, Chef... - --batch nrpe Produce machine readable output formatted for NRPE - --variant [1,2,3] Specify which variant you'd like to check, by default all variants are checked - Can be specified multiple times (e.g. --variant 2 --variant 3) + --no-color don't use color codes + --verbose, -v increase verbosity level, possibly several times + --no-explain don't produce a human-readable explanation of actions to take to mitigate a vulnerability + --paranoid require IBPB to deem Variant 2 as mitigated + --no-sysfs don't use the /sys interface even if present [Linux] + --sysfs-only only use the /sys interface, don't run our own checks [Linux] + --coreos special mode for CoreOS (use an ephemeral toolbox to inspect kernel) [Linux] + + --arch-prefix PREFIX specify a prefix for cross-inspecting a kernel of a different arch, for example "aarch64-linux-gnu-", + so that invoked tools will be prefixed with this (i.e. aarch64-linux-gnu-objdump) + --batch text produce machine readable output, this is the default if --batch is specified alone + --batch json produce JSON output formatted for Puppet, Ansible, Chef... + --batch nrpe produce machine readable output formatted for NRPE + --batch prometheus produce output for consumption by prometheus-node-exporter + + --variant [1,2,3] specify which variant you'd like to check, by default all variants are checked, + can be specified multiple times (e.g. --variant 2 --variant 3) + --hw-only only check for CPU information, don't check for any variant + --no-hw skip CPU information and checks, if you're inspecting a kernel not to be run on this host + + Return codes: + 0 (not vulnerable), 2 (vulnerable), 3 (unknown), 255 (error) IMPORTANT: A false sense of security is worse than no security at all. @@ -61,19 +91,26 @@ However, some mitigations could also exist in your kernel that this script doesn falsely detect mitigations that in the end don't work as expected (for example, on backported or modified kernels). Your system exposure also depends on your CPU. As of now, AMD and ARM processors are marked as immune to some or all of these -vulnerabilities (except some specific ARM models). All Intel processors manufactured since circa 1995 are thought to be vulnerable. -Whatever processor one uses, one might seek more information from the manufacturer of that processor and/or of the device -in which it runs. +vulnerabilities (except some specific ARM models). All Intel processors manufactured since circa 1995 are thought to be vulnerable, +except some specific/old models, such as some early Atoms. Whatever processor one uses, one might seek more information +from the manufacturer of that processor and/or of the device in which it runs. The nature of the discovered vulnerabilities being quite new, the landscape of vulnerable processors can be expected to change over time, which is why this script makes the assumption that all CPUs are vulnerable, except if the manufacturer explicitly stated otherwise in a verifiable public announcement. +Please also note that for Spectre vulnerabilities, all software can possibly be exploited, this tool only verifies that the +kernel (which is the core of the system) you're using has the proper protections in place. Verifying all the other software +is out of the scope of this tool. As a general measure, ensure you always have the most up to date stable versions of all +the software you use, especially for those who are exposed to the world, such as network daemons and browsers. + This tool has been released in the hope that it'll be useful, but don't use it to jump to conclusions about your security. EOF } +os=$(uname -s) + # parse options opt_kernel='' opt_config='' @@ -89,63 +126,130 @@ opt_variant2=0 opt_variant3=0 opt_allvariants=1 opt_no_sysfs=0 +opt_sysfs_only=0 +opt_coreos=0 +opt_arch_prefix='' +opt_hw_only=0 +opt_no_hw=0 +opt_no_explain=0 +opt_paranoid=0 -nrpe_critical=0 -nrpe_unknown=0 +global_critical=0 +global_unknown=0 nrpe_vuln="" +# find a sane command to print colored messages, we prefer `printf` over `echo` +# because `printf` behavior is more standard across Linux/BSD +# we'll try to avoid using shell builtins that might not take options +echo_cmd_type=echo +if which printf >/dev/null 2>&1; then + echo_cmd=$(which printf) + echo_cmd_type=printf +elif which echo >/dev/null 2>&1; then + echo_cmd=$(which echo) +else + # which command is broken? + [ -x /bin/echo ] && echo_cmd=/bin/echo + # for Android + [ -x /system/bin/echo ] && echo_cmd=/system/bin/echo +fi +# still empty ? fallback to builtin +[ -z "$echo_cmd" ] && echo_cmd=echo __echo() { opt="$1" shift - _msg="$@" + _msg="$*" + if [ "$opt_no_color" = 1 ] ; then # strip ANSI color codes - _msg=$(/bin/echo -e "$_msg" | sed -r "s/\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K]//g") + # some sed versions (i.e. toybox) can't seem to handle + # \033 aka \x1B correctly, so do it for them. + if [ "$echo_cmd_type" = printf ]; then + _interpret_chars='' + else + _interpret_chars='-e' + fi + _ctrlchar=$($echo_cmd $_interpret_chars "\033") + _msg=$($echo_cmd $_interpret_chars "$_msg" | sed -r "s/$_ctrlchar\[([0-9][0-9]?(;[0-9][0-9]?)?)?m//g") + fi + if [ "$echo_cmd_type" = printf ]; then + if [ "$opt" = "-n" ]; then + $echo_cmd "$_msg" + else + $echo_cmd "$_msg\n" + fi + else + # shellcheck disable=SC2086 + $echo_cmd $opt -e "$_msg" fi - # explicitly call /bin/echo to avoid shell builtins that might not take options - /bin/echo $opt -e "$_msg" } _echo() { - if [ $opt_verbose -ge $1 ]; then + if [ "$opt_verbose" -ge "$1" ]; then shift - __echo '' "$@" + __echo '' "$*" fi } _echo_nol() { - if [ $opt_verbose -ge $1 ]; then + if [ "$opt_verbose" -ge "$1" ]; then shift - __echo -n "$@" + __echo -n "$*" fi } _warn() { - _echo 0 "\033[31m${@}\033[0m" >&2 + _echo 0 "\033[31m$*\033[0m" >&2 } _info() { - _echo 1 "$@" + _echo 1 "$*" } _info_nol() { - _echo_nol 1 "$@" + _echo_nol 1 "$*" } _verbose() { - _echo 2 "$@" + _echo 2 "$*" +} + +_verbose_nol() +{ + _echo_nol 2 "$*" } _debug() { - _echo 3 "\033[34m(debug) $@\033[0m" + _echo 3 "\033[34m(debug) $*\033[0m" +} + +explain() +{ + if [ "$opt_no_explain" != 1 ] ; then + _info '' + _info "> \033[41m\033[30mHow to fix:\033[0m $*" + fi +} + +is_cpu_vulnerable_cached=0 +_is_cpu_vulnerable_cached() +{ + # shellcheck disable=SC2086 + [ "$1" = 1 ] && return $variant1 + # shellcheck disable=SC2086 + [ "$1" = 2 ] && return $variant2 + # shellcheck disable=SC2086 + [ "$1" = 3 ] && return $variant3 + echo "$0: error: invalid variant '$1' passed to is_cpu_vulnerable()" >&2 + exit 255 } is_cpu_vulnerable() @@ -155,52 +259,140 @@ is_cpu_vulnerable() # (note that in shell, a return of 0 is success) # by default, everything is vulnerable, we work in a "whitelist" logic here. # usage: is_cpu_vulnerable 2 && do something if vulnerable - variant1=0 - variant2=0 - variant3=0 - - if grep -q AMD /proc/cpuinfo; then - # AMD revised their statement about variant2 => vulnerable - # https://www.amd.com/en/corporate/speculative-execution - variant3=1 - elif grep -qi 'CPU implementer\s*:\s*0x41' /proc/cpuinfo; then - # ARM - # reference: https://developer.arm.com/support/security-update - cpupart=$(awk '/CPU part/ {print $4;exit}' /proc/cpuinfo) - cpuarch=$(awk '/CPU architecture/ {print $3;exit}' /proc/cpuinfo) - if [ -n "$cpupart" -a -n "$cpuarch" ]; then - # Cortex-R7 and Cortex-R8 are real-time and only used in medical devices or such - # I can't find their CPU part number, but it's probably not that useful anyway - # model R7 R8 A9 A15 A17 A57 A72 A73 A75 - # part ? ? 0xc09 0xc0f 0xc0e 0xd07 0xd08 0xd09 0xd0a - # arch 7? 7? 7 7 7 8 8 8 8 - if [ "$cpuarch" = 7 ] && echo "$cpupart" | grep -Eq '^0x(c09|c0f|c0e)$'; then - # armv7 vulnerable chips - : - elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -Eq '^0x(d07|d08|d09|d0a)$'; then - # armv8 vulnerable chips - : - else - variant1=1 - variant2=1 - fi - # for variant3, only A75 is vulnerable - if ! [ "$cpuarch" = 8 -a "$cpupart" = 0xd0a ]; then - variant3=1 - fi - fi + if [ "$is_cpu_vulnerable_cached" = 1 ]; then + _is_cpu_vulnerable_cached "$1" + return $? fi - [ "$1" = 1 ] && return $variant1 - [ "$1" = 2 ] && return $variant2 - [ "$1" = 3 ] && return $variant3 - echo "$0: error: invalid variant '$1' passed to is_cpu_vulnerable()" >&2 - exit 1 + variant1='' + variant2='' + variant3='' + + if is_cpu_specex_free; then + variant1=immune + variant2=immune + variant3=immune + elif is_intel; then + # Intel + # https://github.com/crozone/SpectrePoC/issues/1 ^F E5200 => spectre 2 not vulnerable + # https://github.com/paboldin/meltdown-exploit/issues/19 ^F E5200 => meltdown vulnerable + # model name : Pentium(R) Dual-Core CPU E5200 @ 2.50GHz + if grep -qE '^model name.+ Pentium\(R\) Dual-Core[[:space:]]+CPU[[:space:]]+E[0-9]{4}K? ' "$procfs/cpuinfo"; then + variant1=vuln + [ -z "$variant2" ] && variant2=immune + variant3=vuln + fi + if [ "$capabilities_rdcl_no" = 1 ]; then + # capability bit for future Intel processor that will explicitly state + # that they're not vulnerable to Meltdown + # this var is set in check_cpu() + variant3=immune + _debug "is_cpu_vulnerable: RDCL_NO is set so not vuln to meltdown" + fi + elif is_amd; then + # AMD revised their statement about variant2 => vulnerable + # https://www.amd.com/en/corporate/speculative-execution + variant1=vuln + variant2=vuln + [ -z "$variant3" ] && variant3=immune + elif [ "$cpu_vendor" = ARM ]; then + # ARM + # reference: https://developer.arm.com/support/security-update + # some devices (phones or other) have several ARMs and as such different part numbers, + # an example is "bigLITTLE". we shouldn't rely on the first CPU only, so we check the whole list + i=0 + for cpupart in $cpu_part_list + do + i=$(( i + 1 )) + # do NOT quote $cpu_arch_list below + # shellcheck disable=SC2086 + cpuarch=$(echo $cpu_arch_list | awk '{ print $'$i' }') + _debug "checking cpu$i: <$cpupart> <$cpuarch>" + # some kernels report AArch64 instead of 8 + [ "$cpuarch" = "AArch64" ] && cpuarch=8 + if [ -n "$cpupart" ] && [ -n "$cpuarch" ]; then + # Cortex-R7 and Cortex-R8 are real-time and only used in medical devices or such + # I can't find their CPU part number, but it's probably not that useful anyway + # model R7 R8 A9 A15 A17 A57 A72 A73 A75 + # part ? ? 0xc09 0xc0f 0xc0e 0xd07 0xd08 0xd09 0xd0a + # arch 7? 7? 7 7 7 8 8 8 8 + # + # variant 1 & variant 2 + if [ "$cpuarch" = 7 ] && echo "$cpupart" | grep -Eq '^0x(c09|c0f|c0e)$'; then + # armv7 vulnerable chips + _debug "checking cpu$i: this armv7 vulnerable to spectre 1 & 2" + variant1=vuln + variant2=vuln + elif [ "$cpuarch" = 8 ] && echo "$cpupart" | grep -Eq '^0x(d07|d08|d09|d0a)$'; then + # armv8 vulnerable chips + _debug "checking cpu$i: this armv8 vulnerable to spectre 1 & 2" + variant1=vuln + variant2=vuln + else + _debug "checking cpu$i: this arm non vulnerable to 1 & 2" + # others are not vulnerable + [ -z "$variant1" ] && variant1=immune + [ -z "$variant2" ] && variant2=immune + fi + + # for variant3, only A75 is vulnerable + if [ "$cpuarch" = 8 ] && [ "$cpupart" = 0xd0a ]; then + _debug "checking cpu$i: arm A75 vulnerable to meltdown" + variant3=vuln + else + _debug "checking cpu$i: this arm non vulnerable to meltdown" + [ -z "$variant3" ] && variant3=immune + fi + fi + _debug "is_cpu_vulnerable: for cpu$i and so far, we have <$variant1> <$variant2> <$variant3>" + done + fi + _debug "is_cpu_vulnerable: temp results are <$variant1> <$variant2> <$variant3>" + # if at least one of the cpu is vulnerable, then the system is vulnerable + [ "$variant1" = "immune" ] && variant1=1 || variant1=0 + [ "$variant2" = "immune" ] && variant2=1 || variant2=0 + [ "$variant3" = "immune" ] && variant3=1 || variant3=0 + _debug "is_cpu_vulnerable: final results are <$variant1> <$variant2> <$variant3>" + is_cpu_vulnerable_cached=1 + _is_cpu_vulnerable_cached "$1" + return $? +} + +is_cpu_specex_free() +{ + # return true (0) if the CPU doesn't do speculative execution, false (1) if it does. + # if it's not in the list we know, return false (1). + # source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/cpu/common.c#n882 + # { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CEDARVIEW, X86_FEATURE_ANY }, + # { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CLOVERVIEW, X86_FEATURE_ANY }, + # { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_LINCROFT, X86_FEATURE_ANY }, + # { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PENWELL, X86_FEATURE_ANY }, + # { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PINEVIEW, X86_FEATURE_ANY }, + # { X86_VENDOR_CENTAUR, 5 }, + # { X86_VENDOR_INTEL, 5 }, + # { X86_VENDOR_NSC, 5 }, + # { X86_VENDOR_ANY, 4 }, + parse_cpu_details + if is_intel; then + if [ "$cpu_family" = 6 ]; then + if [ "$cpu_model" = "$INTEL_FAM6_ATOM_CEDARVIEW" ] || \ + [ "$cpu_model" = "$INTEL_FAM6_ATOM_CLOVERVIEW" ] || \ + [ "$cpu_model" = "$INTEL_FAM6_ATOM_LINCROFT" ] || \ + [ "$cpu_model" = "$INTEL_FAM6_ATOM_PENWELL" ] || \ + [ "$cpu_model" = "$INTEL_FAM6_ATOM_PINEVIEW" ]; then + return 0 + fi + elif [ "$cpu_family" = 5 ]; then + return 0 + fi + fi + [ "$cpu_family" = 4 ] && return 0 + return 1 } show_header() { - _info "\033[1;34mSpectre and Meltdown mitigation detection tool v$VERSION\033[0m" + _info "Spectre and Meltdown mitigation detection tool v$VERSION" _info } @@ -233,20 +425,23 @@ parse_opt_file() while [ -n "$1" ]; do if [ "$1" = "--kernel" ]; then - opt_kernel=$(parse_opt_file kernel "$2") - [ $? -ne 0 ] && exit $? + opt_kernel=$(parse_opt_file kernel "$2"); ret=$? + [ $ret -ne 0 ] && exit 255 shift 2 opt_live=0 elif [ "$1" = "--config" ]; then - opt_config=$(parse_opt_file config "$2") - [ $? -ne 0 ] && exit $? + opt_config=$(parse_opt_file config "$2"); ret=$? + [ $ret -ne 0 ] && exit 255 shift 2 opt_live=0 elif [ "$1" = "--map" ]; then - opt_map=$(parse_opt_file map "$2") - [ $? -ne 0 ] && exit $? + opt_map=$(parse_opt_file map "$2"); ret=$? + [ $ret -ne 0 ] && exit 255 shift 2 opt_live=0 + elif [ "$1" = "--arch-prefix" ]; then + opt_arch_prefix="$2" + shift 2 elif [ "$1" = "--live" ]; then opt_live_explicit=1 shift @@ -256,27 +451,49 @@ while [ -n "$1" ]; do elif [ "$1" = "--no-sysfs" ]; then opt_no_sysfs=1 shift + elif [ "$1" = "--sysfs-only" ]; then + opt_sysfs_only=1 + shift + elif [ "$1" = "--coreos" ]; then + opt_coreos=1 + shift + elif [ "$1" = "--coreos-within-toolbox" ]; then + # don't use directly: used internally by --coreos + opt_coreos=0 + shift + elif [ "$1" = "--paranoid" ]; then + opt_paranoid=1 + shift + elif [ "$1" = "--hw-only" ]; then + opt_hw_only=1 + shift + elif [ "$1" = "--no-hw" ]; then + opt_no_hw=1 + shift + elif [ "$1" = "--no-explain" ]; then + opt_no_explain=1 + shift elif [ "$1" = "--batch" ]; then opt_batch=1 opt_verbose=0 shift case "$1" in - text|nrpe|json) opt_batch_format="$1"; shift;; + text|nrpe|json|prometheus) opt_batch_format="$1"; shift;; --*) ;; # allow subsequent flags '') ;; # allow nothing at all *) - echo "$0: error: unknown batch format '$1'" - echo "$0: error: --batch expects a format from: text, nrpe, json" - exit 1 >&2 + echo "$0: error: unknown batch format '$1'" >&2 + echo "$0: error: --batch expects a format from: text, nrpe, json" >&2 + exit 255 ;; esac - elif [ "$1" = "-v" -o "$1" = "--verbose" ]; then - opt_verbose=$(expr $opt_verbose + 1) + elif [ "$1" = "-v" ] || [ "$1" = "--verbose" ]; then + opt_verbose=$(( opt_verbose + 1 )) shift elif [ "$1" = "--variant" ]; then if [ -z "$2" ]; then echo "$0: error: option --variant expects a parameter (1, 2 or 3)" >&2 - exit 1 + exit 255 fi case "$2" in 1) opt_variant1=1; opt_allvariants=0;; @@ -284,17 +501,18 @@ while [ -n "$1" ]; do 3) opt_variant3=1; opt_allvariants=0;; *) echo "$0: error: invalid parameter '$2' for --variant, expected either 1, 2 or 3" >&2; - exit 1;; + exit 255 + ;; esac shift 2 - elif [ "$1" = "-h" -o "$1" = "--help" ]; then + elif [ "$1" = "-h" ] || [ "$1" = "--help" ]; then show_header show_usage exit 0 elif [ "$1" = "--version" ]; then opt_no_color=1 show_header - exit 1 + exit 0 elif [ "$1" = "--disclaimer" ]; then show_header show_disclaimer @@ -303,12 +521,22 @@ while [ -n "$1" ]; do show_header show_usage echo "$0: error: unknown option '$1'" - exit 1 + exit 255 fi done show_header +if [ "$opt_no_sysfs" = 1 ] && [ "$opt_sysfs_only" = 1 ]; then + _warn "Incompatible options specified (--no-sysfs and --sysfs-only), aborting" + exit 255 +fi + +if [ "$opt_no_hw" = 1 ] && [ "$opt_hw_only" = 1 ]; then + _warn "Incompatible options specified (--no-hw and --hw-only), aborting" + exit 255 +fi + # print status function pstatus() { @@ -316,54 +544,63 @@ pstatus() _info_nol "$2" else case "$1" in - red) col="\033[101m\033[30m";; - green) col="\033[102m\033[30m";; - yellow) col="\033[103m\033[30m";; - blue) col="\033[104m\033[30m";; + red) col="\033[41m\033[30m";; + green) col="\033[42m\033[30m";; + yellow) col="\033[43m\033[30m";; + blue) col="\033[44m\033[30m";; *) col="";; esac _info_nol "$col $2 \033[0m" fi [ -n "$3" ] && _info_nol " ($3)" _info + unset col } # Print the final status of a vulnerability (incl. batch mode) # Arguments are: CVE UNK/OK/VULN description pvulnstatus() { + pvulnstatus_last_cve="$1" if [ "$opt_batch" = 1 ]; then - case "$opt_batch_format" in - text) _echo 0 "$1: $2 ($3)";; - nrpe) - case "$2" in - UKN) nrpe_unknown="1";; - VULN) nrpe_critical="1"; nrpe_vuln="$nrpe_vuln $1";; - esac - ;; - json) - case "$1" in - CVE-2017-5753) aka="SPECTRE VARIANT 1";; - CVE-2017-5715) aka="SPECTRE VARIANT 2";; - CVE-2017-5754) aka="MELTDOWN";; - esac - case "$2" in - UKN) is_vuln="unknown";; - VULN) is_vuln="true";; - OK) is_vuln="false";; - esac - json_output="${json_output:-[}{\"NAME\":\""$aka"\",\"CVE\":\""$1"\",\"VULNERABLE\":$is_vuln,\"INFOS\":\""$3"\"}," - ;; + case "$1" in + CVE-2017-5753) aka="SPECTRE VARIANT 1";; + CVE-2017-5715) aka="SPECTRE VARIANT 2";; + CVE-2017-5754) aka="MELTDOWN";; + esac + + case "$opt_batch_format" in + text) _echo 0 "$1: $2 ($3)";; + json) + case "$2" in + UNK) is_vuln="null";; + VULN) is_vuln="true";; + OK) is_vuln="false";; + esac + json_output="${json_output:-[}{\"NAME\":\"$aka\",\"CVE\":\"$1\",\"VULNERABLE\":$is_vuln,\"INFOS\":\"$3\"}," + ;; + + nrpe) [ "$2" = VULN ] && nrpe_vuln="$nrpe_vuln $1";; + prometheus) + prometheus_output="${prometheus_output:+$prometheus_output\n}specex_vuln_status{name=\"$aka\",cve=\"$1\",status=\"$2\",info=\"$3\"} 1" + ;; esac fi - _info_nol "> \033[46m\033[30mSTATUS:\033[0m " + # always fill global_* vars because we use that do decide the program exit code + case "$2" in + UNK) global_unknown="1";; + VULN) global_critical="1";; + esac + + # display info if we're not in quiet/batch mode vulnstatus="$2" shift 2 + _info_nol "> \033[46m\033[30mSTATUS:\033[0m " case "$vulnstatus" in - UNK) pstatus yellow UNKNOWN "$@";; - VULN) pstatus red 'VULNERABLE' "$@";; - OK) pstatus green 'NOT VULNERABLE' "$@";; + UNK) pstatus yellow 'UNKNOWN' "$@";; + VULN) pstatus red 'VULNERABLE' "$@";; + OK) pstatus green 'NOT VULNERABLE' "$@";; esac } @@ -384,12 +621,38 @@ pvulnstatus() # Licensed under the GNU General Public License, version 2 (GPLv2). # ---------------------------------------------------------------------- -vmlinux='' -vmlinux_err='' -check_vmlinux() +kernel='' +kernel_err='' +check_kernel() { - readelf -h "$1" > /dev/null 2>&1 || return 1 - return 0 + _file="$1" + _desperate_mode="$2" + # checking the return code of readelf -h is not enough, we could get + # a damaged ELF file and validate it, check for stderr warnings too + _readelf_warnings=$("${opt_arch_prefix}readelf" -S "$_file" 2>&1 >/dev/null | tr "\n" "/"); ret=$? + _readelf_sections=$("${opt_arch_prefix}readelf" -S "$_file" 2>/dev/null | grep -c -e data -e text -e init) + _kernel_size=$(stat -c %s "$_file" 2>/dev/null || stat -f %z "$_file" 2>/dev/null || echo 10000) + _debug "check_kernel: ret=$? size=$_kernel_size sections=$_readelf_sections warnings=$_readelf_warnings" + if [ -n "$_desperate_mode" ]; then + if "${opt_arch_prefix}strings" "$_file" | grep -Eq '^Linux version '; then + _debug "check_kernel (desperate): ... matched!" + return 0 + else + _debug "check_kernel (desperate): ... invalid" + fi + else + if [ $ret -eq 0 ] && [ -z "$_readelf_warnings" ] && [ "$_readelf_sections" -gt 0 ]; then + if [ "$_kernel_size" -ge 100000 ]; then + _debug "check_kernel: ... file is valid" + return 0 + else + _debug "check_kernel: ... file seems valid but is too small, ignoring" + fi + else + _debug "check_kernel: ... file is invalid" + fi + fi + return 1 } try_decompress() @@ -398,159 +661,66 @@ try_decompress() # "grep" that report the byte offset of the line instead of the pattern. # Try to find the header ($1) and decompress from here - for pos in `tr "$1\n$2" "\n$2=" < "$6" | grep -abo "^$2"` + _debug "try_decompress: looking for $3 magic in $6" + for pos in $(tr "$1\n$2" "\n$2=" < "$6" | grep -abo "^$2") do _debug "try_decompress: magic for $3 found at offset $pos" if ! which "$3" >/dev/null 2>&1; then - vmlinux_err="missing '$3' tool, please install it, usually it's in the '$5' package" + kernel_err="missing '$3' tool, please install it, usually it's in the '$5' package" return 0 fi pos=${pos%%:*} - tail -c+$pos "$6" 2>/dev/null | $3 $4 > $vmlinuxtmp 2>/dev/null - if check_vmlinux "$vmlinuxtmp"; then - vmlinux="$vmlinuxtmp" + # shellcheck disable=SC2086 + tail -c+$pos "$6" 2>/dev/null | $3 $4 > "$kerneltmp" 2>/dev/null; ret=$? + if [ ! -s "$kerneltmp" ]; then + # don't rely on $ret, sometimes it's != 0 but worked + # (e.g. gunzip ret=2 just means there was trailing garbage) + _debug "try_decompress: decompression with $3 failed (err=$ret)" + elif check_kernel "$kerneltmp" "$7"; then + kernel="$kerneltmp" _debug "try_decompress: decompressed with $3 successfully!" return 0 + elif [ "$3" != "cat" ]; then + _debug "try_decompress: decompression with $3 worked but result is not a kernel, trying with an offset" + [ -z "$kerneltmp2" ] && kerneltmp2=$(mktemp /tmp/kernel-XXXXXX) + cat "$kerneltmp" > "$kerneltmp2" + try_decompress '\177ELF' xxy 'cat' '' cat "$kerneltmp2" && return 0 else - _debug "try_decompress: decompression with $3 did not work" + _debug "try_decompress: decompression with $3 worked but result is not a kernel" fi done return 1 } -extract_vmlinux() +extract_kernel() { [ -n "$1" ] || return 1 # Prepare temp files: - vmlinuxtmp="$(mktemp /tmp/vmlinux-XXXXXX)" - trap "rm -f $vmlinuxtmp" EXIT + kerneltmp="$(mktemp /tmp/kernel-XXXXXX)" # Initial attempt for uncompressed images or objects: - if check_vmlinux "$1"; then - cat "$1" > "$vmlinuxtmp" - vmlinux=$vmlinuxtmp + if check_kernel "$1"; then + cat "$1" > "$kerneltmp" + kernel=$kerneltmp return 0 fi # That didn't work, so retry after decompression. - try_decompress '\037\213\010' xy gunzip '' gunzip "$1" && return 0 - try_decompress '\3757zXZ\000' abcde unxz '' xz-utils "$1" && return 0 - try_decompress 'BZh' xy bunzip2 '' bzip2 "$1" && return 0 - try_decompress '\135\0\0\0' xxx unlzma '' xz-utils "$1" && return 0 - try_decompress '\211\114\132' xy 'lzop' '-d' lzop "$1" && return 0 - try_decompress '\002\041\114\030' xyy 'lz4' '-d -l' liblz4-tool "$1" && return 0 + for mode in '' 'desperate'; do + try_decompress '\037\213\010' xy gunzip '' gunzip "$1" "$mode" && return 0 + try_decompress '\3757zXZ\000' abcde unxz '' xz-utils "$1" "$mode" && return 0 + try_decompress 'BZh' xy bunzip2 '' bzip2 "$1" "$mode" && return 0 + try_decompress '\135\0\0\0' xxx unlzma '' xz-utils "$1" "$mode" && return 0 + try_decompress '\211\114\132' xy 'lzop' '-d' lzop "$1" "$mode" && return 0 + try_decompress '\002\041\114\030' xyy 'lz4' '-d -l' liblz4-tool "$1" "$mode" && return 0 + try_decompress '\177ELF' xxy 'cat' '' cat "$1" "$mode" && return 0 + done + _verbose "Couldn't extract the kernel image, accuracy might be reduced" return 1 } # end of extract-vmlinux functions -# check for mode selection inconsistency -if [ "$opt_live_explicit" = 1 ]; then - if [ -n "$opt_kernel" -o -n "$opt_config" -o -n "$opt_map" ]; then - show_usage - echo "$0: error: incompatible modes specified, use either --live or --kernel/--config/--map" - exit 1 - fi -fi - -# root check (only for live mode, for offline mode, we already checked if we could read the files) - -if [ "$opt_live" = 1 ]; then - if [ "$(id -u)" -ne 0 ]; then - _warn "Note that you should launch this script with root privileges to get accurate information." - _warn "We'll proceed but you might see permission denied errors." - _warn "To run it as root, you can try the following command: sudo $0" - _warn - fi - _info "Checking for vulnerabilities against running kernel \033[35m"$(uname -s) $(uname -r) $(uname -v) $(uname -m)"\033[0m" - _info "CPU is\033[35m"$(grep '^model name' /proc/cpuinfo | cut -d: -f2 | head -1)"\033[0m" - - # try to find the image of the current running kernel - # first, look for the BOOT_IMAGE hint in the kernel cmdline - if [ -r /proc/cmdline ] && grep -q 'BOOT_IMAGE=' /proc/cmdline; then - opt_kernel=$(grep -Eo 'BOOT_IMAGE=[^ ]+' /proc/cmdline | cut -d= -f2) - _debug "found opt_kernel=$opt_kernel in /proc/cmdline" - # if we have a dedicated /boot partition, our bootloader might have just called it / - # so try to prepend /boot and see if we find anything - [ -e "/boot/$opt_kernel" ] && opt_kernel="/boot/$opt_kernel" - _debug "opt_kernel is now $opt_kernel" - # else, the full path is already there (most probably /boot/something) - fi - # if we didn't find a kernel, default to guessing - if [ ! -e "$opt_kernel" ]; then - [ -e /boot/vmlinuz-linux ] && opt_kernel=/boot/vmlinuz-linux - [ -e /boot/vmlinuz-linux-libre ] && opt_kernel=/boot/vmlinuz-linux-libre - [ -e /boot/vmlinuz-$(uname -r) ] && opt_kernel=/boot/vmlinuz-$(uname -r) - [ -e /boot/kernel-$( uname -r) ] && opt_kernel=/boot/kernel-$( uname -r) - [ -e /boot/bzImage-$(uname -r) ] && opt_kernel=/boot/bzImage-$(uname -r) - [ -e /boot/kernel-genkernel-$(uname -m)-$(uname -r) ] && opt_kernel=/boot/kernel-genkernel-$(uname -m)-$(uname -r) - fi - - # system.map - if [ -e /proc/kallsyms ] ; then - opt_map="/proc/kallsyms" - elif [ -e /boot/System.map-$(uname -r) ] ; then - opt_map=/boot/System.map-$(uname -r) - fi - - # config - if [ -e /proc/config.gz ] ; then - dumped_config="$(mktemp /tmp/config-XXXXXX)" - gunzip -c /proc/config.gz > $dumped_config - # dumped_config will be deleted at the end of the script - opt_config=$dumped_config - elif [ -e /boot/config-$(uname -r) ]; then - opt_config=/boot/config-$(uname -r) - fi -else - _info "Checking for vulnerabilities against specified kernel" -fi - -if [ -n "$opt_kernel" ]; then - _verbose "Will use vmlinux image \033[35m$opt_kernel\033[0m" -else - _verbose "Will use no vmlinux image (accuracy might be reduced)" - bad_accuracy=1 -fi -if [ -n "$dumped_config" ]; then - _verbose "Will use kconfig \033[35m/proc/config.gz\033[0m" -elif [ -n "$opt_config" ]; then - _verbose "Will use kconfig \033[35m$opt_config\033[0m" -else - _verbose "Will use no kconfig (accuracy might be reduced)" - bad_accuracy=1 -fi -if [ -n "$opt_map" ]; then - _verbose "Will use System.map file \033[35m$opt_map\033[0m" -else - _verbose "Will use no System.map file (accuracy might be reduced)" - bad_accuracy=1 -fi - -if [ "$bad_accuracy" = 1 ]; then - _info "We're missing some kernel info (see -v), accuracy might be reduced" -fi - -if [ -e "$opt_kernel" ]; then - if ! which readelf >/dev/null 2>&1; then - vmlinux_err="missing 'readelf' tool, please install it, usually it's in the 'binutils' package" - else - extract_vmlinux "$opt_kernel" - fi -else - vmlinux_err="couldn't find your kernel image in /boot, if you used netboot, this is normal" -fi -if [ -z "$vmlinux" -o ! -r "$vmlinux" ]; then - [ -z "$vmlinux_err" ] && vmlinux_err="couldn't extract your kernel from $opt_kernel" -fi - -_info - -# end of header stuff - -# now we define some util functions and the check_*() funcs, as -# the user can choose to execute only some of those - mount_debugfs() { if [ ! -e /sys/kernel/debug/sched_features ]; then @@ -559,188 +729,1444 @@ mount_debugfs() fi } -umount_debugfs() +load_msr() { - if [ "$mounted_debugfs" = 1 ]; then - # umount debugfs if we did mount it ourselves - umount /sys/kernel/debug + if [ "$os" = Linux ]; then + modprobe msr 2>/dev/null && insmod_msr=1 + _debug "attempted to load module msr, insmod_msr=$insmod_msr" + else + if ! kldstat -q -m cpuctl; then + kldload cpuctl 2>/dev/null && kldload_cpuctl=1 + _debug "attempted to load module cpuctl, kldload_cpuctl=$kldload_cpuctl" + else + _debug "cpuctl module already loaded" + fi fi } +load_cpuid() +{ + if [ "$os" = Linux ]; then + modprobe cpuid 2>/dev/null && insmod_cpuid=1 + _debug "attempted to load module cpuid, insmod_cpuid=$insmod_cpuid" + else + if ! kldstat -q -m cpuctl; then + kldload cpuctl 2>/dev/null && kldload_cpuctl=1 + _debug "attempted to load module cpuctl, kldload_cpuctl=$kldload_cpuctl" + else + _debug "cpuctl module already loaded" + fi + fi +} + +# shellcheck disable=SC2034 +{ +EAX=1; EBX=2; ECX=3; EDX=4; +} +read_cpuid() +{ + # leaf is the value of the eax register when calling the cpuid instruction: + _leaf="$1" + # eax=1 ebx=2 ecx=3 edx=4: + _register="$2" + # number of bits to shift the register right to: + _shift="$3" + # mask to apply as an AND operand to the shifted register value + _mask="$4" + # wanted value (optional), if present we return 0(true) if the obtained value is equal, 1 otherwise: + _wanted="$5" + # in any case, the read value is globally available in $read_cpuid_value + + read_cpuid_value='' + if [ ! -e /dev/cpu/0/cpuid ] && [ ! -e /dev/cpuctl0 ]; then + # try to load the module ourselves (and remember it so we can rmmod it afterwards) + load_cpuid + fi + + if [ -e /dev/cpu/0/cpuid ]; then + # Linux + # we need _leaf to be converted to decimal for dd + _leaf=$(( _leaf )) + _cpuid=$(dd if=/dev/cpu/0/cpuid bs=16 skip="$_leaf" iflag=skip_bytes count=1 2>/dev/null | od -A n -t u4) + elif [ -e /dev/cpuctl0 ]; then + # BSD + _cpuid=$(cpucontrol -i "$_leaf" /dev/cpuctl0 2>/dev/null | awk '{print $4,$5,$6,$7}') + # cpuid level 0x1: 0x000306d4 0x00100800 0x4dfaebbf 0xbfebfbff + else + return 2 + fi + + _debug "cpuid: leaf$_leaf on cpu0, eax-ebx-ecx-edx: $_cpuid" + [ -z "$_cpuid" ] && return 2 + # get the value of the register we want + _reg=$(echo "$_cpuid" | awk '{print $'"$_register"'}') + # Linux returns it as decimal, BSD as hex, normalize to decimal + _reg=$(( _reg )) + # shellcheck disable=SC2046 + _debug "cpuid: wanted register ($_register) has value $_reg aka "$(printf "%08x" "$_reg") + _reg_shifted=$(( _reg >> _shift )) + # shellcheck disable=SC2046 + _debug "cpuid: shifted value by $_shift is $_reg_shifted aka "$(printf "%x" "$_reg_shifted") + read_cpuid_value=$(( _reg_shifted & _mask )) + # shellcheck disable=SC2046 + _debug "cpuid: after AND $_mask, final value is $read_cpuid_value aka "$(printf "%x" "$read_cpuid_value") + if [ -n "$_wanted" ]; then + _debug "cpuid: wanted $_wanted and got $read_cpuid_value" + if [ "$read_cpuid_value" = "$_wanted" ]; then + return 0 + else + return 1 + fi + fi + + return 0 +} + +dmesg_grep() +{ + # grep for something in dmesg, ensuring that the dmesg buffer + # has not been truncated + dmesg_grepped='' + if ! dmesg | grep -qE -e '(^|\] )Linux version [0-9]' -e '^FreeBSD is a registered' ; then + # dmesg truncated + return 2 + fi + dmesg_grepped=$(dmesg | grep -E "$1" | head -1) + # not found: + [ -z "$dmesg_grepped" ] && return 1 + # found, output is in $dmesg_grepped + return 0 +} + +is_coreos() +{ + which coreos-install >/dev/null 2>&1 && which toolbox >/dev/null 2>&1 && return 0 + return 1 +} + +parse_cpu_details() +{ + [ "$parse_cpu_details_done" = 1 ] && return 0 + + if [ -e "$procfs/cpuinfo" ]; then + cpu_vendor=$( grep '^vendor_id' "$procfs/cpuinfo" | awk '{print $3}' | head -1) + cpu_friendly_name=$(grep '^model name' "$procfs/cpuinfo" | cut -d: -f2- | head -1 | sed -e 's/^ *//') + # special case for ARM follows + if grep -qi 'CPU implementer[[:space:]]*:[[:space:]]*0x41' "$procfs/cpuinfo"; then + cpu_vendor='ARM' + # some devices (phones or other) have several ARMs and as such different part numbers, + # an example is "bigLITTLE", so we need to store the whole list, this is needed for is_cpu_vulnerable + cpu_part_list=$(awk '/CPU part/ {print $4}' "$procfs/cpuinfo") + cpu_arch_list=$(awk '/CPU architecture/ {print $3}' "$procfs/cpuinfo") + # take the first one to fill the friendly name, do NOT quote the vars below + # shellcheck disable=SC2086 + cpu_arch=$(echo $cpu_arch_list | awk '{ print $1 }') + # shellcheck disable=SC2086 + cpu_part=$(echo $cpu_part_list | awk '{ print $1 }') + [ "$cpu_arch" = "AArch64" ] && cpu_arch=8 + cpu_friendly_name="ARM" + [ -n "$cpu_arch" ] && cpu_friendly_name="$cpu_friendly_name v$cpu_arch" + [ -n "$cpu_part" ] && cpu_friendly_name="$cpu_friendly_name model $cpu_part" + fi + + cpu_family=$( grep '^cpu family' "$procfs/cpuinfo" | awk '{print $4}' | grep -E '^[0-9]+$' | head -1) + cpu_model=$( grep '^model' "$procfs/cpuinfo" | awk '{print $3}' | grep -E '^[0-9]+$' | head -1) + cpu_stepping=$(grep '^stepping' "$procfs/cpuinfo" | awk '{print $3}' | grep -E '^[0-9]+$' | head -1) + cpu_ucode=$( grep '^microcode' "$procfs/cpuinfo" | awk '{print $3}' | head -1) + else + cpu_friendly_name=$(sysctl -n hw.model) + fi + + # get raw cpuid, it's always useful (referenced in the Intel doc for firmware updates for example) + if read_cpuid 0x1 $EAX 0 0xFFFFFFFF; then + cpuid="$read_cpuid_value" + fi + + # under BSD, linprocfs often doesn't export ucode information, so fetch it ourselves the good old way + if [ -z "$cpu_ucode" ] && [ "$os" != Linux ]; then + load_cpuid + if [ -e /dev/cpuctl0 ]; then + # init MSR with NULLs + cpucontrol -m 0x8b=0 /dev/cpuctl0 + # call CPUID + cpucontrol -i 1 /dev/cpuctl0 >/dev/null + # read MSR + cpu_ucode=$(cpucontrol -m 0x8b /dev/cpuctl0 | awk '{print $3}') + # convert to decimal + cpu_ucode=$(( cpu_ucode )) + # convert back to hex + cpu_ucode=$(printf "0x%x" "$cpu_ucode") + fi + fi + + echo "$cpu_ucode" | grep -q ^0x && cpu_ucode_decimal=$(( cpu_ucode )) + ucode_found="model $cpu_model stepping $cpu_stepping ucode $cpu_ucode cpuid "$(printf "0x%x" "$cpuid") + + # also define those that we will need in other funcs + # taken from ttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/include/asm/intel-family.h + # shellcheck disable=SC2034 + { + INTEL_FAM6_CORE_YONAH=$(( 0x0E )) + + INTEL_FAM6_CORE2_MEROM=$(( 0x0F )) + INTEL_FAM6_CORE2_MEROM_L=$(( 0x16 )) + INTEL_FAM6_CORE2_PENRYN=$(( 0x17 )) + INTEL_FAM6_CORE2_DUNNINGTON=$(( 0x1D )) + + INTEL_FAM6_NEHALEM=$(( 0x1E )) + INTEL_FAM6_NEHALEM_G=$(( 0x1F )) + INTEL_FAM6_NEHALEM_EP=$(( 0x1A )) + INTEL_FAM6_NEHALEM_EX=$(( 0x2E )) + + INTEL_FAM6_WESTMERE=$(( 0x25 )) + INTEL_FAM6_WESTMERE_EP=$(( 0x2C )) + INTEL_FAM6_WESTMERE_EX=$(( 0x2F )) + + INTEL_FAM6_SANDYBRIDGE=$(( 0x2A )) + INTEL_FAM6_SANDYBRIDGE_X=$(( 0x2D )) + INTEL_FAM6_IVYBRIDGE=$(( 0x3A )) + INTEL_FAM6_IVYBRIDGE_X=$(( 0x3E )) + + INTEL_FAM6_HASWELL_CORE=$(( 0x3C )) + INTEL_FAM6_HASWELL_X=$(( 0x3F )) + INTEL_FAM6_HASWELL_ULT=$(( 0x45 )) + INTEL_FAM6_HASWELL_GT3E=$(( 0x46 )) + + INTEL_FAM6_BROADWELL_CORE=$(( 0x3D )) + INTEL_FAM6_BROADWELL_GT3E=$(( 0x47 )) + INTEL_FAM6_BROADWELL_X=$(( 0x4F )) + INTEL_FAM6_BROADWELL_XEON_D=$(( 0x56 )) + + INTEL_FAM6_SKYLAKE_MOBILE=$(( 0x4E )) + INTEL_FAM6_SKYLAKE_DESKTOP=$(( 0x5E )) + INTEL_FAM6_SKYLAKE_X=$(( 0x55 )) + INTEL_FAM6_KABYLAKE_MOBILE=$(( 0x8E )) + INTEL_FAM6_KABYLAKE_DESKTOP=$(( 0x9E )) + + # /* "Small Core" Processors (Atom) */ + + INTEL_FAM6_ATOM_PINEVIEW=$(( 0x1C )) + INTEL_FAM6_ATOM_LINCROFT=$(( 0x26 )) + INTEL_FAM6_ATOM_PENWELL=$(( 0x27 )) + INTEL_FAM6_ATOM_CLOVERVIEW=$(( 0x35 )) + INTEL_FAM6_ATOM_CEDARVIEW=$(( 0x36 )) + INTEL_FAM6_ATOM_SILVERMONT1=$(( 0x37 )) + INTEL_FAM6_ATOM_SILVERMONT2=$(( 0x4D )) + INTEL_FAM6_ATOM_AIRMONT=$(( 0x4C )) + INTEL_FAM6_ATOM_MERRIFIELD=$(( 0x4A )) + INTEL_FAM6_ATOM_MOOREFIELD=$(( 0x5A )) + INTEL_FAM6_ATOM_GOLDMONT=$(( 0x5C )) + INTEL_FAM6_ATOM_DENVERTON=$(( 0x5F )) + INTEL_FAM6_ATOM_GEMINI_LAKE=$(( 0x7A )) + + # /* Xeon Phi */ + + INTEL_FAM6_XEON_PHI_KNL=$(( 0x57 )) + INTEL_FAM6_XEON_PHI_KNM=$(( 0x85 )) + } + parse_cpu_details_done=1 +} + +is_amd() +{ + [ "$cpu_vendor" = AuthenticAMD ] && return 0 + return 1 +} + +is_intel() +{ + [ "$cpu_vendor" = GenuineIntel ] && return 0 + return 1 +} + +is_cpu_smt_enabled() +{ + # SMT / HyperThreading is enabled if siblings != cpucores + if [ -e "$procfs/cpuinfo" ]; then + _siblings=$(awk '/^siblings/ {print $3;exit}' "$procfs/cpuinfo") + _cpucores=$(awk '/^cpu cores/ {print $4;exit}' "$procfs/cpuinfo") + if [ -n "$_siblings" ] && [ -n "$_cpucores" ]; then + if [ "$_siblings" = "$_cpucores" ]; then + return 1 + else + return 0 + fi + fi + fi + # we can't tell + return 2 +} + +is_ucode_blacklisted() +{ + parse_cpu_details + # if it's not an Intel, don't bother: it's not blacklisted + is_intel || return 1 + # it also needs to be family=6 + [ "$cpu_family" = 6 ] || return 1 + # now, check each known bad microcode + # source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/cpu/intel.c#n105 + # 2018-02-08 update: https://newsroom.intel.com/wp-content/uploads/sites/11/2018/02/microcode-update-guidance.pdf + # model,stepping,microcode + for tuple in \ + $INTEL_FAM6_KABYLAKE_DESKTOP,0x0B,0x80 \ + $INTEL_FAM6_KABYLAKE_DESKTOP,0x0A,0x80 \ + $INTEL_FAM6_KABYLAKE_DESKTOP,0x09,0x80 \ + $INTEL_FAM6_KABYLAKE_MOBILE,0x0A,0x80 \ + $INTEL_FAM6_KABYLAKE_MOBILE,0x09,0x80 \ + $INTEL_FAM6_SKYLAKE_X,0x03,0x0100013e \ + $INTEL_FAM6_SKYLAKE_X,0x04,0x02000036 \ + $INTEL_FAM6_SKYLAKE_X,0x04,0x0200003a \ + $INTEL_FAM6_SKYLAKE_X,0x04,0x0200003c \ + $INTEL_FAM6_BROADWELL_CORE,0x04,0x28 \ + $INTEL_FAM6_BROADWELL_GT3E,0x01,0x1b \ + $INTEL_FAM6_BROADWELL_XEON_D,0x02,0x14 \ + $INTEL_FAM6_BROADWELL_XEON_D,0x03,0x07000011 \ + $INTEL_FAM6_BROADWELL_X,0x01,0x0b000023 \ + $INTEL_FAM6_BROADWELL_X,0x01,0x0b000025 \ + $INTEL_FAM6_HASWELL_ULT,0x01,0x21 \ + $INTEL_FAM6_HASWELL_GT3E,0x01,0x18 \ + $INTEL_FAM6_HASWELL_CORE,0x03,0x23 \ + $INTEL_FAM6_HASWELL_X,0x02,0x3b \ + $INTEL_FAM6_HASWELL_X,0x04,0x10 \ + $INTEL_FAM6_IVYBRIDGE_X,0x04,0x42a \ + $INTEL_FAM6_SANDYBRIDGE_X,0x06,0x61b \ + $INTEL_FAM6_SANDYBRIDGE_X,0x07,0x712 + do + model=$(echo $tuple | cut -d, -f1) + stepping=$(( $(echo $tuple | cut -d, -f2) )) + ucode=$(echo $tuple | cut -d, -f3) + echo "$ucode" | grep -q ^0x && ucode_decimal=$(( ucode )) + if [ "$cpu_model" = "$model" ] && [ "$cpu_stepping" = "$stepping" ]; then + if [ "$cpu_ucode_decimal" = "$ucode_decimal" ] || [ "$cpu_ucode" = "$ucode" ]; then + _debug "is_ucode_blacklisted: we have a match! ($cpu_model/$cpu_stepping/$cpu_ucode)" + return 0 + fi + fi + done + _debug "is_ucode_blacklisted: no ($cpu_model/$cpu_stepping/$cpu_ucode)" + return 1 +} + +is_skylake_cpu() +{ + # is this a skylake cpu? + # return 0 if yes, 1 otherwise + #if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL && + # boot_cpu_data.x86 == 6) { + # switch (boot_cpu_data.x86_model) { + # case INTEL_FAM6_SKYLAKE_MOBILE: + # case INTEL_FAM6_SKYLAKE_DESKTOP: + # case INTEL_FAM6_SKYLAKE_X: + # case INTEL_FAM6_KABYLAKE_MOBILE: + # case INTEL_FAM6_KABYLAKE_DESKTOP: + # return true; + parse_cpu_details + is_intel || return 1 + [ "$cpu_family" = 6 ] || return 1 + if [ "$cpu_model" = $INTEL_FAM6_SKYLAKE_MOBILE ] || \ + [ "$cpu_model" = $INTEL_FAM6_SKYLAKE_DESKTOP ] || \ + [ "$cpu_model" = $INTEL_FAM6_SKYLAKE_X ] || \ + [ "$cpu_model" = $INTEL_FAM6_KABYLAKE_MOBILE ] || \ + [ "$cpu_model" = $INTEL_FAM6_KABYLAKE_DESKTOP ]; then + return 0 + fi + return 1 +} + +is_zen_cpu() +{ + # is this CPU from the AMD ZEN family ? (ryzen, epyc, ...) + parse_cpu_details + is_amd || return 1 + [ "$cpu_family" = 23 ] && return 0 + return 1 +} + +# ENTRYPOINT + +# we can't do anything useful under WSL +if uname -a | grep -qE -- '-Microsoft #[0-9]+-Microsoft '; then + _warn "This script doesn't work under Windows Subsystem for Linux" + _warn "You should use the official Microsoft tool instead." + _warn "It can be found under https://aka.ms/SpeculationControlPS" + exit 1 +fi + +# check for mode selection inconsistency +if [ "$opt_live_explicit" = 1 ]; then + if [ -n "$opt_kernel" ] || [ -n "$opt_config" ] || [ -n "$opt_map" ]; then + show_usage + echo "$0: error: incompatible modes specified, use either --live or --kernel/--config/--map" >&2 + exit 255 + fi +fi +if [ "$opt_hw_only" = 1 ]; then + if [ "$opt_allvariants" = 0 ]; then + show_usage + echo "$0: error: incompatible modes specified, --hw-only vs --variant" >&2 + exit 255 + else + opt_allvariants=0 + opt_variant1=0 + opt_variant2=0 + opt_variant3=0 + fi +fi + +# coreos mode +if [ "$opt_coreos" = 1 ]; then + if ! is_coreos; then + _warn "CoreOS mode asked, but we're not under CoreOS!" + exit 255 + fi + _warn "CoreOS mode, starting an ephemeral toolbox to launch the script" + load_msr + load_cpuid + mount_debugfs + toolbox --ephemeral --bind-ro /dev/cpu:/dev/cpu -- sh -c "dnf install -y binutils which && /media/root$PWD/$0 $* --coreos-within-toolbox" + exitcode=$? + exit $exitcode +else + if is_coreos; then + _warn "You seem to be running CoreOS, you might want to use the --coreos option for better results" + _warn + fi +fi + +# if we're under a BSD, try to mount linprocfs for "$procfs/cpuinfo" +procfs=/proc +if echo "$os" | grep -q BSD; then + _debug "We're under BSD, check if we have procfs" + procfs=$(mount | awk '/^linprocfs/ { print $3; exit; }') + if [ -z "$procfs" ]; then + _debug "we don't, try to mount it" + procfs=/proc + [ -d /compat/linux/proc ] && procfs=/compat/linux/proc + test -d $procfs || mkdir $procfs + if mount -t linprocfs linprocfs $procfs 2>/dev/null; then + mounted_procfs=1 + _debug "procfs just mounted at $procfs" + else + procfs='' + fi + else + _debug "We do: $procfs" + fi +fi + +parse_cpu_details +if [ "$opt_live" = 1 ]; then + # root check (only for live mode, for offline mode, we already checked if we could read the files) + if [ "$(id -u)" -ne 0 ]; then + _warn "Note that you should launch this script with root privileges to get accurate information." + _warn "We'll proceed but you might see permission denied errors." + _warn "To run it as root, you can try the following command: sudo $0" + _warn + fi + _info "Checking for vulnerabilities on current system" + _info "Kernel is \033[35m$(uname -s) $(uname -r) $(uname -v) $(uname -m)\033[0m" + _info "CPU is \033[35m$cpu_friendly_name\033[0m" + + # try to find the image of the current running kernel + # first, look for the BOOT_IMAGE hint in the kernel cmdline + if [ -r /proc/cmdline ] && grep -q 'BOOT_IMAGE=' /proc/cmdline; then + opt_kernel=$(grep -Eo 'BOOT_IMAGE=[^ ]+' /proc/cmdline | cut -d= -f2) + _debug "found opt_kernel=$opt_kernel in /proc/cmdline" + # if we have a dedicated /boot partition, our bootloader might have just called it / + # so try to prepend /boot and see if we find anything + [ -e "/boot/$opt_kernel" ] && opt_kernel="/boot/$opt_kernel" + # special case for CoreOS if we're inside the toolbox + [ -e "/media/root/boot/$opt_kernel" ] && opt_kernel="/media/root/boot/$opt_kernel" + _debug "opt_kernel is now $opt_kernel" + # else, the full path is already there (most probably /boot/something) + fi + # if we didn't find a kernel, default to guessing + if [ ! -e "$opt_kernel" ]; then + # Fedora: + [ -e "/lib/modules/$(uname -r)/vmlinuz" ] && opt_kernel="/lib/modules/$(uname -r)/vmlinuz" + # Slackare: + [ -e "/boot/vmlinuz" ] && opt_kernel="/boot/vmlinuz" + # Arch: + [ -e "/boot/vmlinuz-linux" ] && opt_kernel="/boot/vmlinuz-linux" + # Linux-Libre: + [ -e "/boot/vmlinuz-linux-libre" ] && opt_kernel="/boot/vmlinuz-linux-libre" + # pine64 + [ -e "/boot/pine64/Image" ] && opt_kernel="/boot/pine64/Image" + # generic: + [ -e "/boot/vmlinuz-$(uname -r)" ] && opt_kernel="/boot/vmlinuz-$(uname -r)" + [ -e "/boot/kernel-$( uname -r)" ] && opt_kernel="/boot/kernel-$( uname -r)" + [ -e "/boot/bzImage-$(uname -r)" ] && opt_kernel="/boot/bzImage-$(uname -r)" + # Gentoo: + [ -e "/boot/kernel-genkernel-$(uname -m)-$(uname -r)" ] && opt_kernel="/boot/kernel-genkernel-$(uname -m)-$(uname -r)" + # NixOS: + [ -e "/run/booted-system/kernel" ] && opt_kernel="/run/booted-system/kernel" + # systemd kernel-install: + [ -e "/etc/machine-id" ] && [ -e "/boot/$(cat /etc/machine-id)/$(uname -r)/linux" ] && opt_kernel="/boot/$(cat /etc/machine-id)/$(uname -r)/linux" + fi + + # system.map + if [ -e /proc/kallsyms ] ; then + opt_map=/proc/kallsyms + elif [ -e "/lib/modules/$(uname -r)/System.map" ] ; then + opt_map="/lib/modules/$(uname -r)/System.map" + elif [ -e "/boot/System.map-$(uname -r)" ] ; then + opt_map="/boot/System.map-$(uname -r)" + fi + + # config + if [ -e /proc/config.gz ] ; then + dumped_config="$(mktemp /tmp/config-XXXXXX)" + gunzip -c /proc/config.gz > "$dumped_config" + # dumped_config will be deleted at the end of the script + opt_config="$dumped_config" + elif [ -e "/lib/modules/$(uname -r)/config" ]; then + opt_config="/lib/modules/$(uname -r)/config" + elif [ -e "/boot/config-$(uname -r)" ]; then + opt_config="/boot/config-$(uname -r)" + fi +else + _info "Checking for vulnerabilities against specified kernel" + _info "CPU is \033[35m$cpu_friendly_name\033[0m" +fi + +if [ -n "$opt_kernel" ]; then + _verbose "Will use kernel image \033[35m$opt_kernel\033[0m" +else + _verbose "Will use no kernel image (accuracy might be reduced)" + bad_accuracy=1 +fi + +if [ "$os" = Linux ]; then + if [ -n "$opt_config" ] && ! grep -q '^CONFIG_' "$opt_config"; then + # given file is invalid! + _warn "The kernel config file seems invalid, was expecting a plain-text file, ignoring it!" + opt_config='' + fi + + if [ -n "$dumped_config" ] && [ -n "$opt_config" ]; then + _verbose "Will use kconfig \033[35m/proc/config.gz (decompressed)\033[0m" + elif [ -n "$opt_config" ]; then + _verbose "Will use kconfig \033[35m$opt_config\033[0m" + else + _verbose "Will use no kconfig (accuracy might be reduced)" + bad_accuracy=1 + fi + + if [ -n "$opt_map" ]; then + _verbose "Will use System.map file \033[35m$opt_map\033[0m" + else + _verbose "Will use no System.map file (accuracy might be reduced)" + bad_accuracy=1 + fi + + if [ "$bad_accuracy" = 1 ]; then + _info "We're missing some kernel info (see -v), accuracy might be reduced" + fi +fi + +if [ -e "$opt_kernel" ]; then + if ! which "${opt_arch_prefix}readelf" >/dev/null 2>&1; then + _debug "readelf not found" + kernel_err="missing '${opt_arch_prefix}readelf' tool, please install it, usually it's in the 'binutils' package" + elif [ "$opt_sysfs_only" = 1 ]; then + kernel_err='kernel image decompression skipped' + else + extract_kernel "$opt_kernel" + fi +else + _debug "no opt_kernel defined" + kernel_err="couldn't find your kernel image in /boot, if you used netboot, this is normal" +fi +if [ -z "$kernel" ] || [ ! -r "$kernel" ]; then + [ -z "$kernel_err" ] && kernel_err="couldn't extract your kernel from $opt_kernel" +else + # vanilla kernels have with ^Linux version + # also try harder with some kernels (such as Red Hat) that don't have ^Linux version before their version string + # and check for FreeBSD + kernel_version=$("${opt_arch_prefix}strings" "$kernel" 2>/dev/null | grep -E \ + -e '^Linux version ' \ + -e '^[[:alnum:]][^[:space:]]+ \([^[:space:]]+\) #[0-9]+ .+ (19|20)[0-9][0-9]$' \ + -e '^FreeBSD [0-9]' | head -1) + if [ -z "$kernel_version" ]; then + # try even harder with some kernels (such as ARM) that split the release (uname -r) and version (uname -v) in 2 adjacent strings + kernel_version=$("${opt_arch_prefix}strings" "$kernel" 2>/dev/null | grep -E -B1 '^#[0-9]+ .+ (19|20)[0-9][0-9]$' | tr "\n" " ") + fi + if [ -n "$kernel_version" ]; then + # in live mode, check if the img we found is the correct one + if [ "$opt_live" = 1 ]; then + _verbose "Kernel image is \033[35m$kernel_version" + if ! echo "$kernel_version" | grep -qF "$(uname -r)"; then + _warn "Possible disrepancy between your running kernel '$(uname -r)' and the image '$kernel_version' we found ($opt_kernel), results might be incorrect" + fi + else + _info "Kernel image is \033[35m$kernel_version" + fi + else + _verbose "Kernel image version is unknown" + fi +fi + +_info + +# end of header stuff + +# now we define some util functions and the check_*() funcs, as +# the user can choose to execute only some of those + sys_interface_check() { - [ "$opt_live" = 1 -a "$opt_no_sysfs" = 0 -a -r "$1" ] || return 1 - _info_nol "* Checking whether we're safe according to the /sys interface: " + [ "$opt_live" = 1 ] && [ "$opt_no_sysfs" = 0 ] && [ -r "$1" ] || return 1 + _info_nol "* Mitigated according to the /sys interface: " + msg=$(cat "$1") if grep -qi '^not affected' "$1"; then # Not affected status=OK - pstatus green YES "kernel confirms that your CPU is unaffected" + pstatus green YES "$msg" elif grep -qi '^mitigation' "$1"; then # Mitigation: PTI status=OK - pstatus green YES "kernel confirms that the mitigation is active" + pstatus green YES "$msg" elif grep -qi '^vulnerable' "$1"; then # Vulnerable status=VULN - pstatus red NO "kernel confirms your system is vulnerable" + pstatus yellow NO "$msg" else status=UNK - pstatus yellow UNKNOWN "unknown value reported by kernel" + pstatus yellow UNKNOWN "$msg" fi - msg=$(cat "$1") _debug "sys_interface_check: $1=$msg" return 0 } +number_of_cpus() +{ + if echo "$os" | grep -q BSD; then + n=$(sysctl -n hw.ncpu 2>/dev/null || echo 1) + elif [ -e "$procfs/cpuinfo" ]; then + n=$(grep -c ^processor "$procfs/cpuinfo" 2>/dev/null || echo 1) + else + # if we don't know, default to 1 CPU + n=1 + fi + return "$n" +} + +# $1 - msr number +# $2 - cpu index +write_msr() +{ + if [ "$os" != Linux ]; then + cpucontrol -m "$1=0" "/dev/cpuctl$2" >/dev/null 2>&1; ret=$? + else + # convert to decimal + _msrindex=$(( $1 )) + if [ ! -w /dev/cpu/"$2"/msr ]; then + ret=200 # permission error + else + dd if=/dev/zero of=/dev/cpu/"$2"/msr bs=8 count=1 seek="$_msrindex" oflag=seek_bytes 2>/dev/null; ret=$? + fi + fi + _debug "write_msr: for cpu $2 on msr $1 ($_msrindex), ret=$ret" + return $ret +} + +read_msr() +{ + # _msr must be in hex, in the form 0x1234: + _msr="$1" + # cpu index, starting from 0: + _cpu="$2" + read_msr_value='' + if [ "$os" != Linux ]; then + _msr=$(cpucontrol -m "$_msr" "/dev/cpuctl$_cpu" 2>/dev/null); ret=$? + [ $ret -ne 0 ] && return 1 + # MSR 0x10: 0x000003e1 0xb106dded + _msr_h=$(echo "$_msr" | awk '{print $3}'); + _msr_h="$(( _msr_h >> 24 & 0xFF )) $(( _msr_h >> 16 & 0xFF )) $(( _msr_h >> 8 & 0xFF )) $(( _msr_h & 0xFF ))" + _msr_l=$(echo "$_msr" | awk '{print $4}'); + _msr_l="$(( _msr_l >> 24 & 0xFF )) $(( _msr_l >> 16 & 0xFF )) $(( _msr_l >> 8 & 0xFF )) $(( _msr_l & 0xFF ))" + read_msr_value="$_msr_h $_msr_l" + else + # convert to decimal + _msr=$(( _msr )) + if [ ! -r /dev/cpu/"$_cpu"/msr ]; then + return 200 # permission error + fi + read_msr_value=$(dd if=/dev/cpu/"$_cpu"/msr bs=8 count=1 skip="$_msr" iflag=skip_bytes 2>/dev/null | od -t u1 -A n) + if [ -z "$read_msr_value" ]; then + # MSR doesn't exist, don't check for $? because some versions of dd still return 0! + return 1 + fi + fi + _debug "read_msr: MSR=$1 value is $read_msr_value" + return 0 +} + + +check_cpu() +{ + _info "\033[1;34mHardware check\033[0m" + + if ! uname -m | grep -qwE 'x86_64|i[3-6]86|amd64'; then + return + fi + + _info "* Hardware support (CPU microcode) for mitigation techniques" + _info " * Indirect Branch Restricted Speculation (IBRS)" + _info_nol " * SPEC_CTRL MSR is available: " + number_of_cpus + ncpus=$? + idx_max_cpu=$((ncpus-1)) + if [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then + # try to load the module ourselves (and remember it so we can rmmod it afterwards) + load_msr + fi + if [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then + spec_ctrl_msr=-1 + pstatus yellow UNKNOWN "is msr kernel module available?" + else + # the new MSR 'SPEC_CTRL' is at offset 0x48 + # here we use dd, it's the same as using 'rdmsr 0x48' but without needing the rdmsr tool + # if we get a read error, the MSR is not there. bs has to be 8 for msr + # skip=9 because 8*9=72=0x48 + val=0 + cpu_mismatch=0 + for i in $(seq 0 "$idx_max_cpu") + do + read_msr 0x48 "$i"; ret=$? + if [ "$i" -eq 0 ]; then + val=$ret + else + if [ "$ret" -eq $val ]; then + continue + else + cpu_mismatch=1 + fi + fi + done + if [ $val -eq 0 ]; then + if [ $cpu_mismatch -eq 0 ]; then + spec_ctrl_msr=1 + pstatus green YES + else + spec_ctrl_msr=1 + pstatus green YES "But not in all CPUs" + fi + elif [ $val -eq 200 ]; then + pstatus yellow UNKNOWN "is msr kernel module available?" + spec_ctrl_msr=-1 + else + spec_ctrl_msr=0 + pstatus yellow NO + fi + fi + + _info_nol " * CPU indicates IBRS capability: " + # from kernel src: { X86_FEATURE_SPEC_CTRL, CPUID_EDX,26, 0x00000007, 0 }, + # amd: https://developer.amd.com/wp-content/resources/Architecture_Guidelines_Update_Indirect_Branch_Control.pdf + # amd: 8000_0008 EBX[14]=1 + if is_intel; then + read_cpuid 0x7 $EDX 26 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES "SPEC_CTRL feature bit" + cpuid_spec_ctrl=1 + cpuid_ibrs='SPEC_CTRL' + fi + elif is_amd; then + read_cpuid 0x80000008 $EBX 14 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES "IBRS_SUPPORT feature bit" + cpuid_ibrs='IBRS_SUPPORT' + fi + else + ret=-1 + pstatus yellow UNKNOWN "unknown CPU" + fi + if [ $ret -eq 1 ]; then + pstatus yellow NO + elif [ $ret -eq 2 ]; then + pstatus yellow UNKNOWN "is cpuid kernel module available?" + cpuid_spec_ctrl=-1 + fi + + if is_amd; then + _info_nol " * CPU indicates preferring IBRS always-on: " + # amd + read_cpuid 0x80000008 $EBX 16 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES + else + pstatus yellow NO + fi + + _info_nol " * CPU indicates preferring IBRS over retpoline: " + # amd + read_cpuid 0x80000008 $EBX 18 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES + else + pstatus yellow NO + fi + fi + + # IBPB + _info " * Indirect Branch Prediction Barrier (IBPB)" + _info_nol " * PRED_CMD MSR is available: " + if [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then + pstatus yellow UNKNOWN "is msr kernel module available?" + else + # the new MSR 'PRED_CTRL' is at offset 0x49, write-only + # here we use dd, it's the same as using 'wrmsr 0x49 0' but without needing the wrmsr tool + # if we get a write error, the MSR is not there + val=0 + cpu_mismatch=0 + for i in $(seq 0 "$idx_max_cpu") + do + write_msr 0x49 "$i"; ret=$? + if [ "$i" -eq 0 ]; then + val=$ret + else + if [ "$ret" -eq $val ]; then + continue + else + cpu_mismatch=1 + fi + fi + done + + if [ $val -eq 0 ]; then + if [ $cpu_mismatch -eq 0 ]; then + pstatus green YES + else + pstatus green YES "But not in all CPUs" + fi + elif [ $val -eq 200 ]; then + pstatus yellow UNKNOWN "is msr kernel module available?" + else + pstatus yellow NO + fi + fi + + _info_nol " * CPU indicates IBPB capability: " + # CPUID EAX=0x80000008, ECX=0x00 return EBX[12] indicates support for just IBPB. + if [ "$cpuid_spec_ctrl" = 1 ]; then + # spec_ctrl implies ibpb + cpuid_ibpb='SPEC_CTRL' + pstatus green YES "SPEC_CTRL feature bit" + elif is_intel; then + if [ "$cpuid_spec_ctrl" = -1 ]; then + pstatus yellow UNKNOWN "is cpuid kernel module available?" + else + pstatus yellow NO + fi + elif is_amd; then + read_cpuid 0x80000008 $EBX 12 1 1; ret=$? + if [ $ret -eq 0 ]; then + cpuid_ibpb='IBPB_SUPPORT' + pstatus green YES "IBPB_SUPPORT feature bit" + elif [ $ret -eq 1 ]; then + pstatus yellow NO + else + pstatus yellow UNKNOWN "is cpuid kernel module available?" + fi + fi + + # STIBP + _info " * Single Thread Indirect Branch Predictors (STIBP)" + _info_nol " * SPEC_CTRL MSR is available: " + if [ "$spec_ctrl_msr" = 1 ]; then + pstatus green YES + elif [ "$spec_ctrl_msr" = 0 ]; then + pstatus yellow NO + else + pstatus yellow UNKNOWN "is msr kernel module available?" + fi + + _info_nol " * CPU indicates STIBP capability: " + # intel: A processor supports STIBP if it enumerates CPUID (EAX=7H,ECX=0):EDX[27] as 1 + # amd: 8000_0008 EBX[15]=1 + if is_intel; then + read_cpuid 0x7 $EDX 27 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES "Intel STIBP feature bit" + #cpuid_stibp='Intel STIBP' + fi + elif is_amd; then + read_cpuid 0x80000008 $EBX 15 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES "AMD STIBP feature bit" + #cpuid_stibp='AMD STIBP' + fi + else + ret=-1 + pstatus yellow UNKNOWN "unknown CPU" + fi + if [ $ret -eq 1 ]; then + pstatus yellow NO + elif [ $ret -eq 2 ]; then + pstatus yellow UNKNOWN "is cpuid kernel module available?" + fi + + + if is_amd; then + _info_nol " * CPU indicates preferring STIBP always-on: " + read_cpuid 0x80000008 $EBX 17 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES + else + pstatus yellow NO + fi + fi + + if is_intel; then + _info " * Enhanced IBRS (IBRS_ALL)" + _info_nol " * CPU indicates ARCH_CAPABILITIES MSR availability: " + cpuid_arch_capabilities=-1 + # A processor supports the ARCH_CAPABILITIES MSR if it enumerates CPUID (EAX=7H,ECX=0):EDX[29] as 1 + read_cpuid 0x7 $EDX 29 1 1; ret=$? + if [ $ret -eq 0 ]; then + pstatus green YES + cpuid_arch_capabilities=1 + elif [ $ret -eq 2 ]; then + pstatus yellow UNKNOWN "is cpuid kernel module available?" + else + pstatus yellow NO + cpuid_arch_capabilities=0 + fi + + _info_nol " * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: " + capabilities_rdcl_no=-1 + capabilities_ibrs_all=-1 + if [ "$cpuid_arch_capabilities" = -1 ]; then + pstatus yellow UNKNOWN + elif [ "$cpuid_arch_capabilities" != 1 ]; then + capabilities_rdcl_no=0 + capabilities_ibrs_all=0 + pstatus yellow NO + elif [ ! -e /dev/cpu/0/msr ] && [ ! -e /dev/cpuctl0 ]; then + spec_ctrl_msr=-1 + pstatus yellow UNKNOWN "is msr kernel module available?" + else + # the new MSR 'ARCH_CAPABILITIES' is at offset 0x10a + # here we use dd, it's the same as using 'rdmsr 0x10a' but without needing the rdmsr tool + # if we get a read error, the MSR is not there. bs has to be 8 for msr + val=0 + val_cap_msr=0 + cpu_mismatch=0 + for i in $(seq 0 "$idx_max_cpu") + do + read_msr 0x10a "$i"; ret=$? + capabilities=$(echo "$read_msr_value" | awk '{print $8}') + if [ "$i" -eq 0 ]; then + val=$ret + val_cap_msr=$capabilities + else + if [ "$ret" -eq "$val" ] && [ "$capabilities" -eq "$val_cap_msr" ]; then + continue + else + cpu_mismatch=1 + fi + fi + done + capabilities=$val_cap_msr + capabilities_rdcl_no=0 + capabilities_ibrs_all=0 + if [ $val -eq 0 ]; then + _debug "capabilities MSR lower byte is $capabilities (decimal)" + [ $(( capabilities & 1 )) -eq 1 ] && capabilities_rdcl_no=1 + [ $(( capabilities & 2 )) -eq 2 ] && capabilities_ibrs_all=1 + _debug "capabilities says rdcl_no=$capabilities_rdcl_no ibrs_all=$capabilities_ibrs_all" + if [ "$capabilities_ibrs_all" = 1 ]; then + if [ $cpu_mismatch -eq 0 ]; then + pstatus green YES + else: + pstatus green YES "But not in all CPUs" + fi + else + pstatus yellow NO + fi + elif [ $val -eq 200 ]; then + pstatus yellow UNKNOWN "is msr kernel module available?" + else + pstatus yellow NO + fi + fi + + _info_nol " * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): " + if [ "$capabilities_rdcl_no" = -1 ]; then + pstatus yellow UNKNOWN + elif [ "$capabilities_rdcl_no" = 1 ]; then + pstatus green YES + else + pstatus yellow NO + fi + fi + + _info_nol " * CPU microcode is known to cause stability problems: " + if is_ucode_blacklisted; then + pstatus red YES "$ucode_found" + _warn + _warn "The microcode your CPU is running on is known to cause instability problems," + _warn "such as intempestive reboots or random crashes." + _warn "You are advised to either revert to a previous microcode version (that might not have" + _warn "the mitigations for Spectre), or upgrade to a newer one if available." + _warn + else + pstatus blue NO "$ucode_found" + fi +} + +check_cpu_vulnerabilities() +{ + _info "* CPU vulnerability to the three speculative execution attack variants" + for v in 1 2 3; do + _info_nol " * Vulnerable to Variant $v: " + if is_cpu_vulnerable $v; then + pstatus yellow YES + else + pstatus green NO + fi + done +} + +check_redhat_canonical_spectre() +{ + # if we were already called, don't do it again + [ -n "$redhat_canonical_spectre" ] && return + + if ! which "${opt_arch_prefix}strings" >/dev/null 2>&1; then + redhat_canonical_spectre=-1 + elif [ -n "$kernel_err" ]; then + redhat_canonical_spectre=-2 + else + # Red Hat / Ubuntu specific variant1 patch is difficult to detect, + # let's use the two same tricks than the official Red Hat detection script uses: + if "${opt_arch_prefix}strings" "$kernel" | grep -qw noibrs && "${opt_arch_prefix}strings" "$kernel" | grep -qw noibpb; then + # 1) detect their specific variant2 patch. If it's present, it means + # that the variant1 patch is also present (both were merged at the same time) + _debug "found redhat/canonical version of the variant2 patch (implies variant1)" + redhat_canonical_spectre=1 + elif "${opt_arch_prefix}strings" "$kernel" | grep -q 'x86/pti:'; then + # 2) detect their specific variant3 patch. If it's present, but the variant2 + # is not, it means that only variant1 is present in addition to variant3 + _debug "found redhat/canonical version of the variant3 patch (implies variant1 but not variant2)" + redhat_canonical_spectre=2 + else + redhat_canonical_spectre=0 + fi + fi +} + + ################### # SPECTRE VARIANT 1 check_variant1() { _info "\033[1;34mCVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'\033[0m" + if [ "$os" = Linux ]; then + check_variant1_linux + elif echo "$os" | grep -q BSD; then + check_variant1_bsd + else + _warn "Unsupported OS ($os)" + fi +} +check_variant1_linux() +{ status=UNK sys_interface_available=0 msg='' if sys_interface_check "/sys/devices/system/cpu/vulnerabilities/spectre_v1"; then # this kernel has the /sys interface, trust it over everything + # v0.33+: don't. some kernels have backported the array_index_mask_nospec() workaround without + # modifying the vulnerabilities/spectre_v1 file. that's bad. we can't trust it when it says Vulnerable :( + # see "silent backport" detection at the bottom of this func sys_interface_available=1 - else + fi + if [ "$opt_sysfs_only" != 1 ]; then # no /sys interface (or offline mode), fallback to our own ways - _info_nol "* Checking count of LFENCE opcodes in kernel: " - if [ -n "$vmlinux_err" ]; then - msg="couldn't check ($vmlinux_err)" - status=UNK - pstatus yellow UNKNOWN + _info_nol "* Kernel has array_index_mask_nospec (x86): " + # vanilla: look for the Linus' mask aka array_index_mask_nospec() + # that is inlined at least in raw_copy_from_user (__get_user_X symbols) + #mov PER_CPU_VAR(current_task), %_ASM_DX + #cmp TASK_addr_limit(%_ASM_DX),%_ASM_AX + #jae bad_get_user + # /* array_index_mask_nospec() are the 2 opcodes that follow */ + #+sbb %_ASM_DX, %_ASM_DX + #+and %_ASM_DX, %_ASM_AX + #ASM_STAC + # x86 64bits: jae(0x0f 0x83 0x?? 0x?? 0x?? 0x??) sbb(0x48 0x19 0xd2) and(0x48 0x21 0xd0) + # x86 32bits: cmp(0x3b 0x82 0x?? 0x?? 0x00 0x00) jae(0x73 0x??) sbb(0x19 0xd2) and(0x21 0xd0) + if [ -n "$kernel_err" ]; then + pstatus yellow UNKNOWN "couldn't check ($kernel_err)" + elif ! which perl >/dev/null 2>&1; then + pstatus yellow UNKNOWN "missing 'perl' binary, please install it" else - if ! which objdump >/dev/null 2>&1; then - msg="missing 'objdump' tool, please install it, usually it's in the binutils package" - status=UNK - pstatus yellow UNKNOWN + perl -ne '/\x0f\x83....\x48\x19\xd2\x48\x21\xd0/ and $found++; END { exit($found) }' "$kernel"; ret=$? + if [ $ret -gt 0 ]; then + pstatus green YES "$ret occurrence(s) found of 64 bits array_index_mask_nospec()" + v1_mask_nospec="64 bits array_index_mask_nospec" else - # here we disassemble the kernel and count the number of occurrences of the LFENCE opcode - # in non-patched kernels, this has been empirically determined as being around 40-50 - # in patched kernels, this is more around 70-80, sometimes way higher (100+) - # v0.13: 68 found in a 3.10.23-xxxx-std-ipv6-64 (with lots of modules compiled-in directly), which doesn't have the LFENCE patches, - # so let's push the threshold to 70. - nb_lfence=$(objdump -d "$vmlinux" | grep -wc lfence) - if [ "$nb_lfence" -lt 70 ]; then - msg="only $nb_lfence opcodes found, should be >= 70, heuristic to be improved when official patches become available" - status=VULN - pstatus red NO + perl -ne '/\x3b\x82..\x00\x00\x73.\x19\xd2\x21\xd0/ and $found++; END { exit($found) }' "$kernel"; ret=$? + if [ $ret -gt 0 ]; then + pstatus green YES "$ret occurrence(s) found of 32 bits array_index_mask_nospec()" + v1_mask_nospec="32 bits array_index_mask_nospec" else - msg="$nb_lfence opcodes found, which is >= 70, heuristic to be improved when official patches become available" - status=OK - pstatus green YES + pstatus yellow NO fi fi fi - fi - # if we have the /sys interface, don't even check is_cpu_vulnerable ourselves, the kernel already does it - if [ "$sys_interface_available" = 0 ] && ! is_cpu_vulnerable 1; then - # override status & msg in case CPU is not vulnerable after all - msg="your CPU vendor reported your CPU model as not vulnerable" - status=OK + _info_nol "* Kernel has the Red Hat/Ubuntu patch: " + check_redhat_canonical_spectre + if [ "$redhat_canonical_spectre" = -1 ]; then + pstatus yellow UNKNOWN "missing '${opt_arch_prefix}strings' tool, please install it, usually it's in the binutils package" + elif [ "$redhat_canonical_spectre" = -2 ]; then + pstatus yellow UNKNOWN "couldn't check ($kernel_err)" + elif [ "$redhat_canonical_spectre" = 1 ]; then + pstatus green YES + elif [ "$redhat_canonical_spectre" = 2 ]; then + pstatus green YES "but without IBRS" + else + pstatus yellow NO + fi + + _info_nol "* Kernel has mask_nospec64 (arm): " + #.macro mask_nospec64, idx, limit, tmp + #sub \tmp, \idx, \limit + #bic \tmp, \tmp, \idx + #and \idx, \idx, \tmp, asr #63 + #csdb + #.endm + #$ aarch64-linux-gnu-objdump -d vmlinux | grep -w bic -A1 -B1 | grep -w sub -A2 | grep -w and -B2 + #ffffff8008082e44: cb190353 sub x19, x26, x25 + #ffffff8008082e48: 8a3a0273 bic x19, x19, x26 + #ffffff8008082e4c: 8a93ff5a and x26, x26, x19, asr #63 + #ffffff8008082e50: d503229f hint #0x14 + # /!\ can also just be "csdb" instead of "hint #0x14" for native objdump + # + # if we have v1_mask_nospec or redhat_canonical_spectre>0, don't bother disassembling the kernel, the answer is no. + if [ -n "$v1_mask_nospec" ] || [ "$redhat_canonical_spectre" -gt 0 ]; then + pstatus yellow NO + elif [ -n "$kernel_err" ]; then + pstatus yellow UNKNOWN "couldn't check ($kernel_err)" + elif ! which perl >/dev/null 2>&1; then + pstatus yellow UNKNOWN "missing 'perl' binary, please install it" + elif ! which "${opt_arch_prefix}objdump" >/dev/null 2>&1; then + pstatus yellow UNKNOWN "missing '${opt_arch_prefix}objdump' tool, please install it, usually it's in the binutils package" + else + "${opt_arch_prefix}objdump" -d "$kernel" | perl -ne 'push @r, $_; /\s(hint|csdb)\s/ && $r[0]=~/\ssub\s+(x\d+)/ && $r[1]=~/\sbic\s+$1,\s+$1,/ && $r[2]=~/\sand\s/ && exit(9); shift @r if @r>3'; ret=$? + if [ "$ret" -eq 9 ]; then + pstatus green YES "mask_nospec64 macro is present and used" + v1_mask_nospec="arm mask_nospec64" + else + pstatus yellow NO + fi + fi + + + if [ "$opt_verbose" -ge 2 ] || ( [ -z "$v1_mask_nospec" ] && [ "$redhat_canonical_spectre" != 1 ] && [ "$redhat_canonical_spectre" != 2 ] ); then + # this is a slow heuristic and we don't need it if we already know the kernel is patched + # but still show it in verbose mode + _info_nol "* Checking count of LFENCE instructions following a jump in kernel... " + if [ -n "$kernel_err" ]; then + pstatus yellow UNKNOWN "couldn't check ($kernel_err)" + else + if ! which "${opt_arch_prefix}objdump" >/dev/null 2>&1; then + pstatus yellow UNKNOWN "missing '${opt_arch_prefix}objdump' tool, please install it, usually it's in the binutils package" + else + # here we disassemble the kernel and count the number of occurrences of the LFENCE opcode + # in non-patched kernels, this has been empirically determined as being around 40-50 + # in patched kernels, this is more around 70-80, sometimes way higher (100+) + # v0.13: 68 found in a 3.10.23-xxxx-std-ipv6-64 (with lots of modules compiled-in directly), which doesn't have the LFENCE patches, + # so let's push the threshold to 70. + # v0.33+: now only count lfence opcodes after a jump, way less error-prone + # non patched kernel have between 0 and 20 matches, patched ones have at least 40-45 + nb_lfence=$("${opt_arch_prefix}objdump" -d "$kernel" 2>/dev/null | grep -w -B1 lfence | grep -Ewc 'jmp|jne|je') + if [ "$nb_lfence" -lt 30 ]; then + pstatus yellow NO "only $nb_lfence jump-then-lfence instructions found, should be >= 30 (heuristic)" + else + v1_lfence=1 + pstatus green YES "$nb_lfence jump-then-lfence instructions found, which is >= 30 (heuristic)" + fi + fi + fi + fi + + else + # we have no sysfs but were asked to use it only! + msg="/sys vulnerability interface use forced, but it's not available!" + status=UNK fi # report status - pvulnstatus CVE-2017-5753 "$status" "$msg" + cve='CVE-2017-5753' + + if ! is_cpu_vulnerable 1; then + # override status & msg in case CPU is not vulnerable after all + pvulnstatus $cve OK "your CPU vendor reported your CPU model as not vulnerable" + elif [ -z "$msg" ]; then + # if msg is empty, sysfs check didn't fill it, rely on our own test + if [ -n "$v1_mask_nospec" ]; then + pvulnstatus $cve OK "Kernel source has been patched to mitigate the vulnerability ($v1_mask_nospec)" + elif [ "$redhat_canonical_spectre" = 1 ] || [ "$redhat_canonical_spectre" = 2 ]; then + pvulnstatus $cve OK "Kernel source has been patched to mitigate the vulnerability (Red Hat/Ubuntu patch)" + elif [ "$v1_lfence" = 1 ]; then + pvulnstatus $cve OK "Kernel source has PROBABLY been patched to mitigate the vulnerability (jump-then-lfence instructions heuristic)" + elif [ "$kernel_err" ]; then + pvulnstatus $cve UNK "Couldn't find kernel image or tools missing to execute the checks" + explain "Re-run this script with root privileges, after installing the missing tools indicated above" + else + pvulnstatus $cve VULN "Kernel source needs to be patched to mitigate the vulnerability" + explain "Your kernel is too old to have the mitigation for Variant 1, you should upgrade to a newer kernel. If you're using a Linux distro and didn't compile the kernel yourself, you should upgrade your distro to get a newer kernel." + fi + else + if [ "$msg" = "Vulnerable" ] && [ -n "$v1_mask_nospec" ]; then + pvulnstatus $cve OK "Kernel source has been patched to mitigate the vulnerability (silent backport of array_index_mask_nospec)" + else + if [ "$msg" = "Vulnerable" ]; then + msg="Kernel source needs to be patched to mitigate the vulnerability" + _explain="Your kernel is too old to have the mitigation for Variant 1, you should upgrade to a newer kernel. If you're using a Linux distro and didn't compile the kernel yourself, you should upgrade your distro to get a newer kernel." + fi + pvulnstatus $cve "$status" "$msg" + [ -n "$_explain" ] && explain "$_explain" + unset _explain + fi + fi } +check_variant1_bsd() +{ + cve='CVE-2017-5753' + if ! is_cpu_vulnerable 1; then + # override status & msg in case CPU is not vulnerable after all + pvulnstatus $cve OK "your CPU vendor reported your CPU model as not vulnerable" + else + pvulnstatus $cve VULN "no mitigation for BSD yet" + fi +} + + ################### # SPECTRE VARIANT 2 check_variant2() { _info "\033[1;34mCVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'\033[0m" + if [ "$os" = Linux ]; then + check_variant2_linux + elif echo "$os" | grep -q BSD; then + check_variant2_bsd + else + _warn "Unsupported OS ($os)" + fi +} +check_variant2_linux() +{ status=UNK sys_interface_available=0 msg='' if sys_interface_check "/sys/devices/system/cpu/vulnerabilities/spectre_v2"; then # this kernel has the /sys interface, trust it over everything sys_interface_available=1 - else + fi + if [ "$opt_sysfs_only" != 1 ]; then _info "* Mitigation 1" - _info_nol "* Hardware (CPU microcode) support for mitigation: " - if [ ! -e /dev/cpu/0/msr ]; then - # try to load the module ourselves (and remember it so we can rmmod it afterwards) - modprobe msr 2>/dev/null && insmod_msr=1 - _debug "attempted to load module msr, ret=$insmod_msr" - fi - if [ ! -e /dev/cpu/0/msr ]; then - pstatus yellow UNKNOWN "couldn't read /dev/cpu/0/msr, is msr support enabled in your kernel?" - else - # the new MSR 'SPEC_CTRL' is at offset 0x48 - # here we use dd, it's the same as using 'rdmsr 0x48' but without needing the rdmsr tool - # if we get a read error, the MSR is not there - dd if=/dev/cpu/0/msr of=/dev/null bs=8 count=1 skip=9 2>/dev/null - if [ $? -eq 0 ]; then - pstatus green YES - else - pstatus red NO - fi - fi - if [ "$insmod_msr" = 1 ]; then - # if we used modprobe ourselves, rmmod the module - rmmod msr 2>/dev/null - _debug "attempted to unload module msr, ret=$?" - fi + ibrs_can_tell=0 + ibrs_supported='' + ibrs_enabled='' + ibpb_can_tell=0 + ibpb_supported='' + ibpb_enabled='' - _info_nol "* Kernel support for IBRS: " if [ "$opt_live" = 1 ]; then + # in live mode, we can check for the ibrs_enabled file in debugfs + # all versions of the patches have it (NOT the case of IBPB or KPTI) + ibrs_can_tell=1 mount_debugfs - for ibrs_file in \ - /sys/kernel/debug/ibrs_enabled \ - /sys/kernel/debug/x86/ibrs_enabled \ - /proc/sys/kernel/ibrs_enabled; do - if [ -e "$ibrs_file" ]; then + for dir in \ + /sys/kernel/debug \ + /sys/kernel/debug/x86 \ + /proc/sys/kernel; do + if [ -e "$dir/ibrs_enabled" ]; then # if the file is there, we have IBRS compiled-in # /sys/kernel/debug/ibrs_enabled: vanilla - # /sys/kernel/debug/x86/ibrs_enabled: RedHat (see https://access.redhat.com/articles/3311301) + # /sys/kernel/debug/x86/ibrs_enabled: Red Hat (see https://access.redhat.com/articles/3311301) # /proc/sys/kernel/ibrs_enabled: OpenSUSE tumbleweed - pstatus green YES - ibrs_supported=1 - ibrs_enabled=$(cat "$ibrs_file" 2>/dev/null) - _debug "ibrs: found $ibrs_file=$ibrs_enabled" + specex_knob_dir=$dir + ibrs_supported="$dir/ibrs_enabled exists" + ibrs_enabled=$(cat "$dir/ibrs_enabled" 2>/dev/null) + _debug "ibrs: found $dir/ibrs_enabled=$ibrs_enabled" + # if ibrs_enabled is there, ibpb_enabled will be in the same dir + if [ -e "$dir/ibpb_enabled" ]; then + # if the file is there, we have IBPB compiled-in (see note above for IBRS) + ibpb_supported="$dir/ibpb_enabled exists" + ibpb_enabled=$(cat "$dir/ibpb_enabled" 2>/dev/null) + _debug "ibpb: found $dir/ibpb_enabled=$ibpb_enabled" + else + _debug "ibpb: $dir/ibpb_enabled file doesn't exist" + fi break else - _debug "ibrs: file $ibrs_file doesn't exist" + _debug "ibrs: $dir/ibrs_enabled file doesn't exist" fi done + # on some newer kernels, the spec_ctrl_ibrs flag in "$procfs/cpuinfo" + # is set when ibrs has been administratively enabled (usually from cmdline) + # which in that case means ibrs is supported *and* enabled for kernel & user + # as per the ibrs patch series v3 + if [ -z "$ibrs_supported" ]; then + if grep ^flags "$procfs/cpuinfo" | grep -qw spec_ctrl_ibrs; then + _debug "ibrs: found spec_ctrl_ibrs flag in $procfs/cpuinfo" + ibrs_supported="spec_ctrl_ibrs flag in $procfs/cpuinfo" + # enabled=2 -> kernel & user + ibrs_enabled=2 + # XXX and what about ibpb ? + fi + fi + if [ -e "/sys/devices/system/cpu/vulnerabilities/spectre_v2" ]; then + # when IBPB is enabled on 4.15+, we can see it in sysfs + if grep -q ', IBPB' "/sys/devices/system/cpu/vulnerabilities/spectre_v2"; then + _debug "ibpb: found enabled in sysfs" + [ -z "$ibpb_supported" ] && ibpb_supported='IBPB found enabled in sysfs' + [ -z "$ibpb_enabled" ] && ibpb_enabled=1 + fi + # when IBRS_FW is enabled on 4.15+, we can see it in sysfs + if grep -q ', IBRS_FW' "/sys/devices/system/cpu/vulnerabilities/spectre_v2"; then + _debug "ibrs: found IBRS_FW in sysfs" + [ -z "$ibrs_supported" ] && ibrs_supported='found IBRS_FW in sysfs' + ibrs_fw_enabled=1 + fi + # when IBRS is enabled on 4.15+, we can see it in sysfs + if grep -q 'Indirect Branch Restricted Speculation' "/sys/devices/system/cpu/vulnerabilities/spectre_v2"; then + _debug "ibrs: found IBRS in sysfs" + [ -z "$ibrs_supported" ] && ibrs_supported='found IBRS in sysfs' + [ -z "$ibrs_enabled" ] && ibrs_enabled=3 + fi + fi + # in live mode, if ibrs or ibpb is supported and we didn't find these are enabled, then they are not + [ -n "$ibrs_supported" ] && [ -z "$ibrs_enabled" ] && ibrs_enabled=0 + [ -n "$ibpb_supported" ] && [ -z "$ibpb_enabled" ] && ibpb_enabled=0 fi - if [ "$ibrs_supported" != 1 -a -n "$opt_map" ]; then + if [ -z "$ibrs_supported" ]; then + check_redhat_canonical_spectre + if [ "$redhat_canonical_spectre" = 1 ]; then + ibrs_supported="Red Hat/Ubuntu variant" + ibpb_supported="Red Hat/Ubuntu variant" + fi + fi + if [ -z "$ibrs_supported" ] && [ -n "$kernel" ]; then + if ! which "${opt_arch_prefix}strings" >/dev/null 2>&1; then + : + else + ibrs_can_tell=1 + ibrs_supported=$("${opt_arch_prefix}strings" "$kernel" | grep -Fw -e ', IBRS_FW' | head -1) + if [ -n "$ibrs_supported" ]; then + _debug "ibrs: found ibrs evidence in kernel image ($ibrs_supported)" + ibrs_supported="found '$ibrs_supported' in kernel image" + fi + fi + fi + if [ -z "$ibrs_supported" ] && [ -n "$opt_map" ]; then + ibrs_can_tell=1 if grep -q spec_ctrl "$opt_map"; then - pstatus green YES - ibrs_supported=1 + ibrs_supported="found spec_ctrl in symbols file" _debug "ibrs: found '*spec_ctrl*' symbol in $opt_map" fi fi - if [ "$ibrs_supported" != 1 ]; then - pstatus red NO + # recent (4.15) vanilla kernels have IBPB but not IBRS, and without the debugfs tunables of Red Hat + # we can detect it directly in the image + if [ -z "$ibpb_supported" ] && [ -n "$kernel" ]; then + if ! which "${opt_arch_prefix}strings" >/dev/null 2>&1; then + : + else + ibpb_can_tell=1 + ibpb_supported=$("${opt_arch_prefix}strings" "$kernel" | grep -Fw -e 'ibpb' -e ', IBPB' | head -1) + if [ -n "$ibpb_supported" ]; then + _debug "ibpb: found ibpb evidence in kernel image ($ibpb_supported)" + ibpb_supported="found '$ibpb_supported' in kernel image" + fi + fi fi - _info_nol "* IBRS enabled for Kernel space: " + _info_nol " * Kernel is compiled with IBRS support: " + if [ -z "$ibrs_supported" ]; then + if [ "$ibrs_can_tell" = 1 ]; then + pstatus yellow NO + else + # if we're in offline mode without System.map, we can't really know + pstatus yellow UNKNOWN "in offline mode, we need the kernel image and System.map to be able to tell" + fi + else + if [ "$opt_verbose" -ge 2 ]; then + pstatus green YES "$ibrs_supported" + else + pstatus green YES + fi + fi + + _info_nol " * IBRS enabled and active: " if [ "$opt_live" = 1 ]; then - # 0 means disabled - # 1 is enabled only for kernel space - # 2 is enabled for kernel and user space - case "$ibrs_enabled" in - "") [ "$ibrs_supported" = 1 ] && pstatus yellow UNKNOWN || pstatus red NO;; - 0) pstatus red NO;; - 1 | 2) pstatus green YES;; - *) pstatus yellow UNKNOWN;; - esac + if [ "$ibpb_enabled" = 2 ]; then + # if ibpb=2, ibrs is forcefully=0 + pstatus blue NO "IBPB used instead of IBRS in all kernel entrypoints" + else + # 0 means disabled + # 1 is enabled only for kernel space + # 2 is enabled for kernel and user space + # 3 is enabled + case "$ibrs_enabled" in + 0) + if [ "$ibrs_fw_enabled" = 1 ]; then + pstatus blue YES "for firmware code only" + else + pstatus yellow NO + fi + ;; + 1) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel space and firmware code"; else pstatus green YES "for kernel space"; fi;; + 2) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel, user space, and firmware code" ; else pstatus green YES "for both kernel and user space"; fi;; + 3) if [ "$ibrs_fw_enabled" = 1 ]; then pstatus green YES "for kernel and firmware code"; else pstatus green YES; fi;; + *) pstatus yellow UNKNOWN;; + esac + fi else pstatus blue N/A "not testable in offline mode" fi - _info_nol "* IBRS enabled for User space: " + _info_nol " * Kernel is compiled with IBPB support: " + if [ -z "$ibpb_supported" ]; then + if [ "$ibpb_can_tell" = 1 ]; then + pstatus yellow NO + else + # if we're in offline mode without System.map, we can't really know + pstatus yellow UNKNOWN "in offline mode, we need the kernel image to be able to tell" + fi + else + if [ "$opt_verbose" -ge 2 ]; then + pstatus green YES "$ibpb_supported" + else + pstatus green YES + fi + fi + + _info_nol " * IBPB enabled and active: " if [ "$opt_live" = 1 ]; then - case "$ibrs_enabled" in - "") [ "$ibrs_supported" = 1 ] && pstatus yellow UNKNOWN || pstatus red NO;; - 0 | 1) pstatus red NO;; - 2) pstatus green YES;; + case "$ibpb_enabled" in + "") + if [ "$ibrs_supported" = 1 ]; then + pstatus yellow UNKNOWN + else + pstatus yellow NO + fi + ;; + 0) + pstatus yellow NO + ;; + 1) pstatus green YES;; + 2) pstatus green YES "IBPB used instead of IBRS in all kernel entrypoints";; *) pstatus yellow UNKNOWN;; esac else @@ -748,180 +2174,539 @@ check_variant2() fi _info "* Mitigation 2" - _info_nol "* Kernel compiled with retpoline option: " + _info_nol " * Kernel has branch predictor hardening (arm): " + if [ -r "$opt_config" ]; then + bp_harden_can_tell=1 + bp_harden=$(grep -w 'CONFIG_HARDEN_BRANCH_PREDICTOR=y' "$opt_config") + if [ -n "$bp_harden" ]; then + pstatus green YES + _debug "bp_harden: found '$bp_harden' in $opt_config" + fi + fi + if [ -z "$bp_harden" ] && [ -n "$opt_map" ]; then + bp_harden_can_tell=1 + bp_harden=$(grep -w bp_hardening_data "$opt_map") + if [ -n "$bp_harden" ]; then + pstatus green YES + _debug "bp_harden: found '$bp_harden' in $opt_map" + fi + fi + if [ -z "$bp_harden" ]; then + if [ "$bp_harden_can_tell" = 1 ]; then + pstatus yellow NO + else + pstatus yellow UNKNOWN + fi + fi + + _info_nol " * Kernel compiled with retpoline option: " # We check the RETPOLINE kernel options if [ -r "$opt_config" ]; then if grep -q '^CONFIG_RETPOLINE=y' "$opt_config"; then pstatus green YES retpoline=1 - _debug "retpoline: found "$(grep '^CONFIG_RETPOLINE' "$opt_config")" in $opt_config" + # shellcheck disable=SC2046 + _debug 'retpoline: found '$(grep '^CONFIG_RETPOLINE' "$opt_config")" in $opt_config" else - pstatus red NO + pstatus yellow NO fi else pstatus yellow UNKNOWN "couldn't read your kernel configuration" fi - _info_nol "* Kernel compiled with a retpoline-aware compiler: " - # Now check if the compiler used to compile the kernel knows how to insert retpolines in generated asm - # For gcc, this is -mindirect-branch=thunk-extern (detected by the kernel makefiles) - # See gcc commit https://github.com/hjl-tools/gcc/commit/23b517d4a67c02d3ef80b6109218f2aadad7bd79 - # In latest retpoline LKML patches, the noretpoline_setup symbol exists only if CONFIG_RETPOLINE is set - # *AND* if the compiler is retpoline-compliant, so look for that symbol - if [ -n "$opt_map" ]; then - # look for the symbol - if grep -qw noretpoline_setup "$opt_map"; then - retpoline_compiler=1 - pstatus green YES "noretpoline_setup symbol found in System.map" - else - pstatus red NO - fi - elif [ -n "$vmlinux" ]; then - # look for the symbol - if which nm >/dev/null 2>&1; then - # the proper way: use nm and look for the symbol - if nm "$vmlinux" 2>/dev/null | grep -qw 'noretpoline_setup'; then - retpoline_compiler=1 - pstatus green YES "noretpoline_setup found in vmlinux symbols" - else - pstatus red NO + if [ "$retpoline" = 1 ]; then + # Now check if the compiler used to compile the kernel knows how to insert retpolines in generated asm + # For gcc, this is -mindirect-branch=thunk-extern (detected by the kernel makefiles) + # See gcc commit https://github.com/hjl-tools/gcc/commit/23b517d4a67c02d3ef80b6109218f2aadad7bd79 + # In latest retpoline LKML patches, the noretpoline_setup symbol exists only if CONFIG_RETPOLINE is set + # *AND* if the compiler is retpoline-compliant, so look for that symbol + # + # if there is "retpoline" in the file and NOT "minimal", then it's full retpoline + # (works for vanilla and Red Hat variants) + if [ "$opt_live" = 1 ] && [ -e "/sys/devices/system/cpu/vulnerabilities/spectre_v2" ]; then + if grep -qwi retpoline /sys/devices/system/cpu/vulnerabilities/spectre_v2; then + if grep -qwi minimal /sys/devices/system/cpu/vulnerabilities/spectre_v2; then + retpoline_compiler=0 + retpoline_compiler_reason="kernel reports minimal retpoline compilation" + else + retpoline_compiler=1 + retpoline_compiler_reason="kernel reports full retpoline compilation" + fi + fi + elif [ -n "$opt_map" ]; then + # look for the symbol + if grep -qw noretpoline_setup "$opt_map"; then + retpoline_compiler=1 + retpoline_compiler_reason="noretpoline_setup symbol found in System.map" + fi + elif [ -n "$kernel" ]; then + # look for the symbol + if which "${opt_arch_prefix}nm" >/dev/null 2>&1; then + # the proper way: use nm and look for the symbol + if "${opt_arch_prefix}nm" "$kernel" 2>/dev/null | grep -qw 'noretpoline_setup'; then + retpoline_compiler=1 + retpoline_compiler_reason="noretpoline_setup found in kernel symbols" + fi + elif grep -q noretpoline_setup "$kernel"; then + # if we don't have nm, nevermind, the symbol name is long enough to not have + # any false positive using good old grep directly on the binary + retpoline_compiler=1 + retpoline_compiler_reason="noretpoline_setup found in kernel" fi - elif grep -q noretpoline_setup "$vmlinux"; then - # if we don't have nm, nevermind, the symbol name is long enough to not have - # any false positive using good old grep directly on the binary - retpoline_compiler=1 - pstatus green YES "noretpoline_setup found in vmlinux" - else - pstatus red NO fi + if [ -n "$retpoline_compiler" ]; then + _info_nol " * Kernel compiled with a retpoline-aware compiler: " + if [ "$retpoline_compiler" = 1 ]; then + if [ -n "$retpoline_compiler_reason" ]; then + pstatus green YES "$retpoline_compiler_reason" + else + pstatus green YES + fi + else + if [ -n "$retpoline_compiler_reason" ]; then + pstatus red NO "$retpoline_compiler_reason" + else + pstatus red NO + fi + fi + fi + fi + + # only Red Hat has a tunable to disable it on runtime + if [ "$opt_live" = 1 ]; then + if [ -e "$specex_knob_dir/retp_enabled" ]; then + retp_enabled=$(cat "$specex_knob_dir/retp_enabled" 2>/dev/null) + _debug "retpoline: found $specex_knob_dir/retp_enabled=$retp_enabled" + _info_nol " * Retpoline is enabled: " + if [ "$retp_enabled" = 1 ]; then + pstatus green YES + else + pstatus yellow NO + fi + fi + fi + + # only for information, in verbose mode + if [ "$opt_verbose" -ge 2 ]; then + _info_nol " * Local gcc is retpoline-aware: " + if which gcc >/dev/null 2>&1; then + if [ -n "$(gcc -mindirect-branch=thunk-extern --version 2>&1 >/dev/null)" ]; then + pstatus blue NO + else + pstatus green YES + fi + else + pstatus blue NO "gcc is not installed" + fi + fi + + if is_skylake_cpu || [ "$opt_verbose" -ge 2 ]; then + _info_nol " * Kernel supports RSB filling: " + if ! which "${opt_arch_prefix}strings" >/dev/null 2>&1; then + pstatus yellow UNKNOWN "missing '${opt_arch_prefix}strings' tool, please install it, usually it's in the binutils package" + elif [ -z "$kernel" ]; then + pstatus yellow UNKNOWN "kernel image missing" + else + rsb_filling=$("${opt_arch_prefix}strings" "$kernel" | grep -w 'Filling RSB on context switch') + if [ -n "$rsb_filling" ]; then + pstatus green YES + else + pstatus yellow NO + fi + fi + fi + + elif [ "$sys_interface_available" = 0 ]; then + # we have no sysfs but were asked to use it only! + msg="/sys vulnerability interface use forced, but it's not available!" + status=UNK + fi + + cve='CVE-2017-5715' + if ! is_cpu_vulnerable 2; then + # override status & msg in case CPU is not vulnerable after all + pvulnstatus $cve OK "your CPU vendor reported your CPU model as not vulnerable" + else + if [ "$retpoline" = 1 ] && [ "$retpoline_compiler" = 1 ] && [ "$retp_enabled" != 0 ] && [ -n "$ibpb_enabled" ] && [ "$ibpb_enabled" -ge 1 ] && ( ! is_skylake_cpu || [ -n "$rsb_filling" ] ); then + pvulnstatus $cve OK "Full retpoline + IBPB are mitigating the vulnerability" + elif [ "$retpoline" = 1 ] && [ "$retpoline_compiler" = 1 ] && [ "$retp_enabled" != 0 ] && [ "$opt_paranoid" = 0 ] && ( ! is_skylake_cpu || [ -n "$rsb_filling" ] ); then + pvulnstatus $cve OK "Full retpoline is mitigating the vulnerability" + if [ -n "$cpuid_ibpb" ]; then + _warn "You should enable IBPB to complete retpoline as a Variant 2 mitigation" + else + _warn "IBPB is considered as a good addition to retpoline for Variant 2 mitigation, but your CPU microcode doesn't support it" + fi + elif [ -n "$ibrs_enabled" ] && [ -n "$ibpb_enabled" ] && [ "$ibrs_enabled" -ge 1 ] && [ "$ibpb_enabled" -ge 1 ]; then + pvulnstatus $cve OK "IBRS + IBPB are mitigating the vulnerability" + elif [ "$ibpb_enabled" = 2 ] && ! is_cpu_smt_enabled; then + pvulnstatus $cve OK "Full IBPB is mitigating the vulnerability" + elif [ -n "$bp_harden" ]; then + pvulnstatus $cve OK "Branch predictor hardening mitigates the vulnerability" + elif [ -z "$bp_harden" ] && [ "$cpu_vendor" = ARM ]; then + pvulnstatus $cve VULN "Branch predictor hardening is needed to mitigate the vulnerability" + explain "Your kernel has not been compiled with the CONFIG_UNMAP_KERNEL_AT_EL0 option, recompile it with this option enabled." + elif [ "$opt_live" != 1 ]; then + if [ "$retpoline" = 1 ] && [ -n "$ibpb_supported" ]; then + pvulnstatus $cve OK "offline mode: kernel supports retpoline + IBPB to mitigate the vulnerability" + elif [ -n "$ibrs_supported" ] && [ -n "$ibpb_supported" ]; then + pvulnstatus $cve OK "offline mode: kernel supports IBRS + IBPB to mitigate the vulnerability" + elif [ "$ibrs_can_tell" != 1 ]; then + pvulnstatus $cve UNK "offline mode: not enough information" + explain "Re-run this script with root privileges, and give it the kernel image (--kernel), the kernel configuration (--config) and the System.map file (--map) corresponding to the kernel you would like to inspect." + fi + fi + + # if we arrive here and didn't already call pvulnstatus, then it's VULN, let's explain why + if [ "$pvulnstatus_last_cve" != "$cve" ]; then + # explain what's needed for this CPU + if is_skylake_cpu; then + pvulnstatus $cve VULN "IBRS+IBPB or retpoline+IBPB+RBS filling, is needed to mitigate the vulnerability" + explain "To mitigate this vulnerability, you need either IBRS + IBPB, both requiring hardware support from your CPU microcode in addition to kernel support, or a kernel compiled with retpoline and IBPB, with retpoline requiring a retpoline-aware compiler (re-run this script with -v to know if your version of gcc is retpoline-aware) and IBPB requiring hardware support from your CPU microcode. You also need a recent-enough kernel that supports RSB filling if you plan to use retpoline. For Skylake+ CPUs, the IBRS + IBPB approach is generally preferred as it guarantees complete protection, and the performance impact is not as high as with older CPUs in comparison with retpoline. More information about how to enable the missing bits for those two possible mitigations on your system follow. You only need to take one of the two approaches." + elif is_zen_cpu; then + pvulnstatus $cve VULN "retpoline+IBPB is needed to mitigate the vulnerability" + explain "To mitigate this vulnerability, You need a kernel compiled with retpoline + IBPB support, with retpoline requiring a retpoline-aware compiler (re-run this script with -v to know if your version of gcc is retpoline-aware) and IBPB requiring hardware support from your CPU microcode." + elif is_intel || is_amd; then + pvulnstatus $cve VULN "IBRS+IBPB or retpoline+IBPB is needed to mitigate the vulnerability" + explain "To mitigate this vulnerability, you need either IBRS + IBPB, both requiring hardware support from your CPU microcode in addition to kernel support, or a kernel compiled with retpoline and IBPB, with retpoline requiring a retpoline-aware compiler (re-run this script with -v to know if your version of gcc is retpoline-aware) and IBPB requiring hardware support from your CPU microcode. The retpoline + IBPB approach is generally preferred as the performance impact is lower. More information about how to enable the missing bits for those two possible mitigations on your system follow. You only need to take one of the two approaches." + else + # in that case, we might want to trust sysfs if it's there + if [ -n "$msg" ]; then + [ "$msg" = Vulnerable ] && msg="no known mitigation exists for your CPU vendor ($cpu_vendor)" + pvulnstatus $cve $status "$msg" + else + pvulnstatus $cve VULN "no known mitigation exists for your CPU vendor ($cpu_vendor)" + fi + fi + fi + + # if we are in live mode, we can check for a lot more stuff and explain further + if [ "$opt_live" = 1 ] && [ "$vulnstatus" != "OK" ]; then + _explain_hypervisor="An updated CPU microcode will have IBRS/IBPB capabilities indicated in the Hardware Check section above. If you're running under an hypervisor (KVM, Xen, VirtualBox, VMware, ...), the hypervisor needs to be up to date to be able to export the new host CPU flags to the guest. You can run this script on the host to check if the host CPU is IBRS/IBPB. If it is, and it doesn't show up in the guest, upgrade the hypervisor." + # IBPB (amd & intel) + if ( [ -z "$ibpb_enabled" ] || [ "$ibpb_enabled" = 0 ] ) && ( is_intel || is_amd ); then + if [ -z "$cpuid_ibpb" ]; then + explain "The microcode of your CPU needs to be upgraded to be able to use IBPB. This is usually done at boot time by your kernel (the upgrade is not persistent across reboots which is why it's done at each boot). If you're using a distro, make sure you are up to date, as microcode updates are usually shipped alongside with the distro kernel. Availability of a microcode update for you CPU model depends on your CPU vendor. You can usually find out online if a microcode update is available for your CPU by searching for your CPUID (indicated in the Hardware Check section). $_explain_hypervisor" + fi + if [ -z "$ibpb_supported" ]; then + explain "Your kernel doesn't have IBPB support, so you need to either upgrade your kernel (if you're using a distro) or recompiling a more recent kernel." + fi + if [ -n "$cpuid_ibpb" ] && [ -n "$ibpb_supported" ]; then + if [ -e "$specex_knob_dir/ibpb_enabled" ]; then + # newer (April 2018) Red Hat kernels have ibpb_enabled as ro, and automatically enables it with retpoline + if [ ! -w "$specex_knob_dir/ibpb_enabled" ] && [ -e "$specex_knob_dir/retp_enabled" ]; then + explain "Both your CPU and your kernel have IBPB support, but it is currently disabled. You kernel should enable IBPB automatically if you enable retpoline. You may enable it with \`echo 1 > $specex_knob_dir/retp_enabled\`." + else + explain "Both your CPU and your kernel have IBPB support, but it is currently disabled. You may enable it with \`echo 1 > $specex_knob_dir/ibpb_enabled\`." + fi + else + explain "Both your CPU and your kernel have IBPB support, but it is currently disabled. You may enable it. Check in your distro's documentation on how to do this." + fi + fi + elif [ "$ibpb_enabled" = 2 ] && is_cpu_smt_enabled; then + explain "You have ibpb_enabled set to 2, but it only offers sufficient protection when simultaneous multi-threading (aka SMT or HyperThreading) is disabled. You should reboot your system with the kernel parameter \`nosmt\`." + fi + # /IBPB + + # IBRS (amd & intel) + if ( [ -z "$ibrs_enabled" ] || [ "$ibrs_enabled" = 0 ] ) && ( is_intel || is_amd ); then + if [ -z "$cpuid_ibrs" ]; then + explain "The microcode of your CPU needs to be upgraded to be able to use IBRS. This is usually done at boot time by your kernel (the upgrade is not persistent across reboots which is why it's done at each boot). If you're using a distro, make sure you are up to date, as microcode updates are usually shipped alongside with the distro kernel. Availability of a microcode update for you CPU model depends on your CPU vendor. You can usually find out online if a microcode update is available for your CPU by searching for your CPUID (indicated in the Hardware Check section). $_explain_hypervisor" + fi + if [ -z "$ibrs_supported" ]; then + explain "Your kernel doesn't have IBRS support, so you need to either upgrade your kernel (if you're using a distro) or recompiling a more recent kernel." + fi + if [ -n "$cpuid_ibrs" ] && [ -n "$ibrs_supported" ]; then + if [ -e "$specex_knob_dir/ibrs_enabled" ]; then + explain "Both your CPU and your kernel have IBRS support, but it is currently disabled. You may enable it with \`echo 1 > $specex_knob_dir/ibrs_enabled\`." + else + explain "Both your CPU and your kernel have IBRS support, but it is currently disabled. You may enable it. Check in your distro's documentation on how to do this." + fi + fi + fi + # /IBRS + unset _explain_hypervisor + + # RETPOLINE (amd & intel) + if is_amd || is_intel; then + if [ "$retpoline" = 0 ]; then + explain "Your kernel is not compiled with retpoline support, so you need to either upgrade your kernel (if you're using a distro) or recompile your kernel with the CONFIG_RETPOLINE option enabled. You also need to compile your kernel with a retpoline-aware compiler (re-run this script with -v to know if your version of gcc is retpoline-aware)." + elif [ "$retpoline" = 1 ] && [ "$retpoline_compiler" = 0 ]; then + explain "Your kernel is compiled with retpoline, but without a retpoline-aware compiler (re-run this script with -v to know if your version of gcc is retpoline-aware)." + elif [ "$retpoline" = 1 ] && [ "$retpoline_compiler" = 1 ] && [ "$retp_enabled" = 0 ]; then + explain "Your kernel has retpoline support and has been compiled with a retpoline-aware compiler, but retpoline is disabled. You should enable it with \`echo 1 > $specex_knob_dir/retp_enabled\`." + fi + fi + # /RETPOLINE + fi + fi + # sysfs msgs: + #1 "Vulnerable" + #2 "Vulnerable: Minimal generic ASM retpoline" + #2 "Vulnerable: Minimal AMD ASM retpoline" + # "Mitigation: Full generic retpoline" + # "Mitigation: Full AMD retpoline" + # $MITIGATION + ", IBPB" + # $MITIGATION + ", IBRS_FW" + #5 $MITIGATION + " - vulnerable module loaded" + # Red Hat only: + #2 "Vulnerable: Minimal ASM retpoline", + #3 "Vulnerable: Retpoline without IBPB", + #4 "Vulnerable: Retpoline on Skylake+", + #5 "Vulnerable: Retpoline with unsafe module(s)", + # "Mitigation: Full retpoline", + # "Mitigation: Full retpoline and IBRS (user space)", + # "Mitigation: IBRS (kernel)", + # "Mitigation: IBRS (kernel and user space)", + # "Mitigation: IBP disabled", +} + +check_variant2_bsd() +{ + _info "* Mitigation 1" + _info_nol " * Kernel supports IBRS: " + ibrs_disabled=$(sysctl -n hw.ibrs_disable 2>/dev/null) + if [ -z "$ibrs_disabled" ]; then + pstatus yellow NO + else + pstatus green YES + fi + + _info_nol " * IBRS enabled and active: " + ibrs_active=$(sysctl -n hw.ibrs_active 2>/dev/null) + if [ "$ibrs_active" = 1 ]; then + pstatus green YES + else + pstatus yellow NO + fi + + _info "* Mitigation 2" + _info_nol " * Kernel compiled with RETPOLINE: " + if [ -n "$kernel_err" ]; then + pstatus yellow UNKNOWN "couldn't check ($kernel_err)" + else + if ! which "${opt_arch_prefix}readelf" >/dev/null 2>&1; then + pstatus yellow UNKNOWN "missing '${opt_arch_prefix}readelf' tool, please install it, usually it's in the binutils package" else - pstatus yellow UNKNOWN "couldn't find your kernel image or System.map" + nb_thunks=$("${opt_arch_prefix}readelf" -s "$kernel" | grep -c -e __llvm_retpoline_ -e __llvm_external_retpoline_ -e __x86_indirect_thunk_) + if [ "$nb_thunks" -gt 0 ]; then + retpoline=1 + pstatus green YES "found $nb_thunks thunk(s)" + else + pstatus yellow NO + fi fi fi - # if we have the /sys interface, don't even check is_cpu_vulnerable ourselves, the kernel already does it - if [ "$sys_interface_available" = 0 ] && ! is_cpu_vulnerable 2; then + cve='CVE-2017-5715' + if ! is_cpu_vulnerable 2; then # override status & msg in case CPU is not vulnerable after all - pvulnstatus CVE-2017-5715 OK "your CPU vendor reported your CPU model as not vulnerable" - elif [ -z "$msg" ]; then - # if msg is empty, sysfs check didn't fill it, rely on our own test - if [ "$retpoline" = 1 -a "$retpoline_compiler" = 1 ]; then - pvulnstatus CVE-2017-5715 OK "retpoline mitigate the vulnerability" - elif [ "$opt_live" = 1 ]; then - if [ "$ibrs_enabled" = 1 -o "$ibrs_enabled" = 2 ]; then - pvulnstatus CVE-2017-5715 OK "IBRS mitigates the vulnerability" - else - pvulnstatus CVE-2017-5715 VULN "IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability" - fi - else - if [ "$ibrs_supported" = 1 ]; then - pvulnstatus CVE-2017-5715 OK "offline mode: IBRS will mitigate the vulnerability if enabled at runtime" - else - pvulnstatus CVE-2017-5715 VULN "IBRS hardware + kernel support OR kernel with retpoline are needed to mitigate the vulnerability" - fi - fi + pvulnstatus $cve OK "your CPU vendor reported your CPU model as not vulnerable" + elif [ "$retpoline" = 1 ]; then + pvulnstatus $cve OK "Retpoline mitigates the vulnerability" + elif [ "$ibrs_active" = 1 ]; then + pvulnstatus $cve OK "IBRS mitigates the vulnerability" + elif [ "$ibrs_disabled" = 0 ]; then + pvulnstatus $cve VULN "IBRS is supported by your kernel but your CPU microcode lacks support" + explain "The microcode of your CPU needs to be upgraded to be able to use IBRS. Availability of a microcode update for you CPU model depends on your CPU vendor. You can usually find out online if a microcode update is available for your CPU by searching for your CPUID (indicated in the Hardware Check section). To do a microcode update, you can search the ports for the \`cpupdate\` tool. Microcode updates done this way are not reboot-proof, so be sure to do it every time the system boots up." + elif [ "$ibrs_disabled" = 1 ]; then + pvulnstatus $cve VULN "IBRS is supported but administratively disabled on your system" + explain "To enable IBRS, use \`sysctl hw.ibrs_disable=0\`" else - pvulnstatus CVE-2017-5715 "$status" "$msg" + pvulnstatus $cve VULN "IBRS is needed to mitigate the vulnerability but your kernel is missing support" + explain "You need to either upgrade your kernel or recompile yourself a more recent version having IBRS support" fi } ######################## # MELTDOWN aka VARIANT 3 + +# no security impact but give a hint to the user in verbose mode +# about PCID/INVPCID cpuid features that must be present to avoid +# too big a performance impact with PTI +# refs: +# https://marc.info/?t=151532047900001&r=1&w=2 +# https://groups.google.com/forum/m/#!topic/mechanical-sympathy/L9mHTbeQLNU +pti_performance_check() +{ + _info_nol " * Reduced performance impact of PTI: " + if [ -e "$procfs/cpuinfo" ] && grep ^flags "$procfs/cpuinfo" | grep -qw pcid; then + cpu_pcid=1 + else + read_cpuid 0x1 $ECX 17 1 1; ret=$? + [ $ret -eq 0 ] && cpu_pcid=1 + fi + + if [ -e "$procfs/cpuinfo" ] && grep ^flags "$procfs/cpuinfo" | grep -qw invpcid; then + cpu_invpcid=1 + else + read_cpuid 0x7 $EBX 10 1 1; ret=$? + [ $ret -eq 0 ] && cpu_invpcid=1 + fi + + if [ "$cpu_invpcid" = 1 ]; then + pstatus green YES 'CPU supports INVPCID, performance impact of PTI will be greatly reduced' + elif [ "$cpu_pcid" = 1 ]; then + pstatus green YES 'CPU supports PCID, performance impact of PTI will be reduced' + else + pstatus blue NO 'PCID/INVPCID not supported, performance impact of PTI will be significant' + fi +} + check_variant3() { _info "\033[1;34mCVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'\033[0m" + if [ "$os" = Linux ]; then + check_variant3_linux + elif echo "$os" | grep -q BSD; then + check_variant3_bsd + else + _warn "Unsupported OS ($os)" + fi +} +check_variant3_linux() +{ status=UNK sys_interface_available=0 msg='' if sys_interface_check "/sys/devices/system/cpu/vulnerabilities/meltdown"; then # this kernel has the /sys interface, trust it over everything sys_interface_available=1 - else + fi + if [ "$opt_sysfs_only" != 1 ]; then _info_nol "* Kernel supports Page Table Isolation (PTI): " - kpti_support=0 + kpti_support='' kpti_can_tell=0 if [ -n "$opt_config" ]; then kpti_can_tell=1 - if grep -Eq '^(CONFIG_PAGE_TABLE_ISOLATION|CONFIG_KAISER)=y' "$opt_config"; then - _debug "kpti_support: found option "$(grep -E '^(CONFIG_PAGE_TABLE_ISOLATION|CONFIG_KAISER)=y' "$opt_config")" in $opt_config" - kpti_support=1 + kpti_support=$(grep -w -e CONFIG_PAGE_TABLE_ISOLATION=y -e CONFIG_KAISER=y -e CONFIG_UNMAP_KERNEL_AT_EL0=y "$opt_config") + if [ -n "$kpti_support" ]; then + _debug "kpti_support: found option '$kpti_support' in $opt_config" fi fi - if [ "$kpti_support" = 0 -a -n "$opt_map" ]; then + if [ -z "$kpti_support" ] && [ -n "$opt_map" ]; then # it's not an elif: some backports don't have the PTI config but still include the patch # so we try to find an exported symbol that is part of the PTI patch in System.map + # parse_kpti: arm kpti_can_tell=1 - if grep -qw kpti_force_enabled "$opt_map"; then - _debug "kpti_support: found kpti_force_enabled in $opt_map" - kpti_support=1 + kpti_support=$(grep -w -e kpti_force_enabled -e parse_kpti "$opt_map") + if [ -n "$kpti_support" ]; then + _debug "kpti_support: found '$kpti_support' in $opt_map" fi fi - if [ "$kpti_support" = 0 -a -n "$vmlinux" ]; then - # same as above but in case we don't have System.map and only vmlinux, look for the + if [ -z "$kpti_support" ] && [ -n "$kernel" ]; then + # same as above but in case we don't have System.map and only kernel, look for the # nopti option that is part of the patch (kernel command line option) + # 'kpti=': arm kpti_can_tell=1 - if ! which strings >/dev/null 2>&1; then - pstatus yellow UNKNOWN "missing 'strings' tool, please install it, usually it's in the binutils package" + if ! which "${opt_arch_prefix}strings" >/dev/null 2>&1; then + pstatus yellow UNKNOWN "missing '${opt_arch_prefix}strings' tool, please install it, usually it's in the binutils package" else - if strings "$vmlinux" | grep -qw nopti; then - _debug "kpti_support: found nopti string in $vmlinux" - kpti_support=1 + kpti_support=$("${opt_arch_prefix}strings" "$kernel" | grep -w -e nopti -e kpti=) + if [ -n "$kpti_support" ]; then + _debug "kpti_support: found '$kpti_support' in $kernel" fi fi fi - if [ "$kpti_support" = 1 ]; then - pstatus green YES + if [ -n "$kpti_support" ]; then + if [ "$opt_verbose" -ge 2 ]; then + pstatus green YES "found '$kpti_support'" + else + pstatus green YES + fi elif [ "$kpti_can_tell" = 1 ]; then - pstatus red NO + pstatus yellow NO else pstatus yellow UNKNOWN "couldn't read your kernel configuration nor System.map file" fi mount_debugfs - _info_nol "* PTI enabled and active: " + _info_nol " * PTI enabled and active: " if [ "$opt_live" = 1 ]; then dmesg_grep="Kernel/User page tables isolation: enabled" dmesg_grep="$dmesg_grep|Kernel page table isolation enabled" dmesg_grep="$dmesg_grep|x86/pti: Unmapping kernel while in userspace" - if grep ^flags /proc/cpuinfo | grep -qw pti; then + if grep ^flags "$procfs/cpuinfo" | grep -qw pti; then # vanilla PTI patch sets the 'pti' flag in cpuinfo - _debug "kpti_enabled: found 'pti' flag in /proc/cpuinfo" + _debug "kpti_enabled: found 'pti' flag in $procfs/cpuinfo" kpti_enabled=1 - elif grep ^flags /proc/cpuinfo | grep -qw kaiser; then + elif grep ^flags "$procfs/cpuinfo" | grep -qw kaiser; then # kernel line 4.9 sets the 'kaiser' flag in cpuinfo - _debug "kpti_enabled: found 'kaiser' flag in /proc/cpuinfo" + _debug "kpti_enabled: found 'kaiser' flag in $procfs/cpuinfo" kpti_enabled=1 elif [ -e /sys/kernel/debug/x86/pti_enabled ]; then - # RedHat Backport creates a dedicated file, see https://access.redhat.com/articles/3311301 + # Red Hat Backport creates a dedicated file, see https://access.redhat.com/articles/3311301 kpti_enabled=$(cat /sys/kernel/debug/x86/pti_enabled 2>/dev/null) _debug "kpti_enabled: file /sys/kernel/debug/x86/pti_enabled exists and says: $kpti_enabled" - elif dmesg | grep -Eq "$dmesg_grep"; then - # if we can't find the flag, grep dmesg output - _debug "kpti_enabled: found hint in dmesg: "$(dmesg | grep -E "$dmesg_grep") - kpti_enabled=1 - elif [ -r /var/log/dmesg ] && grep -Eq "$dmesg_grep" /var/log/dmesg; then - # if we can't find the flag in dmesg output, grep in /var/log/dmesg when readable - _debug "kpti_enabled: found hint in /var/log/dmesg: "$(grep -E "$dmesg_grep" /var/log/dmesg) - kpti_enabled=1 - else + fi + if [ -z "$kpti_enabled" ]; then + dmesg_grep "$dmesg_grep"; ret=$? + if [ $ret -eq 0 ]; then + _debug "kpti_enabled: found hint in dmesg: $dmesg_grepped" + kpti_enabled=1 + elif [ $ret -eq 2 ]; then + _debug "kpti_enabled: dmesg truncated" + kpti_enabled=-1 + fi + fi + if [ -z "$kpti_enabled" ]; then _debug "kpti_enabled: couldn't find any hint that PTI is enabled" kpti_enabled=0 fi if [ "$kpti_enabled" = 1 ]; then pstatus green YES + elif [ "$kpti_enabled" = -1 ]; then + pstatus yellow UNKNOWN "dmesg truncated, please reboot and relaunch this script" else - pstatus red NO + pstatus yellow NO fi else - pstatus blue N/A "can't verify if PTI is enabled in offline mode" + pstatus blue N/A "not testable in offline mode" + fi + + pti_performance_check + + elif [ "$sys_interface_available" = 0 ]; then + # we have no sysfs but were asked to use it only! + msg="/sys vulnerability interface use forced, but it's not available!" + status=UNK + fi + + + # Test if the current host is a Xen PV Dom0 / DomU + if [ -d "/proc/xen" ]; then + # XXX do we have a better way that relying on dmesg? + dmesg_grep 'Booting paravirtualized kernel on Xen$'; ret=$? + if [ $ret -eq 2 ]; then + _warn "dmesg truncated, Xen detection will be unreliable. Please reboot and relaunch this script" + elif [ $ret -eq 0 ]; then + if [ -e /proc/xen/capabilities ] && grep -q "control_d" /proc/xen/capabilities; then + xen_pv_domo=1 + else + xen_pv_domu=1 + fi + # PVHVM guests also print 'Booting paravirtualized kernel', so we need this check. + dmesg_grep 'Xen HVM callback vector for event delivery is enabled$'; ret=$? + if [ $ret -eq 0 ]; then + xen_pv_domu=0 + fi + fi + fi + + if [ "$opt_live" = 1 ]; then + # checking whether we're running under Xen PV 64 bits. If yes, we are affected by variant3 + # (unless we are a Dom0) + _info_nol "* Running as a Xen PV DomU: " + if [ "$xen_pv_domu" = 1 ]; then + pstatus yellow YES + else + pstatus blue NO fi fi - # if we have the /sys interface, don't even check is_cpu_vulnerable ourselves, the kernel already does it cve='CVE-2017-5754' - if [ "$sys_interface_available" = 0 ] && ! is_cpu_vulnerable 3; then + if ! is_cpu_vulnerable 3; then # override status & msg in case CPU is not vulnerable after all pvulnstatus $cve OK "your CPU vendor reported your CPU model as not vulnerable" elif [ -z "$msg" ]; then @@ -929,54 +2714,142 @@ check_variant3() if [ "$opt_live" = 1 ]; then if [ "$kpti_enabled" = 1 ]; then pvulnstatus $cve OK "PTI mitigates the vulnerability" + elif [ "$xen_pv_domo" = 1 ]; then + pvulnstatus $cve OK "Xen Dom0s are safe and do not require PTI" + elif [ "$xen_pv_domu" = 1 ]; then + pvulnstatus $cve VULN "Xen PV DomUs are vulnerable and need to be run in HVM, PVHVM, PVH mode, or the Xen hypervisor must have the Xen's own PTI patch" + explain "Go to https://blog.xenproject.org/2018/01/22/xen-project-spectre-meltdown-faq-jan-22-update/ for more information" + elif [ "$kpti_enabled" = -1 ]; then + pvulnstatus $cve UNK "couldn't find any clue of PTI activation due to a truncated dmesg, please reboot and relaunch this script" else pvulnstatus $cve VULN "PTI is needed to mitigate the vulnerability" + if [ -n "$kpti_support" ]; then + if [ -e "/sys/kernel/debug/x86/pti_enabled" ]; then + explain "Your kernel supports PTI but it's disabled, you can enable it with \`echo 1 > /sys/kernel/debug/x86/pti_enabled\`" + elif grep -q -w nopti -w pti=off /proc/cmdline; then + explain "Your kernel supports PTI but it has been disabled on command-line, remove the nopti or pti=off option from your bootloader configuration" + else + explain "Your kernel supports PTI but it has been disabled, check \`dmesg\` right after boot to find clues why the system disabled it" + fi + else + explain "If you're using a distro kernel, upgrade your distro to get the latest kernel available. Otherwise, recompile the kernel with the CONFIG_PAGE_TABLE_ISOLATION option (named CONFIG_KAISER for some kernels), or the CONFIG_UNMAP_KERNEL_AT_EL0 option (for ARM64)" + fi fi else - if [ "$kpti_support" = 1 ]; then + if [ -n "$kpti_support" ]; then pvulnstatus $cve OK "offline mode: PTI will mitigate the vulnerability if enabled at runtime" - else + elif [ "$kpti_can_tell" = 1 ]; then pvulnstatus $cve VULN "PTI is needed to mitigate the vulnerability" + explain "If you're using a distro kernel, upgrade your distro to get the latest kernel available. Otherwise, recompile the kernel with the CONFIG_PAGE_TABLE_ISOLATION option (named CONFIG_KAISER for some kernels), or the CONFIG_UNMAP_KERNEL_AT_EL0 option (for ARM64)" + else + pvulnstatus $cve UNK "offline mode: not enough information" + explain "Re-run this script with root privileges, and give it the kernel image (--kernel), the kernel configuration (--config) and the System.map file (--map) corresponding to the kernel you would like to inspect." fi fi else + if [ "$xen_pv_domo" = 1 ]; then + msg="Xen Dom0s are safe and do not require PTI" + status="OK" + elif [ "$xen_pv_domu" = 1 ]; then + msg="Xen PV DomUs are vulnerable and need to be run in HVM, PVHVM, PVH mode, or the Xen hypervisor must have the Xen's own PTI patch" + status="VULN" + _explain="Go to https://blog.xenproject.org/2018/01/22/xen-project-spectre-meltdown-faq-jan-22-update/ for more information" + elif [ "$msg" = "Vulnerable" ]; then + msg="PTI is needed to mitigate the vulnerability" + _explain="If you're using a distro kernel, upgrade your distro to get the latest kernel available. Otherwise, recompile the kernel with the CONFIG_PAGE_TABLE_ISOLATION option (named CONFIG_KAISER for some kernels), or the CONFIG_UNMAP_KERNEL_AT_EL0 option (for ARM64)" + fi pvulnstatus $cve "$status" "$msg" + [ -z "$_explain" ] && [ "$msg" = "Vulnerable" ] && _explain="If you're using a distro kernel, upgrade your distro to get the latest kernel available. Otherwise, recompile the kernel with the CONFIG_PAGE_TABLE_ISOLATION option (named CONFIG_KAISER for some kernels), or the CONFIG_UNMAP_KERNEL_AT_EL0 option (for ARM64)" + [ -n "$_explain" ] && explain "$_explain" + unset _explain + fi + + # Warn the user about XSA-254 recommended mitigations + if [ "$xen_pv_domo" = 1 ]; then + _warn + _warn "This host is a Xen Dom0. Please make sure that you are running your DomUs" + _warn "in HVM, PVHVM or PVH mode to prevent any guest-to-host / host-to-guest attacks." + _warn + _warn "See https://blog.xenproject.org/2018/01/22/xen-project-spectre-meltdown-faq-jan-22-update/ and XSA-254 for details." fi } +check_variant3_bsd() +{ + _info_nol "* Kernel supports Page Table Isolation (PTI): " + kpti_enabled=$(sysctl -n vm.pmap.pti 2>/dev/null) + if [ -z "$kpti_enabled" ]; then + pstatus yellow NO + else + pstatus green YES + fi + + _info_nol " * PTI enabled and active: " + if [ "$kpti_enabled" = 1 ]; then + pstatus green YES + else + pstatus yellow NO + fi + + pti_performance_check + + cve='CVE-2017-5754' + if ! is_cpu_vulnerable 3; then + # override status & msg in case CPU is not vulnerable after all + pvulnstatus $cve OK "your CPU vendor reported your CPU model as not vulnerable" + elif [ "$kpti_enabled" = 1 ]; then + pvulnstatus $cve OK "PTI mitigates the vulnerability" + elif [ -n "$kpti_enabled" ]; then + pvulnstatus $cve VULN "PTI is supported but disabled on your system" + else + pvulnstatus $cve VULN "PTI is needed to mitigate the vulnerability" + fi +} + +if [ "$opt_no_hw" = 0 ] && [ -z "$opt_arch_prefix" ]; then + check_cpu + check_cpu_vulnerabilities + _info +fi + # now run the checks the user asked for -if [ "$opt_variant1" = 1 -o "$opt_allvariants" = 1 ]; then +if [ "$opt_variant1" = 1 ] || [ "$opt_allvariants" = 1 ]; then check_variant1 _info fi -if [ "$opt_variant2" = 1 -o "$opt_allvariants" = 1 ]; then +if [ "$opt_variant2" = 1 ] || [ "$opt_allvariants" = 1 ]; then check_variant2 _info fi -if [ "$opt_variant3" = 1 -o "$opt_allvariants" = 1 ]; then +if [ "$opt_variant3" = 1 ] || [ "$opt_allvariants" = 1 ]; then check_variant3 _info fi +_vars=$(set | grep -Ev '^[A-Z_[:space:]]' | sort | tr "\n" '|') +_debug "variables at end of script: $_vars" + _info "A false sense of security is worse than no security at all, see --disclaimer" -# this'll umount only if we mounted debugfs ourselves -umount_debugfs - -# cleanup the temp decompressed config -[ -n "$dumped_config" ] && rm -f "$dumped_config" - -if [ "$opt_batch" = 1 -a "$opt_batch_format" = "nrpe" ]; then +if [ "$opt_batch" = 1 ] && [ "$opt_batch_format" = "nrpe" ]; then if [ ! -z "$nrpe_vuln" ]; then echo "Vulnerable:$nrpe_vuln" else echo "OK" fi - [ "$nrpe_critical" = 1 ] && exit 2 # critical - [ "$nrpe_unknown" = 1 ] && exit 3 # unknown - exit 0 # ok fi -if [ "$opt_batch" = 1 -a "$opt_batch_format" = "json" ]; then - _echo 0 ${json_output%?}] +if [ "$opt_batch" = 1 ] && [ "$opt_batch_format" = "json" ]; then + _echo 0 "${json_output%?}]" fi + +if [ "$opt_batch" = 1 ] && [ "$opt_batch_format" = "prometheus" ]; then + echo "# TYPE specex_vuln_status untyped" + echo "# HELP specex_vuln_status Exposure of system to speculative execution vulnerabilities" + echo "$prometheus_output" +fi + +# exit with the proper exit code +[ "$global_critical" = 1 ] && exit 2 # critical +[ "$global_unknown" = 1 ] && exit 3 # unknown +exit 0 # ok From ae89e38d56e12d6efeb2a6bd7fabeaa4f2453882 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 10 May 2018 19:13:31 +0200 Subject: [PATCH 174/313] [fix] some services are marked as None --- src/yunohost/service.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 1852259ad..ef31afda0 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -574,6 +574,12 @@ def _get_services(): except: return {} else: + # some services are marked as None to remove them from YunoHost + # filter this + for key, value in services.items(): + if value is None: + del services[key] + return services From e8412ae0c8097c234233d07ab2fce889c542f290 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 10 May 2018 19:44:05 +0200 Subject: [PATCH 175/313] [mod] more debug information --- src/yunohost/service.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 1852259ad..7e52ec9c5 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -75,6 +75,7 @@ def service_add(name, status=None, log=None, runlevel=None): try: _save_services(services) except: + # we'll get a logger.warning with more details in _save_services raise MoulinetteError(errno.EIO, m18n.n('service_add_failed', service=name)) logger.success(m18n.n('service_added', service=name)) @@ -98,6 +99,7 @@ def service_remove(name): try: _save_services(services) except: + # we'll get a logger.warning with more details in _save_services raise MoulinetteError(errno.EIO, m18n.n('service_remove_failed', service=name)) logger.success(m18n.n('service_removed', service=name)) @@ -585,9 +587,12 @@ def _save_services(services): services -- A dict of managed services with their parameters """ - # TODO: Save to custom services.yml - with open('/etc/yunohost/services.yml', 'w') as f: - yaml.safe_dump(services, f, default_flow_style=False) + try: + with open('/etc/yunohost/services.yml', 'w') as f: + yaml.safe_dump(services, f, default_flow_style=False) + except Exception as e: + logger.warning('Error while saving services, exception: %s', e, exc_info=1) + raise def _tail(file, n, offset=None): From 061b6bbcce7131e01198f39bdcaedf43a5d26fe1 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 10 May 2018 21:51:36 +0200 Subject: [PATCH 176/313] [enh] display service journalctl logs on failed to start/stop/enable/disable error --- locales/en.json | 8 ++++---- src/yunohost/service.py | 25 +++++++++++++++++++++---- 2 files changed, 25 insertions(+), 8 deletions(-) diff --git a/locales/en.json b/locales/en.json index 0f45c7a8b..d237333d3 100644 --- a/locales/en.json +++ b/locales/en.json @@ -334,9 +334,9 @@ "service_conf_up_to_date": "The configuration is already up-to-date for service '{service}'", "service_conf_updated": "The configuration has been updated for service '{service}'", "service_conf_would_be_updated": "The configuration would have been updated for service '{service}'", - "service_disable_failed": "Unable to disable service '{service:s}'", + "service_disable_failed": "Unable to disable service '{service:s}'\n\nRecent service logs:{logs:s}", "service_disabled": "The service '{service:s}' has been disabled", - "service_enable_failed": "Unable to enable service '{service:s}'", + "service_enable_failed": "Unable to enable service '{service:s}'\n\nRecent service logs:{logs:s}", "service_enabled": "The service '{service:s}' has been enabled", "service_no_log": "No log to display for service '{service:s}'", "service_regenconf_dry_pending_applying": "Checking pending configuration which would have been applied for service '{service}'...", @@ -344,10 +344,10 @@ "service_regenconf_pending_applying": "Applying pending configuration for service '{service}'...", "service_remove_failed": "Unable to remove service '{service:s}'", "service_removed": "The service '{service:s}' has been removed", - "service_start_failed": "Unable to start service '{service:s}'", + "service_start_failed": "Unable to start service '{service:s}'\n\nRecent service logs:{logs:s}", "service_started": "The service '{service:s}' has been started", "service_status_failed": "Unable to determine status of service '{service:s}'", - "service_stop_failed": "Unable to stop service '{service:s}'", + "service_stop_failed": "Unable to stop service '{service:s}'\n\nRecent service logs:{logs:s}", "service_stopped": "The service '{service:s}' has been stopped", "service_unknown": "Unknown service '{service:s}'", "ssowat_conf_generated": "The SSOwat configuration has been generated", diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 7e52ec9c5..13256c324 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -115,13 +115,16 @@ def service_start(names): """ if isinstance(names, str): names = [names] + for name in names: if _run_service_command('start', name): logger.success(m18n.n('service_started', service=name)) else: if service_status(name)['status'] != 'running': raise MoulinetteError(errno.EPERM, - m18n.n('service_start_failed', service=name)) + m18n.n('service_start_failed', + service=name, + logs=_get_journalctl_logs(name))) logger.info(m18n.n('service_already_started', service=name)) @@ -141,7 +144,9 @@ def service_stop(names): else: if service_status(name)['status'] != 'inactive': raise MoulinetteError(errno.EPERM, - m18n.n('service_stop_failed', service=name)) + m18n.n('service_stop_failed', + service=name, + logs=_get_journalctl_logs(name))) logger.info(m18n.n('service_already_stopped', service=name)) @@ -160,7 +165,9 @@ def service_enable(names): logger.success(m18n.n('service_enabled', service=name)) else: raise MoulinetteError(errno.EPERM, - m18n.n('service_enable_failed', service=name)) + m18n.n('service_enable_failed', + service=name, + logs=_get_journalctl_logs(name))) def service_disable(names): @@ -178,7 +185,9 @@ def service_disable(names): logger.success(m18n.n('service_disabled', service=name)) else: raise MoulinetteError(errno.EPERM, - m18n.n('service_disable_failed', service=name)) + m18n.n('service_disable_failed', + service=name, + logs=_get_journalctl_logs(name))) def service_status(names=[]): @@ -798,3 +807,11 @@ def manually_modified_files(): output.append(filename) return output + + +def _get_journalctl_logs(service): + try: + return subprocess.check_output("journalctl -xn -u %s" % service, shell=True) + except: + import traceback + return "error while get services logs from journalctl:\n%s" % traceback.format_exc() From 4420cc300a915fcb149d1065b8477a48f0ca7ee4 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 10 May 2018 22:10:35 +0200 Subject: [PATCH 177/313] [mod] remove unused variable --- src/yunohost/service.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 13256c324..8485a9f2c 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -229,8 +229,8 @@ def service_status(names=[]): # Retrieve service status try: - ret = subprocess.check_output(status, stderr=subprocess.STDOUT, - shell=True) + subprocess.check_output(status, stderr=subprocess.STDOUT, + shell=True) except subprocess.CalledProcessError as e: if 'usage:' in e.output.lower(): logger.warning(m18n.n('service_status_failed', service=name)) From 2843ce923d53403934995d4a6d48120746d68506 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 10 May 2018 22:37:27 +0200 Subject: [PATCH 178/313] Have a specific upgrade for nginx-common because some people edit /etc/nginx/nginx.conf --- locales/en.json | 1 + .../data_migrations/0003_migrate_to_stretch.py | 16 ++++++++++++++-- src/yunohost/service.py | 11 +++++++++++ 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/locales/en.json b/locales/en.json index 0f45c7a8b..ff1616c79 100644 --- a/locales/en.json +++ b/locales/en.json @@ -230,6 +230,7 @@ "migration_0003_patching_sources_list": "Patching the sources.lists ...", "migration_0003_main_upgrade": "Starting main upgrade ...", "migration_0003_fail2ban_upgrade": "Starting the fail2ban upgrade ...", + "migration_0003_nginx_upgrade": "Starting the nginx-common upgrade ...", "migration_0003_yunohost_upgrade": "Starting the yunohost package upgrade ... The migration will end, but the actual upgrade will happen right after. After the operation is complete, you might have to re-log on the webadmin.", "migration_0003_not_jessie": "The current debian distribution is not Jessie !", "migration_0003_system_not_fully_up_to_date": "Your system is not fully up to date. Please perform a regular upgrade before running the migration to stretch.", diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index ab4974e2e..a15d786df 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -15,7 +15,10 @@ from moulinette.utils.filesystem import read_file from yunohost.tools import Migration from yunohost.app import unstable_apps -from yunohost.service import _run_service_command, service_regen_conf, manually_modified_files +from yunohost.service import (_run_service_command, + service_regen_conf, + manually_modified_files, + manually_modified_files_compared_to_debian_default) from yunohost.utils.filesystem import free_space_in_directory from yunohost.utils.packages import get_installed_version @@ -47,7 +50,7 @@ class MyMigration(Migration): self.apt_update() apps_packages = self.get_apps_equivs_packages() self.unhold(["metronome"]) - self.hold(YUNOHOST_PACKAGES + apps_packages + ["fail2ban"]) + self.hold(YUNOHOST_PACKAGES + apps_packages + ["fail2ban", "nginx-common"]) # Main dist-upgrade logger.warning(m18n.n("migration_0003_main_upgrade")) @@ -68,6 +71,11 @@ class MyMigration(Migration): self.apt_dist_upgrade(conf_flags=["new", "miss", "def"]) _run_service_command("restart", "fail2ban") + # Specific upgrade for nginx-common... + logger.warning(m18n.n("migration_0003_nginx_upgrade")) + self.unhold(["nginx-common"]) + self.apt_dist_upgrade(conf_flags=["new", "def"]) + # Clean the mess os.system("apt autoremove --assume-yes") os.system("apt clean --assume-yes") @@ -129,6 +137,10 @@ class MyMigration(Migration): # Manually modified files ? (c.f. yunohost service regen-conf) modified_files = manually_modified_files() + # We also have a specific check for nginx.conf which some people + # modified and needs to be upgraded... + if "/etc/nginx/nginx.conf" in manually_modified_files_compared_to_debian_default(): + modified_files.append("/etc/nginx/nginx.conf") modified_files = "".join(["\n - "+f for f in modified_files ]) message = m18n.n("migration_0003_general_warning") diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 1852259ad..6c8acfbca 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -793,3 +793,14 @@ def manually_modified_files(): output.append(filename) return output + + +def manually_modified_files_compared_to_debian_default(): + + # from https://serverfault.com/a/90401 + r = subprocess.check_output("dpkg-query -W -f='${Conffiles}\n' '*' \ + | awk 'OFS=\" \"{print $2,$1}' \ + | md5sum -c 2>/dev/null \ + | awk -F': ' '$2 !~ /OK/{print $1}'", shell=True) + return r.strip().split("\n") + From e848524912a5846cbb4fb376aa7836dd5935e5fe Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 10 May 2018 22:58:28 +0200 Subject: [PATCH 179/313] Unused imports, PEP8 --- .../0003_migrate_to_stretch.py | 22 ++++++------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index a15d786df..41ab6b4b2 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -1,10 +1,5 @@ import glob import os -import requests -import base64 -import time -import json -import errno from shutil import copy2 from moulinette import m18n, msettings @@ -16,7 +11,6 @@ from moulinette.utils.filesystem import read_file from yunohost.tools import Migration from yunohost.app import unstable_apps from yunohost.service import (_run_service_command, - service_regen_conf, manually_modified_files, manually_modified_files_compared_to_debian_default) from yunohost.utils.filesystem import free_space_in_directory @@ -24,7 +18,8 @@ from yunohost.utils.packages import get_installed_version logger = getActionLogger('yunohost.migration') -YUNOHOST_PACKAGES = ["yunohost", "yunohost-admin", "moulinette", "ssowat" ] +YUNOHOST_PACKAGES = ["yunohost", "yunohost-admin", "moulinette", "ssowat"] + class MyMigration(Migration): "Upgrade the system to Debian Stretch and Yunohost 3.0" @@ -103,7 +98,7 @@ class MyMigration(Migration): # in the middle and debian version could be >= 9.x but yunohost package # would still be in 2.x... if not self.debian_major_version() == 8 \ - and not self.yunohost_major_version() == 2: + and not self.yunohost_major_version() == 2: raise MoulinetteError(m18n.n("migration_0003_not_jessie")) # Have > 1 Go free space on /var/ ? @@ -113,7 +108,7 @@ class MyMigration(Migration): # Check system is up to date # (but we don't if 'stretch' is already in the sources.list ... # which means maybe a previous upgrade crashed and we're re-running it) - if not " stretch " in read_file("/etc/apt/sources.list"): + if " stretch " not in read_file("/etc/apt/sources.list"): self.apt_update() apt_list_upgradable = check_output("apt list --upgradable -a") if "upgradable" in apt_list_upgradable: @@ -128,12 +123,12 @@ class MyMigration(Migration): # in the middle and debian version could be >= 9.x but yunohost package # would still be in 2.x... if not self.debian_major_version() == 8 \ - and not self.yunohost_major_version() == 2: + and not self.yunohost_major_version() == 2: return None # Get list of problematic apps ? I.e. not official or community+working problematic_apps = unstable_apps() - problematic_apps = "".join(["\n - "+app for app in problematic_apps ]) + problematic_apps = "".join(["\n - " + app for app in problematic_apps]) # Manually modified files ? (c.f. yunohost service regen-conf) modified_files = manually_modified_files() @@ -141,7 +136,7 @@ class MyMigration(Migration): # modified and needs to be upgraded... if "/etc/nginx/nginx.conf" in manually_modified_files_compared_to_debian_default(): modified_files.append("/etc/nginx/nginx.conf") - modified_files = "".join(["\n - "+f for f in modified_files ]) + modified_files = "".join(["\n - " + f for f in modified_files]) message = m18n.n("migration_0003_general_warning") @@ -232,7 +227,6 @@ class MyMigration(Migration): os.system(command) - def apt_dist_upgrade(self, conf_flags): # Make apt-get happy @@ -264,7 +258,6 @@ class MyMigration(Migration): # enabled if the user explicitly add --verbose ... os.system(command) - # Those are files that should be kept and restored before the final switch # to yunohost 3.x... They end up being modified by the various dist-upgrades # (or need to be taken out momentarily), which then blocks the regen-conf @@ -304,4 +297,3 @@ class MyMigration(Migration): for f in self.files_to_keep: dest_file = f.strip('/').replace("/", "_") copy2(os.path.join(tmp_dir, dest_file), f) - From be35b491602b0f74ca7aaa4ba1beb71e265578ed Mon Sep 17 00:00:00 2001 From: Quenti Date: Mon, 7 May 2018 09:41:19 +0000 Subject: [PATCH 180/313] [i18n] Translated using Weblate (Occitan) Currently translated at 1.5% (6 of 385 strings) --- locales/oc.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 35a9e8342..42b437cca 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -3,5 +3,6 @@ "admin_password_change_failed": "Impossible de cambiar lo senhal", "admin_password_changed": "Lo senhal d'administracion es ben estat cambiat", "app_already_installed": "{app:s} es ja installat", - "app_already_up_to_date": "{app:s} es ja a jorn" + "app_already_up_to_date": "{app:s} es ja a jorn", + "installation_complete": "Installacion acabada" } From aab608b8d3de3c127d8aa8006677d69f50896847 Mon Sep 17 00:00:00 2001 From: Gustavo Date: Mon, 7 May 2018 00:22:49 +0000 Subject: [PATCH 181/313] [i18n] Translated using Weblate (Portuguese) Currently translated at 29.0% (112 of 385 strings) --- locales/pt.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/locales/pt.json b/locales/pt.json index 88690249c..ee94b6352 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -167,5 +167,6 @@ "app_already_up_to_date": "{app:s} já está atualizado", "app_argument_choice_invalid": "Escolha inválida para o argumento '{name:s}', deve ser um dos {choices:s}", "app_argument_invalid": "Valor inválido de argumento '{name:s}': {error:s}", - "app_argument_required": "O argumento '{name:s}' é obrigatório" + "app_argument_required": "O argumento '{name:s}' é obrigatório", + "app_change_url_failed_nginx_reload": "Falha ao reiniciar o nginx. Aqui está o retorno de 'nginx -t':\n{nginx_errors:s}" } From 62e9c9f04d3b03d36f543b3bdb21f6e7d9d2aa8e Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Wed, 9 May 2018 14:05:46 +0000 Subject: [PATCH 182/313] [i18n] Translated using Weblate (Arabic) Currently translated at 93.2% (359 of 385 strings) --- locales/ar.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index 9d2cfe54a..e4594bc81 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -5,7 +5,7 @@ "admin_password_changed": "تم تعديل الكلمة السرية الإدارية", "app_already_installed": "{app:s} تم تنصيبه مِن قبل", "app_already_installed_cant_change_url": "", - "app_already_up_to_date": "", + "app_already_up_to_date": "{app:s} تم تحديثه مِن قَبل", "app_argument_choice_invalid": "", "app_argument_invalid": "", "app_argument_required": "", @@ -222,7 +222,7 @@ "migrate_tsig_wait_4": "30 ثانية …", "migrate_tsig_not_needed": "You do not appear to use a dyndns domain, so no migration is needed !", "migrations_backward": "Migrating backward.", - "migrations_bad_value_for_target": "Invalide number for target argument, available migrations numbers are 0 or {}", + "migrations_bad_value_for_target": "", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", "migrations_current_target": "Migration target is {}", "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {number} {name}", From ee319ef525f9a61b6c8660dd25f1e285da45c99a Mon Sep 17 00:00:00 2001 From: Quenti Date: Thu, 10 May 2018 11:02:36 +0000 Subject: [PATCH 183/313] [i18n] Translated using Weblate (Occitan) Currently translated at 10.3% (40 of 385 strings) --- locales/oc.json | 36 +++++++++++++++++++++++++++++++++++- 1 file changed, 35 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 42b437cca..27c0c4d7d 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -4,5 +4,39 @@ "admin_password_changed": "Lo senhal d'administracion es ben estat cambiat", "app_already_installed": "{app:s} es ja installat", "app_already_up_to_date": "{app:s} es ja a jorn", - "installation_complete": "Installacion acabada" + "installation_complete": "Installacion acabada", + "app_id_invalid": "Id d’aplicacion incorrècte", + "app_install_files_invalid": "Fichièrs d’installacion incorrèctes", + "app_no_upgrade": "Pas cap d’aplicacion de metre a jorn", + "app_not_correctly_installed": "{app:s} sembla pas ben installat", + "app_not_installed": "{app:s} es pas installat", + "app_not_properly_removed": "{app:s} es pas estat corrèctament suprimit", + "app_removed": "{app:s} es estat suprimit", + "app_unknown": "Aplicacion desconeguda", + "app_upgrade_app_name": "Mesa a jorn de l’aplicacion {app}...", + "app_upgrade_failed": "Impossible de metre a jorn {app:s}", + "app_upgrade_some_app_failed": "D’aplicacions se pòdon pas metre a jorn", + "app_upgraded": "{app:s} es estat mes a jorn", + "appslist_fetched": "Recuperacion de la lista d’aplicacions {appslist:s} corrèctament realizada", + "appslist_migrating": "Migracion de la lista d’aplicacion{appslist:s}…", + "appslist_name_already_tracked": "I a ja una lista d’aplicacion enregistrada amb lo nom {name:s}.", + "appslist_removed": "Supression de la lista d’aplicacions {appslist:s} corrèctament realizada", + "appslist_retrieve_bad_format": "Lo fichièr recuperat per la lista d’aplicacions {appslist:s} es pas valid", + "appslist_unknown": "La lista d’aplicacions {appslist:s} es desconeguda.", + "appslist_url_already_tracked": "I a ja una lista d’aplicacions enregistrada amb l’URL {url:s}.", + "ask_current_admin_password": "Senhal administrator actual", + "ask_email": "Adreça de corrièl", + "ask_firstname": "Prenom", + "ask_lastname": "Nom", + "ask_list_to_remove": "Lista de suprimir", + "ask_main_domain": "Domeni màger", + "ask_new_admin_password": "Nòu senhal administrator", + "ask_password": "Senhal", + "ask_path": "Camin", + "backup_action_required": "Devètz precisar çò que cal salvagardar", + "backup_app_failed": "Impossible de salvagardar l’aplicacion « {app:s} »", + "backup_applying_method_copy": "Còpia de totes los fichièrs dins la salvagarda…", + "backup_applying_method_tar": "Creacion de l’archiu tar de la salvagarda…", + "backup_archive_name_exists": "Un archiu de salvagarda amb aquesta nom existís ja", + "backup_archive_name_unknown": "L’archiu local de salvagarda apelat « {name:s} » es desconegut" } From 606d04981ae53e5740c67b8f67fd8432166cbdb6 Mon Sep 17 00:00:00 2001 From: Jean-Baptiste Holcroft Date: Thu, 10 May 2018 21:11:49 +0000 Subject: [PATCH 184/313] [i18n] Translated using Weblate (Arabic) Currently translated at 93.2% (360 of 386 strings) --- locales/ar.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/ar.json b/locales/ar.json index e4594bc81..740ce0fcc 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -222,7 +222,7 @@ "migrate_tsig_wait_4": "30 ثانية …", "migrate_tsig_not_needed": "You do not appear to use a dyndns domain, so no migration is needed !", "migrations_backward": "Migrating backward.", - "migrations_bad_value_for_target": "", + "migrations_bad_value_for_target": "Invalid number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", "migrations_current_target": "Migration target is {}", "migrations_error_failed_to_load_migration": "ERROR: failed to load migration {number} {name}", From d769f539ab3e07e8629d8d0c2c80ad31029c6b71 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 10 May 2018 23:46:08 +0200 Subject: [PATCH 185/313] apt and hold packages are fucking stupid, so we need to handle this the dirty way --- .../data_migrations/0003_migrate_to_stretch.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index 41ab6b4b2..faf324303 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -45,12 +45,16 @@ class MyMigration(Migration): self.apt_update() apps_packages = self.get_apps_equivs_packages() self.unhold(["metronome"]) - self.hold(YUNOHOST_PACKAGES + apps_packages + ["fail2ban", "nginx-common"]) + self.hold(YUNOHOST_PACKAGES + apps_packages + ["fail2ban"]) + if "/etc/nginx/nginx.conf" in manually_modified_files_compared_to_debian_default() \ + and os.path.exists("/etc/nginx/nginx.conf"): + os.system("mv /etc/nginx/nginx.conf \ + /home/yunohost.conf/backup/nginx.conf.bkp_before_stretch") # Main dist-upgrade logger.warning(m18n.n("migration_0003_main_upgrade")) _run_service_command("stop", "mysql") - self.apt_dist_upgrade(conf_flags=["old", "def"]) + self.apt_dist_upgrade(conf_flags=["old", "miss", "def"]) _run_service_command("start", "mysql") if self.debian_major_version() == 8: raise MoulinetteError(m18n.n("migration_0003_still_on_jessie_after_main_upgrade", log=self.logfile)) @@ -66,11 +70,6 @@ class MyMigration(Migration): self.apt_dist_upgrade(conf_flags=["new", "miss", "def"]) _run_service_command("restart", "fail2ban") - # Specific upgrade for nginx-common... - logger.warning(m18n.n("migration_0003_nginx_upgrade")) - self.unhold(["nginx-common"]) - self.apt_dist_upgrade(conf_flags=["new", "def"]) - # Clean the mess os.system("apt autoremove --assume-yes") os.system("apt clean --assume-yes") From 7ea53f2ff7023762d3a6ae671f15661c28574f85 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 01:25:41 +0200 Subject: [PATCH 186/313] [fix] metldown script can now returns 2/3 return code --- src/yunohost/tools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 80f7bcaa5..f3c56a6c7 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -666,7 +666,7 @@ def _check_if_vulnerable_to_meltdown(): stderr=subprocess.STDOUT) output, _ = call.communicate() - assert call.returncode == 0 + assert call.returncode in (0, 2, 3), "Return code: %s" % call.returncode CVEs = json.loads(output) assert len(CVEs) == 1 From 8186f044dced4bd91069ef39ab799359f24de0ff Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 11 May 2018 03:32:54 +0200 Subject: [PATCH 187/313] Replace the nginx.conf thing with a function called at the beginning of the migration that restore the original file if it was modified --- locales/en.json | 2 +- .../0003_migrate_to_stretch.py | 62 +++++++++++++++++-- 2 files changed, 59 insertions(+), 5 deletions(-) diff --git a/locales/en.json b/locales/en.json index ff1616c79..978465b67 100644 --- a/locales/en.json +++ b/locales/en.json @@ -230,7 +230,7 @@ "migration_0003_patching_sources_list": "Patching the sources.lists ...", "migration_0003_main_upgrade": "Starting main upgrade ...", "migration_0003_fail2ban_upgrade": "Starting the fail2ban upgrade ...", - "migration_0003_nginx_upgrade": "Starting the nginx-common upgrade ...", + "migration_0003_restoring_origin_nginx_conf": "Your file /etc/nginx/nginx.conf was edited somehow. The migration is going to reset back to its original state first... The previous file will be available as {backup_dest}.", "migration_0003_yunohost_upgrade": "Starting the yunohost package upgrade ... The migration will end, but the actual upgrade will happen right after. After the operation is complete, you might have to re-log on the webadmin.", "migration_0003_not_jessie": "The current debian distribution is not Jessie !", "migration_0003_system_not_fully_up_to_date": "Your system is not fully up to date. Please perform a regular upgrade before running the migration to stretch.", diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index faf324303..b2fcd08ac 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -39,6 +39,8 @@ class MyMigration(Migration): logger.warning(m18n.n("migration_0003_start", logfile=self.logfile)) # Preparing the upgrade + self.restore_original_nginx_conf_if_needed() + logger.warning(m18n.n("migration_0003_patching_sources_list")) self.patch_apt_sources_list() self.backup_files_to_keep() @@ -46,10 +48,6 @@ class MyMigration(Migration): apps_packages = self.get_apps_equivs_packages() self.unhold(["metronome"]) self.hold(YUNOHOST_PACKAGES + apps_packages + ["fail2ban"]) - if "/etc/nginx/nginx.conf" in manually_modified_files_compared_to_debian_default() \ - and os.path.exists("/etc/nginx/nginx.conf"): - os.system("mv /etc/nginx/nginx.conf \ - /home/yunohost.conf/backup/nginx.conf.bkp_before_stretch") # Main dist-upgrade logger.warning(m18n.n("migration_0003_main_upgrade")) @@ -296,3 +294,59 @@ class MyMigration(Migration): for f in self.files_to_keep: dest_file = f.strip('/').replace("/", "_") copy2(os.path.join(tmp_dir, dest_file), f) + + # On some setups, /etc/nginx/nginx.conf got edited. But this file needs + # to be upgraded because of the way the new module system works for nginx. + # (in particular, having the line that include the modules at the top) + # + # So here, if it got edited, we force the restore of the original conf + # *before* starting the actual upgrade... + # + # An alternative strategy that was attempted was to hold the nginx-common + # package and have a specific upgrade for it like for fail2ban, but that + # leads to apt complaining about not being able to upgrade for shitty + # reasons >.> + def restore_original_nginx_conf_if_needed(self): + if "/etc/nginx/nginx.conf" not in manually_modified_files_compared_to_debian_default(): + return + + if not os.path.exists("/etc/nginx/nginx.conf"): + return + + # If stretch is in the sources.list, we already started migrating on + # stretch so we don't re-do this + if " stretch " in read_file("/etc/apt/sources.list"): + return + + backup_dest = "/home/yunohost.conf/backup/nginx.conf.bkp_before_stretch" + + logger.warning(m18n.n("migration_0003_restoring_origin_nginx_conf", + backup_dest=backup_dest)) + + os.system("mv /etc/nginx/nginx.conf %s" % backup_dest) + + command = "" + command += " DEBIAN_FRONTEND=noninteractive" + command += " APT_LISTCHANGES_FRONTEND=none" + command += " apt-get" + command += " --fix-broken --show-upgraded --assume-yes" + command += ' -o Dpkg::Options::="--force-confmiss"' + command += " install --reinstall" + command += " nginx-common" + + logger.debug("Running apt command :\n{}".format(command)) + + command += " 2>&1 | tee -a {}".format(self.logfile) + + is_api = msettings.get('interface') == 'api' + if is_api: + callbacks = ( + lambda l: logger.info(l.rstrip()), + lambda l: logger.warning(l.rstrip()), + ) + call_async_output(command, callbacks, shell=True) + else: + # We do this when running from the cli to have the output of the + # command showing in the terminal, since 'info' channel is only + # enabled if the user explicitly add --verbose ... + os.system(command) From 642de6dc330d789b4bcbb81e69592ec8115f7680 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 11 May 2018 02:09:06 +0000 Subject: [PATCH 188/313] Update changelog for 2.7.13.2 release --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian/changelog b/debian/changelog index 1fa1544ad..da5428e22 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +yunohost (2.7.13.2) testing; urgency=low + + * [fix] Fix an error with services marked as None (#466) + * [fix] Issue with nginx not upgrading correctly /etc/nginx/nginx.conf if it was manually modified + + -- Alexandre Aubin Fri, 11 May 2018 02:06:42 +0000 + yunohost (2.7.13.1) testing; urgency=low * [fix] Misc fixes on stretch migration following feedback From d32ab073ba2719170bb3d5254d772d8100be9445 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:21:24 +0200 Subject: [PATCH 189/313] [mod] removes status key from /etc/yunohost/service.yml for generic approach --- data/hooks/conf_regen/01-yunohost | 18 ++++++++++++++++++ data/templates/yunohost/services.yml | 25 +++++-------------------- 2 files changed, 23 insertions(+), 20 deletions(-) diff --git a/data/hooks/conf_regen/01-yunohost b/data/hooks/conf_regen/01-yunohost index e1daa7c3d..faf041110 100755 --- a/data/hooks/conf_regen/01-yunohost +++ b/data/hooks/conf_regen/01-yunohost @@ -61,11 +61,17 @@ do_pre_regen() { _update_services() { sudo python2 - << EOF import yaml + + with open('services.yml') as f: new_services = yaml.load(f) + with open('/etc/yunohost/services.yml') as f: services = yaml.load(f) + updated = False + + for service, conf in new_services.items(): # remove service with empty conf if conf is None: @@ -73,20 +79,32 @@ for service, conf in new_services.items(): print("removing '{0}' from services".format(service)) del services[service] updated = True + # add new service elif not services.get(service, None): print("adding '{0}' to services".format(service)) services[service] = conf updated = True + # update service conf else: conffiles = services[service].pop('conffiles', {}) + + # status need to be removed + if "status" not in conf and "status" in services[service]: + print("update '{0}' service status access".format(service)) + del services[service]["status"] + updated = True + if services[service] != conf: print("update '{0}' service".format(service)) services[service].update(conf) updated = True + if conffiles: services[service]['conffiles'] = conffiles + + if updated: with open('/etc/yunohost/services.yml-new', 'w') as f: yaml.safe_dump(services, f, default_flow_style=False) diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index fb8c076f9..b4c9ab362 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -1,57 +1,42 @@ nginx: - status: service log: /var/log/nginx avahi-daemon: - status: service log: /var/log/daemon.log dnsmasq: - status: service log: /var/log/daemon.log fail2ban: - status: service log: /var/log/fail2ban.log dovecot: - status: service log: [/var/log/mail.log,/var/log/mail.err] postfix: - status: service log: [/var/log/mail.log,/var/log/mail.err] rmilter: - status: systemctl status rmilter.service log: /var/log/mail.log rspamd: - status: systemctl status rspamd.service log: /var/log/mail.log redis-server: - status: service log: /var/log/redis/redis-server.log mysql: - status: service log: [/var/log/mysql.log,/var/log/mysql.err] -glances: - status: service +glances: {} ssh: - status: service log: /var/log/auth.log +ssl: + status: null metronome: - status: metronomectl status log: [/var/log/metronome/metronome.log,/var/log/metronome/metronome.err] slapd: - status: service log: /var/log/syslog php5-fpm: - status: service log: /var/log/php5-fpm.log yunohost-api: - status: service log: /var/log/yunohost/yunohost-api.log yunohost-firewall: - status: service need_lock: true nslcd: - status: service log: /var/log/syslog -nsswitch: {} +nsswitch: + status: null bind9: null tahoe-lafs: null memcached: null From 312e9bb22ef2b1ee50eecdebb1c940099a2fca1a Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:21:53 +0200 Subject: [PATCH 190/313] [mod] respect yaml indentation --- data/templates/yunohost/services.yml | 32 ++++++++++++++-------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index b4c9ab362..0c12b9e60 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -1,40 +1,40 @@ nginx: - log: /var/log/nginx + log: /var/log/nginx avahi-daemon: - log: /var/log/daemon.log + log: /var/log/daemon.log dnsmasq: - log: /var/log/daemon.log + log: /var/log/daemon.log fail2ban: - log: /var/log/fail2ban.log + log: /var/log/fail2ban.log dovecot: - log: [/var/log/mail.log,/var/log/mail.err] + log: [/var/log/mail.log,/var/log/mail.err] postfix: - log: [/var/log/mail.log,/var/log/mail.err] + log: [/var/log/mail.log,/var/log/mail.err] rmilter: - log: /var/log/mail.log + log: /var/log/mail.log rspamd: - log: /var/log/mail.log + log: /var/log/mail.log redis-server: - log: /var/log/redis/redis-server.log + log: /var/log/redis/redis-server.log mysql: - log: [/var/log/mysql.log,/var/log/mysql.err] + log: [/var/log/mysql.log,/var/log/mysql.err] glances: {} ssh: - log: /var/log/auth.log + log: /var/log/auth.log ssl: status: null metronome: - log: [/var/log/metronome/metronome.log,/var/log/metronome/metronome.err] + log: [/var/log/metronome/metronome.log,/var/log/metronome/metronome.err] slapd: - log: /var/log/syslog + log: /var/log/syslog php5-fpm: - log: /var/log/php5-fpm.log + log: /var/log/php5-fpm.log yunohost-api: - log: /var/log/yunohost/yunohost-api.log + log: /var/log/yunohost/yunohost-api.log yunohost-firewall: need_lock: true nslcd: - log: /var/log/syslog + log: /var/log/syslog nsswitch: status: null bind9: null From f4df8c8ec83fc30ca1b79f0f032812eb8b70b03b Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:35:28 +0200 Subject: [PATCH 191/313] [enh] move to dbus to retreive service status --- debian/control | 2 +- src/yunohost/service.py | 63 +++++++++++++++++++++-------------------- 2 files changed, 33 insertions(+), 32 deletions(-) diff --git a/debian/control b/debian/control index d1505994a..17961b83d 100644 --- a/debian/control +++ b/debian/control @@ -12,7 +12,7 @@ Architecture: all Depends: ${python:Depends}, ${misc:Depends} , moulinette (>= 2.7.1), ssowat (>= 2.7.1) , python-psutil, python-requests, python-dnspython, python-openssl - , python-apt, python-miniupnpc + , python-apt, python-miniupnpc, python-dbus , glances , dnsutils, bind9utils, unzip, git, curl, cron, wget , ca-certificates, netcat-openbsd, iproute diff --git a/src/yunohost/service.py b/src/yunohost/service.py index ef61154bd..a5a97d67c 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -202,46 +202,47 @@ def service_status(names=[]): raise MoulinetteError(errno.EINVAL, m18n.n('service_unknown', service=name)) - status = None - if services[name].get('status') == 'service': - status = 'service %s status' % name - elif "status" in services[name]: - status = str(services[name]['status']) - else: + # this "service" isn't a service actually so we skip it + # + # the historical reason is because regenconf has been hacked into the + # service part of YunoHost will in some situation we need to regenconf + # for things that aren't services + # the hack was to add fake services... + # we need to extract regenconf from service at some point, also because + # some app would really like to use it + if "status" in services[name] and services[name]["status"] is None: continue - runlevel = 5 - if 'runlevel' in services[name].keys(): - runlevel = int(services[name]['runlevel']) + status = _get_service_information_from_systemd(name) - result[name] = {'status': 'unknown', 'loaded': 'unknown'} - - # Retrieve service status - try: - ret = subprocess.check_output(status, stderr=subprocess.STDOUT, - shell=True) - except subprocess.CalledProcessError as e: - if 'usage:' in e.output.lower(): - logger.warning(m18n.n('service_status_failed', service=name)) - else: - result[name]['status'] = 'inactive' - else: - result[name]['status'] = 'running' - - # Retrieve service loading - rc_path = glob.glob("/etc/rc%d.d/S[0-9][0-9]%s" % (runlevel, name)) - if len(rc_path) == 1 and os.path.islink(rc_path[0]): - result[name]['loaded'] = 'enabled' - elif os.path.isfile("/etc/init.d/%s" % name): - result[name]['loaded'] = 'disabled' - else: - result[name]['loaded'] = 'not-found' + result[name] = { + 'status': str(status.get("SubState", "unknown")), + 'loaded': str(status.get("LoadState", "unknown")), + } if len(names) == 1: return result[names[0]] return result +def _get_service_information_from_systemd(service): + "this is the equivalent of 'systemctl status $service'" + import dbus + + d = dbus.SystemBus() + + systemd = d.get_object('org.freedesktop.systemd1','/org/freedesktop/systemd1') + manager = dbus.Interface(systemd, 'org.freedesktop.systemd1.Manager') + + service_path = manager.GetUnit(service + ".service") + service_proxy = d.get_object('org.freedesktop.systemd1', service_path) + + # unit_proxy = dbus.Interface(service_proxy, 'org.freedesktop.systemd1.Unit',) + properties_interface = dbus.Interface(service_proxy, 'org.freedesktop.DBus.Properties') + + return properties_interface.GetAll('org.freedesktop.systemd1.Unit') + + def service_log(name, number=50): """ Log every log files of a service From 07139e7bc1de5f89cfc3b1a0ac4974444881b38b Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:40:35 +0200 Subject: [PATCH 192/313] [enh] display service description on status --- src/yunohost/service.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index a5a97d67c..7284f95b8 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -218,6 +218,7 @@ def service_status(names=[]): result[name] = { 'status': str(status.get("SubState", "unknown")), 'loaded': str(status.get("LoadState", "unknown")), + 'description': str(status.get("Description", "")), } if len(names) == 1: From 929515ba940f5a439a2dab02eb21e1476323a22d Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:49:20 +0200 Subject: [PATCH 193/313] [mod] remove useless import --- src/yunohost/service.py | 1 - 1 file changed, 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 7284f95b8..fed7ff3be 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -27,7 +27,6 @@ import os import time import yaml import json -import glob import subprocess import errno import shutil From 1b774527d87ac8a3bafd10a0e6a982adf59f6fc4 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:49:43 +0200 Subject: [PATCH 194/313] [enh] get active status of service --- src/yunohost/service.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index fed7ff3be..31ed54a5d 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -217,6 +217,7 @@ def service_status(names=[]): result[name] = { 'status': str(status.get("SubState", "unknown")), 'loaded': str(status.get("LoadState", "unknown")), + 'active': str(status.get("ActiveState", "unknown")), 'description': str(status.get("Description", "")), } From 0011c4ab56a6b4b4cd49f82097eb5a81ae69f76b Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:49:52 +0200 Subject: [PATCH 195/313] [enh] get since how much time a service is running --- src/yunohost/service.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 31ed54a5d..b5fd3a9ed 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -31,7 +31,9 @@ import subprocess import errno import shutil import hashlib + from difflib import unified_diff +from datetime import datetime from moulinette import m18n from moulinette.core import MoulinetteError @@ -218,6 +220,10 @@ def service_status(names=[]): 'status': str(status.get("SubState", "unknown")), 'loaded': str(status.get("LoadState", "unknown")), 'active': str(status.get("ActiveState", "unknown")), + 'active_at': { + "timestamp": str(status.get("ActiveEnterTimestamp", "unknown")), + "human": datetime.fromtimestamp(status.get("ActiveEnterTimestamp") / 1000000).strftime("%F %X"), + }, 'description': str(status.get("Description", "")), } From 2bef98a519b4a7635b16e9285ac18797264b2e5d Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 04:51:28 +0200 Subject: [PATCH 196/313] [enh] add path to service file in service status --- src/yunohost/service.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index b5fd3a9ed..e73da3430 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -225,6 +225,7 @@ def service_status(names=[]): "human": datetime.fromtimestamp(status.get("ActiveEnterTimestamp") / 1000000).strftime("%F %X"), }, 'description': str(status.get("Description", "")), + 'service_file_path': str(status.get("FragmentPath", "unknown")), } if len(names) == 1: From 54dffa5f94722841b1a55001bf105d62ad152e28 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 05:08:02 +0200 Subject: [PATCH 197/313] [mod] refactor service_log to make is readable --- src/yunohost/service.py | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index ef61154bd..617115360 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -256,21 +256,33 @@ def service_log(name, number=50): if name not in services.keys(): raise MoulinetteError(errno.EINVAL, m18n.n('service_unknown', service=name)) - if 'log' in services[name]: - log_list = services[name]['log'] - result = {} - if not isinstance(log_list, list): - log_list = [log_list] - - for log_path in log_list: - if os.path.isdir(log_path): - for log in [f for f in os.listdir(log_path) if os.path.isfile(os.path.join(log_path, f)) and f[-4:] == '.log']: - result[os.path.join(log_path, log)] = _tail(os.path.join(log_path, log), int(number)) - else: - result[log_path] = _tail(log_path, int(number)) - else: + if 'log' not in services[name]: raise MoulinetteError(errno.EPERM, m18n.n('service_no_log', service=name)) + log_list = services[name]['log'] + + if not isinstance(log_list, list): + log_list = [log_list] + + result = {} + + for log_path in log_list: + # log is a file, read it + if not os.path.isdir(log_path): + result[log_path] = _tail(log_path, int(number)) + continue + + for log_file in os.listdir(log_path): + log_file_path = os.path.join(log_path, log_file) + # not a file : skip + if not os.path.isfile(log_file_path): + continue + + if not log_file.endswith(".log"): + continue + + result[log_file_path] = _tail(log_file_path, int(number)) + return result From 1f6a7b2ee59a6f901ca053fb7b749da6dbb72781 Mon Sep 17 00:00:00 2001 From: "ljf (zamentur)" Date: Fri, 11 May 2018 16:52:28 +0200 Subject: [PATCH 198/313] [fix] Untrusted TLS connection established to --- data/templates/postfix/main.cf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/data/templates/postfix/main.cf b/data/templates/postfix/main.cf index bdd364250..b96bb4860 100644 --- a/data/templates/postfix/main.cf +++ b/data/templates/postfix/main.cf @@ -45,6 +45,10 @@ smtp_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers smtp_tls_mandatory_ciphers= $smtpd_tls_mandatory_ciphers smtp_tls_loglevel=1 +# Fix "Untrusted TLS connection established to" message in log +smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt +smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt + # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for # information on enabling SSL in the smtp client. From bd28c244795719851c5b186825997a26f2fbc713 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 05:16:07 +0200 Subject: [PATCH 199/313] [mod] blank lines to make code more readable --- src/yunohost/service.py | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index ef61154bd..f9bc14a03 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -323,12 +323,15 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, # create the pending conf directory for the service service_pending_path = os.path.join(PENDING_CONF_DIR, name) filesystem.mkdir(service_pending_path, 0755, True, uid='admin') + # return the arguments to pass to the script return pre_args + [service_pending_path, ] + pre_result = hook_callback('conf_regen', names, pre_callback=_pre_call) # Update the services name names = pre_result['succeed'].keys() + if not names: raise MoulinetteError(errno.EIO, m18n.n('service_regenconf_failed', @@ -386,6 +389,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, 'service_conf_file_manually_removed', conf=system_path)) conf_status = 'removed' + # -> system conf is not managed yet elif not saved_hash: logger.debug("> system conf is not managed yet") @@ -409,6 +413,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, logger.warning(m18n.n('service_conf_file_kept_back', conf=system_path, service=service)) conf_status = 'unmanaged' + # -> system conf has not been manually modified elif system_hash == saved_hash: if to_remove: @@ -421,6 +426,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, logger.debug("> system conf is already up-to-date") os.remove(pending_path) continue + else: logger.debug("> system conf has been manually modified") if system_hash == new_hash: @@ -457,6 +463,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, 'service_conf_updated' if not dry_run else 'service_conf_would_be_updated', service=service)) + if succeed_regen and not dry_run: _update_conf_hashes(service, conf_hashes) @@ -480,6 +487,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, else: regen_conf_files = '' return post_args + [regen_conf_files, ] + hook_callback('conf_regen', names, pre_callback=_pre_call) return result @@ -678,25 +686,33 @@ def _get_pending_conf(services=[]): """ result = {} + if not os.path.isdir(PENDING_CONF_DIR): return result + if not services: services = os.listdir(PENDING_CONF_DIR) + for name in services: service_pending_path = os.path.join(PENDING_CONF_DIR, name) + if not os.path.isdir(service_pending_path): continue + path_index = len(service_pending_path) service_conf = {} + for root, dirs, files in os.walk(service_pending_path): for filename in files: pending_path = os.path.join(root, filename) service_conf[pending_path[path_index:]] = pending_path + if service_conf: result[name] = service_conf else: # remove empty directory shutil.rmtree(service_pending_path, ignore_errors=True) + return result @@ -708,9 +724,11 @@ def _get_conf_hashes(service): if service not in services: logger.debug("Service %s is not in services.yml yet.", service) return {} + elif services[service] is None or 'conffiles' not in services[service]: logger.debug("No configuration files for service %s.", service) return {} + else: return services[service]['conffiles'] @@ -743,11 +761,14 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): backup_path = os.path.join(BACKUP_CONF_DIR, '{0}-{1}'.format( system_conf.lstrip('/'), time.strftime("%Y%m%d.%H%M%S"))) backup_dir = os.path.dirname(backup_path) + if not os.path.isdir(backup_dir): filesystem.mkdir(backup_dir, 0755, True) + shutil.copy2(system_conf, backup_path) logger.info(m18n.n('service_conf_file_backed_up', conf=system_conf, backup=backup_path)) + try: if not new_conf: os.remove(system_conf) @@ -755,8 +776,10 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): conf=system_conf)) else: system_dir = os.path.dirname(system_conf) + if not os.path.isdir(system_dir): filesystem.mkdir(system_dir, 0755, True) + shutil.copyfile(new_conf, system_conf) logger.info(m18n.n('service_conf_file_updated', conf=system_conf)) @@ -766,6 +789,7 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): conf=system_conf), exc_info=1) return False + elif new_conf: try: copy_succeed = os.path.samefile(system_conf, new_conf) @@ -777,8 +801,10 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): conf=system_conf, new=new_conf), exc_info=1) return False + return True + def manually_modified_files(): # We do this to have --quiet, i.e. don't throw a whole bunch of logs From 1fab47cbeab4e1a2ddea080090a76094992b6b52 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 22:19:54 +0200 Subject: [PATCH 200/313] [mod] reduce indentation level --- src/yunohost/service.py | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index f9bc14a03..527d7a2c7 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -292,14 +292,19 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, # Return the list of pending conf if list_pending: pending_conf = _get_pending_conf(names) - if with_diff: - for service, conf_files in pending_conf.items(): - for system_path, pending_path in conf_files.items(): - pending_conf[service][system_path] = { - 'pending_conf': pending_path, - 'diff': _get_files_diff( - system_path, pending_path, True), - } + + if not with_diff: + return pending_conf + + for service, conf_files in pending_conf.items(): + for system_path, pending_path in conf_files.items(): + + pending_conf[service][system_path] = { + 'pending_conf': pending_path, + 'diff': _get_files_diff( + system_path, pending_path, True), + } + return pending_conf # Clean pending conf directory From 7435cfdea391e6793735174ffe83a9b407610dfc Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 22:20:07 +0200 Subject: [PATCH 201/313] [mod] simplify code, give more verbose debug output --- src/yunohost/service.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 527d7a2c7..f965343d4 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -511,11 +511,11 @@ def _run_service_command(action, service): if service not in services.keys(): raise MoulinetteError(errno.EINVAL, m18n.n('service_unknown', service=service)) - cmd = None - if action in ['start', 'stop', 'restart', 'reload', 'enable', 'disable']: - cmd = 'systemctl %s %s' % (action, service) - else: - raise ValueError("Unknown action '%s'" % action) + possible_actions = ['start', 'stop', 'restart', 'reload', 'enable', 'disable'] + if action not in possible_actions: + raise ValueError("Unknown action '%s', available actions are: %s" % (action, ", ".join(possible_actions))) + + cmd = 'systemctl %s %s' % (action, service) need_lock = services[service].get('need_lock', False) \ and action in ['start', 'stop', 'restart', 'reload'] From 1d59738085628b49952b3e8efc5cb3bf5b875f56 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 22:57:37 +0200 Subject: [PATCH 202/313] [fix] always remove lock if needed --- src/yunohost/service.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index f965343d4..91b060a57 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -530,14 +530,17 @@ def _run_service_command(action, service): PID = _give_lock(action, service, p) # Wait for the command to complete p.communicate() - # Remove the lock if one was given - if need_lock and PID != 0: - _remove_lock(PID) except subprocess.CalledProcessError as e: # TODO: Log output? logger.warning(m18n.n('service_cmd_exec_failed', command=' '.join(e.cmd))) return False + + finally: + # Remove the lock if one was given + if need_lock and PID != 0: + _remove_lock(PID) + return True From ebe5cab0999cf51e99ab66bbbcb2482795c55223 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 11 May 2018 23:27:24 +0200 Subject: [PATCH 203/313] [mod] add warning comment about unconcurrency safe _remove_lock function --- src/yunohost/service.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 91b060a57..20819ae98 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -573,6 +573,7 @@ def _give_lock(action, service, p): return son_PID def _remove_lock(PID_to_remove): + # FIXME ironically not concurrency safe because it's not atomic... PIDs = filesystem.read_file(MOULINETTE_LOCK).split("\n") PIDs_to_keep = [ PID for PID in PIDs if int(PID) != PID_to_remove ] From 14c270cebdc67a1123331237cee6dba347ee7623 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 12 May 2018 00:26:22 +0200 Subject: [PATCH 204/313] [mod] offset is never used --- src/yunohost/service.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 20819ae98..9b4b8348e 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -613,7 +613,7 @@ def _save_services(services): yaml.safe_dump(services, f, default_flow_style=False) -def _tail(file, n, offset=None): +def _tail(file, n): """ Reads a n lines from f with an offset of offset lines. The return value is a tuple in the form ``(lines, has_more)`` where `has_more` is @@ -621,7 +621,7 @@ def _tail(file, n, offset=None): """ avg_line_length = 74 - to_read = n + (offset or 0) + to_read = n try: with open(file, 'r') as f: @@ -635,7 +635,7 @@ def _tail(file, n, offset=None): pos = f.tell() lines = f.read().splitlines() if len(lines) >= to_read or pos == 0: - return lines[-to_read:offset and -offset or None] + return lines[-to_read] avg_line_length *= 1.3 except IOError: From ac6a14055dc48faa67b147b07ab6ab79cedee03b Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 12 May 2018 02:22:26 +0200 Subject: [PATCH 205/313] [mod] lisibility --- src/yunohost/service.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 9b4b8348e..b5908741f 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -632,10 +632,13 @@ def _tail(file, n): # woops. apparently file is smaller than what we want # to step back, go to the beginning instead f.seek(0) + pos = f.tell() lines = f.read().splitlines() + if len(lines) >= to_read or pos == 0: return lines[-to_read] + avg_line_length *= 1.3 except IOError: From b7e946517b998fa58ce0cf839421ace8da19adb1 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 12 May 2018 02:22:38 +0200 Subject: [PATCH 206/313] [mod] more debug output --- src/yunohost/service.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index b5908741f..e37cd0062 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -641,7 +641,8 @@ def _tail(file, n): avg_line_length *= 1.3 - except IOError: + except IOError as e: + logger.warning("Error while tailing file '%s': %s", file, e, exc_info=1) return [] From 3155def9dd13e3ccbc3e76862e754aea563dbf8d Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 12 May 2018 02:55:08 +0200 Subject: [PATCH 207/313] [mod] simplify code --- src/yunohost/service.py | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index e37cd0062..0f5c1beb4 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -654,25 +654,25 @@ def _get_files_diff(orig_file, new_file, as_string=False, skip_header=True): header can also be removed if skip_header is True. """ - contents = [[], []] - for i, path in enumerate((orig_file, new_file)): - try: - with open(path, 'r') as f: - contents[i] = f.readlines() - except IOError: - pass + with open(orig_file, 'r') as orig_file: + orig_file = orig_file.readlines() + + with open(new_file, 'r') as new_file: + new_file.readlines() # Compare files and format output - diff = unified_diff(contents[0], contents[1]) + diff = unified_diff(orig_file, new_file) + if skip_header: - for i in range(2): - try: - next(diff) - except: - break + try: + next(diff) + next(diff) + except: + pass + if as_string: - result = ''.join(line for line in diff) - return result.rstrip() + return ''.join(diff).rstrip() + return diff From d15ca90eedb656258f6b1cad69464123e66b5d3b Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 12 May 2018 02:59:09 +0200 Subject: [PATCH 208/313] [mod] add more debug output --- src/yunohost/service.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 0f5c1beb4..ee9ff33f1 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -679,11 +679,14 @@ def _get_files_diff(orig_file, new_file, as_string=False, skip_header=True): def _calculate_hash(path): """Calculate the MD5 hash of a file""" hasher = hashlib.md5() + try: with open(path, 'rb') as f: hasher.update(f.read()) return hasher.hexdigest() - except IOError: + + except IOError as e: + logger.warning("Error while calculating file '%s' hash: %s", path, e, exc_info=1) return None From 249994785f2837114a688feca492dd93173c7cbb Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 12 May 2018 03:12:52 +0200 Subject: [PATCH 209/313] [mod] more debug output --- src/yunohost/service.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index ee9ff33f1..99726b720 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -799,7 +799,8 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): shutil.copyfile(new_conf, system_conf) logger.info(m18n.n('service_conf_file_updated', conf=system_conf)) - except: + except Exception as e: + logger.warning("Exception while trying to regenerate conf '%s': %s", system_conf, e, exc_info=1) if not new_conf and os.path.exists(system_conf): logger.warning(m18n.n('service_conf_file_remove_failed', conf=system_conf), From 5f2f262c57aaabe914781a8679e8ec1e3497cefb Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sat, 12 May 2018 03:13:03 +0200 Subject: [PATCH 210/313] [doc] add comment explaining situation --- src/yunohost/service.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 99726b720..27b7f378b 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -809,6 +809,9 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): elif new_conf: try: + # From documentation: + # Raise an exception if an os.stat() call on either pathname fails. + # (os.stats returns a series of information from a file like type, size...) copy_succeed = os.path.samefile(system_conf, new_conf) except: copy_succeed = False From 4686e48dbc9551438a1875b639417302a39225da Mon Sep 17 00:00:00 2001 From: Quenti Date: Fri, 11 May 2018 22:09:33 +0000 Subject: [PATCH 211/313] [i18n] Translated using Weblate (Occitan) Currently translated at 17.3% (67 of 386 strings) --- locales/oc.json | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 27c0c4d7d..ff86b107e 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -38,5 +38,32 @@ "backup_applying_method_copy": "Còpia de totes los fichièrs dins la salvagarda…", "backup_applying_method_tar": "Creacion de l’archiu tar de la salvagarda…", "backup_archive_name_exists": "Un archiu de salvagarda amb aquesta nom existís ja", - "backup_archive_name_unknown": "L’archiu local de salvagarda apelat « {name:s} » es desconegut" + "backup_archive_name_unknown": "L’archiu local de salvagarda apelat « {name:s} » es desconegut", + "action_invalid": "Accion « {action:s} » incorrècte", + "app_argument_choice_invalid": "Causida invalida pel paramètre « {name:s} », cal que siá un de {choices:s}", + "app_argument_invalid": "Valor invalida pel paramètre « {name:s} » : {error:s}", + "app_argument_required": "Lo paramètre « {name:s} » es requesit", + "app_change_url_failed_nginx_reload": "La reaviada de nginx a fracassat. Vaquí la sortida de « nginx -t » :\n{nginx_errors:s}", + "app_change_url_identical_domains": "L’ancian e lo novèl coble domeni/camin son identics per {domain:s}{path:s}, pas res a far.", + "app_change_url_success": "L’URL de l’aplicacion {app:s} a cambiat per {domain:s}{path:s}", + "app_checkurl_is_deprecated": "Packagers /!\\ 'app checkurl' es obsolèt ! Utilizatz 'app register-url' a la plaça !", + "app_extraction_failed": "Extraccion dels fichièrs d’installacion impossibla", + "app_incompatible": "L’aplicacion {app} es pas compatibla amb vòstra version de YunoHost", + "app_location_already_used": "L’aplicacion « {app} » es ja installada a aqueste emplaçament ({path})", + "app_manifest_invalid": "Manifest d’aplicacion incorrècte : {error}", + "app_package_need_update": "Lo paquet de l’aplicacion {app} deu èsser mes a jorn per seguir los cambiaments de YunoHost", + "app_requirements_checking": "Verificacion dels paquets requesida per {app}...", + "app_sources_fetch_failed": "Recuperacion dels fichièrs fonts impossibla", + "app_unsupported_remote_type": "Lo tipe alonhat utilizat per l’aplicacion es pas suportat", + "appslist_retrieve_error": "Impossible de recuperar la lista d’aplicacions alonhadas {appslist:s} : {error:s}", + "backup_archive_app_not_found": "L’aplicacion « {app:s} » es pas estada trobada dins l’archiu de la salvagarda", + "backup_archive_broken_link": "Impossible d‘accedir a l’archiu de salvagarda (ligam invalid cap a {path:s})", + "backup_archive_mount_failed": "Lo montatge de l’archiu de salvagarda a fracassat", + "backup_archive_open_failed": "Impossible de dobrir l’archiu de salvagarda", + "backup_archive_system_part_not_available": "La part « {part:s} » del sistèma es pas disponibla dins aquesta salvagarda", + "backup_cleaning_failed": "Impossible de netejar lo repertòri temporari de salvagarda", + "backup_copying_to_organize_the_archive": "Còpia de {size:s} Mio per organizar l’archiu", + "backup_created": "Salvagarda acabada", + "backup_creating_archive": "Creacion de l’archiu de salvagarda...", + "backup_creation_failed": "Impossible de crear la salvagarda" } From 644c927d854cb00cc168edc9b9517710ea71df90 Mon Sep 17 00:00:00 2001 From: Jean-Baptiste Holcroft Date: Sat, 12 May 2018 08:45:47 +0000 Subject: [PATCH 212/313] [i18n] Translated using Weblate (French) Currently translated at 100.0% (386 of 386 strings) --- locales/fr.json | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/locales/fr.json b/locales/fr.json index 84601dcb5..ff1278369 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -200,9 +200,9 @@ "service_configuration_conflict": "Le fichier {file:s} a été modifié depuis sa dernière génération. Veuillez y appliquer les modifications manuellement ou utiliser l’option --force (ce qui écrasera toutes les modifications effectuées sur le fichier).", "service_configured": "La configuration du service « {service:s} » a été générée avec succès", "service_configured_all": "La configuration de tous les services a été générée avec succès", - "service_disable_failed": "Impossible de désactiver le service « {service:s} »", + "service_disable_failed": "Impossible de désactiver le service « {service:s} »\n\nJournaux récents : {logs:s}", "service_disabled": "Le service « {service:s} » a été désactivé", - "service_enable_failed": "Impossible d'activer le service « {service:s} »", + "service_enable_failed": "Impossible d’activer le service « {service:s} »\n\nJournaux récents : {logs:s}", "service_enabled": "Le service « {service:s} » a été activé", "service_no_log": "Aucun journal à afficher pour le service « {service:s} »", "service_regenconf_dry_pending_applying": "Vérification des configurations en attentes qui pourraient être appliquées pour le service « {service} »…", @@ -210,10 +210,10 @@ "service_regenconf_pending_applying": "Application des configurations en attentes pour le service « {service} »…", "service_remove_failed": "Impossible d'enlever le service « {service:s} »", "service_removed": "Le service « {service:s} » a été enlevé", - "service_start_failed": "Impossible de démarrer le service « {service:s} »", + "service_start_failed": "Impossible de démarrer le service « {service:s} »\n\nJournaux récents : {logs:s}", "service_started": "Le service « {service:s} » a été démarré", "service_status_failed": "Impossible de déterminer le statut du service « {service:s} »", - "service_stop_failed": "Impossible d'arrêter le service « {service:s} »", + "service_stop_failed": "Impossible d’arrêter le service « {service:s} »\n\nJournaux récents : {logs:s}", "service_stopped": "Le service « {service:s} » a été arrêté", "service_unknown": "Service « {service:s} » inconnu", "services_configured": "La configuration a été générée avec succès", @@ -379,5 +379,24 @@ "migrate_tsig_wait_3": "1 minute…", "migrate_tsig_wait_4": "30 secondes…", "migrate_tsig_not_needed": "Il ne semble pas que vous utilisez un domaine dyndns, donc aucune migration n’est nécessaire !", - "app_checkurl_is_deprecated": "Packagers /!\\ 'app checkurl' est obsolète ! Utilisez 'app register-url' en remplacement !" + "app_checkurl_is_deprecated": "Packagers /!\\ 'app checkurl' est obsolète ! Utilisez 'app register-url' en remplacement !", + "migration_description_0001_change_cert_group_to_sslcert": "Change les permissions de groupe des certificats de « metronome » à « ssl-cert »", + "migration_description_0002_migrate_to_tsig_sha256": "Améliore la sécurité de DynDNDS TSIG en utilisant SHA512 au lieu de MD5", + "migration_description_0003_migrate_to_stretch": "Mise à niveau du système vers Debian Stretch et YunoHost 3.0", + "migration_0003_backward_impossible": "La migration Stretch n’est pas réversible.", + "migration_0003_start": "Démarrage de la migration vers Stretch. Les journaux seront disponibles dans {logfile}.", + "migration_0003_patching_sources_list": "Modification de sources.lists…", + "migration_0003_main_upgrade": "Démarrage de la mise à niveau principale…", + "migration_0003_fail2ban_upgrade": "Démarrage de la mise à niveau de fail2ban…", + "migration_0003_restoring_origin_nginx_conf": "Votre fichier /etc/nginx/nginx.conf a été modifié d’une manière ou d’une autre. La migration va d’abords le réinitialiser à son état initial… Le fichier précédent sera disponible en tant que {backup_dest}.", + "migration_0003_yunohost_upgrade": "Démarrage de la mise à niveau du paquet YunoHost… La migration terminera, mais la mise à jour réelle aura lieu immédiatement après. Après cette opération terminée, vous pourriez avoir à vous reconnecter à l’administration web.", + "migration_0003_not_jessie": "La distribution Debian actuelle n’est pas Jessie !", + "migration_0003_system_not_fully_up_to_date": "Votre système n’est pas complètement à jour. Veuillez mener une mise à jour classique avant de lancer à migration à Stretch.", + "migration_0003_still_on_jessie_after_main_upgrade": "Quelque chose s’est ma passé pendant la mise à niveau principale : le système est toujours sur Jessie ?!? Pour investiguer le problème, veuillez regarder {log} 🙁…", + "migration_0003_general_warning": "Veuillez noter que cette migration est une opération délicate. Si l’équipe YunoHost a fait de son mieux pour la relire et la tester, la migration pourrait tout de même casser des parties de votre système ou de vos applications.\n\nEn conséquence, nous vous recommandons :\n - de lancer une sauvegarde de vos données ou applications critiques ;\n - d’être patient après avoir lancé la migration : selon votre connexion internet et matériel, cela pourrait prendre jusqu'à quelques heures pour que tout soit à niveau.", + "migration_0003_problematic_apps_warning": "Veuillez noter que les applications suivantes, éventuellement problématiques, ont été détectées. Il semble qu’elles n’aient pas été installées depuis une liste d’application ou qu’elles ne soit pas marquées «working ». En conséquence, nous ne pouvons pas garantir qu’elles fonctionneront après la mise à niveau : {problematic_apps}", + "migration_0003_modified_files": "Veuillez noter que les fichiers suivants ont été détectés comme modifiés manuellement et pourraient être écrasés à la fin de la mise à niveau : {manually_modified_files}", + "migrations_list_conflict_pending_done": "Vous ne pouvez pas utiliser --previous et --done simultanément.", + "migrations_to_be_ran_manually": "La migration {number} {name} doit être lancée manuellement. Veuillez aller dans Outils > Migration dans l’interface admin, ou lancer `yunohost tools migrations migrate`.", + "migrations_need_to_accept_disclaimer": "Pour lancer la migration {number} {name}, vous devez accepter cette clause de non-responsabilité :\n---\n{disclaimer}\n---\nSi vous acceptez de lancer la migration, veuillez relancer la commande avec l’option --accept-disclaimer." } From 676d26fb2c596d35130999cb2894754e486511d5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 12 May 2018 19:22:39 +0200 Subject: [PATCH 213/313] Convert old comments in php pools conf files --- src/yunohost/data_migrations/0004_php5_to_php7_pools.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py index 90023bcd4..b6a36e44b 100644 --- a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py +++ b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py @@ -48,6 +48,11 @@ class MyMigration(Migration): c = "sed -i '1i {}' {}".format(MIGRATION_COMMENT, dest) os.system(c) + # Some old comments starting with '#' instead of ';' are not + # compatible in php7 + c = "sed -i 's/^#/;#/g' {}".format(dest) + os.system(c) + # Reload/restart the php pools _run_service_command("restart", "php7.0-fpm") os.system("systemctl stop php5-fpm") From 2dcd274adef06af55fd6b080e645e06e9bca901e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 12 May 2018 19:31:15 +0200 Subject: [PATCH 214/313] Update changelog for beta1.3 --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian/changelog b/debian/changelog index a00fcceed..cb77689e1 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +yunohost (3.0.0~beta1.3) testing; urgency=low + + * Use mariadb 10.1 now + * Convert old php comment starting with # for php5->7 migration + + -- Alexandre Aubin Sat, 12 May 2018 19:26:00 +0000 + yunohost (3.0.0~beta1.2) testing; urgency=low Removing http2 also from yunohost_admin.conf since there still are some From 82b598b5ca33b5230c1f509767ecd87191a3565a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Josu=C3=A9=20Tille?= Date: Sat, 12 May 2018 21:31:12 +0200 Subject: [PATCH 215/313] Fix from comment PR #462 --- data/helpers.d/backend | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/data/helpers.d/backend b/data/helpers.d/backend index a912cd337..8dce2df06 100644 --- a/data/helpers.d/backend +++ b/data/helpers.d/backend @@ -134,7 +134,7 @@ ynh_remove_systemd_config () { # __PORT_2__ by $port_2 # ynh_add_nginx_config () { - local finalnginxconf="/etc/nginx/conf.d/$domain.d/$app.conf" + finalnginxconf="/etc/nginx/conf.d/$domain.d/$app.conf" local others_var=${1:-} ynh_backup_if_checksum_is_different "$finalnginxconf" sudo cp ../conf/nginx.conf "$finalnginxconf" @@ -161,14 +161,18 @@ ynh_add_nginx_config () { fi # Replace all other variable given as arguments - for v in $others_var + for var_to_replace in $others_var do - ynh_replace_string "__${v^^}__" "${!v}" "$finalnginxconf" + # ${var_to_replace^^} make the content of the variable on upper-cases + # ${!var_to_replace} get the content of the variable named $var_to_replace + ynh_replace_string "__${var_to_replace^^}__" "${!var_to_replace}" "$finalnginxconf" done if [ "${path_url:-}" != "/" ] then ynh_replace_string "^#sub_path_only" "" "$finalnginxconf" + else + ynh_replace_string "^#root_path_only" "" "$finalnginxconf" fi ynh_store_file_checksum "$finalnginxconf" From 6461b3ec111de5d5c3b1f1ee8348dca5af88d79b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 15 May 2018 17:52:49 +0200 Subject: [PATCH 216/313] Update comment about certificates --- data/templates/postfix/main.cf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/data/templates/postfix/main.cf b/data/templates/postfix/main.cf index b96bb4860..7d7589c66 100644 --- a/data/templates/postfix/main.cf +++ b/data/templates/postfix/main.cf @@ -45,7 +45,8 @@ smtp_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers smtp_tls_mandatory_ciphers= $smtpd_tls_mandatory_ciphers smtp_tls_loglevel=1 -# Fix "Untrusted TLS connection established to" message in log +# Configure Root CA certificates +# (for example, avoids getting "Untrusted TLS connection established to" messages in logs) smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt From a897ec94f8b6a2265f5c2827ecaacbc9bd4f2000 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 15 May 2018 19:40:04 +0200 Subject: [PATCH 217/313] Remove a line which I added for test / debug --- bin/yunoprompt | 3 --- 1 file changed, 3 deletions(-) diff --git a/bin/yunoprompt b/bin/yunoprompt index bb71e96b9..ab9068d26 100755 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -47,9 +47,6 @@ ${fingerprint[4]} EOF ) - -echo "$LOGO_AND_FINGERPRINTS" > /etc/issue.net - if [[ ! -f /etc/yunohost/installed ]] then if [[ ! -f /etc/yunohost/from_script ]] From 2bc5e82b9cdc7e3c3b55d635f7fc0466012db9ad Mon Sep 17 00:00:00 2001 From: Maniack Crudelis Date: Tue, 15 May 2018 19:51:13 +0200 Subject: [PATCH 218/313] [enh] We need a fucking log Die quiet ! Die !!! --- data/helpers.d/package | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/helpers.d/package b/data/helpers.d/package index a1d29651e..e360fad4c 100644 --- a/data/helpers.d/package +++ b/data/helpers.d/package @@ -30,7 +30,7 @@ ynh_package_version() { # # usage: ynh_apt update ynh_apt() { - DEBIAN_FRONTEND=noninteractive sudo apt-get -y -qq $@ + DEBIAN_FRONTEND=noninteractive sudo apt-get -y $@ } # Update package index files @@ -163,4 +163,4 @@ EOF ynh_remove_app_dependencies () { local dep_app=${app//_/-} # Replace all '_' by '-' ynh_package_autopurge ${dep_app}-ynh-deps # Remove the fake package and its dependencies if they not still used. -} \ No newline at end of file +} From 8b0295aa0423b72180ed74cae119432072b066b2 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 17 May 2018 04:52:55 +0200 Subject: [PATCH 219/313] [fix] keep backward compatibility --- src/yunohost/service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 7adecce39..d02adc083 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -229,7 +229,7 @@ def service_status(names=[]): result[name] = { 'status': str(status.get("SubState", "unknown")), - 'loaded': str(status.get("LoadState", "unknown")), + 'loaded': "enabled" if str(status.get("LoadState", "unknown")) == "loaded" else str(status.get("LoadState", "unknown")), 'active': str(status.get("ActiveState", "unknown")), 'active_at': { "timestamp": str(status.get("ActiveEnterTimestamp", "unknown")), From 2a4713f785c205a8ad13ba8d136da63779024756 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 17 May 2018 22:23:18 +0200 Subject: [PATCH 220/313] Alternative logo + misc tweak / cleaning --- bin/yunoprompt | 64 ++++++++++++++++++++++++-------------------------- 1 file changed, 31 insertions(+), 33 deletions(-) diff --git a/bin/yunoprompt b/bin/yunoprompt index ab9068d26..5a7992789 100755 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -16,15 +16,13 @@ done # LOGO=$(cat << 'EOF' - '. ' '' -d. - /M+ h- .shh/ // /NMy- hMdosso - 'MN' /' '. -' :+ N: .Nmyym yo .MN' omNds: :mN' .sydMMMNds+ - sMh:/dN: :M' m: oMh' .M: dy h' MM: 'Mo oMh:-sMh /ddNdyyNM' - .sMMy' /M' /M- sMMd/sM- -Ms +M+ MM: +M/ mM' -Md 'NM. hM. - mM .M- :NN yMMMMMM: .dMNNMd' -/oMMmhmMMh /msosNM/ ::oMM. +M: - 'MN sMNMM+ mN:.+mM+ -+o/ :hMMm+- 'oN- :oyo- 'yho. - - hy /yy: :- -. -Nh ' - . + .--------------. + | \\ / _ _ | + | | |_|| |(_) | + | | + | |_| _ __|_ | + | | |(_)_\\ | | + '______________' EOF ) @@ -35,15 +33,17 @@ EOF # LOGO_AND_FINGERPRINTS=$(cat << EOF -"$LOGO" -IP: ${ip} -SSH fingerprints: -${fingerprint[0]} -${fingerprint[1]} -${fingerprint[2]} -${fingerprint[3]} -${fingerprint[4]} +$LOGO + + IP: ${ip} + SSH fingerprints: + ${fingerprint[0]} + ${fingerprint[1]} + ${fingerprint[2]} + ${fingerprint[3]} + ${fingerprint[4]} + EOF ) @@ -55,25 +55,23 @@ then chvt 2 echo "$LOGO_AND_FINGERPRINTS" echo -e "\e[m Post-installation \e[0m" - echo "Congratulations! YunoHost has been successfully installed. - Two more steps are required to activate the services of your server." + echo "Congratulations! YunoHost has been successfully installed.\nTwo more steps are required to activate the services of your server." read -p "Proceed to post-installation? (y/n) " -n 1 - RESULT=1 - while [ $RESULT -gt 0 ]; do - if [[ $REPLY =~ ^[Nn]$ ]]; then + RESULT=1 + while [ $RESULT -gt 0 ]; do + if [[ $REPLY =~ ^[Nn]$ ]]; then chvt 1 - exit 0 - fi - echo -e "\n" - /usr/bin/yunohost tools postinstall - let RESULT=$? - if [ $RESULT -gt 0 ]; then - echo -e "\n" - read -p "Retry? (y/n) " -n 1 - fi - done + exit 0 + fi + echo -e "\n" + /usr/bin/yunohost tools postinstall + let RESULT=$? + if [ $RESULT -gt 0 ]; then + echo -e "\n" + read -p "Retry? (y/n) " -n 1 + fi + done fi else # YunoHost is already post-installed echo "$LOGO_AND_FINGERPRINTS" > /etc/issue fi - From 9ed8d9cdbcccfb1dea8cac23fc295b8dcfd7b5a4 Mon Sep 17 00:00:00 2001 From: Quenti Date: Sun, 13 May 2018 18:02:39 +0000 Subject: [PATCH 221/313] [i18n] Translated using Weblate (Occitan) Currently translated at 22.2% (86 of 386 strings) --- locales/oc.json | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index ff86b107e..e0d476cf2 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -65,5 +65,24 @@ "backup_copying_to_organize_the_archive": "Còpia de {size:s} Mio per organizar l’archiu", "backup_created": "Salvagarda acabada", "backup_creating_archive": "Creacion de l’archiu de salvagarda...", - "backup_creation_failed": "Impossible de crear la salvagarda" + "backup_creation_failed": "Impossible de crear la salvagarda", + "app_already_installed_cant_change_url": "Aquesta aplicacion es ja installada. Aquesta foncion pòt pas simplament cambiar l’URL. Agachatz « app changeurl » s’es disponible.", + "app_change_no_change_url_script": "L’aplicacion {app_name:s} pren pas en compte lo cambiament d’URL, poiretz aver de la metre a jorn.", + "app_change_url_no_script": "L’aplicacion {app_name:s} pren pas en compte lo cambiament d’URL, benlèu que vos cal la metre a jorn.", + "app_make_default_location_already_used": "Impossible de configurar l’aplicacion « {app} » per defaut pel domeni {domain} perque es ja utilizat per l’aplicacion {other_app}", + "app_location_install_failed": "Impossible d’installar l’aplicacion a aqueste emplaçament per causa de conflicte amb l’aplicacion {other_app} qu’es ja installada sus {other_path}", + "app_location_unavailable": "Aquesta URL es pas disponibla o en conflicte amb una aplicacion existenta", + "appslist_corrupted_json": "Cargament impossible de la lista d’aplicacion. Sembla que {filename:s} siá gastat.", + "backup_delete_error": "Impossible de suprimir « {path:s} »", + "backup_deleted": "La salvagarda es estada suprimida", + "backup_hook_unknown": "Script de salvagarda « {hook:s} » desconegut", + "backup_invalid_archive": "Archiu de salvagarda incorrècte", + "backup_method_borg_finished": "La salvagarda dins Borg es acabada", + "backup_method_copy_finished": "La còpia de salvagarda es acabada", + "backup_method_tar_finished": "L’archiu tar de la salvagarda es estat creat", + "backup_output_directory_not_empty": "Lo dorsièr de sortida es pas void", + "backup_output_directory_required": "Vos cal especificar un dorsièr de sortida per la salvagarda", + "backup_running_app_script": "Lançament de l’escript de salvagarda de l’aplicacion « {app:s} »...", + "backup_running_hooks": "Execucion dels scripts de salvagarda...", + "backup_system_part_failed": "Impossible de salvagardar la part « {part:s} » del sistèma" } From da27a0c9476da5ca24c197bb55d92794839accb5 Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Thu, 17 May 2018 16:40:30 +0000 Subject: [PATCH 222/313] [i18n] Translated using Weblate (Arabic) Currently translated at 93.5% (361 of 386 strings) --- locales/ar.json | 53 +++++++++++++++++++++++++++---------------------- 1 file changed, 29 insertions(+), 24 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index 740ce0fcc..d2bc735f2 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -24,11 +24,11 @@ "app_location_unavailable": "This url is not available or conflicts with an already installed app", "app_manifest_invalid": "Invalid app manifest: {error}", "app_no_upgrade": "البرمجيات لا تحتاج إلى تحديث", - "app_not_correctly_installed": "{app:s} seems to be incorrectly installed", - "app_not_installed": "{app:s} is not installed", + "app_not_correctly_installed": "يبدو أن التطبيق {app:s} لم يتم تنصيبه بشكل صحيح", + "app_not_installed": "إنّ التطبيق {app:s} غير مُنصَّب", "app_not_properly_removed": "{app:s} has not been properly removed", "app_package_need_update": "The app {app} package needs to be updated to follow YunoHost changes", - "app_removed": "{app:s} has been removed", + "app_removed": "تمت إزالة تطبيق {app:s}", "app_requirements_checking": "Checking required packages for {app}...", "app_requirements_failed": "Unable to meet requirements for {app}: {error}", "app_requirements_unmeet": "Requirements are not met for {app}, the package {pkgname} ({version}) must be {spec}", @@ -38,7 +38,7 @@ "app_upgrade_app_name": "جارٍ تحديث برنامج {app}...", "app_upgrade_failed": "تعذرت عملية ترقية {app:s}", "app_upgrade_some_app_failed": "تعذرت عملية ترقية بعض البرمجيات", - "app_upgraded": "{app:s} has been upgraded", + "app_upgraded": "تم تحديث التطبيق {app:s}", "appslist_corrupted_json": "Could not load the application lists. It looks like {filename:s} is corrupted.", "appslist_could_not_migrate": "Could not migrate app list {appslist:s} ! Unable to parse the url... The old cron job has been kept in {bkp_file:s}.", "appslist_fetched": "The application list {appslist:s} has been fetched", @@ -115,8 +115,8 @@ "certmanager_cannot_read_cert": "Something wrong happened when trying to open current certificate for domain {domain:s} (file: {file:s}), reason: {reason:s}", "certmanager_cert_install_success": "تمت عملية تنصيب شهادة Let's Encrypt بنجاح على النطاق {domain:s}!", "certmanager_cert_install_success_selfsigned": "Successfully installed a self-signed certificate for domain {domain:s}!", - "certmanager_cert_renew_success": "Successfully renewed Let's Encrypt certificate for domain {domain:s}!", - "certmanager_cert_signing_failed": "Signing the new certificate failed", + "certmanager_cert_renew_success": "نجحت عملية تجديد شهادة Let's Encrypt الخاصة باسم النطاق {domain:s} !", + "certmanager_cert_signing_failed": "فشل إجراء توقيع الشهادة الجديدة", "certmanager_certificate_fetching_or_enabling_failed": "Sounds like enabling the new certificate for {domain:s} failed somehow...", "certmanager_conflicting_nginx_file": "Unable to prepare domain for ACME challenge: the nginx configuration file {filepath:s} is conflicting and should be removed first", "certmanager_couldnt_fetch_intermediate_cert": "Timed out when trying to fetch intermediate certificate from Let's Encrypt. Certificate installation/renewal aborted - please try again later.", @@ -139,13 +139,13 @@ "diagnosis_monitor_disk_error": "Can't monitor disks: {error}", "diagnosis_monitor_network_error": "Can't monitor network: {error}", "diagnosis_monitor_system_error": "Can't monitor system: {error}", - "diagnosis_no_apps": "No installed application", + "diagnosis_no_apps": "لم تقم بتنصيب أية تطبيقات بعد", "dnsmasq_isnt_installed": "dnsmasq does not seem to be installed, please run 'apt-get remove bind9 && apt-get install dnsmasq'", "domain_cannot_remove_main": "Cannot remove main domain. Set a new main domain first", "domain_cert_gen_failed": "Unable to generate certificate", - "domain_created": "The domain has been created", - "domain_creation_failed": "Unable to create domain", - "domain_deleted": "The domain has been deleted", + "domain_created": "تم إنشاء النطاق", + "domain_creation_failed": "تعذرت عملية إنشاء النطاق", + "domain_deleted": "تم حذف النطاق", "domain_deletion_failed": "Unable to delete domain", "domain_dns_conf_is_just_a_recommendation": "This command shows you what is the *recommended* configuration. It does not actually set up the DNS configuration for you. It is your responsability to configure your DNS zone in your registrar according to this recommendation.", "domain_dyndns_already_subscribed": "You've already subscribed to a DynDNS domain", @@ -257,18 +257,18 @@ "package_not_installed": "Package '{pkgname}' is not installed", "package_unexpected_error": "An unexpected error occurred processing the package '{pkgname}'", "package_unknown": "Unknown package '{pkgname}'", - "packages_no_upgrade": "There is no package to upgrade", + "packages_no_upgrade": "لا يوجد هناك أية حزمة بحاجة إلى تحديث", "packages_upgrade_critical_later": "Critical packages ({packages:s}) will be upgraded later", "packages_upgrade_failed": "Unable to upgrade all of the packages", "path_removal_failed": "Unable to remove path {:s}", "pattern_backup_archive_name": "Must be a valid filename with max 30 characters, and alphanumeric and -_. characters only", - "pattern_domain": "Must be a valid domain name (e.g. my-domain.org)", - "pattern_email": "Must be a valid email address (e.g. someone@domain.org)", + "pattern_domain": "يتوجب أن يكون إسم نطاق صالح (مثل my-domain.org)", + "pattern_email": "يتوجب أن يكون عنوان بريد إلكتروني صالح (مثل someone@domain.org)", "pattern_firstname": "Must be a valid first name", "pattern_lastname": "Must be a valid last name", "pattern_listname": "Must be alphanumeric and underscore characters only", "pattern_mailbox_quota": "Must be a size with b/k/M/G/T suffix or 0 to disable the quota", - "pattern_password": "Must be at least 3 characters long", + "pattern_password": "يتوجب أن تكون مكونة من 3 حروف على الأقل", "pattern_port": "يجب أن يكون رقم منفذ صالح (مثال 0-65535)", "pattern_port_or_range": "Must be a valid port number (i.e. 0-65535) or range of ports (e.g. 100:200)", "pattern_positive_number": "يجب أن يكون عددا إيجابيا", @@ -283,22 +283,22 @@ "restore_cleaning_failed": "Unable to clean-up the temporary restoration directory", "restore_complete": "Restore complete", "restore_confirm_yunohost_installed": "Do you really want to restore an already installed system? [{answers:s}]", - "restore_extracting": "Extracting needed files from the archive...", + "restore_extracting": "فك الضغط عن الملفات التي نحتاجها من النسخة الإحتياطية ...", "restore_failed": "Unable to restore the system", "restore_hook_unavailable": "Restoration script for '{part:s}' not available on your system and not in the archive either", "restore_may_be_not_enough_disk_space": "Your system seems not to have enough disk space (freespace: {free_space:d} B, needed space: {needed_space:d} B, security margin: {margin:d} B)", - "restore_mounting_archive": "Mounting archive into '{path:s}'", + "restore_mounting_archive": "تنصيب النسخة الإحتياطية على المسار '{path:s}'", "restore_not_enough_disk_space": "Not enough disk space (freespace: {free_space:d} B, needed space: {needed_space:d} B, security margin: {margin:d} B)", "restore_nothings_done": "Nothing has been restored", "restore_removing_tmp_dir_failed": "Unable to remove an old temporary directory", "restore_running_app_script": "Running restore script of app '{app:s}'...", "restore_running_hooks": "Running restoration hooks...", "restore_system_part_failed": "Unable to restore the '{part:s}' system part", - "server_shutdown": "The server will shutdown", - "server_shutdown_confirm": "The server will shutdown immediatly, are you sure? [{answers:s}]", + "server_shutdown": "سوف ينطفئ الخادوم", + "server_shutdown_confirm": "سوف ينطفئ الخادوم حالا. متأكد ؟ [{answers:s}]", "server_reboot": "The server will reboot", "server_reboot_confirm": "The server will reboot immediatly, are you sure? [{answers:s}]", - "service_add_failed": "Unable to add service '{service:s}'", + "service_add_failed": "تعذرت إضافة خدمة '{service:s}'", "service_added": "The service '{service:s}' has been added", "service_already_started": "Service '{service:s}' has already been started", "service_already_stopped": "Service '{service:s}' has already been stopped", @@ -315,9 +315,9 @@ "service_conf_up_to_date": "The configuration is already up-to-date for service '{service}'", "service_conf_updated": "The configuration has been updated for service '{service}'", "service_conf_would_be_updated": "The configuration would have been updated for service '{service}'", - "service_disable_failed": "Unable to disable service '{service:s}'", + "service_disable_failed": "", "service_disabled": "The service '{service:s}' has been disabled", - "service_enable_failed": "Unable to enable service '{service:s}'", + "service_enable_failed": "", "service_enabled": "The service '{service:s}' has been enabled", "service_no_log": "No log to display for service '{service:s}'", "service_regenconf_dry_pending_applying": "Checking pending configuration which would have been applied for service '{service}'...", @@ -325,10 +325,10 @@ "service_regenconf_pending_applying": "Applying pending configuration for service '{service}'...", "service_remove_failed": "Unable to remove service '{service:s}'", "service_removed": "The service '{service:s}' has been removed", - "service_start_failed": "Unable to start service '{service:s}'", + "service_start_failed": "", "service_started": "The service '{service:s}' has been started", "service_status_failed": "Unable to determine status of service '{service:s}'", - "service_stop_failed": "Unable to stop service '{service:s}'", + "service_stop_failed": "", "service_stopped": "The service '{service:s}' has been stopped", "service_unknown": "Unknown service '{service:s}'", "ssowat_conf_generated": "The SSOwat configuration has been generated", @@ -364,5 +364,10 @@ "yunohost_ca_creation_success": "تم إنشاء هيئة الشهادات المحلية.", "yunohost_configured": "YunoHost has been configured", "yunohost_installing": "عملية تنصيب يونوهوست جارية …", - "yunohost_not_installed": "YunoHost is not or not correctly installed. Please execute 'yunohost tools postinstall'" + "yunohost_not_installed": "YunoHost is not or not correctly installed. Please execute 'yunohost tools postinstall'", + "migration_description_0003_migrate_to_stretch": "تحديث النظام إلى ديبيان ستريتش و واي يونوهوست 3.0", + "migration_0003_patching_sources_list": "عملية تعديل ملف المصادر sources.lists جارية ...", + "migration_0003_main_upgrade": "بداية عملية التحديث الأساسية ...", + "migration_0003_fail2ban_upgrade": "بداية عملية تحديث fail2ban ...", + "migration_0003_not_jessie": "إن توزيعة ديبيان الحالية تختلف عن جيسي !" } From 02842b311d19e1ef403c5b501896ae619628896c Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 17 May 2018 06:00:04 +0200 Subject: [PATCH 223/313] [enh] add service descriptions to en.json --- locales/en.json | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/locales/en.json b/locales/en.json index 86f36749b..3e64b1973 100644 --- a/locales/en.json +++ b/locales/en.json @@ -335,6 +335,24 @@ "service_conf_up_to_date": "The configuration is already up-to-date for service '{service}'", "service_conf_updated": "The configuration has been updated for service '{service}'", "service_conf_would_be_updated": "The configuration would have been updated for service '{service}'", + "service_description_avahi-daemon": "Avahi mDNS/DNS-SD Stack", + "service_description_dnsmasq": "dnsmasq - A lightweight DHCP and caching DNS server", + "service_description_dovecot": "Dovecot IMAP/POP3 email server", + "service_description_fail2ban": "Start/stop fail2ban", + "service_description_glances": "Starts and daemonize Glances server", + "service_description_metronome": "Metronome XMPP Server", + "service_description_mysql": "Start and stop the mysql database server daemon", + "service_description_nginx": "A high performance web server and a reverse proxy server", + "service_description_nslcd": "LDAP connection daemon", + "service_description_php5-fpm": "The PHP FastCGI Process Manager", + "service_description_postfix": "Postfix Mail Transport Agent", + "service_description_redis-server": "Advanced key-value store", + "service_description_rmilter": "Another sendmail milter for different mail checks", + "service_description_rspamd": "rapid spam filtering system", + "service_description_slapd": "OpenLDAP standalone server (Lightweight Directory Access Protocol)", + "service_description_ssh": "OpenBSD Secure Shell server", + "service_description_yunohost-api": "YunoHost API Server", + "service_description_yunohost-firewall": "YunoHost Firewall", "service_disable_failed": "Unable to disable service '{service:s}'\n\nRecent service logs:{logs:s}", "service_disabled": "The service '{service:s}' has been disabled", "service_enable_failed": "Unable to enable service '{service:s}'\n\nRecent service logs:{logs:s}", From 357be33583f6b23a50853fd3f85dc83a81b11114 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 17 May 2018 06:20:01 +0200 Subject: [PATCH 224/313] [enh] uses services descriptions translatables --- src/yunohost/service.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index d02adc083..96fd8ff92 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -227,6 +227,15 @@ def service_status(names=[]): status = _get_service_information_from_systemd(name) + translation_key = "service_description_%s" % name + description = m18n.n(translation_key) + + # that mean that we don't have a translation for this string + # that's the only way to test for that for now + # if we don't have it, uses the one provide by systemd + if description == translation_key: + description = str(status.get("Description", "")) + result[name] = { 'status': str(status.get("SubState", "unknown")), 'loaded': "enabled" if str(status.get("LoadState", "unknown")) == "loaded" else str(status.get("LoadState", "unknown")), @@ -235,7 +244,7 @@ def service_status(names=[]): "timestamp": str(status.get("ActiveEnterTimestamp", "unknown")), "human": datetime.fromtimestamp(status.get("ActiveEnterTimestamp") / 1000000).strftime("%F %X"), }, - 'description': str(status.get("Description", "")), + 'description': description, 'service_file_path': str(status.get("FragmentPath", "unknown")), } From 72bd201cb2efc5f67df29a2eb6384e2a5770fc3f Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 18 May 2018 04:31:09 +0200 Subject: [PATCH 225/313] [enh] import services descriptions from https://pad.aquilenet.fr/p/8Cg5Miv6Of Thanks to everyone who contributed <3 Co-authored-by: ariasuni Co-authored-by: Haelwenn (lanodan) Monnier --- locales/en.json | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/locales/en.json b/locales/en.json index 3e64b1973..e7bfd2ded 100644 --- a/locales/en.json +++ b/locales/en.json @@ -335,24 +335,24 @@ "service_conf_up_to_date": "The configuration is already up-to-date for service '{service}'", "service_conf_updated": "The configuration has been updated for service '{service}'", "service_conf_would_be_updated": "The configuration would have been updated for service '{service}'", - "service_description_avahi-daemon": "Avahi mDNS/DNS-SD Stack", - "service_description_dnsmasq": "dnsmasq - A lightweight DHCP and caching DNS server", - "service_description_dovecot": "Dovecot IMAP/POP3 email server", - "service_description_fail2ban": "Start/stop fail2ban", - "service_description_glances": "Starts and daemonize Glances server", - "service_description_metronome": "Metronome XMPP Server", - "service_description_mysql": "Start and stop the mysql database server daemon", - "service_description_nginx": "A high performance web server and a reverse proxy server", - "service_description_nslcd": "LDAP connection daemon", - "service_description_php5-fpm": "The PHP FastCGI Process Manager", - "service_description_postfix": "Postfix Mail Transport Agent", - "service_description_redis-server": "Advanced key-value store", - "service_description_rmilter": "Another sendmail milter for different mail checks", - "service_description_rspamd": "rapid spam filtering system", - "service_description_slapd": "OpenLDAP standalone server (Lightweight Directory Access Protocol)", - "service_description_ssh": "OpenBSD Secure Shell server", - "service_description_yunohost-api": "YunoHost API Server", - "service_description_yunohost-firewall": "YunoHost Firewall", + "service_description_avahi-daemon": "allows to reach your server using yunohost.local on your local network", + "service_description_dnsmasq": "handles domain name resolution (DNS)", + "service_description_dovecot": "allows e-mail client to access/fetch email (via IMAP and POP3)", + "service_description_fail2ban": "protects against bruteforce and other kind of attacks from the Internet", + "service_description_glances": "monitors system information on your server", + "service_description_metronome": "manage XMPP instant messaging accounts", + "service_description_mysql": "stores applications data (SQL database)", + "service_description_nginx": "serves or provides access to all the websites hosted on your server", + "service_description_nslcd": "handles YunoHost user shell connection", + "service_description_php5-fpm": "runs applications written in PHP with nginx", + "service_description_postfix": "used to send and receive emails", + "service_description_redis-server": "a specialized database used for rapid data access, task queue and communication between programs", + "service_description_rmilter": "checks various parameters in emails", + "service_description_rspamd": "filters spam, and other email-related features", + "service_description_slapd": "stores users, domains and related information", + "service_description_ssh": "allows you to connect remotely to your server via a terminal (SSH protocol)", + "service_description_yunohost-api": "manages interactions between the YunoHost web interface and the system", + "service_description_yunohost-firewall": "manages open and close connexion ports to services", "service_disable_failed": "Unable to disable service '{service:s}'\n\nRecent service logs:{logs:s}", "service_disabled": "The service '{service:s}' has been disabled", "service_enable_failed": "Unable to enable service '{service:s}'\n\nRecent service logs:{logs:s}", From 23474558fcca8234d7ea3c18c80e63427df6cdc0 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Fri, 18 May 2018 04:38:11 +0200 Subject: [PATCH 226/313] [mod] anglish --- src/yunohost/service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 96fd8ff92..69b2bb9fc 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -232,7 +232,7 @@ def service_status(names=[]): # that mean that we don't have a translation for this string # that's the only way to test for that for now - # if we don't have it, uses the one provide by systemd + # if we don't have it, uses the one provided by systemd if description == translation_key: description = str(status.get("Description", "")) From 53dde3a6c7f32d11f7e141eb2084e7e4edb79e4b Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 19 May 2018 21:59:52 +0200 Subject: [PATCH 227/313] We need to set status:null for yunohost pseudo-service --- data/templates/yunohost/services.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index 0c12b9e60..ba568760e 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -37,6 +37,8 @@ nslcd: log: /var/log/syslog nsswitch: status: null +yunohost: + status: null bind9: null tahoe-lafs: null memcached: null From d77c616d71eb7a48f6e613b49129f8494830dfb7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 20 May 2018 21:09:18 +0200 Subject: [PATCH 228/313] Return None directly if we try to calculate the hash of a file that does not exists --- src/yunohost/service.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index d02adc083..866fab414 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -713,6 +713,10 @@ def _get_files_diff(orig_file, new_file, as_string=False, skip_header=True): def _calculate_hash(path): """Calculate the MD5 hash of a file""" + + if not os.path.exists(path): + return None + hasher = hashlib.md5() try: @@ -889,7 +893,7 @@ def _get_journalctl_logs(service): import traceback return "error while get services logs from journalctl:\n%s" % traceback.format_exc() - + def manually_modified_files_compared_to_debian_default(): # from https://serverfault.com/a/90401 From c0be9676e37c9a6b13c48070b29897e1efefc1a7 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 21 May 2018 00:46:48 +0200 Subject: [PATCH 229/313] Rework condition (and remove the 'from_script' flag) --- bin/yunoprompt | 47 ++++++++++++++++++++++------------------------- 1 file changed, 22 insertions(+), 25 deletions(-) diff --git a/bin/yunoprompt b/bin/yunoprompt index 5a7992789..b92f2d209 100755 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -47,31 +47,28 @@ $LOGO EOF ) -if [[ ! -f /etc/yunohost/installed ]] +if [[ -f /etc/yunohost/installed ]] then - if [[ ! -f /etc/yunohost/from_script ]] - then - sleep 5 - chvt 2 - echo "$LOGO_AND_FINGERPRINTS" - echo -e "\e[m Post-installation \e[0m" - echo "Congratulations! YunoHost has been successfully installed.\nTwo more steps are required to activate the services of your server." - read -p "Proceed to post-installation? (y/n) " -n 1 - RESULT=1 - while [ $RESULT -gt 0 ]; do - if [[ $REPLY =~ ^[Nn]$ ]]; then - chvt 1 - exit 0 - fi - echo -e "\n" - /usr/bin/yunohost tools postinstall - let RESULT=$? - if [ $RESULT -gt 0 ]; then - echo -e "\n" - read -p "Retry? (y/n) " -n 1 - fi - done - fi -else # YunoHost is already post-installed echo "$LOGO_AND_FINGERPRINTS" > /etc/issue +else + sleep 5 + chvt 2 + echo "$LOGO_AND_FINGERPRINTS" + echo -e "\e[m Post-installation \e[0m" + echo "Congratulations! YunoHost has been successfully installed.\nTwo more steps are required to activate the services of your server." + read -p "Proceed to post-installation? (y/n) " -n 1 + RESULT=1 + while [ $RESULT -gt 0 ]; do + if [[ $REPLY =~ ^[Nn]$ ]]; then + chvt 1 + exit 0 + fi + echo -e "\n" + /usr/bin/yunohost tools postinstall + let RESULT=$? + if [ $RESULT -gt 0 ]; then + echo -e "\n" + read -p "Retry? (y/n) " -n 1 + fi + done fi From eb76ca3fafd71f15f3096c928c614eccc0c4d483 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 21 May 2018 00:48:39 +0200 Subject: [PATCH 230/313] Change logo again ('Modular' font from patorjk.com) --- bin/yunoprompt | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/bin/yunoprompt b/bin/yunoprompt index b92f2d209..de05dd6fa 100755 --- a/bin/yunoprompt +++ b/bin/yunoprompt @@ -16,13 +16,13 @@ done # LOGO=$(cat << 'EOF' - .--------------. - | \\ / _ _ | - | | |_|| |(_) | - | | - | |_| _ __|_ | - | | |(_)_\\ | | - '______________' + __ __ __ __ __ _ _______ __ __ _______ _______ _______ + | | | || | | || | | || || | | || || || | + | |_| || | | || |_| || _ || |_| || _ || _____||_ _| + | || |_| || || | | || || | | || |_____ | | + |_ _|| || _ || |_| || _ || |_| ||_____ | | | + | | | || | | || || | | || | _____| | | | + |___| |_______||_| |__||_______||__| |__||_______||_______| |___| EOF ) From e7a4b6df2c27027fd4e0a6cf22f85e450652df9e Mon Sep 17 00:00:00 2001 From: "ljf (zamentur)" Date: Mon, 21 May 2018 01:28:08 +0200 Subject: [PATCH 231/313] [enh] Add postgresql helpers (#238) * [enh] Add postgresql helpers * Updated from experimental helpers repo * Update postgresql helpers, c.f. Experimental_helpers/#13 --- data/helpers.d/psql | 150 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 150 insertions(+) create mode 100644 data/helpers.d/psql diff --git a/data/helpers.d/psql b/data/helpers.d/psql new file mode 100644 index 000000000..ddacbef8c --- /dev/null +++ b/data/helpers.d/psql @@ -0,0 +1,150 @@ +# Create a master password and set up global settings +# Please always call this script in install and restore scripts +# +# usage: ynh_psql_test_if_first_run +ynh_psql_test_if_first_run() { + if [ -f /etc/yunohost/psql ]; + then + echo "PostgreSQL is already installed, no need to create master password" + else + pgsql=$(ynh_string_random) + pg_hba="" + echo "$pgsql" >> /etc/yunohost/psql + + if [ -e /etc/postgresql/9.4/ ] + then + pg_hba=/etc/postgresql/9.4/main/pg_hba.conf + elif [ -e /etc/postgresql/9.6/ ] + then + pg_hba=/etc/postgresql/9.6/main/pg_hba.conf + else + ynh_die "postgresql shoud be 9.4 or 9.6" + fi + + systemctl start postgresql + sudo --login --user=postgres psql -c"ALTER user postgres WITH PASSWORD '$pgsql'" postgres + + # force all user to connect to local database using passwords + # https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html#EXAMPLE-PG-HBA.CONF + # Note: we can't use peer since YunoHost create users with nologin + # See: https://github.com/YunoHost/yunohost/blob/unstable/data/helpers.d/user + sed -i '/local\s*all\s*all\s*peer/i \ + local all all password' "$pg_hba" + systemctl enable postgresql + systemctl reload postgresql + fi +} + +# Open a connection as a user +# +# example: ynh_psql_connect_as 'user' 'pass' <<< "UPDATE ...;" +# example: ynh_psql_connect_as 'user' 'pass' < /path/to/file.sql +# +# usage: ynh_psql_connect_as user pwd [db] +# | arg: user - the user name to connect as +# | arg: pwd - the user password +# | arg: db - the database to connect to +ynh_psql_connect_as() { + user="$1" + pwd="$2" + db="$3" + sudo --login --user=postgres PGUSER="$user" PGPASSWORD="$pwd" psql "$db" +} + +# # Execute a command as root user +# +# usage: ynh_psql_execute_as_root sql [db] +# | arg: sql - the SQL command to execute +# | arg: db - the database to connect to +ynh_psql_execute_as_root () { + sql="$1" + sudo --login --user=postgres psql <<< "$sql" +} + +# Execute a command from a file as root user +# +# usage: ynh_psql_execute_file_as_root file [db] +# | arg: file - the file containing SQL commands +# | arg: db - the database to connect to +ynh_psql_execute_file_as_root() { + file="$1" + db="$2" + sudo --login --user=postgres psql "$db" < "$file" +} + +# Create a database, an user and its password. Then store the password in the app's config +# +# After executing this helper, the password of the created database will be available in $db_pwd +# It will also be stored as "psqlpwd" into the app settings. +# +# usage: ynh_psql_setup_db user name [pwd] +# | arg: user - Owner of the database +# | arg: name - Name of the database +# | arg: pwd - Password of the database. If not given, a password will be generated +ynh_psql_setup_db () { + db_user="$1" + db_name="$2" + new_db_pwd=$(ynh_string_random) # Generate a random password + # If $3 is not given, use new_db_pwd instead for db_pwd. + db_pwd="${3:-$new_db_pwd}" + ynh_psql_create_db "$db_name" "$db_user" "$db_pwd" # Create the database + ynh_app_setting_set "$app" psqlpwd "$db_pwd" # Store the password in the app's config +} + +# Create a database and grant privilegies to a user +# +# usage: ynh_psql_create_db db [user [pwd]] +# | arg: db - the database name to create +# | arg: user - the user to grant privilegies +# | arg: pwd - the user password +ynh_psql_create_db() { + db="$1" + user="$2" + pwd="$3" + ynh_psql_create_user "$user" "$pwd" + sudo --login --user=postgres createdb --owner="$user" "$db" +} + +# Drop a database +# +# usage: ynh_psql_drop_db db +# | arg: db - the database name to drop +# | arg: user - the user to drop +ynh_psql_remove_db() { + db="$1" + user="$2" + sudo --login --user=postgres dropdb "$db" + ynh_psql_drop_user "$user" +} + +# Dump a database +# +# example: ynh_psql_dump_db 'roundcube' > ./dump.sql +# +# usage: ynh_psql_dump_db db +# | arg: db - the database name to dump +# | ret: the psqldump output +ynh_psql_dump_db() { + db="$1" + sudo --login --user=postgres pg_dump "$db" +} + + +# Create a user +# +# usage: ynh_psql_create_user user pwd [host] +# | arg: user - the user name to create +ynh_psql_create_user() { + user="$1" + pwd="$2" + sudo --login --user=postgres psql -c"CREATE USER $user WITH PASSWORD '$pwd'" postgres +} + +# Drop a user +# +# usage: ynh_psql_drop_user user +# | arg: user - the user name to drop +ynh_psql_drop_user() { + user="$1" + sudo --login --user=postgres dropuser "$user" +} From 59bb47de185352070c191274fd7a34341db6d886 Mon Sep 17 00:00:00 2001 From: Bram Date: Sat, 26 May 2018 10:43:37 +0200 Subject: [PATCH 232/313] backup filename limit set to 50 --- data/actionsmap/yunohost.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index 6fac16511..4cf0f8955 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -788,7 +788,7 @@ backup: help: Name of the backup archive extra: pattern: &pattern_backup_archive_name - - !!str ^[\w\-\._]{1,30}(? Date: Mon, 28 May 2018 02:24:34 +0200 Subject: [PATCH 233/313] Merge with unstable, update changelog --- debian/changelog | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/debian/changelog b/debian/changelog index da5428e22..60467eec7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,24 @@ +yunohost (2.7.13.3) testing; urgency=low + + * [enh] Add postgresql helpers (#238) + * [enh] Bring back the bootprompt (#363) + * [enh] Allow to disable the backup during the upgrade (#431) + * [fix] Remove warning from equivs (#439) + * [enh] Add SOURCE_EXTRACT (true/false) in ynh_setup_source (#460) + * [enh] More debug output in services.py (#468) + * [enh] Be able to use more variables in template for nginx conf (#462) + * [enh] Upgrade Meltdown / Spectre diagnosis (#464) + * [enh] Check services status via dbus (#469, #478, #479) + * [mod] Cleaning in services.py code (#470, #472) + * [enh] Improvate and translate service descriptions (#476) + * [fix] Fix "untrusted TLS connection" in mail logs (#471) + * [fix] Make apt-get helper not quiet so we can debug (#475) + * [i18n] Improve Occitan, Portuguese, Arabic, French translations + + Contributors : ljf, Maniack, Josue, Aleks, Bram, Quent-in, itxtoledo, ButterflyOfFire, Jibec, ariasuni, Haelwenn + + -- Alexandre Aubin Mon, 28 May 2018 02:23:00 +0000 + yunohost (2.7.13.2) testing; urgency=low * [fix] Fix an error with services marked as None (#466) From 5e452aa07df3aae8b0cf68b3ef466baacbb6a414 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 28 May 2018 02:31:05 +0200 Subject: [PATCH 234/313] Update changelog --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/debian/changelog b/debian/changelog index dc6c6276b..a0992251a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +yunohost (3.0.0~beta1.4) testing; urgency=low + + * Merge with jessie's branches + + -- Alexandre Aubin Mon, 28 May 2018 02:30:00 +0000 + yunohost (3.0.0~beta1.3) testing; urgency=low * Use mariadb 10.1 now From d0b9eb1bddf5152ffb0b23bf42ac5aaad5260ce7 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Tue, 29 May 2018 08:31:44 +0200 Subject: [PATCH 235/313] [fix] handle grabbing services status from alternate names, fix yunohost/issues#1134 --- src/yunohost/service.py | 66 +++++++++++++++++++++++++++++------------ 1 file changed, 47 insertions(+), 19 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index b252f0873..65a6f6f2d 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -227,26 +227,47 @@ def service_status(names=[]): status = _get_service_information_from_systemd(name) - translation_key = "service_description_%s" % name - description = m18n.n(translation_key) + # try to get status using alternative version if they exists + # this is for mariadb/mysql but is generic in case of + alternates = services[name].get("alternates", []) + while status is None and alternates: + status = _get_service_information_from_systemd(alternates.pop()) - # that mean that we don't have a translation for this string - # that's the only way to test for that for now - # if we don't have it, uses the one provided by systemd - if description == translation_key: - description = str(status.get("Description", "")) + if status is None: + logger.error("Failed to get status information via dbus for service %s, systemctl didn't recognize this service ('NoSuchUnit')." % name) + result[name] = { + 'status': "unknown", + 'loaded': "unknown", + 'active': "unknown", + 'active_at': { + "timestamp": "unknown", + "human": "unknown", + }, + 'description': "Error: failed to get information for this service, it doesn't exists for systemd", + 'service_file_path': "unknown", + } - result[name] = { - 'status': str(status.get("SubState", "unknown")), - 'loaded': "enabled" if str(status.get("LoadState", "unknown")) == "loaded" else str(status.get("LoadState", "unknown")), - 'active': str(status.get("ActiveState", "unknown")), - 'active_at': { - "timestamp": str(status.get("ActiveEnterTimestamp", "unknown")), - "human": datetime.fromtimestamp(status.get("ActiveEnterTimestamp") / 1000000).strftime("%F %X"), - }, - 'description': description, - 'service_file_path': str(status.get("FragmentPath", "unknown")), - } + else: + translation_key = "service_description_%s" % name + description = m18n.n(translation_key) + + # that mean that we don't have a translation for this string + # that's the only way to test for that for now + # if we don't have it, uses the one provided by systemd + if description == translation_key: + description = str(status.get("Description", "")) + + result[name] = { + 'status': str(status.get("SubState", "unknown")), + 'loaded': "enabled" if str(status.get("LoadState", "unknown")) == "loaded" else str(status.get("LoadState", "unknown")), + 'active': str(status.get("ActiveState", "unknown")), + 'active_at': { + "timestamp": str(status.get("ActiveEnterTimestamp", "unknown")), + "human": datetime.fromtimestamp(status.get("ActiveEnterTimestamp") / 1000000).strftime("%F %X"), + }, + 'description': description, + 'service_file_path': str(status.get("FragmentPath", "unknown")), + } if len(names) == 1: return result[names[0]] @@ -256,13 +277,20 @@ def service_status(names=[]): def _get_service_information_from_systemd(service): "this is the equivalent of 'systemctl status $service'" import dbus + from dbus.exceptions import DBusException d = dbus.SystemBus() systemd = d.get_object('org.freedesktop.systemd1','/org/freedesktop/systemd1') manager = dbus.Interface(systemd, 'org.freedesktop.systemd1.Manager') - service_path = manager.GetUnit(service + ".service") + try: + service_path = manager.GetUnit(service + ".service") + except DBusException as exception: + if exception.get_dbus_name() == 'org.freedesktop.systemd1.NoSuchUnit': + return None + raise + service_proxy = d.get_object('org.freedesktop.systemd1', service_path) # unit_proxy = dbus.Interface(service_proxy, 'org.freedesktop.systemd1.Unit',) From 6ec5a916f3edb20427f758eabe3fd1ac4784f5fd Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Tue, 29 May 2018 08:32:36 +0200 Subject: [PATCH 236/313] [fix] would have failed on status.get returning None --- src/yunohost/service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 65a6f6f2d..ae37bd8c7 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -263,7 +263,7 @@ def service_status(names=[]): 'active': str(status.get("ActiveState", "unknown")), 'active_at': { "timestamp": str(status.get("ActiveEnterTimestamp", "unknown")), - "human": datetime.fromtimestamp(status.get("ActiveEnterTimestamp") / 1000000).strftime("%F %X"), + "human": datetime.fromtimestamp(status["ActiveEnterTimestamp"] / 1000000).strftime("%F %X") if "ActiveEnterTimestamp" in status else "unknown", }, 'description': description, 'service_file_path': str(status.get("FragmentPath", "unknown")), From 75b6fd87864509295c2e1afa002901e7b625e1b4 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Tue, 29 May 2018 08:54:17 +0200 Subject: [PATCH 237/313] [mod] add mariadb as an alternates for mysql service --- data/templates/yunohost/services.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/data/templates/yunohost/services.yml b/data/templates/yunohost/services.yml index ba568760e..47452c476 100644 --- a/data/templates/yunohost/services.yml +++ b/data/templates/yunohost/services.yml @@ -18,6 +18,7 @@ redis-server: log: /var/log/redis/redis-server.log mysql: log: [/var/log/mysql.log,/var/log/mysql.err] + alternates: ['mariadb'] glances: {} ssh: log: /var/log/auth.log From d3f7809fb43fa36e672cccaf14f2a33da6e82dd6 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Tue, 29 May 2018 08:55:58 +0200 Subject: [PATCH 238/313] [fix] redo yolo logic in case file doesn't exist --- src/yunohost/service.py | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index b252f0873..100150c21 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -698,11 +698,18 @@ def _get_files_diff(orig_file, new_file, as_string=False, skip_header=True): header can also be removed if skip_header is True. """ - with open(orig_file, 'r') as orig_file: - orig_file = orig_file.readlines() - with open(new_file, 'r') as new_file: - new_file.readlines() + if os.path.exists(orig_file): + with open(orig_file, 'r') as orig_file: + orig_file = orig_file.readlines() + else: + orig_file = [] + + if not os.path.exists(new_file): + with open(new_file, 'r') as new_file: + new_file.readlines() + else: + new_file = [] # Compare files and format output diff = unified_diff(orig_file, new_file) From 3a6f3c37323adbfdc8ed53dcbfde79f536a4da75 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Thu, 31 May 2018 09:32:29 +0200 Subject: [PATCH 239/313] [fix] check if log exists before tailing to avoid errors --- src/yunohost/service.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index b252f0873..743efa6da 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -298,7 +298,7 @@ def service_log(name, number=50): for log_path in log_list: # log is a file, read it if not os.path.isdir(log_path): - result[log_path] = _tail(log_path, int(number)) + result[log_path] = _tail(log_path, int(number)) if os.path.exists(log_path) else [] continue for log_file in os.listdir(log_path): @@ -310,7 +310,7 @@ def service_log(name, number=50): if not log_file.endswith(".log"): continue - result[log_file_path] = _tail(log_file_path, int(number)) + result[log_file_path] = _tail(log_file_path, int(number)) if os.path.exists(log_file_path) else [] return result From 91483f38965d2b5a6ac678353ccdbd48a8187d09 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 1 Jun 2018 02:30:10 +0200 Subject: [PATCH 240/313] Reflag some messages as info or debug --- src/yunohost/app.py | 18 ++++++------- src/yunohost/backup.py | 16 ++++++------ src/yunohost/certificate.py | 22 ++++++++-------- .../0002_migrate_to_tsig_sha256.py | 14 +++++----- .../0003_migrate_to_stretch.py | 10 +++---- src/yunohost/domain.py | 2 +- src/yunohost/dyndns.py | 4 +-- src/yunohost/firewall.py | 10 +++---- src/yunohost/hook.py | 6 ++--- src/yunohost/service.py | 26 +++++++++---------- src/yunohost/tools.py | 6 ++--- 11 files changed, 67 insertions(+), 67 deletions(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index 20997de77..a073baf95 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -566,7 +566,7 @@ def app_upgrade(auth, app=[], url=None, file=None): logger.info("Upgrading apps %s", ", ".join(app)) for app_instance_name in apps: - logger.warning(m18n.n('app_upgrade_app_name', app=app_instance_name)) + logger.info(m18n.n('app_upgrade_app_name', app=app_instance_name)) installed = _is_installed(app_instance_name) if not installed: raise MoulinetteError(errno.ENOPKG, @@ -1098,7 +1098,7 @@ def app_setting(app, key, value=None, delete=False): try: return app_settings[key] except: - logger.info("cannot get app setting '%s' for '%s'", key, app) + logger.debug("cannot get app setting '%s' for '%s'", key, app) return None else: if delete and key in app_settings: @@ -1449,7 +1449,7 @@ def _extract_app_from_file(path, remove=False): Dict manifest """ - logger.info(m18n.n('extracting')) + logger.debug(m18n.n('extracting')) if os.path.exists(APP_TMP_FOLDER): shutil.rmtree(APP_TMP_FOLDER) @@ -1490,7 +1490,7 @@ def _extract_app_from_file(path, remove=False): raise MoulinetteError(errno.EINVAL, m18n.n('app_manifest_invalid', error=e.strerror)) - logger.info(m18n.n('done')) + logger.debug(m18n.n('done')) manifest['remote'] = {'type': 'file', 'path': path} return manifest, extracted_app_folder @@ -1535,7 +1535,7 @@ def _fetch_app_from_git(app): if os.path.exists(app_tmp_archive): os.remove(app_tmp_archive) - logger.info(m18n.n('downloading')) + logger.debug(m18n.n('downloading')) if ('@' in app) or ('http://' in app) or ('https://' in app): url = app @@ -1586,7 +1586,7 @@ def _fetch_app_from_git(app): raise MoulinetteError(errno.EIO, m18n.n('app_manifest_invalid', error=e.strerror)) else: - logger.info(m18n.n('done')) + logger.debug(m18n.n('done')) # Store remote repository info into the returned manifest manifest['remote'] = {'type': 'git', 'url': url, 'branch': branch} @@ -1643,7 +1643,7 @@ def _fetch_app_from_git(app): raise MoulinetteError(errno.EIO, m18n.n('app_manifest_invalid', error=e.strerror)) else: - logger.info(m18n.n('done')) + logger.debug(m18n.n('done')) # Store remote repository info into the returned manifest manifest['remote'] = { @@ -1766,7 +1766,7 @@ def _check_manifest_requirements(manifest, app_instance_name): elif not requirements: return - logger.info(m18n.n('app_requirements_checking', app=app_instance_name)) + logger.debug(m18n.n('app_requirements_checking', app=app_instance_name)) # Retrieve versions of each required package try: @@ -1996,7 +1996,7 @@ def _migrate_appslist_system(): for cron_path in legacy_crons: appslist_name = os.path.basename(cron_path).replace("yunohost-applist-", "") - logger.info(m18n.n('appslist_migrating', appslist=appslist_name)) + logger.debug(m18n.n('appslist_migrating', appslist=appslist_name)) # Parse appslist url in cron cron_file_content = open(cron_path).read().strip() diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index f8176e79b..1fe67e406 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -577,7 +577,7 @@ class BackupManager(): if system_targets == []: return - logger.info(m18n.n('backup_running_hooks')) + logger.debug(m18n.n('backup_running_hooks')) # Prepare environnement env_dict = self._get_env_var() @@ -665,7 +665,7 @@ class BackupManager(): tmp_app_bkp_dir = env_dict["YNH_APP_BACKUP_DIR"] settings_dir = os.path.join(self.work_dir, 'apps', app, 'settings') - logger.info(m18n.n('backup_running_app_script', app=app)) + logger.debug(m18n.n('backup_running_app_script', app=app)) try: # Prepare backup directory for the app filesystem.mkdir(tmp_app_bkp_dir, 0750, True, uid='admin') @@ -722,9 +722,9 @@ class BackupManager(): """Apply backup methods""" for method in self.methods: - logger.info(m18n.n('backup_applying_method_' + method.method_name)) + logger.debug(m18n.n('backup_applying_method_' + method.method_name)) method.mount_and_backup(self) - logger.info(m18n.n('backup_method_' + method.method_name + '_finished')) + logger.debug(m18n.n('backup_method_' + method.method_name + '_finished')) def _compute_backup_size(self): """ @@ -1125,7 +1125,7 @@ class RestoreManager(): if system_targets == []: return - logger.info(m18n.n('restore_running_hooks')) + logger.debug(m18n.n('restore_running_hooks')) env_dict = self._get_env_var() ret = hook_callback('restore', @@ -1210,7 +1210,7 @@ class RestoreManager(): self.targets.set_result("apps", app_instance_name, "Warning") return - logger.info(m18n.n('restore_running_app_script', app=app_instance_name)) + logger.debug(m18n.n('restore_running_app_script', app=app_instance_name)) try: # Restore app settings app_settings_new_path = os.path.join('/etc/yunohost/apps/', @@ -1582,7 +1582,7 @@ class BackupMethod(object): m18n.n('backup_unable_to_organize_files')) # Copy unbinded path - logger.info(m18n.n('backup_copying_to_organize_the_archive', + logger.debug(m18n.n('backup_copying_to_organize_the_archive', size=str(size))) for path in paths_needed_to_be_copied: dest = os.path.join(self.work_dir, path['dest']) @@ -1786,7 +1786,7 @@ class TarBackupMethod(BackupMethod): if ret != 0: logger.warning(m18n.n('backup_archive_mount_failed')) - logger.info(m18n.n("restore_extracting")) + logger.debug(m18n.n("restore_extracting")) tar = tarfile.open(self._archive_file, "r:gz") tar.extract('info.json', path=self.work_dir) diff --git a/src/yunohost/certificate.py b/src/yunohost/certificate.py index 775e726e9..6d70b9b0a 100644 --- a/src/yunohost/certificate.py +++ b/src/yunohost/certificate.py @@ -210,7 +210,7 @@ def _certificate_install_selfsigned(domain_list, force=False): raise MoulinetteError( errno.EIO, m18n.n('domain_cert_gen_failed')) else: - logger.info(out) + logger.debug(out) # Link the CA cert (not sure it's actually needed in practice though, # since we append it at the end of crt.pem. For instance for Let's @@ -485,11 +485,11 @@ location ^~ '/.well-known/acme-challenge' # Write the conf if os.path.exists(nginx_conf_file): - logger.info( + logger.debug( "Nginx configuration file for ACME challenge already exists for domain, skipping.") return - logger.info( + logger.debug( "Adding Nginx configuration file for Acme challenge for domain %s.", domain) with open(nginx_conf_file, "w") as f: @@ -531,7 +531,7 @@ def _fetch_and_enable_new_certificate(domain, staging=False): _regen_dnsmasq_if_needed() # Prepare certificate signing request - logger.info( + logger.debug( "Prepare key and certificate signing request (CSR) for %s...", domain) domain_key_file = "%s/%s.pem" % (TMP_FOLDER, domain) @@ -541,7 +541,7 @@ def _fetch_and_enable_new_certificate(domain, staging=False): _prepare_certificate_signing_request(domain, domain_key_file, TMP_FOLDER) # Sign the certificate - logger.info("Now using ACME Tiny to sign the certificate...") + logger.debug("Now using ACME Tiny to sign the certificate...") domain_csr_file = "%s/%s.csr" % (TMP_FOLDER, domain) @@ -579,7 +579,7 @@ def _fetch_and_enable_new_certificate(domain, staging=False): raise MoulinetteError(errno.EINVAL, m18n.n('certmanager_couldnt_fetch_intermediate_cert')) # Now save the key and signed certificate - logger.info("Saving the key and signed certificate...") + logger.debug("Saving the key and signed certificate...") # Create corresponding directory date_tag = datetime.now().strftime("%Y%m%d.%H%M%S") @@ -642,7 +642,7 @@ def _prepare_certificate_signing_request(domain, key_file, output_folder): # Save the request in tmp folder csr_file = output_folder + domain + ".csr" - logger.info("Saving to %s.", csr_file) + logger.debug("Saving to %s.", csr_file) with open(csr_file, "w") as f: f.write(crypto.dump_certificate_request(crypto.FILETYPE_PEM, csr)) @@ -753,7 +753,7 @@ def _get_status(domain): def _generate_account_key(): - logger.info("Generating account key ...") + logger.debug("Generating account key ...") _generate_key(ACCOUNT_KEY_FILE) _set_permissions(ACCOUNT_KEY_FILE, "root", "root", 0400) @@ -776,7 +776,7 @@ def _set_permissions(path, user, group, permissions): def _enable_certificate(domain, new_cert_folder): - logger.info("Enabling the certificate for domain %s ...", domain) + logger.debug("Enabling the certificate for domain %s ...", domain) live_link = os.path.join(CERT_FOLDER, domain) @@ -793,7 +793,7 @@ def _enable_certificate(domain, new_cert_folder): os.symlink(new_cert_folder, live_link) - logger.info("Restarting services...") + logger.debug("Restarting services...") for service in ("postfix", "dovecot", "metronome"): _run_service_command("restart", service) @@ -802,7 +802,7 @@ def _enable_certificate(domain, new_cert_folder): def _backup_current_cert(domain): - logger.info("Backuping existing certificate for domain %s", domain) + logger.debug("Backuping existing certificate for domain %s", domain) cert_folder_domain = os.path.join(CERT_FOLDER, domain) diff --git a/src/yunohost/data_migrations/0002_migrate_to_tsig_sha256.py b/src/yunohost/data_migrations/0002_migrate_to_tsig_sha256.py index 5d495b06c..5cbc4494f 100644 --- a/src/yunohost/data_migrations/0002_migrate_to_tsig_sha256.py +++ b/src/yunohost/data_migrations/0002_migrate_to_tsig_sha256.py @@ -30,10 +30,10 @@ class MyMigration(Migration): (domain, private_key_path) = _guess_current_dyndns_domain(dyn_host) assert "+157" in private_key_path except (MoulinetteError, AssertionError): - logger.warning(m18n.n("migrate_tsig_not_needed")) + logger.info(m18n.n("migrate_tsig_not_needed")) return - logger.warning(m18n.n('migrate_tsig_start', domain=domain)) + logger.info(m18n.n('migrate_tsig_start', domain=domain)) public_key_path = private_key_path.rsplit(".private", 1)[0] + ".key" public_key_md5 = open(public_key_path).read().strip().split(' ')[-1] @@ -77,15 +77,15 @@ class MyMigration(Migration): os.system("mv /etc/yunohost/dyndns/*+157* /tmp") # sleep to wait for dyndns cache invalidation - logger.warning(m18n.n('migrate_tsig_wait')) + logger.info(m18n.n('migrate_tsig_wait')) time.sleep(60) - logger.warning(m18n.n('migrate_tsig_wait_2')) + logger.info(m18n.n('migrate_tsig_wait_2')) time.sleep(60) - logger.warning(m18n.n('migrate_tsig_wait_3')) + logger.info(m18n.n('migrate_tsig_wait_3')) time.sleep(30) - logger.warning(m18n.n('migrate_tsig_wait_4')) + logger.info(m18n.n('migrate_tsig_wait_4')) time.sleep(30) - logger.warning(m18n.n('migrate_tsig_end')) + logger.info(m18n.n('migrate_tsig_end')) return diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index b2fcd08ac..3dee44188 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -36,12 +36,12 @@ class MyMigration(Migration): self.check_assertions() - logger.warning(m18n.n("migration_0003_start", logfile=self.logfile)) + logger.info(m18n.n("migration_0003_start", logfile=self.logfile)) # Preparing the upgrade self.restore_original_nginx_conf_if_needed() - logger.warning(m18n.n("migration_0003_patching_sources_list")) + logger.info(m18n.n("migration_0003_patching_sources_list")) self.patch_apt_sources_list() self.backup_files_to_keep() self.apt_update() @@ -50,7 +50,7 @@ class MyMigration(Migration): self.hold(YUNOHOST_PACKAGES + apps_packages + ["fail2ban"]) # Main dist-upgrade - logger.warning(m18n.n("migration_0003_main_upgrade")) + logger.info(m18n.n("migration_0003_main_upgrade")) _run_service_command("stop", "mysql") self.apt_dist_upgrade(conf_flags=["old", "miss", "def"]) _run_service_command("start", "mysql") @@ -58,7 +58,7 @@ class MyMigration(Migration): raise MoulinetteError(m18n.n("migration_0003_still_on_jessie_after_main_upgrade", log=self.logfile)) # Specific upgrade for fail2ban... - logger.warning(m18n.n("migration_0003_fail2ban_upgrade")) + logger.info(m18n.n("migration_0003_fail2ban_upgrade")) self.unhold(["fail2ban"]) # Don't move this if folder already exists. If it does, we probably are # running this script a 2nd, 3rd, ... time but /etc/fail2ban will @@ -73,7 +73,7 @@ class MyMigration(Migration): os.system("apt clean --assume-yes") # Upgrade yunohost packages - logger.warning(m18n.n("migration_0003_yunohost_upgrade")) + logger.info(m18n.n("migration_0003_yunohost_upgrade")) self.restore_files_to_keep() self.unhold(YUNOHOST_PACKAGES + apps_packages) self.upgrade_yunohost_packages() diff --git a/src/yunohost/domain.py b/src/yunohost/domain.py index 5196d107a..545408592 100644 --- a/src/yunohost/domain.py +++ b/src/yunohost/domain.py @@ -202,7 +202,7 @@ def domain_dns_conf(domain, ttl=None): is_cli = True if msettings.get('interface') == 'cli' else False if is_cli: - logger.warning(m18n.n("domain_dns_conf_is_just_a_recommendation")) + logger.info(m18n.n("domain_dns_conf_is_just_a_recommendation")) return result diff --git a/src/yunohost/dyndns.py b/src/yunohost/dyndns.py index aaf86decd..785b0dd34 100644 --- a/src/yunohost/dyndns.py +++ b/src/yunohost/dyndns.py @@ -141,7 +141,7 @@ def dyndns_subscribe(subscribe_host="dyndns.yunohost.org", domain=None, key=None if not os.path.exists('/etc/yunohost/dyndns'): os.makedirs('/etc/yunohost/dyndns') - logger.info(m18n.n('dyndns_key_generating')) + logger.debug(m18n.n('dyndns_key_generating')) os.system('cd /etc/yunohost/dyndns && ' 'dnssec-keygen -a hmac-sha512 -b 512 -r /dev/urandom -n USER %s' % domain) @@ -288,7 +288,7 @@ def dyndns_update(dyn_host="dyndns.yunohost.org", domain=None, key=None, # to nsupdate as argument write_to_file(DYNDNS_ZONE, '\n'.join(lines)) - logger.info("Now pushing new conf to DynDNS host...") + logger.debug("Now pushing new conf to DynDNS host...") try: command = ["/usr/bin/nsupdate", "-k", key, DYNDNS_ZONE] diff --git a/src/yunohost/firewall.py b/src/yunohost/firewall.py index 97451511f..7b1c72170 100644 --- a/src/yunohost/firewall.py +++ b/src/yunohost/firewall.py @@ -305,7 +305,7 @@ def firewall_upnp(action='status', no_refresh=False): # Compatibility with previous version if action == 'reload': - logger.info("'reload' action is deprecated and will be removed") + logger.debug("'reload' action is deprecated and will be removed") try: # Remove old cron job os.remove('/etc/cron.d/yunohost-firewall') @@ -357,7 +357,7 @@ def firewall_upnp(action='status', no_refresh=False): # Select UPnP device upnpc.selectigd() except: - logger.info('unable to select UPnP device', exc_info=1) + logger.debug('unable to select UPnP device', exc_info=1) enabled = False else: # Iterate over ports @@ -376,7 +376,7 @@ def firewall_upnp(action='status', no_refresh=False): upnpc.addportmapping(port, protocol, upnpc.lanaddr, port, 'yunohost firewall: port %d' % port, '') except: - logger.info('unable to add port %d using UPnP', + logger.debug('unable to add port %d using UPnP', port, exc_info=1) enabled = False @@ -459,6 +459,6 @@ def _update_firewall_file(rules): def _on_rule_command_error(returncode, cmd, output): """Callback for rules commands error""" # Log error and continue commands execution - logger.info('"%s" returned non-zero exit status %d:\n%s', - cmd, returncode, prependlines(output.rstrip(), '> ')) + logger.debug('"%s" returned non-zero exit status %d:\n%s', + cmd, returncode, prependlines(output.rstrip(), '> ')) return True diff --git a/src/yunohost/hook.py b/src/yunohost/hook.py index 1f971edb6..32570ab57 100644 --- a/src/yunohost/hook.py +++ b/src/yunohost/hook.py @@ -355,13 +355,13 @@ def hook_exec(path, args=None, raise_on_error=False, no_trace=False, command.append(cmd.format(script=cmd_script, args=cmd_args)) if logger.isEnabledFor(log.DEBUG): - logger.info(m18n.n('executing_command', command=' '.join(command))) + logger.debug(m18n.n('executing_command', command=' '.join(command))) else: - logger.info(m18n.n('executing_script', script=path)) + logger.debug(m18n.n('executing_script', script=path)) # Define output callbacks and call command callbacks = ( - lambda l: logger.info(l.rstrip()), + lambda l: logger.debug(l.rstrip()), lambda l: logger.warning(l.rstrip()), ) returncode = call_async_output( diff --git a/src/yunohost/service.py b/src/yunohost/service.py index c5ee33f83..0dd71742c 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -126,7 +126,7 @@ def service_start(names): m18n.n('service_start_failed', service=name, logs=_get_journalctl_logs(name))) - logger.info(m18n.n('service_already_started', service=name)) + logger.debug(m18n.n('service_already_started', service=name)) def service_stop(names): @@ -148,7 +148,7 @@ def service_stop(names): m18n.n('service_stop_failed', service=name, logs=_get_journalctl_logs(name))) - logger.info(m18n.n('service_already_stopped', service=name)) + logger.debug(m18n.n('service_already_stopped', service=name)) def service_enable(names): @@ -416,7 +416,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, # Iterate over services and process pending conf for service, conf_files in _get_pending_conf(names).items(): - logger.info(m18n.n( + logger.debug(m18n.n( 'service_regenconf_pending_applying' if not dry_run else 'service_regenconf_dry_pending_applying', service=service)) @@ -459,7 +459,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, regenerated = _regen( system_path, pending_path, save=False) else: - logger.warning(m18n.n( + logger.info(m18n.n( 'service_conf_file_manually_removed', conf=system_path)) conf_status = 'removed' @@ -476,16 +476,16 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, # we assume that it is safe to regen it, since the file is backuped # anyway (by default in _regen), as long as we warn the user # appropriately. - logger.warning(m18n.n('service_conf_new_managed_file', - conf=system_path, service=service)) + logger.info(m18n.n('service_conf_new_managed_file', + conf=system_path, service=service)) regenerated = _regen(system_path, pending_path) conf_status = 'new' elif force: regenerated = _regen(system_path) conf_status = 'force-removed' else: - logger.warning(m18n.n('service_conf_file_kept_back', - conf=system_path, service=service)) + logger.info(m18n.n('service_conf_file_kept_back', + conf=system_path, service=service)) conf_status = 'unmanaged' # -> system conf has not been manually modified @@ -530,7 +530,7 @@ def service_regen_conf(names=[], with_diff=False, force=False, dry_run=False, # Check for service conf changes if not succeed_regen and not failed_regen: - logger.info(m18n.n('service_conf_up_to_date', service=service)) + logger.debug(m18n.n('service_conf_up_to_date', service=service)) continue elif not failed_regen: logger.success(m18n.n( @@ -865,13 +865,13 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): filesystem.mkdir(backup_dir, 0755, True) shutil.copy2(system_conf, backup_path) - logger.info(m18n.n('service_conf_file_backed_up', + logger.debug(m18n.n('service_conf_file_backed_up', conf=system_conf, backup=backup_path)) try: if not new_conf: os.remove(system_conf) - logger.info(m18n.n('service_conf_file_removed', + logger.debug(m18n.n('service_conf_file_removed', conf=system_conf)) else: system_dir = os.path.dirname(system_conf) @@ -880,8 +880,8 @@ def _process_regen_conf(system_conf, new_conf=None, save=True): filesystem.mkdir(system_dir, 0755, True) shutil.copyfile(new_conf, system_conf) - logger.info(m18n.n('service_conf_file_updated', - conf=system_conf)) + logger.debug(m18n.n('service_conf_file_updated', + conf=system_conf)) except Exception as e: logger.warning("Exception while trying to regenerate conf '%s': %s", system_conf, e, exc_info=1) if not new_conf and os.path.exists(system_conf): diff --git a/src/yunohost/tools.py b/src/yunohost/tools.py index 3a2958e3c..ad8cfd846 100644 --- a/src/yunohost/tools.py +++ b/src/yunohost/tools.py @@ -224,7 +224,7 @@ def _set_hostname(hostname, pretty_hostname=None): logger.warning(out) raise MoulinetteError(errno.EIO, m18n.n('domain_hostname_failed')) else: - logger.info(out) + logger.debug(out) def _is_inside_container(): @@ -424,7 +424,7 @@ def tools_update(ignore_apps=False, ignore_packages=False): cache = apt.Cache() # Update APT cache - logger.info(m18n.n('updating_apt_cache')) + logger.debug(m18n.n('updating_apt_cache')) if not cache.update(): raise MoulinetteError(errno.EPERM, m18n.n('update_cache_failed')) @@ -438,7 +438,7 @@ def tools_update(ignore_apps=False, ignore_packages=False): 'fullname': pkg.fullname, 'changelog': pkg.get_changelog() }) - logger.info(m18n.n('done')) + logger.debug(m18n.n('done')) # "apps" will list upgradable packages apps = [] From e47fc937c39477cf3c54c084ce6ab864c1a4c8a2 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 1 Jun 2018 21:46:46 +0000 Subject: [PATCH 241/313] Set verbose by default (and remove the corresponding option) --- bin/yunohost | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/bin/yunohost b/bin/yunohost index 1522b7118..fd9c2dbfd 100755 --- a/bin/yunohost +++ b/bin/yunohost @@ -9,8 +9,8 @@ import argparse IN_DEVEL = False # Level for which loggers will log -LOGGERS_LEVEL = 'INFO' -TTY_LOG_LEVEL = 'SUCCESS' +LOGGERS_LEVEL = 'DEBUG' +TTY_LOG_LEVEL = 'INFO' # Handlers that will be used by loggers # - file: log to the file LOG_DIR/LOG_FILE @@ -58,10 +58,6 @@ def _parse_cli_args(): action='store_true', default=False, help="Log and print debug messages", ) - parser.add_argument('--verbose', - action='store_true', default=False, - help="Be more verbose in the output", - ) parser.add_argument('--quiet', action='store_true', default=False, help="Don't produce any output", @@ -92,13 +88,13 @@ def _parse_cli_args(): return (parser, opts, args) -def _init_moulinette(debug=False, verbose=False, quiet=False): +def _init_moulinette(debug=False, quiet=False): """Configure logging and initialize the moulinette""" # Define loggers handlers handlers = set(LOGGERS_HANDLERS) if quiet and 'tty' in handlers: handlers.remove('tty') - elif verbose and 'tty' not in handlers: + elif 'tty' not in handlers: handlers.append('tty') root_handlers = set(handlers) @@ -108,10 +104,8 @@ def _init_moulinette(debug=False, verbose=False, quiet=False): # Define loggers level level = LOGGERS_LEVEL tty_level = TTY_LOG_LEVEL - if verbose: - tty_level = 'INFO' if debug: - tty_level = level = 'DEBUG' + tty_level = 'DEBUG' # Custom logging configuration logging = { @@ -196,7 +190,7 @@ if __name__ == '__main__': sys.exit(1) parser, opts, args = _parse_cli_args() - _init_moulinette(opts.debug, opts.verbose, opts.quiet) + _init_moulinette(opts.debug, opts.quiet) # Check that YunoHost is installed if not os.path.isfile('/etc/yunohost/installed') and \ From 61949a0fbab59b8f1da25bddd049b57dd4cd4c52 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 1 Jun 2018 22:29:21 +0000 Subject: [PATCH 242/313] Updating changelog --- debian/changelog | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/debian/changelog b/debian/changelog index a0992251a..0a8353ef3 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,13 @@ +yunohost (3.0.0~beta1.5) testing; urgency=low + + * Fix a bug for services with alternate names (mysql<->mariadb) + * Fix a bug in regen conf when computing diff with files that don't exists + * Increase backup filename length + + (Fixes by Bram <3) + + -- Alexandre Aubin Mon, 02 Jun 2018 00:14:00 +0000 + yunohost (3.0.0~beta1.4) testing; urgency=low * Merge with jessie's branches From e05b8549b92b9887348420f8d8860b9af330530e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 5 Jun 2018 18:22:50 +0200 Subject: [PATCH 243/313] Update changelog --- debian/changelog | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/debian/changelog b/debian/changelog index 60467eec7..9bd67a3f8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,13 @@ +yunohost (2.7.13.4) testing; urgency=low + + * Fix a bug for services with alternate names (mysql<->mariadb) + * Fix a bug in regen conf when computing diff with files that don't exists + * Increase backup filename length + + (Fixes by Bram <3) + + -- Alexandre Aubin Tue, 05 Jun 2018 18:22:00 +0000 + yunohost (2.7.13.3) testing; urgency=low * [enh] Add postgresql helpers (#238) From ffc773c856c6c5f23391203b73bc2c1b92d96df3 Mon Sep 17 00:00:00 2001 From: Bram Date: Thu, 7 Jun 2018 13:51:10 +0200 Subject: [PATCH 244/313] [mod] we moved away from redmine --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9aed880ac..4033bd6fb 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ This repository is the core of YunoHost code. ## Issues -- [Please report issues on YunoHost bugtracker](https://dev.yunohost.org/projects/yunohost/issues) (no registration needed). +- [Please report issues on YunoHost bugtracker](https://github.com/YunoHost/issues). ## Contribute - You can develop on this repository using [ynh-dev tool](https://github.com/YunoHost/ynh-dev) with `use-git` sub-command. From cc6819691f7866f3cba5cb370537ed2085168876 Mon Sep 17 00:00:00 2001 From: Bram Date: Thu, 7 Jun 2018 14:00:04 +0200 Subject: [PATCH 245/313] [mod] we moved away from redmine --- src/yunohost/app.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/app.py b/src/yunohost/app.py index a4ab8db7b..18a8be84b 100644 --- a/src/yunohost/app.py +++ b/src/yunohost/app.py @@ -1746,7 +1746,7 @@ def _check_manifest_requirements(manifest, app_instance_name): # Validate multi-instance app if is_true(manifest.get('multi_instance', False)): # Handle backward-incompatible change introduced in yunohost >= 2.3.6 - # See https://dev.yunohost.org/issues/156 + # See https://github.com/YunoHost/issues/issues/156 yunohost_req = requirements.get('yunohost', None) if (not yunohost_req or not packages.SpecifierSet(yunohost_req) & '>= 2.3.6'): From e11730c1e3bb0869093e23c17377edc6ec8afcb6 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 10 Jun 2018 18:07:51 +0200 Subject: [PATCH 246/313] Fix service description for php7.0 --- locales/en.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/en.json b/locales/en.json index 1c120661d..85745e1fb 100644 --- a/locales/en.json +++ b/locales/en.json @@ -348,7 +348,7 @@ "service_description_mysql": "stores applications data (SQL database)", "service_description_nginx": "serves or provides access to all the websites hosted on your server", "service_description_nslcd": "handles YunoHost user shell connection", - "service_description_php5-fpm": "runs applications written in PHP with nginx", + "service_description_php7.0-fpm": "runs applications written in PHP with nginx", "service_description_postfix": "used to send and receive emails", "service_description_redis-server": "a specialized database used for rapid data access, task queue and communication between programs", "service_description_rmilter": "checks various parameters in emails", From 2adc80f8db5138e354fae509b24d837d170a67cf Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 11 Jun 2018 16:18:38 +0200 Subject: [PATCH 247/313] [fix] Microdecision : bug in get_file_diff following refactoring ... --- src/yunohost/service.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index b56c7ad20..0ce8073fa 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -733,9 +733,9 @@ def _get_files_diff(orig_file, new_file, as_string=False, skip_header=True): else: orig_file = [] - if not os.path.exists(new_file): + if os.path.exists(new_file): with open(new_file, 'r') as new_file: - new_file.readlines() + new_file = new_file.readlines() else: new_file = [] From 3681e6adfcf33b4a4643c310ac0891fe0d87d07f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 11 Jun 2018 17:45:17 +0200 Subject: [PATCH 248/313] Attempt to make postgresql not send an email about the 9.4->9.6 migration --- src/yunohost/data_migrations/0003_migrate_to_stretch.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index b2fcd08ac..8b8d37447 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -228,6 +228,8 @@ class MyMigration(Migration): # Make apt-get happy os.system("echo 'libc6 libraries/restart-without-asking boolean true' | debconf-set-selections") + # Don't send an email to root about the postgresql migration. It should be handled automatically after. + os.system("echo 'postgresql-common postgresql-common/obsolete-major seen true' | debconf-set-selections") command = "" command += " DEBIAN_FRONTEND=noninteractive" From 18330ab042f6c784583c9b673cee1bef69b4ac5c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 11 Jun 2018 18:15:19 +0200 Subject: [PATCH 249/313] Check available space in /var/lib/postgresql before running postgresql migration --- locales/en.json | 1 + src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py | 7 +++---- src/yunohost/utils/filesystem.py | 4 ++++ 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/locales/en.json b/locales/en.json index 85745e1fb..5eb977713 100644 --- a/locales/en.json +++ b/locales/en.json @@ -242,6 +242,7 @@ "migration_0003_modified_files": "Please note that the following files were found to be manually modified and might be overwritten at the end of the upgrade : {manually_modified_files}", "migration_0005_postgresql_94_not_installed": "Postgresql was not installed on your system. Nothing to do!", "migration_0005_postgresql_96_not_installed": "Postgresql 9.4 has been found to be installed, but not postgresql 9.6 !? Something weird might have happened on your system :( ...", + "migration_0005_not_enough_space": "Not enough space is available in {path} to run the migration right now :(.", "migrations_backward": "Migrating backward.", "migrations_bad_value_for_target": "Invalid number for target argument, available migrations numbers are 0 or {}", "migrations_cant_reach_migration_file": "Can't access migrations files at path %s", diff --git a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py index a6bfafcf2..9df51979d 100644 --- a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py +++ b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py @@ -5,6 +5,7 @@ from moulinette.core import MoulinetteError from moulinette.utils.log import getActionLogger from yunohost.tools import Migration +from yunohost.utils.filesystem import free_space_in_directory, space_used_by_directory logger = getActionLogger('yunohost.migration') @@ -12,7 +13,6 @@ logger = getActionLogger('yunohost.migration') class MyMigration(Migration): "Migrate DBs from Postgresql 9.4 to 9.6 after migrating to Stretch" - def migrate(self): if not self.package_is_installed("postgresql-9.4"): @@ -22,8 +22,8 @@ class MyMigration(Migration): if not self.package_is_installed("postgresql-9.6"): raise MoulinetteError(m18n.n("migration_0005_postgresql_96_not_installed")) - # FIXME / TODO : maybe add checks about the size of - # /var/lib/postgresql/9.4/main/base/ compared to available space ? + if not space_used_by_directory("/var/lib/postgresql/9.4") < free_space_in_directory("/var/lib/postgresql"): + raise MoulinetteError(m18n.n("migration_0005_not_enough_space", path="/var/lib/postgresql/")) subprocess.check_call("service postgresql stop", shell=True) subprocess.check_call("pg_dropcluster --stop 9.6 main", shell=True) @@ -35,7 +35,6 @@ class MyMigration(Migration): pass - def package_is_installed(self, package_name): p = subprocess.Popen("dpkg --list | grep -q -w {}".format(package_name), shell=True) diff --git a/src/yunohost/utils/filesystem.py b/src/yunohost/utils/filesystem.py index 9b39f5daa..3f026f980 100644 --- a/src/yunohost/utils/filesystem.py +++ b/src/yunohost/utils/filesystem.py @@ -23,3 +23,7 @@ import os def free_space_in_directory(dirpath): stat = os.statvfs(dirpath) return stat.f_frsize * stat.f_bavail + +def space_used_by_directory(dirpath): + stat = os.statvfs(dirpath) + return stat.f_frsize * stat.f_blocks From 0f6d4de8e469471f4042da942e8bf4774c1b6102 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 11 Jun 2018 18:23:38 +0200 Subject: [PATCH 250/313] Remove the logrotate for php5-fpm --- src/yunohost/data_migrations/0004_php5_to_php7_pools.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py index b6a36e44b..1afbf16b7 100644 --- a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py +++ b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py @@ -56,6 +56,7 @@ class MyMigration(Migration): # Reload/restart the php pools _run_service_command("restart", "php7.0-fpm") os.system("systemctl stop php5-fpm") + os.system("rm /etc/logrotate.d/php5-fpm") # We remove this otherwise the logrotate cron will be unhappy # Get list of nginx conf file nginx_conf_files = glob.glob("/etc/nginx/conf.d/*.d/*.conf") From d55c029c9b27403a7ac2ed9aff02e3d683c62a7f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 11 Jun 2018 21:58:01 +0200 Subject: [PATCH 251/313] Don't open old IMAP port (465) --- data/templates/yunohost/firewall.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/data/templates/yunohost/firewall.yml b/data/templates/yunohost/firewall.yml index 201a39092..835a82519 100644 --- a/data/templates/yunohost/firewall.yml +++ b/data/templates/yunohost/firewall.yml @@ -1,10 +1,10 @@ uPnP: enabled: false - TCP: [22, 25, 80, 443, 465, 587, 993, 5222, 5269] + TCP: [22, 25, 80, 443, 587, 993, 5222, 5269] UDP: [] ipv4: - TCP: [22, 25, 53, 80, 443, 465, 587, 993, 5222, 5269] + TCP: [22, 25, 53, 80, 443, 587, 993, 5222, 5269] UDP: [53, 5353] ipv6: - TCP: [22, 25, 53, 80, 443, 465, 587, 993, 5222, 5269] + TCP: [22, 25, 53, 80, 443, 587, 993, 5222, 5269] UDP: [53, 5353] From 0ebfa145b8ae7184cdc78638949013457803c39a Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 11 Jun 2018 23:40:23 +0200 Subject: [PATCH 252/313] Close port 465, open 587 during migration according to SMTP port change --- locales/en.json | 2 +- src/yunohost/data_migrations/0003_migrate_to_stretch.py | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/locales/en.json b/locales/en.json index e7bfd2ded..37160d403 100644 --- a/locales/en.json +++ b/locales/en.json @@ -235,7 +235,7 @@ "migration_0003_not_jessie": "The current debian distribution is not Jessie !", "migration_0003_system_not_fully_up_to_date": "Your system is not fully up to date. Please perform a regular upgrade before running the migration to stretch.", "migration_0003_still_on_jessie_after_main_upgrade": "Something wrong happened during the main upgrade : system is still on Jessie !? To investigate the issue, please look at {log} :s ...", - "migration_0003_general_warning": "Please note that this migration is a delicate operation. While the YunoHost team did its best to review and test it, the migration might still break parts of the system or apps.\n\nTherefore, we recommend you to :\n - Perform a backup of any critical data or app ;\n - Be patient after launching the migration : depending on your internet connection and hardware, it might take up to a few hours for everything to upgrade.", + "migration_0003_general_warning": "Please note that this migration is a delicate operation. While the YunoHost team did its best to review and test it, the migration might still break parts of the system or apps.\n\nTherefore, we recommend you to :\n - Perform a backup of any critical data or app. More infos on https://yunohost.org/backup ;\n - Be patient after launching the migration : depending on your internet connection and hardware, it might take up to a few hours for everything to upgrade.\n\nAdditionally, the port for SMTP, used by external email clients like (Thunderbird or K9-Mail) was changed from 465 (SSL/TLS) to 587 (STARTTLS). The old port 465 will automatically be closed and the new port 587 will be opened in the firewall. You and your users *will* have to adapt the configuration of your email clients accordingly!", "migration_0003_problematic_apps_warning": "Please note that the following possibly problematic installed apps were detected. It looks like those were not installed from an applist or are not flagged as 'working'. Consequently, we cannot guarantee that they will still work after the upgrade : {problematic_apps}", "migration_0003_modified_files": "Please note that the following files were found to be manually modified and might be overwritten at the end of the upgrade : {manually_modified_files}", "migrations_backward": "Migrating backward.", diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index 8b8d37447..6900b678a 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -15,6 +15,7 @@ from yunohost.service import (_run_service_command, manually_modified_files_compared_to_debian_default) from yunohost.utils.filesystem import free_space_in_directory from yunohost.utils.packages import get_installed_version +from yunohost.firewall import firewall_allow, firewall_disallow logger = getActionLogger('yunohost.migration') @@ -72,6 +73,11 @@ class MyMigration(Migration): os.system("apt autoremove --assume-yes") os.system("apt clean --assume-yes") + # We moved to port 587 for SMTP + # https://busylog.net/smtp-tls-ssl-25-465-587/ + firewall_allow("Both", 587) + firewall_disallow("Both", 465) + # Upgrade yunohost packages logger.warning(m18n.n("migration_0003_yunohost_upgrade")) self.restore_files_to_keep() From a895662693133d3da06afa56cf43478fc8051ae4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 11 Jun 2018 23:42:18 +0200 Subject: [PATCH 253/313] Explicitly enable php7.0-fpm and disable php5-fpm during php migration --- src/yunohost/data_migrations/0004_php5_to_php7_pools.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py index 1afbf16b7..0237ddb38 100644 --- a/src/yunohost/data_migrations/0004_php5_to_php7_pools.py +++ b/src/yunohost/data_migrations/0004_php5_to_php7_pools.py @@ -55,7 +55,9 @@ class MyMigration(Migration): # Reload/restart the php pools _run_service_command("restart", "php7.0-fpm") + _run_service_command("enable", "php7.0-fpm") os.system("systemctl stop php5-fpm") + os.system("systemctl disable php5-fpm") os.system("rm /etc/logrotate.d/php5-fpm") # We remove this otherwise the logrotate cron will be unhappy # Get list of nginx conf file From f96aa4450537dec77c4c1479bbdb1f36ad24d3c0 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 12 Jun 2018 00:05:47 +0200 Subject: [PATCH 254/313] Rely on the codename instead of release number because lsb_release is fokin stupid --- .../data_migrations/0003_migrate_to_stretch.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index 6900b678a..add511a81 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -55,7 +55,7 @@ class MyMigration(Migration): _run_service_command("stop", "mysql") self.apt_dist_upgrade(conf_flags=["old", "miss", "def"]) _run_service_command("start", "mysql") - if self.debian_major_version() == 8: + if self.debian_major_version() == "jessie": raise MoulinetteError(m18n.n("migration_0003_still_on_jessie_after_main_upgrade", log=self.logfile)) # Specific upgrade for fail2ban... @@ -89,7 +89,10 @@ class MyMigration(Migration): # because "platform" relies on uname, which on some weird setups does # not behave correctly (still says running Jessie when lsb_release says # Stretch...) - return int(check_output("lsb_release -r").split("\t")[1][0]) + # Also lsb_release is fucking stupid and sometimes return "Release: 8" + # and "Codename: stretch". So apparently the codename is more reliable + # than the release number :| + return check_output("lsb_release -c").split("\t")[1].strip() def yunohost_major_version(self): return int(get_installed_version("yunohost").split('.')[0]) @@ -100,7 +103,7 @@ class MyMigration(Migration): # NB : we do both check to cover situations where the upgrade crashed # in the middle and debian version could be >= 9.x but yunohost package # would still be in 2.x... - if not self.debian_major_version() == 8 \ + if not self.debian_major_version() == "jessie" \ and not self.yunohost_major_version() == 2: raise MoulinetteError(m18n.n("migration_0003_not_jessie")) @@ -125,7 +128,7 @@ class MyMigration(Migration): # NB : we do both check to cover situations where the upgrade crashed # in the middle and debian version could be >= 9.x but yunohost package # would still be in 2.x... - if not self.debian_major_version() == 8 \ + if not self.debian_major_version() == "jessie" \ and not self.yunohost_major_version() == 2: return None From 201edd8c38b7ab333f05e38ee00a3a1e4b517504 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 12 Jun 2018 00:29:30 +0200 Subject: [PATCH 255/313] Revert "Rely on the codename instead of release number because lsb_release is fokin stupid" This reverts commit f96aa4450537dec77c4c1479bbdb1f36ad24d3c0. --- .../data_migrations/0003_migrate_to_stretch.py | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index add511a81..6900b678a 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -55,7 +55,7 @@ class MyMigration(Migration): _run_service_command("stop", "mysql") self.apt_dist_upgrade(conf_flags=["old", "miss", "def"]) _run_service_command("start", "mysql") - if self.debian_major_version() == "jessie": + if self.debian_major_version() == 8: raise MoulinetteError(m18n.n("migration_0003_still_on_jessie_after_main_upgrade", log=self.logfile)) # Specific upgrade for fail2ban... @@ -89,10 +89,7 @@ class MyMigration(Migration): # because "platform" relies on uname, which on some weird setups does # not behave correctly (still says running Jessie when lsb_release says # Stretch...) - # Also lsb_release is fucking stupid and sometimes return "Release: 8" - # and "Codename: stretch". So apparently the codename is more reliable - # than the release number :| - return check_output("lsb_release -c").split("\t")[1].strip() + return int(check_output("lsb_release -r").split("\t")[1][0]) def yunohost_major_version(self): return int(get_installed_version("yunohost").split('.')[0]) @@ -103,7 +100,7 @@ class MyMigration(Migration): # NB : we do both check to cover situations where the upgrade crashed # in the middle and debian version could be >= 9.x but yunohost package # would still be in 2.x... - if not self.debian_major_version() == "jessie" \ + if not self.debian_major_version() == 8 \ and not self.yunohost_major_version() == 2: raise MoulinetteError(m18n.n("migration_0003_not_jessie")) @@ -128,7 +125,7 @@ class MyMigration(Migration): # NB : we do both check to cover situations where the upgrade crashed # in the middle and debian version could be >= 9.x but yunohost package # would still be in 2.x... - if not self.debian_major_version() == "jessie" \ + if not self.debian_major_version() == 8 \ and not self.yunohost_major_version() == 2: return None From 1b55eacf9cd1e41f65e222d830ed760eba012b9c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 12 Jun 2018 00:29:52 +0200 Subject: [PATCH 256/313] Rely on /etc/os-release to get the release number.. --- .../data_migrations/0003_migrate_to_stretch.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index 6900b678a..49e85a64e 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -85,11 +85,13 @@ class MyMigration(Migration): self.upgrade_yunohost_packages() def debian_major_version(self): - # We rely on lsb_release instead of the python module "platform", - # because "platform" relies on uname, which on some weird setups does - # not behave correctly (still says running Jessie when lsb_release says - # Stretch...) - return int(check_output("lsb_release -r").split("\t")[1][0]) + # The python module "platform" and lsb_release are not reliable because + # on some setup, they still return Release=8 even after upgrading to + # stretch ... (Apparently this is related to OVH overriding some stuff + # with /etc/lsb-release for instance -_-) + # Instead, we rely on /etc/os-release which should be the raw info from + # the distribution... + return int(check_output("grep VERSION_ID /etc/os-release | tr '\"' ' ' | cut -d ' ' -f2")) def yunohost_major_version(self): return int(get_installed_version("yunohost").split('.')[0]) From 98862ee25613f8d8aaf92b71e145de8692495c3c Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 12 Jun 2018 01:04:04 +0200 Subject: [PATCH 257/313] Update changelog --- debian/changelog | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/debian/changelog b/debian/changelog index 9bd67a3f8..2c855eae1 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,15 @@ +yunohost (2.7.13.5) testing; urgency=low + + * [fix] a bug when log to be fetched is empty + * [fix] a bug when computing diff in regen_conf + * [stretch-migration] Tell postgresql-common to not send an email about 9.4->9.6 migration + * [stretch-migration] Close port 465 / open port 587 during migration according to SMTP port change in postfix + * [stretch-migration] Rely on /etc/os-release to get debian release number + + Fixes by Bram and Aleks + + -- Alexandre Aubin Tue, 12 Jun 2018 01:00:00 +0000 + yunohost (2.7.13.4) testing; urgency=low * Fix a bug for services with alternate names (mysql<->mariadb) From 11fee7d6a5798a77ba1bd07f7d546299a5e9f96e Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 12 Jun 2018 01:12:01 +0200 Subject: [PATCH 258/313] Update changelog --- debian/changelog | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/debian/changelog b/debian/changelog index 1254ac2f5..5c3cd8b53 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,10 +1,16 @@ +yunohost (3.0.0~beta1.6) testing; urgency=low + + * [fix] Service description for php7.0-fpm + * [fix] Remove old logrotate for php5-fpm during migration + * [fix] Explicitly enable php7.0-fpm and disable php5-fpm during migration + * [fix] Don't open the old SMTP port anymore (465) + * [enh] Check space available before running the postgresql migration + + -- Alexandre Aubin Tue, 12 Jun 2018 01:00:00 +0000 + yunohost (3.0.0~beta1.5) testing; urgency=low - * Fix a bug for services with alternate names (mysql<->mariadb) - * Fix a bug in regen conf when computing diff with files that don't exists - * Increase backup filename length - - (Fixes by Bram <3) + * (c.f. 2.7.13.4) -- Alexandre Aubin Mon, 02 Jun 2018 00:14:00 +0000 From abf0b6c0d9a37c3b790bc03f299da67eea7f5b90 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Tue, 12 Jun 2018 23:22:31 +0200 Subject: [PATCH 259/313] Typo --- locales/en.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/en.json b/locales/en.json index 37160d403..4ca65826c 100644 --- a/locales/en.json +++ b/locales/en.json @@ -235,7 +235,7 @@ "migration_0003_not_jessie": "The current debian distribution is not Jessie !", "migration_0003_system_not_fully_up_to_date": "Your system is not fully up to date. Please perform a regular upgrade before running the migration to stretch.", "migration_0003_still_on_jessie_after_main_upgrade": "Something wrong happened during the main upgrade : system is still on Jessie !? To investigate the issue, please look at {log} :s ...", - "migration_0003_general_warning": "Please note that this migration is a delicate operation. While the YunoHost team did its best to review and test it, the migration might still break parts of the system or apps.\n\nTherefore, we recommend you to :\n - Perform a backup of any critical data or app. More infos on https://yunohost.org/backup ;\n - Be patient after launching the migration : depending on your internet connection and hardware, it might take up to a few hours for everything to upgrade.\n\nAdditionally, the port for SMTP, used by external email clients like (Thunderbird or K9-Mail) was changed from 465 (SSL/TLS) to 587 (STARTTLS). The old port 465 will automatically be closed and the new port 587 will be opened in the firewall. You and your users *will* have to adapt the configuration of your email clients accordingly!", + "migration_0003_general_warning": "Please note that this migration is a delicate operation. While the YunoHost team did its best to review and test it, the migration might still break parts of the system or apps.\n\nTherefore, we recommend you to :\n - Perform a backup of any critical data or app. More infos on https://yunohost.org/backup ;\n - Be patient after launching the migration : depending on your internet connection and hardware, it might take up to a few hours for everything to upgrade.\n\nAdditionally, the port for SMTP, used by external email clients (like Thunderbird or K9-Mail) was changed from 465 (SSL/TLS) to 587 (STARTTLS). The old port 465 will automatically be closed and the new port 587 will be opened in the firewall. You and your users *will* have to adapt the configuration of your email clients accordingly!", "migration_0003_problematic_apps_warning": "Please note that the following possibly problematic installed apps were detected. It looks like those were not installed from an applist or are not flagged as 'working'. Consequently, we cannot guarantee that they will still work after the upgrade : {problematic_apps}", "migration_0003_modified_files": "Please note that the following files were found to be manually modified and might be overwritten at the end of the upgrade : {manually_modified_files}", "migrations_backward": "Migrating backward.", From 9df14c6506993ba81af186764731296af009d261 Mon Sep 17 00:00:00 2001 From: Bram Date: Tue, 12 Jun 2018 23:43:40 +0200 Subject: [PATCH 260/313] [fix] remove slice by mistake in 14c270cebdc67a1123331237cee6dba347ee7623 --- src/yunohost/service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/service.py b/src/yunohost/service.py index 0ce8073fa..ef711a4a9 100644 --- a/src/yunohost/service.py +++ b/src/yunohost/service.py @@ -709,7 +709,7 @@ def _tail(file, n): lines = f.read().splitlines() if len(lines) >= to_read or pos == 0: - return lines[-to_read] + return lines[-to_read:] avg_line_length *= 1.3 From 8b08de665a17881052d57a676546d443564d9c25 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 13 Jun 2018 19:39:56 +0200 Subject: [PATCH 261/313] Add util functions to extract network interfaces and gateway --- src/yunohost/monitor.py | 2 + src/yunohost/utils/network.py | 76 +++++++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) diff --git a/src/yunohost/monitor.py b/src/yunohost/monitor.py index ed13d532d..fc10a4fbc 100644 --- a/src/yunohost/monitor.py +++ b/src/yunohost/monitor.py @@ -164,6 +164,7 @@ def monitor_network(units=None, human_readable=False): units = ['check', 'usage', 'infos'] # Get network devices and their addresses + # TODO / FIXME : use functions in utils/network.py to manage this devices = {} output = subprocess.check_output('ip addr show'.split()) for d in re.split('^(?:[0-9]+: )', output, flags=re.MULTILINE): @@ -213,6 +214,7 @@ def monitor_network(units=None, human_readable=False): elif u == 'infos': p_ipv4 = get_public_ip() or 'unknown' + # TODO / FIXME : use functions in utils/network.py to manage this l_ip = 'unknown' for name, addrs in devices.items(): if name == 'lo': diff --git a/src/yunohost/utils/network.py b/src/yunohost/utils/network.py index e22d1644d..470354f63 100644 --- a/src/yunohost/utils/network.py +++ b/src/yunohost/utils/network.py @@ -19,10 +19,13 @@ """ import logging +import re +import subprocess from urllib import urlopen logger = logging.getLogger('yunohost.utils.network') + def get_public_ip(protocol=4): """Retrieve the public IP address from ip.yunohost.org""" @@ -37,3 +40,76 @@ def get_public_ip(protocol=4): return urlopen(url).read().strip() except IOError: return None + + +def get_network_interfaces(): + + # Get network devices and their addresses (raw infos from 'ip addr') + devices_raw = {} + output = subprocess.check_output('ip addr show'.split()) + for d in re.split('^(?:[0-9]+: )', output, flags=re.MULTILINE): + # Extract device name (1) and its addresses (2) + m = re.match('([^\s@]+)(?:@[\S]+)?: (.*)', d, flags=re.DOTALL) + if m: + devices_raw[m.group(1)] = m.group(2) + + # Parse relevant informations for each of them + devices = {name: _extract_inet(addrs) for name, addrs in devices_raw.items() if name != "lo"} + + return devices or "unknown" + + +def get_gateway(): + + output = subprocess.check_output('ip route show'.split()) + m = re.search('default via (.*) dev ([a-z]+[0-9]?)', output) + if not m: + return "unknown" + + addr = _extract_inet(m.group(1), True) + return addr.popitem()[1] if len(addr) == 1 else "unknown" + + +############################################################################### + + +def _extract_inet(string, skip_netmask=False, skip_loopback=True): + """ + Extract IP addresses (v4 and/or v6) from a string limited to one + address by protocol + + Keyword argument: + string -- String to search in + skip_netmask -- True to skip subnet mask extraction + skip_loopback -- False to include addresses reserved for the + loopback interface + + Returns: + A dict of {protocol: address} with protocol one of 'ipv4' or 'ipv6' + + """ + ip4_pattern = '((25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}' + ip6_pattern = '(((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)::((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)' + ip4_pattern += '/[0-9]{1,2})' if not skip_netmask else ')' + ip6_pattern += '/[0-9]{1,3})' if not skip_netmask else ')' + result = {} + + for m in re.finditer(ip4_pattern, string): + addr = m.group(1) + if skip_loopback and addr.startswith('127.'): + continue + + # Limit to only one result + result['ipv4'] = addr + break + + for m in re.finditer(ip6_pattern, string): + addr = m.group(1) + if skip_loopback and addr == '::1': + continue + + # Limit to only one result + result['ipv6'] = addr + break + + return result From 2aeed38ea5574ae8d12df6bb0c32aea3942f53e5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 13 Jun 2018 20:01:41 +0200 Subject: [PATCH 262/313] Disable predictable network interface names to avoid cases where devices don't reboot properly because interface name changed... --- .../0003_migrate_to_stretch.py | 20 +++++++++++++++++++ src/yunohost/utils/network.py | 6 +++--- 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index 8b8d37447..105480241 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -15,6 +15,7 @@ from yunohost.service import (_run_service_command, manually_modified_files_compared_to_debian_default) from yunohost.utils.filesystem import free_space_in_directory from yunohost.utils.packages import get_installed_version +from yunohost.utils.network import get_network_interfaces logger = getActionLogger('yunohost.migration') @@ -68,6 +69,8 @@ class MyMigration(Migration): self.apt_dist_upgrade(conf_flags=["new", "miss", "def"]) _run_service_command("restart", "fail2ban") + self.disable_predicable_interface_names() + # Clean the mess os.system("apt autoremove --assume-yes") os.system("apt clean --assume-yes") @@ -352,3 +355,20 @@ class MyMigration(Migration): # command showing in the terminal, since 'info' channel is only # enabled if the user explicitly add --verbose ... os.system(command) + + def disable_predicable_interface_names(self): + + # Try to see if currently used interface names are predictable ones or not... + # If we ain't using "eth0" or "wlan0", assume we are using predictable interface + # names and therefore they shouldnt be disabled + network_interfaces = get_network_interfaces().keys() + if "eth0" not in network_interfaces and "wlan0" not in network_interfaces: + return + + interfaces_config = read_file("/etc/network/interfaces") + if "eth0" not in interfaces_config and "wlan0" not in interfaces_config: + return + + # Disable predictive interface names + # c.f. https://unix.stackexchange.com/a/338730 + os.system("ln -s /dev/null /etc/systemd/network/99-default.link") diff --git a/src/yunohost/utils/network.py b/src/yunohost/utils/network.py index 470354f63..dec0384bf 100644 --- a/src/yunohost/utils/network.py +++ b/src/yunohost/utils/network.py @@ -56,7 +56,7 @@ def get_network_interfaces(): # Parse relevant informations for each of them devices = {name: _extract_inet(addrs) for name, addrs in devices_raw.items() if name != "lo"} - return devices or "unknown" + return devices def get_gateway(): @@ -64,10 +64,10 @@ def get_gateway(): output = subprocess.check_output('ip route show'.split()) m = re.search('default via (.*) dev ([a-z]+[0-9]?)', output) if not m: - return "unknown" + return None addr = _extract_inet(m.group(1), True) - return addr.popitem()[1] if len(addr) == 1 else "unknown" + return addr.popitem()[1] if len(addr) == 1 else None ############################################################################### From 898d6659000f075f8b3edf57a204f3b8dbf1a43f Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 15 Jun 2018 15:29:05 +0200 Subject: [PATCH 263/313] Remove archivemount stuff (#491) --- debian/control | 2 +- src/yunohost/backup.py | 89 +++++++++------------- src/yunohost/tests/test_backuprestore.py | 96 +----------------------- 3 files changed, 39 insertions(+), 148 deletions(-) diff --git a/debian/control b/debian/control index ba5f65b6c..256038598 100644 --- a/debian/control +++ b/debian/control @@ -33,7 +33,7 @@ Recommends: yunohost-admin , python-pip , unattended-upgrades , libdbd-ldap-perl, libnet-dns-perl -Suggests: htop, vim, rsync, acpi-support-base, udisks2, archivemount +Suggests: htop, vim, rsync, acpi-support-base, udisks2 Conflicts: iptables-persistent , moulinette-yunohost, yunohost-config , yunohost-config-others, yunohost-config-postfix diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index 1fe67e406..db0f44abe 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -1316,9 +1316,7 @@ class BackupMethod(object): TarBackupMethod --------------- This method compresses all files to backup in a .tar.gz archive. When - restoring, it tries to mount the archive using archivemount/fuse instead - of untaring the archive. Some systems don't support fuse (for these, - it automatically falls back to untaring the required parts). + restoring, it untars the required parts. CustomBackupMethod ------------------ @@ -1687,8 +1685,7 @@ class CopyBackupMethod(BackupMethod): class TarBackupMethod(BackupMethod): """ - This class compress all files to backup in archive. To restore it try to - mount the archive with archivemount (fuse). Some system don't support fuse. + This class compress all files to backup in archive. """ def __init__(self, repo=None): @@ -1760,8 +1757,6 @@ class TarBackupMethod(BackupMethod): Exceptions: backup_archive_open_failed -- Raised if the archive can't be open - backup_archive_mount_failed -- Raised if the system don't support - archivemount """ super(TarBackupMethod, self).mount(restore_manager) @@ -1776,60 +1771,50 @@ class TarBackupMethod(BackupMethod): tar.close() # Mount the tarball + logger.debug(m18n.n("restore_extracting")) + tar = tarfile.open(self._archive_file, "r:gz") + tar.extract('info.json', path=self.work_dir) + try: - ret = subprocess.call(['archivemount', '-o', 'readonly', - self._archive_file, self.work_dir]) - except: - ret = -1 + tar.extract('backup.csv', path=self.work_dir) + except KeyError: + # Old backup archive have no backup.csv file + pass - # If archivemount failed, extract the archive - if ret != 0: - logger.warning(m18n.n('backup_archive_mount_failed')) + # Extract system parts backup + conf_extracted = False - logger.debug(m18n.n("restore_extracting")) - tar = tarfile.open(self._archive_file, "r:gz") - tar.extract('info.json', path=self.work_dir) + system_targets = self.manager.targets.list("system", exclude=["Skipped"]) + apps_targets = self.manager.targets.list("apps", exclude=["Skipped"]) - try: - tar.extract('backup.csv', path=self.work_dir) - except KeyError: - # Old backup archive have no backup.csv file - pass - - # Extract system parts backup - conf_extracted = False - - system_targets = self.manager.targets.list("system", exclude=["Skipped"]) - apps_targets = self.manager.targets.list("apps", exclude=["Skipped"]) - - for system_part in system_targets: - # Caution: conf_ynh_currenthost helpers put its files in - # conf/ynh - if system_part.startswith("conf_"): - if conf_extracted: - continue - system_part = "conf/" - conf_extracted = True - else: - system_part = system_part.replace("_", "/") + "/" - subdir_and_files = [ - tarinfo for tarinfo in tar.getmembers() - if tarinfo.name.startswith(system_part) - ] - tar.extractall(members=subdir_and_files, path=self.work_dir) + for system_part in system_targets: + # Caution: conf_ynh_currenthost helpers put its files in + # conf/ynh + if system_part.startswith("conf_"): + if conf_extracted: + continue + system_part = "conf/" + conf_extracted = True + else: + system_part = system_part.replace("_", "/") + "/" subdir_and_files = [ tarinfo for tarinfo in tar.getmembers() - if tarinfo.name.startswith("hooks/restore/") + if tarinfo.name.startswith(system_part) ] tar.extractall(members=subdir_and_files, path=self.work_dir) + subdir_and_files = [ + tarinfo for tarinfo in tar.getmembers() + if tarinfo.name.startswith("hooks/restore/") + ] + tar.extractall(members=subdir_and_files, path=self.work_dir) - # Extract apps backup - for app in apps_targets: - subdir_and_files = [ - tarinfo for tarinfo in tar.getmembers() - if tarinfo.name.startswith("apps/" + app) - ] - tar.extractall(members=subdir_and_files, path=self.work_dir) + # Extract apps backup + for app in apps_targets: + subdir_and_files = [ + tarinfo for tarinfo in tar.getmembers() + if tarinfo.name.startswith("apps/" + app) + ] + tar.extractall(members=subdir_and_files, path=self.work_dir) class BorgBackupMethod(BackupMethod): diff --git a/src/yunohost/tests/test_backuprestore.py b/src/yunohost/tests/test_backuprestore.py index 8c860fc60..1071c1642 100644 --- a/src/yunohost/tests/test_backuprestore.py +++ b/src/yunohost/tests/test_backuprestore.py @@ -101,9 +101,6 @@ def app_is_installed(app): def backup_test_dependencies_are_met(): - # We need archivemount installed for the backup features to work - assert os.system("which archivemount >/dev/null") == 0 - # Dummy test apps (or backup archives) assert os.path.exists("./tests/apps/backup_wordpress_from_2p4") assert os.path.exists("./tests/apps/backup_legacy_app_ynh") @@ -250,42 +247,6 @@ def test_backup_and_restore_all_sys(): assert os.path.exists("/etc/ssowat/conf.json") -def test_backup_and_restore_archivemount_failure(monkeypatch, mocker): - - # Create the backup - backup_create(ignore_system=False, ignore_apps=True) - - archives = backup_list()["archives"] - assert len(archives) == 1 - - archives_info = backup_info(archives[0], with_details=True) - assert archives_info["apps"] == {} - assert (len(archives_info["system"].keys()) == - len(os.listdir("/usr/share/yunohost/hooks/backup/"))) - - # Remove ssowat conf - assert os.path.exists("/etc/ssowat/conf.json") - os.system("rm -rf /etc/ssowat/") - assert not os.path.exists("/etc/ssowat/conf.json") - - def custom_subprocess_call(*args, **kwargs): - import subprocess as subprocess2 - if args[0] and args[0][0]=="archivemount": - monkeypatch.undo() - return 1 - return subprocess.call(*args, **kwargs) - - monkeypatch.setattr("subprocess.call", custom_subprocess_call) - mocker.spy(m18n, "n") - - # Restore the backup - backup_restore(auth, name=archives[0], force=True, - ignore_system=False, ignore_apps=True) - - # Check ssowat conf is back - assert os.path.exists("/etc/ssowat/conf.json") - - ############################################################################### # System restore from 2.4 # ############################################################################### @@ -311,38 +272,6 @@ def test_restore_system_from_Ynh2p4(monkeypatch, mocker): ignore_apps=True, force=True) - -@pytest.mark.with_system_archive_from_2p4 -def test_restore_system_from_Ynh2p4_archivemount_failure(monkeypatch, mocker): - - # Backup current system - backup_create(ignore_system=False, ignore_apps=True) - archives = backup_list()["archives"] - assert len(archives) == 2 - - def custom_subprocess_call(*args, **kwargs): - import subprocess as subprocess2 - if args[0] and args[0][0]=="archivemount": - monkeypatch.undo() - return 1 - return subprocess.call(*args, **kwargs) - - monkeypatch.setattr("subprocess.call", custom_subprocess_call) - - try: - # Restore system from 2.4 - backup_restore(auth, name=backup_list()["archives"][1], - ignore_system=False, - ignore_apps=True, - force=True) - finally: - # Restore system as it was - backup_restore(auth, name=backup_list()["archives"][0], - ignore_system=False, - ignore_apps=True, - force=True) - - ############################################################################### # App backup # ############################################################################### @@ -545,29 +474,6 @@ def test_restore_app_not_in_backup(mocker): assert not _is_installed("yoloswag") -@pytest.mark.with_wordpress_archive_from_2p4 -def test_restore_app_archivemount_failure(monkeypatch, mocker): - - def custom_subprocess_call(*args, **kwargs): - import subprocess as subprocess2 - if args[0] and args[0][0]=="archivemount": - monkeypatch.undo() - return 1 - return subprocess.call(*args, **kwargs) - - monkeypatch.setattr("subprocess.call", custom_subprocess_call) - mocker.spy(m18n, "n") - - assert not _is_installed("wordpress") - - backup_restore(auth, name=backup_list()["archives"][0], - ignore_system=True, - ignore_apps=False, - apps=["wordpress"]) - - assert _is_installed("wordpress") - - @pytest.mark.with_wordpress_archive_from_2p4 def test_restore_app_already_installed(mocker): @@ -643,7 +549,7 @@ def test_restore_archive_with_no_json(mocker): # Create a backup with no info.json associated os.system("touch /tmp/afile") os.system("tar -czvf /home/yunohost.backup/archives/badbackup.tar.gz /tmp/afile") - + assert "badbackup" in backup_list()["archives"] mocker.spy(m18n, "n") From 022524473e532ec5f6ebe9d0bd889a6e3e384206 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 15 Jun 2018 16:21:54 +0200 Subject: [PATCH 264/313] Update changelog --- debian/changelog | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/debian/changelog b/debian/changelog index 2c855eae1..2e480e1bb 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,13 @@ + +yunohost (2.7.13.6) testing; urgency=low + + * Misc fixes + * [stretch-migration] Disable predictable network interface names + + Fixes by Bram and Aleks + + -- Alexandre Aubin Fri, 15 Jun 2018 16:20:00 +0000 + yunohost (2.7.13.5) testing; urgency=low * [fix] a bug when log to be fetched is empty From aca404a5d78b3690ea5ec7fa74e5e253719b3603 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 15 Jun 2018 17:25:27 +0200 Subject: [PATCH 265/313] Condition typo :< --- src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py index 9df51979d..871edcd19 100644 --- a/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py +++ b/src/yunohost/data_migrations/0005_postgresql_9p4_to_9p6.py @@ -22,7 +22,7 @@ class MyMigration(Migration): if not self.package_is_installed("postgresql-9.6"): raise MoulinetteError(m18n.n("migration_0005_postgresql_96_not_installed")) - if not space_used_by_directory("/var/lib/postgresql/9.4") < free_space_in_directory("/var/lib/postgresql"): + if not space_used_by_directory("/var/lib/postgresql/9.4") > free_space_in_directory("/var/lib/postgresql"): raise MoulinetteError(m18n.n("migration_0005_not_enough_space", path="/var/lib/postgresql/")) subprocess.check_call("service postgresql stop", shell=True) From 8df696849b7608054ce5cc524abde96ad43bc8f2 Mon Sep 17 00:00:00 2001 From: "ljf (zamentur)" Date: Fri, 15 Jun 2018 18:54:14 +0200 Subject: [PATCH 266/313] [fix] Redirect corectly php5 to php7 file during restore (#489) * [fix] Redirect corectly php5 to php7 file during restore * [enh] Avoid to use bash command to do replace * [enh] Use moulinette helpers * [fix] Migrate correctly the first column of backup csv * [fix] Missing argument in locale --- locales/en.json | 1 + src/yunohost/backup.py | 51 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) diff --git a/locales/en.json b/locales/en.json index cbfefad93..21aa67d8b 100644 --- a/locales/en.json +++ b/locales/en.json @@ -103,6 +103,7 @@ "backup_output_directory_not_empty": "The output directory is not empty", "backup_output_directory_required": "You must provide an output directory for the backup", "backup_output_symlink_dir_broken": "You have a broken symlink instead of your archives directory '{path:s}'. You may have a specific setup to backup your data on an other filesystem, in this case you probably forgot to remount or plug your hard dirve or usb key.", + "backup_php5_to_php7_migration_may_fail": "Could not convert your archive to support php7, your php apps may fail to restore (reason: {error:s})", "backup_running_app_script": "Running backup script of app '{app:s}'...", "backup_running_hooks": "Running backup hooks...", "backup_system_part_failed": "Unable to backup the '{part:s}' system part", diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index db0f44abe..41724d61c 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -1111,11 +1111,58 @@ class RestoreManager(): try: self._postinstall_if_needed() + + # Apply dirty patch to redirect php5 file on php7 + self._patch_backup_csv_file() + + self._restore_system() self._restore_apps() finally: self.clean() + def _patch_backup_csv_file(self): + """ + Apply dirty patch to redirect php5 file on php7 + """ + + backup_csv = os.path.join(self.work_dir, 'backup.csv') + + if not os.path.isfile(backup_csv): + return + + try: + contains_php5 = False + with open(backup_csv) as csvfile: + reader = csv.DictReader(csvfile, fieldnames=['source', 'dest']) + newlines = [] + for row in reader: + if 'php5' in row['source']: + contains_php5 = True + row['source'] = row['source'].replace('/etc/php5', '/etc/php/7.0') \ + .replace('/var/run/php5-fpm', '/var/run/php/php7.0-fpm') \ + .replace('php5','php7') + + newlines.append(row) + except (IOError, OSError, csv.Error) as e: + raise MoulinetteError(errno.EIO,m18n.n('error_reading_file', + file=backup_csv, + error=str(e))) + + if not contains_php5: + return + + try: + with open(backup_csv, 'w') as csvfile: + writer = csv.DictWriter(csvfile, + fieldnames=['source', 'dest'], + quoting=csv.QUOTE_ALL) + for row in newlines: + writer.writerow(row) + except (IOError, OSError, csv.Error) as e: + logger.warning(m18n.n('backup_php5_to_php7_migration_may_fail', + error=str(e))) + def _restore_system(self): """ Restore user and system parts """ @@ -1202,6 +1249,10 @@ class RestoreManager(): # Apply dirty patch to make php5 apps compatible with php7 _patch_php5(app_settings_in_archive) + # Delete _common.sh file in backup + common_file = os.path.join(app_backup_in_archive, '_common.sh') + filesystem.rm(common_file, force=True) + # Check if the app has a restore script app_restore_script_in_archive = os.path.join(app_scripts_in_archive, 'restore') From 8268d6e0747a65594b1feb5bbb2c9502ae6f737d Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Fri, 15 Jun 2018 19:30:51 +0200 Subject: [PATCH 267/313] Fix counter-intuitive backup API (#490) * Remove old/deprecated --hooks * Remove --ignore-system and --ignore-apps, backup/restore everything by default, or only the parts explicitly given --- data/actionsmap/yunohost.yml | 37 +++---------------- src/yunohost/backup.py | 71 ++++-------------------------------- 2 files changed, 13 insertions(+), 95 deletions(-) diff --git a/data/actionsmap/yunohost.yml b/data/actionsmap/yunohost.yml index 4cf0f8955..7db57b0e6 100644 --- a/data/actionsmap/yunohost.yml +++ b/data/actionsmap/yunohost.yml @@ -780,7 +780,7 @@ backup: ### backup_create() create: - action_help: Create a backup local archive + action_help: Create a backup local archive. If neither --apps or --system are given, this will backup all apps and all system parts. If only --apps if given, this will only backup apps and no system parts. Similarly, if only --system is given, this will only backup system parts and no apps. api: POST /backup arguments: -n: @@ -804,28 +804,15 @@ backup: help: List of backup methods to apply (copy or tar by default) nargs: "*" --system: - help: List of system parts to backup (all by default) + help: List of system parts to backup (or all if none given). nargs: "*" --apps: - help: List of application names to backup (all by default) + help: List of application names to backup (or all if none given) nargs: "*" - --hooks: - help: (Deprecated) See --system - nargs: "*" - --ignore-system: - help: Do not backup system - action: store_true - --ignore-apps: - help: Do not backup apps - action: store_true - --ignore-hooks: - help: (Deprecated) See --ignore-system - action: store_true - ### backup_restore() restore: - action_help: Restore from a local backup archive + action_help: Restore from a local backup archive. If neither --apps or --system are given, this will restore all apps and all system parts in the archive. If only --apps if given, this will only restore apps and no system parts. Similarly, if only --system is given, this will only restore system parts and no apps. api: POST /backup/restore/ configuration: authenticate: all @@ -834,23 +821,11 @@ backup: name: help: Name of the local backup archive --system: - help: List of system parts to restore (all by default) + help: List of system parts to restore (or all if none is given) nargs: "*" --apps: - help: List of application names to restore (all by default) + help: List of application names to restore (or all if none is given) nargs: "*" - --hooks: - help: (Deprecated) See --system - nargs: "*" - --ignore-system: - help: Do not restore system parts - action: store_true - --ignore-apps: - help: Do not restore apps - action: store_true - --ignore-hooks: - help: (Deprecated) See --ignore-system - action: store_true --force: help: Force restauration on an already installed system action: store_true diff --git a/src/yunohost/backup.py b/src/yunohost/backup.py index 41724d61c..acb7eb574 100644 --- a/src/yunohost/backup.py +++ b/src/yunohost/backup.py @@ -1959,9 +1959,7 @@ class CustomBackupMethod(BackupMethod): def backup_create(name=None, description=None, methods=[], output_directory=None, no_compress=False, - ignore_system=False, system=[], - ignore_apps=False, apps=[], - ignore_hooks=False, hooks=[]): + system=[], apps=[]): """ Create a backup local archive @@ -1972,12 +1970,7 @@ def backup_create(name=None, description=None, methods=[], output_directory -- Output directory for the backup no_compress -- Do not create an archive file system -- List of system elements to backup - ignore_system -- Ignore system elements apps -- List of application names to backup - ignore_apps -- Do not backup apps - - hooks -- (Deprecated) Renamed to "system" - ignore_hooks -- (Deprecated) Renamed to "ignore_system" """ # TODO: Add a 'clean' argument to clean output directory @@ -1986,22 +1979,6 @@ def backup_create(name=None, description=None, methods=[], # Validate / parse arguments # ########################################################################### - # Historical, deprecated options - if ignore_hooks is not False: - logger.warning("--ignore-hooks is deprecated and will be removed in the" - "future. Please use --ignore-system instead.") - ignore_system = ignore_hooks - - if hooks != [] and hooks is not None: - logger.warning("--hooks is deprecated and will be removed in the" - "future. Please use --system instead.") - system = hooks - - # Validate that there's something to backup - if ignore_system and ignore_apps: - raise MoulinetteError(errno.EINVAL, - m18n.n('backup_action_required')) - # Validate there is no archive with the same name if name and name in backup_list()['archives']: raise MoulinetteError(errno.EINVAL, @@ -2034,14 +2011,9 @@ def backup_create(name=None, description=None, methods=[], else: methods = ['tar'] # In future, borg will be the default actions - if ignore_system: - system = None - elif system is None: + # If no --system or --apps given, backup everything + if system is None and apps is None: system = [] - - if ignore_apps: - apps = None - elif apps is None: apps = [] ########################################################################### @@ -2090,11 +2062,7 @@ def backup_create(name=None, description=None, methods=[], } -def backup_restore(auth, name, - system=[], ignore_system=False, - apps=[], ignore_apps=False, - hooks=[], ignore_hooks=False, - force=False): +def backup_restore(auth, name, system=[], apps=[], force=False): """ Restore from a local backup archive @@ -2102,48 +2070,23 @@ def backup_restore(auth, name, name -- Name of the local backup archive force -- Force restauration on an already installed system system -- List of system parts to restore - ignore_system -- Do not restore any system parts apps -- List of application names to restore - ignore_apps -- Do not restore apps - - hooks -- (Deprecated) Renamed to "system" - ignore_hooks -- (Deprecated) Renamed to "ignore_system" """ ########################################################################### # Validate / parse arguments # ########################################################################### - # Historical, deprecated options - if ignore_hooks is not False: - logger.warning("--ignore-hooks is deprecated and will be removed in the" - "future. Please use --ignore-system instead.") - ignore_system = ignore_hooks - if hooks != [] and hooks is not None: - logger.warning("--hooks is deprecated and will be removed in the" - "future. Please use --system instead.") - system = hooks - - # Validate what to restore - if ignore_system and ignore_apps: - raise MoulinetteError(errno.EINVAL, - m18n.n('restore_action_required')) - - if ignore_system: - system = None - elif system is None: + # If no --system or --apps given, restore everything + if system is None and apps is None: system = [] - - if ignore_apps: - apps = None - elif apps is None: apps = [] # TODO don't ask this question when restoring apps only and certain system # parts # Check if YunoHost is installed - if os.path.isfile('/etc/yunohost/installed') and not ignore_system: + if system is not None and os.path.isfile('/etc/yunohost/installed'): logger.warning(m18n.n('yunohost_already_installed')) if not force: try: From a25b746ea595b2b8f8727771bc731d06304ab721 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 16 Jun 2018 16:22:14 +0200 Subject: [PATCH 268/313] Update changelog --- debian/changelog | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/debian/changelog b/debian/changelog index 82eaff86f..e5a059351 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,13 @@ +yunohost (3.0.0~beta1.7) testing; urgency=low + + * Merge with jessie's branches + * Set verbose by default + * Remove archivemount stuff + * Correctly patch php5/php7 stuff when doing a backup restore + * Fix counter-intuitive backup API + + -- Alexandre Aubin Sat, 16 Jun 2018 16:20:00 +0000 + yunohost (3.0.0~beta1.6) testing; urgency=low * [fix] Service description for php7.0-fpm From 0c248bcb7eafcfcccb14570c8b0983183dcd30e0 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sat, 16 Jun 2018 20:59:18 +0200 Subject: [PATCH 269/313] Last minute fix : install php7.0-acpu to hopefully make stretch still work after the upgrade --- src/yunohost/data_migrations/0003_migrate_to_stretch.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/yunohost/data_migrations/0003_migrate_to_stretch.py b/src/yunohost/data_migrations/0003_migrate_to_stretch.py index c291a31b7..6969de571 100644 --- a/src/yunohost/data_migrations/0003_migrate_to_stretch.py +++ b/src/yunohost/data_migrations/0003_migrate_to_stretch.py @@ -221,9 +221,9 @@ class MyMigration(Migration): upgrade_command += " apt-get install" upgrade_command += " --assume-yes " upgrade_command += " ".join(YUNOHOST_PACKAGES) - # We also install php-zip to fix an issue with nextcloud and kanboard - # that need it when on stretch. - upgrade_command += " php-zip" + # We also install php-zip and php7.0-acpu to fix an issue with + # nextcloud and kanboard that need it when on stretch. + upgrade_command += " php-zip php7.0-apcu" upgrade_command += " 2>&1 | tee -a {}".format(self.logfile) wait_until_end_of_yunohost_command = "(while [ -f {} ]; do sleep 2; done)".format(MOULINETTE_LOCK) From 572daa15e409e52d03ab300fdb0f1b27ddbc2c0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Wed, 23 May 2018 15:07:50 +0000 Subject: [PATCH 270/313] [i18n] Translated using Weblate (Occitan) Currently translated at 23.0% (93 of 404 strings) --- locales/oc.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index e0d476cf2..a1af70124 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -84,5 +84,12 @@ "backup_output_directory_required": "Vos cal especificar un dorsièr de sortida per la salvagarda", "backup_running_app_script": "Lançament de l’escript de salvagarda de l’aplicacion « {app:s} »...", "backup_running_hooks": "Execucion dels scripts de salvagarda...", - "backup_system_part_failed": "Impossible de salvagardar la part « {part:s} » del sistèma" + "backup_system_part_failed": "Impossible de salvagardar la part « {part:s} » del sistèma", + "app_requirements_failed": "Impossible de complir las condicions requesidas per {app} : {error}", + "app_requirements_unmeet": "Las condicions requesidas per {app} son pas complidas, lo paquet {pkgname} ({version}) deu èsser {spec}", + "appslist_could_not_migrate": "Migracion de la lista impossibla {appslist:s} ! Impossible d’analizar l’URL… L’anciana tasca cron es estada servada dins {bkp_file:s}.", + "backup_abstract_method": "Aqueste metòde de salvagarda es pas encara implementat", + "backup_applying_method_custom": "Crida lo metòde de salvagarda personalizat « {method:s} »…", + "backup_borg_not_implemented": "Lo metòde de salvagarda Bord es pas encara implementat", + "backup_couldnt_bind": "Impossible de ligar {src:s} amb {dest:s}" } From d8ddc0f8de7f52bf11a872265383d4442d0d15c5 Mon Sep 17 00:00:00 2001 From: Jean-Baptiste Holcroft Date: Mon, 21 May 2018 08:05:35 +0000 Subject: [PATCH 271/313] [i18n] Translated using Weblate (French) Currently translated at 100.0% (404 of 404 strings) --- locales/fr.json | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/locales/fr.json b/locales/fr.json index ff1278369..3939503f9 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -398,5 +398,23 @@ "migration_0003_modified_files": "Veuillez noter que les fichiers suivants ont été détectés comme modifiés manuellement et pourraient être écrasés à la fin de la mise à niveau : {manually_modified_files}", "migrations_list_conflict_pending_done": "Vous ne pouvez pas utiliser --previous et --done simultanément.", "migrations_to_be_ran_manually": "La migration {number} {name} doit être lancée manuellement. Veuillez aller dans Outils > Migration dans l’interface admin, ou lancer `yunohost tools migrations migrate`.", - "migrations_need_to_accept_disclaimer": "Pour lancer la migration {number} {name}, vous devez accepter cette clause de non-responsabilité :\n---\n{disclaimer}\n---\nSi vous acceptez de lancer la migration, veuillez relancer la commande avec l’option --accept-disclaimer." + "migrations_need_to_accept_disclaimer": "Pour lancer la migration {number} {name}, vous devez accepter cette clause de non-responsabilité :\n---\n{disclaimer}\n---\nSi vous acceptez de lancer la migration, veuillez relancer la commande avec l’option --accept-disclaimer.", + "service_description_avahi-daemon": "permet d’atteindre votre serveur via yunohost.local sur votre réseau local", + "service_description_dnsmasq": "assure la résolution des noms de domaine (DNS)", + "service_description_dovecot": "permet aux clients de messagerie d’accéder/récupérer les courriels (via IMAP et POP3)", + "service_description_fail2ban": "protège contre les attaques brute-force et autres types d’attaques venant d’Internet", + "service_description_glances": "surveille les informations système de votre serveur", + "service_description_metronome": "gère les comptes de messagerie instantanée XMPP", + "service_description_mysql": "stocke les données des applications (bases de données SQL)", + "service_description_nginx": "sert ou permet l’accès à tous les sites web hébergés sur votre serveur", + "service_description_nslcd": "gère la connexion en ligne de commande des utilisateurs YunoHost", + "service_description_php5-fpm": "exécute des applications écrites en PHP avec nginx", + "service_description_postfix": "utilisé pour envoyer et recevoir des courriels", + "service_description_redis-server": "une base de donnée spécialisée utilisée pour l’accès rapide aux données, les files d’attentes et la communication inter-programmes", + "service_description_rmilter": "vérifie divers paramètres dans les courriels", + "service_description_rspamd": "filtre le pourriel, et d’autres fonctionnalités liées au courriel", + "service_description_slapd": "stocke les utilisateurs, domaines et leurs informations liées", + "service_description_ssh": "vous permet de vous connecter à distance à votre serveur via un terminal (protocole SSH)", + "service_description_yunohost-api": "permet les interactions entre l’interface web de YunoHost et le système", + "service_description_yunohost-firewall": "gère les ports de connexion ouverts et fermés aux services" } From fc7b4ca6921ac2696b2cce2db385af5b00d09b55 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Wed, 23 May 2018 15:19:03 +0000 Subject: [PATCH 272/313] [i18n] Translated using Weblate (Occitan) Currently translated at 28.2% (114 of 404 strings) --- locales/oc.json | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index a1af70124..91876c154 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -91,5 +91,26 @@ "backup_abstract_method": "Aqueste metòde de salvagarda es pas encara implementat", "backup_applying_method_custom": "Crida lo metòde de salvagarda personalizat « {method:s} »…", "backup_borg_not_implemented": "Lo metòde de salvagarda Bord es pas encara implementat", - "backup_couldnt_bind": "Impossible de ligar {src:s} amb {dest:s}" + "backup_couldnt_bind": "Impossible de ligar {src:s} amb {dest:s}.", + "backup_csv_addition_failed": "Impossible d’ajustar de fichièrs a la salvagarda dins lo fichièr CSV", + "backup_custom_backup_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « backup »", + "backup_custom_mount_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « mount »", + "backup_custom_need_mount_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « need_mount »", + "backup_method_custom_finished": "Lo metòde de salvagarda personalizat « {method:s} » es acabat", + "backup_nothings_done": "I a pas res de salvagardar", + "backup_unable_to_organize_files": "Impossible d’organizar los fichièrs dins l’archiu amb lo metòde rapid", + "service_status_failed": "Impossible dedeterminar l’estat del servici « {service:s} »", + "service_stopped": "Lo servici « {service:s} » es estat arrestat", + "service_unknown": "Servici « {service:s} » desconegut", + "unbackup_app": "L’aplicacion « {app:s} » serà pas salvagardada", + "unit_unknown": "Unitat « {unit:s} » desconeguda", + "unlimit": "Cap de quòta", + "unrestore_app": "L’aplicacion « {app:s} » serà pas restaurada", + "upnp_dev_not_found": "Cap de periferic compatible UPnP pas trobat", + "upnp_disabled": "UPnP es desactivat", + "upnp_enabled": "UPnP es activat", + "upnp_port_open_failed": "Impossible de dobrir los pòrts amb UPnP", + "yunohost_already_installed": "YunoHost es ja installat", + "yunohost_configured": "YunoHost es estat configurat", + "yunohost_installing": "Installacion de YunoHost..." } From 38f54e12d0b4a02d742155cdf64db825d4675f4c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Fri, 25 May 2018 09:14:15 +0000 Subject: [PATCH 273/313] [i18n] Translated using Weblate (Occitan) Currently translated at 30.1% (122 of 404 strings) --- locales/oc.json | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 91876c154..77ae81a4e 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -112,5 +112,13 @@ "upnp_port_open_failed": "Impossible de dobrir los pòrts amb UPnP", "yunohost_already_installed": "YunoHost es ja installat", "yunohost_configured": "YunoHost es estat configurat", - "yunohost_installing": "Installacion de YunoHost..." + "yunohost_installing": "Installacion de YunoHost...", + "backup_applying_method_borg": "Mandadís de totes los fichièrs a la salvagarda dins lo repertòri borg-backup…", + "backup_csv_creation_failed": "Creacion impossibla del fichièr CSV necessari a las operacions futuras de restauracion", + "backup_extracting_archive": "Extraccion de l’archiu de salvagarda…", + "backup_output_symlink_dir_broken": "Avètz un ligam simbolic copat allòc de vòstre repertòri d’archiu « {path:s} ». Poiriatz aver una configuracion personalizada per salvagardar vòstras donadas sus un autre sistèma de fichièrs, en aquel cas, saique oblidèretz de montar o de connectar lo disc o la clau USB.", + "backup_with_no_backup_script_for_app": "L’aplicacion {app:s} a pas cap de script de salvagarda. I fasèm pas cas.", + "backup_with_no_restore_script_for_app": "L’aplicacion {app:s} a pas cap de script de restauracion, poiretz pas restaurar automaticament la salvagarda d’aquesta aplicacion.", + "certmanager_acme_not_configured_for_domain": "Lo certificat del domeni {domain:s} sembla pas corrèctament installat. Mercés de lançar d’en primièr cert-install per aqueste domeni.", + "certmanager_attempt_to_renew_nonLE_cert": "Lo certificat pel domeni {domain:s} es pas provesit per Let's Encrypt. Impossible de lo renovar automaticament !" } From 7dea3b66b101bac7c9ab0cd1e8d2464984d5121a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Fri, 25 May 2018 09:32:52 +0000 Subject: [PATCH 274/313] [i18n] Translated using Weblate (Occitan) Currently translated at 34.6% (140 of 404 strings) To bypass, en occitan...vesi pas, deu i aver un imatge tot pariu --- locales/oc.json | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 77ae81a4e..53550d8bf 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -120,5 +120,24 @@ "backup_with_no_backup_script_for_app": "L’aplicacion {app:s} a pas cap de script de salvagarda. I fasèm pas cas.", "backup_with_no_restore_script_for_app": "L’aplicacion {app:s} a pas cap de script de restauracion, poiretz pas restaurar automaticament la salvagarda d’aquesta aplicacion.", "certmanager_acme_not_configured_for_domain": "Lo certificat del domeni {domain:s} sembla pas corrèctament installat. Mercés de lançar d’en primièr cert-install per aqueste domeni.", - "certmanager_attempt_to_renew_nonLE_cert": "Lo certificat pel domeni {domain:s} es pas provesit per Let's Encrypt. Impossible de lo renovar automaticament !" + "certmanager_attempt_to_renew_nonLE_cert": "Lo certificat pel domeni {domain:s} es pas provesit per Let's Encrypt. Impossible de lo renovar automaticament !", + "certmanager_attempt_to_renew_valid_cert": "Lo certificat pel domeni {domain:s} es a man d’expirar ! Utilizatz --force per cortcircuitar", + "certmanager_cannot_read_cert": "Quicòm a trucat en ensajar de dobrir lo certificat actual pel domeni {domain:s} (fichièr : {file:s}), rason : {reason:s}", + "certmanager_cert_install_success": "Installacion capitada del certificat Let’s Encrypt pel domeni {domain:s} !", + "certmanager_cert_install_success_selfsigned": "Installacion capitada del certificat auto-signat pel domeni {domain:s} !", + "certmanager_cert_signing_failed": "Fracàs de la signatura del noù certificat", + "certmanager_domain_cert_not_selfsigned": "Lo certificat del domeni {domain:s} es pas auto-signat. Volètz vertadièrament lo remplaçar ? (Utiliatz --force)", + "certmanager_domain_dns_ip_differs_from_public_ip": "L’enregistrament DNS « A » del domeni {domain:s} es diferent de l’adreça IP d’aqueste servidor. Se fa pauc qu’avètz modificat l’enregistrament « A », mercés d’esperar l’espandiment (qualques verificadors d’espandiment son disponibles en linha). (Se sabètz ço que fasèm, utilizatz --no-checks per desactivar aqueles contraròtles)", + "certmanager_domain_http_not_working": "Sembla que lo domeni {domain:s} es pas accessible via HTTP. Mercés de verificar que las configuracions DNS e nginx son corrèctas", + "certmanager_domain_unknown": "Domeni desconegut {domain:s}", + "certmanager_no_cert_file": "Lectura impossibla del fichièr del certificat pel domeni {domain:s} (fichièr : {file:s})", + "certmanager_self_ca_conf_file_not_found": "Lo fichièr de configuracion per l’autoritat del certificat auto-signat es introbabla (fichièr : {file:s})", + "certmanager_unable_to_parse_self_CA_name": "Analisi impossible lo nom de l’autoritat del certificat auto-signat (fichièr : {file:s})", + "custom_app_url_required": "Cal que donetz una URL per actualizar vòstra aplicacion personalizada {app:s}", + "custom_appslist_name_required": "Cal que nomenetz vòstra lista d’aplicacions personalizadas", + "diagnosis_debian_version_error": "Impossible de determinar la version de Debian : {error}", + "diagnosis_kernel_version_error": "Impossible de recuperar la version del nuclèu : {error}", + "diagnosis_no_apps": "Pas cap d’aplicacion installada", + "dnsmasq_isnt_installed": "dnsmasq sembla pas èsser installat, mercés de lançar « apt-get remove bind9 && apt-get install dnsmasq »", + "domain_cannot_remove_main": "Impossible de levar lo domeni màger. Definissètz un novèl domeni màger d’en primièr." } From 0fc6597fc48fe13003f0b648720b6a46653e3f53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Fri, 25 May 2018 12:56:19 +0000 Subject: [PATCH 275/313] [i18n] Translated using Weblate (Occitan) Currently translated at 41.5% (168 of 404 strings) --- locales/oc.json | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 53550d8bf..be272f80a 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -139,5 +139,33 @@ "diagnosis_kernel_version_error": "Impossible de recuperar la version del nuclèu : {error}", "diagnosis_no_apps": "Pas cap d’aplicacion installada", "dnsmasq_isnt_installed": "dnsmasq sembla pas èsser installat, mercés de lançar « apt-get remove bind9 && apt-get install dnsmasq »", - "domain_cannot_remove_main": "Impossible de levar lo domeni màger. Definissètz un novèl domeni màger d’en primièr." + "domain_cannot_remove_main": "Impossible de levar lo domeni màger. Definissètz un novèl domeni màger d’en primièr", + "domain_cert_gen_failed": "Generacion del certificat impossibla", + "domain_created": "Lo domeni es creat", + "domain_creation_failed": "Creacion del certificat impossibla", + "domain_deleted": "Lo domeni es suprimit", + "domain_deletion_failed": "Supression impossibla del domeni", + "domain_dyndns_invalid": "Domeni incorrècte per una utilizacion amb DynDNS", + "domain_dyndns_root_unknown": "Domeni DynDNS màger desconegut", + "domain_exists": "Lo domeni existís ja", + "domain_hostname_failed": "Fracàs de la creacion d’un nòu nom d’òst", + "domain_unknown": "Domeni desconegut", + "domain_zone_exists": "Lo fichièr zòna DNS existís ja", + "domain_zone_not_found": "Fichèr de zòna DNS introbable pel domeni {:s}", + "domains_available": "Domenis disponibles :", + "done": "Acabat", + "downloading": "Telecargament…", + "dyndns_could_not_check_provide": "Impossible de verificar se {provider:s} pòt provesir {domain:s}.", + "dyndns_cron_installed": "La tasca cron pel domeni DynDNS es installada", + "dyndns_cron_remove_failed": "Impossible de levar la tasca cron pel domeni DynDNS", + "dyndns_cron_removed": "La tasca cron pel domeni DynDNS es levada", + "dyndns_ip_update_failed": "Impossible d’actualizar l’adreça IP sul domeni DynDNS", + "dyndns_ip_updated": "Vòstra adreça IP es estada actualizada pel domeni DynDNS", + "dyndns_key_generating": "La clau DNS es a se generar, pòt trigar una estona...", + "dyndns_key_not_found": "Clau DNS introbabla pel domeni", + "dyndns_no_domain_registered": "Cap de domeni pas enregistrat amb DynDNS", + "dyndns_registered": "Lo domeni DynDNS es enregistrat", + "dyndns_registration_failed": "Enregistrament del domeni DynDNS impossibla : {error:s}", + "dyndns_domain_not_provided": "Lo provesidor DynDNS {provider:s} pòt pas fornir lo domeni {domain:s}.", + "dyndns_unavailable": "Lo domeni {domain:s} es pas disponible" } From 78af61b308e72c1a7e77d6bc3739971e15d6cc45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Fri, 25 May 2018 14:15:01 +0000 Subject: [PATCH 276/313] [i18n] Translated using Weblate (Occitan) Currently translated at 56.4% (228 of 404 strings) --- locales/oc.json | 62 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 61 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index be272f80a..ca6ced9ab 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -167,5 +167,65 @@ "dyndns_registered": "Lo domeni DynDNS es enregistrat", "dyndns_registration_failed": "Enregistrament del domeni DynDNS impossibla : {error:s}", "dyndns_domain_not_provided": "Lo provesidor DynDNS {provider:s} pòt pas fornir lo domeni {domain:s}.", - "dyndns_unavailable": "Lo domeni {domain:s} es pas disponible" + "dyndns_unavailable": "Lo domeni {domain:s} es pas disponible.", + "extracting": "Extraccion…", + "field_invalid": "Camp incorrècte : « {:s} »", + "format_datetime_short": "%d/%m/%Y %H:%M", + "global_settings_cant_open_settings": "Fracàs de la dobertura del fichièr de configuracion, rason : {reason:s}", + "global_settings_key_doesnt_exists": "La clau « {settings_key:s} » existís pas dins las configuracions globalas, podètz veire totas las claus disponiblas en picant « yunohost settings list »", + "global_settings_reset_success": "Capitada ! Vòstra configuracion precedenta es estada salvagarda dins {path:s}", + "global_settings_setting_example_bool": "Exemple d’opcion booleana", + "global_settings_unknown_setting_from_settings_file": "Clau desconeguda dins los paramètres : {setting_key:s}, apartat e salvagardat dins /etc/yunohost/unkown_settings.json", + "installation_failed": "Fracàs de l’installacion", + "invalid_url_format": "Format d’URL pas valid", + "ldap_initialized": "L’annuari LDAP es inicializat", + "license_undefined": "indefinida", + "maindomain_change_failed": "Modificacion impossibla del domeni màger", + "maindomain_changed": "Lo domeni màger es estat modificat", + "migrate_tsig_end": "La migracion cap a hmac-sha512 es acabada", + "migrate_tsig_wait_2": "2 minutas…", + "migrate_tsig_wait_3": "1 minuta…", + "migrate_tsig_wait_4": "30 segondas…", + "migration_description_0002_migrate_to_tsig_sha256": "Melhora la seguretat de DynDNS TSIG en utilizar SHA512 allòc de MD5", + "migration_description_0003_migrate_to_stretch": "Mesa a nivèl del sistèma cap a Debian Stretch e YunoHost 3.0", + "migration_0003_backward_impossible": "La migracion Stretch es pas reversibla.", + "migration_0003_start": "Aviada de la migracion cap a Stretech. Los jornals seràn disponibles dins {logfile}.", + "migration_0003_patching_sources_list": "Petaçatge de sources.lists…", + "migration_0003_main_upgrade": "Aviada de la mesa a nivèl màger…", + "migration_0003_fail2ban_upgrade": "Aviada de la mesa a nivèl de fail2ban…", + "migration_0003_not_jessie": "La distribucion Debian actuala es pas Jessie !", + "migrations_cant_reach_migration_file": "Impossible d’accedir als fichièrs de migracion amb lo camin %s", + "migrations_current_target": "La cibla de migracion est {}", + "migrations_error_failed_to_load_migration": "ERROR : fracàs del cargament de la migracion {number} {name}", + "migrations_list_conflict_pending_done": "Podètz pas utilizar --previous e --done a l’encòp.", + "migrations_loading_migration": "Cargament de la migracion{number} {name}…", + "migrations_no_migrations_to_run": "Cap de migracion de lançar", + "migrations_show_currently_running_migration": "Realizacion de la migracion {number} {name}…", + "migrations_show_last_migration": "La darrièra migracion realizada es {}", + "monitor_glances_con_failed": "Connexion impossibla al servidor Glances", + "monitor_not_enabled": "Lo seguiment de l’estat del servidor es pas activat", + "monitor_stats_no_update": "Cap de donadas d’estat del servidor d’actualizar", + "mountpoint_unknown": "Ponch de montatge desconegut", + "mysql_db_creation_failed": "Creacion de la basa de donadas MySQL impossibla", + "no_appslist_found": "Cap de lista d’aplicacions pas trobaba", + "no_internet_connection": "Lo servidor es pas connectat a Internet", + "package_not_installed": "Lo paquet « {pkgname} » es pas installat", + "package_unknown": "Paquet « {pkgname} » desconegut", + "packages_no_upgrade": "I a pas cap de paquet d’actualizar", + "packages_upgrade_failed": "Actualizacion de totes los paquets impossibla", + "path_removal_failed": "Impossible de suprimir lo camin {:s}", + "pattern_domain": "Deu èsser un nom de domeni valid (ex : mon-domeni.org)", + "pattern_email": "Deu èsser una adreça electronica valida (ex : escais@domeni.org)", + "pattern_firstname": "Deu èsser un pichon nom valid", + "pattern_lastname": "Deu èsser un nom valid", + "pattern_password": "Deu conténer almens 3 caractèrs", + "pattern_port": "Deu èsser un numèro de pòrt valid (ex : 0-65535)", + "pattern_port_or_range": "Deu èsser un numèro de pòrt valid (ex : 0-65535) o un interval de pòrt (ex : 100:200)", + "pattern_positive_number": "Deu èsser un nombre positiu", + "port_already_closed": "Lo pòrt {port:d} es ja tampat per las connexions {ip_version:s}", + "port_already_opened": "Lo pòrt {port:d} es ja dubèrt per las connexions {ip_version:s}", + "port_available": "Lo pòrt {port:d} es disponible", + "port_unavailable": "Lo pòrt {port:d} es pas disponible", + "restore_already_installed_app": "Una aplicacion es ja installada amb l’id « {app:s} »", + "restore_app_failed": "Impossible de restaurar l’aplicacion « {app:s} »" } From 9dd1389d8893fea28db0ddbb781225b508c3126f Mon Sep 17 00:00:00 2001 From: Quenti Date: Sun, 27 May 2018 17:18:09 +0000 Subject: [PATCH 277/313] [i18n] Translated using Weblate (Occitan) Currently translated at 56.9% (230 of 404 strings) --- locales/oc.json | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index ca6ced9ab..f0029aac0 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -227,5 +227,7 @@ "port_available": "Lo pòrt {port:d} es disponible", "port_unavailable": "Lo pòrt {port:d} es pas disponible", "restore_already_installed_app": "Una aplicacion es ja installada amb l’id « {app:s} »", - "restore_app_failed": "Impossible de restaurar l’aplicacion « {app:s} »" + "restore_app_failed": "Impossible de restaurar l’aplicacion « {app:s} »", + "backup_ask_for_copying_if_needed": "D’unes fichièrs an pas pogut èsser preparatz per la salvagarda en utilizar lo metòde qu’evita de gastar d’espaci sul sistèma de manièra temporala. Per lançar la salvagarda, cal utilizar temporàriament {size:s} Mo. Acceptatz ?", + "yunohost_not_installed": "YunoHost es pas installat o corrèctament installat. Mercés d’executar « yunohost tools postinstall »" } From e823bb84f8a9d22b7a2121b7c005d62c537e5cec Mon Sep 17 00:00:00 2001 From: Quenti Date: Sun, 27 May 2018 17:23:34 +0000 Subject: [PATCH 278/313] [i18n] Translated using Weblate (Occitan) Currently translated at 56.9% (230 of 404 strings) --- locales/oc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index f0029aac0..566853198 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -228,6 +228,6 @@ "port_unavailable": "Lo pòrt {port:d} es pas disponible", "restore_already_installed_app": "Una aplicacion es ja installada amb l’id « {app:s} »", "restore_app_failed": "Impossible de restaurar l’aplicacion « {app:s} »", - "backup_ask_for_copying_if_needed": "D’unes fichièrs an pas pogut èsser preparatz per la salvagarda en utilizar lo metòde qu’evita de gastar d’espaci sul sistèma de manièra temporala. Per lançar la salvagarda, cal utilizar temporàriament {size:s} Mo. Acceptatz ?", + "backup_ask_for_copying_if_needed": "D’unes fichièrs an pas pogut èsser preparatz per la salvagarda en utilizar lo metòde qu’evita de gastar d’espaci sul sistèma de manièra temporària. Per lançar la salvagarda, cal utilizar temporàriament {size:s} Mo. Acceptatz ?", "yunohost_not_installed": "YunoHost es pas installat o corrèctament installat. Mercés d’executar « yunohost tools postinstall »" } From e0223b197b57710a895e1648a40be8e5312095fb Mon Sep 17 00:00:00 2001 From: Quenti Date: Sun, 27 May 2018 17:24:55 +0000 Subject: [PATCH 279/313] [i18n] Translated using Weblate (Occitan) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently translated at 57.9% (234 of 404 strings) dorsièr o repertòri ? --- locales/oc.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 566853198..b7686ee37 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -229,5 +229,10 @@ "restore_already_installed_app": "Una aplicacion es ja installada amb l’id « {app:s} »", "restore_app_failed": "Impossible de restaurar l’aplicacion « {app:s} »", "backup_ask_for_copying_if_needed": "D’unes fichièrs an pas pogut èsser preparatz per la salvagarda en utilizar lo metòde qu’evita de gastar d’espaci sul sistèma de manièra temporària. Per lançar la salvagarda, cal utilizar temporàriament {size:s} Mo. Acceptatz ?", - "yunohost_not_installed": "YunoHost es pas installat o corrèctament installat. Mercés d’executar « yunohost tools postinstall »" + "yunohost_not_installed": "YunoHost es pas installat o corrèctament installat. Mercés d’executar « yunohost tools postinstall »", + "backup_output_directory_forbidden": "Repertòri de destinacion defendut. Las salvagardas pòdon pas se realizar dins los repertòris bin, /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var ou /home/yunohost.backup/archives", + "certmanager_attempt_to_replace_valid_cert": "Sètz a remplaçar un certificat corrècte e valid pel domeni {domain:s} ! (Utilizatz --force per cortcircuitar)", + "certmanager_cert_renew_success": "Renovèlament capitat d’un certificat Let's Encrypt pel domeni {domain:s} !", + "certmanager_certificate_fetching_or_enabling_failed": "Sembla d’aver fracassat l’activacion d’un nòu certificat per {domain:s}…", + "certmanager_conflicting_nginx_file": "Impossible de preparar lo domeni pel desfís ACME : lo fichièr de configuracion nginx {filepath:s} es en conflicte e deu èsser levat d’en primièr" } From 2d66651aaeb8cf64cae784a8959effe64171e500 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Mon, 28 May 2018 06:57:41 +0000 Subject: [PATCH 280/313] [i18n] Translated using Weblate (Occitan) Currently translated at 59.1% (239 of 404 strings) --- locales/oc.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index b7686ee37..de443e93f 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -234,5 +234,10 @@ "certmanager_attempt_to_replace_valid_cert": "Sètz a remplaçar un certificat corrècte e valid pel domeni {domain:s} ! (Utilizatz --force per cortcircuitar)", "certmanager_cert_renew_success": "Renovèlament capitat d’un certificat Let's Encrypt pel domeni {domain:s} !", "certmanager_certificate_fetching_or_enabling_failed": "Sembla d’aver fracassat l’activacion d’un nòu certificat per {domain:s}…", - "certmanager_conflicting_nginx_file": "Impossible de preparar lo domeni pel desfís ACME : lo fichièr de configuracion nginx {filepath:s} es en conflicte e deu èsser levat d’en primièr" + "certmanager_conflicting_nginx_file": "Impossible de preparar lo domeni pel desfís ACME : lo fichièr de configuracion nginx {filepath:s} es en conflicte e deu èsser levat d’en primièr", + "certmanager_couldnt_fetch_intermediate_cert": "Expiracion del relambi pendent l’ensag de recuperacion del certificat intermediari dins de Let's Encrypt. L’installacion / lo renovèlament es estat interromput - tornatz ensajar mai tard.", + "certmanager_domain_not_resolved_locally": "Lo domeni {domain:s} pòt pas èsser determinat dins de vòstre servidor YunoHost. Pòt arribar s’avètz recentament modificat vòstre enregistrament DNS. Dins aqueste cas, mercés d’esperar unas oras per l’espandiment. Se lo problèma dura, consideratz ajustar {domain:s} a /etc/hosts. (Se sabètz çò que fasetz, utilizatz --no-checks per desactivar las verificacions.)", + "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let'S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", + "certmanager_hit_rate_limit": "Tròp de certificats son ja estats demandats recentament per aqueste ensem de domeni {domain:s}. Mercés de tornar ensajar mai tard. Legissètz https://letsencrypt.org/docs/rate-limits/ per mai detalhs", + "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafòc/router amont de vòstre servidor es mal configurat." } From 4bb25bca9c0b8d6dd923bd980f365a08cec317da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Mon, 28 May 2018 07:27:59 +0000 Subject: [PATCH 281/313] [i18n] Translated using Weblate (Occitan) Currently translated at 74.5% (301 of 404 strings) --- locales/oc.json | 64 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 63 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index de443e93f..660f55473 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -239,5 +239,67 @@ "certmanager_domain_not_resolved_locally": "Lo domeni {domain:s} pòt pas èsser determinat dins de vòstre servidor YunoHost. Pòt arribar s’avètz recentament modificat vòstre enregistrament DNS. Dins aqueste cas, mercés d’esperar unas oras per l’espandiment. Se lo problèma dura, consideratz ajustar {domain:s} a /etc/hosts. (Se sabètz çò que fasetz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let'S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_hit_rate_limit": "Tròp de certificats son ja estats demandats recentament per aqueste ensem de domeni {domain:s}. Mercés de tornar ensajar mai tard. Legissètz https://letsencrypt.org/docs/rate-limits/ per mai detalhs", - "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafòc/router amont de vòstre servidor es mal configurat." + "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via HTTP amb son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafòc/router amont de vòstre servidor es mal configurat.", + "domain_dns_conf_is_just_a_recommendation": "Aqueste pagina mòstra la configuracion *recomandada*. Non configura *pas* lo DNS per vos. Sètz responsable de la configuracion de vòstra zòna DNS en çò de vòstre registrar DNS amb aquesta recomandacion.", + "domain_dyndns_already_subscribed": "Avètz ja soscrich a un domeni DynDNS", + "domain_dyndns_dynette_is_unreachable": "Impossible de contactar la dynette YunoHost, siá YunoHost pas es pas corrèctament connectat a Internet, siá lo servidor de la dynett es arrestat. Error : {error}", + "domain_uninstall_app_first": "Una o mantuna aplicacions son installadas sus aqueste domeni. Mercés de las desinstallar d’en primièr abans de suprimir aqueste domeni", + "firewall_reload_failed": "Impossible de recargar lo parafòc", + "firewall_reloaded": "Lo parafòc es estat recargat", + "firewall_rules_cmd_failed": "Unas règlas del parafòc an fracassat. Per mai informacions, consultatz lo jornal.", + "global_settings_bad_choice_for_enum": "La valor del paramètre {setting:s} es incorrècta. Recebut : {received_type:s}, esperat {expected_type:s}", + "global_settings_bad_type_for_setting": "Lo tipe del paramètre {setting:s} es incorrècte. Recebut : {received_type:s}, esperat {expected_type:s}", + "global_settings_cant_write_settings": "Fracàs de l’escritura del fichièr de configuracion, rason : {reason:s}", + "global_settings_setting_example_enum": "Exemple d’opcion de tipe enumeracion", + "global_settings_setting_example_int": "Exemple d’opcion de tipe entièr", + "global_settings_setting_example_string": "Exemple d’opcion de tipe cadena", + "global_settings_unknown_type": "Situacion inesperada, la configuracion {setting:s} sembla d’aver lo tipe {unknown_type:s} mas es pas un tipe pres en carga pel sistèma.", + "hook_exec_failed": "Fracàs de l’execucion del script « {path:s} »", + "hook_exec_not_terminated": "L’execucion del escript « {path:s} » es pas acabada", + "hook_list_by_invalid": "La proprietat de tria de las accions es invalida", + "hook_name_unknown": "Nom de script « {name:s} » desconegut", + "ldap_init_failed_to_create_admin": "L’inicializacion de LDAP a pas pogut crear l’utilizaire admin", + "mail_domain_unknown": "Lo domeni de corrièl « {domain:s} » es desconegut", + "mailbox_used_space_dovecot_down": "Lo servici corrièl Dovecot deu èsser aviat, se volètz conéisser l’espaci ocupat per la messatjariá", + "migrate_tsig_failed": "La migracion del domeni dyndns {domain} cap a hmac-sha512 a pas capitat, anullacion de las modificacions. Error : {error_code} - {error}", + "migrate_tsig_wait": "Esperem 3 minutas que lo servidor dyndns prenga en compte la novèla clau…", + "migrate_tsig_not_needed": "Sembla qu’utilizatz pas un domeni dyndns, donc cap de migracion es pas necessària !", + "migration_0003_yunohost_upgrade": "Aviada de la mesa a nivèl del paquet YunoHost… La migracion acabarà, mas la mesa a jorn reala se realizarà tot bèl aprèp. Un còp acabada, poiretz vos reconnectar a l’administracion web.", + "migration_0003_system_not_fully_up_to_date": "Lo sistèma es pas complètament a jorn. Mercés de lançar una mesa a jorn classica abans de començar la migracion per Stretch.", + "migration_0003_modified_files": "Mercés de notar que los fichièrs seguents son estats detectats coma modificats manualament e poiràn èsser escafats a la fin de la mesa a nivèl : {manually_modified_files}", + "monitor_period_invalid": "Lo periòde de temps es incorrècte", + "monitor_stats_file_not_found": "Lo fichièr d’estatisticas es introbabe", + "monitor_stats_period_unavailable": "Cap d’estatisticas son pas disponiblas pel periòde", + "mysql_db_init_failed": "Impossible d’inicializar la basa de donadas MySQL", + "service_disable_failed": "Impossible de desactivar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_disabled": "Lo servici « {service:s} » es desactivat", + "service_enable_failed": "Impossible d’activar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_enabled": "Lo servici « {service:s} » es activat", + "service_no_log": "Cap de jornal de far veire pel servici « {service:s} »", + "service_regenconf_dry_pending_applying": "Verificacion de las configuracions en espèra que poirián èsser aplicadas pel servici « {service} »…", + "service_regenconf_failed": "Regeneracion impossibla de la configuracion pels servicis : {services}", + "service_regenconf_pending_applying": "Aplicacion de as configuraion en espèra pel servici « {service} »…", + "service_remove_failed": "Impossible de levar lo servici « {service:s} »", + "service_removed": "Lo servici « {service:s} » es estat levat", + "service_start_failed": "Impossible d’aviar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_started": "Lo servici « {service:s} » es aviat", + "service_stop_failed": "Impossible d’arrestar lo servici « {service:s} »↵\n\nJornals recents : {logs:s}", + "ssowat_conf_generated": "La configuracion SSowat es generada", + "ssowat_conf_updated": "La configuracion SSOwat es estada actualizada", + "system_upgraded": "Lo sistèma es estat actualizat", + "system_username_exists": "Lo nom d’utilizaire existís ja dins los utilizaires sistèma", + "unexpected_error": "Una error inesperada s’es producha", + "upgrade_complete": "Actualizacion acabada", + "upgrading_packages": "Actualizacion dels paquets…", + "user_created": "L’utilizaire es creat", + "user_creation_failed": "Creacion de l’utilizaire impossibla", + "user_deleted": "L’utilizaire es suprimit", + "user_deletion_failed": "Supression impossibla de l’utilizaire", + "user_home_creation_failed": "Creacion impossibla del repertòri personal a l’utilizaire", + "user_info_failed": "Recuperacion impossibla de las informacions tocant l’utilizaire", + "user_unknown": "Utilizaire « {user:s} » desconegut", + "user_update_failed": "Modificacion impossibla de l’utilizaire", + "user_updated": "L’utilizaire es estat modificat", + "yunohost_ca_creation_failed": "Creacion impossibla de l’autoritat de certificacion", + "yunohost_ca_creation_success": "L’autoritat de certificacion locala es creada." } From 7b99d3dc35ac5658e7457535310bb8ac1730899e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Mon, 28 May 2018 12:13:25 +0000 Subject: [PATCH 282/313] [i18n] Translated using Weblate (Occitan) Currently translated at 77.4% (313 of 404 strings) --- locales/oc.json | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 660f55473..bbfa9af2a 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -301,5 +301,17 @@ "user_update_failed": "Modificacion impossibla de l’utilizaire", "user_updated": "L’utilizaire es estat modificat", "yunohost_ca_creation_failed": "Creacion impossibla de l’autoritat de certificacion", - "yunohost_ca_creation_success": "L’autoritat de certificacion locala es creada." + "yunohost_ca_creation_success": "L’autoritat de certificacion locala es creada.", + "service_conf_file_kept_back": "Lo fichièr de configuracion « {conf} » deuriá èsser suprimit pel servici {service} mas es estat servat", + "service_conf_file_manually_modified": "Lo fichièr de configuracion « {conf} » es estat modificat manualament e serà pas actualizat", + "service_conf_file_manually_removed": "Lo fichièr de configuracion « {conf} » es suprimit manualament e serà pas creat", + "service_conf_file_remove_failed": "Supression impossibla del fichièr de configuracion « {conf} »", + "service_conf_file_removed": "Lo fichièr de configuracion « {conf} » es suprimit", + "service_conf_file_updated": "Lo fichièr de configuracion « {conf} » es actualizat", + "service_conf_new_managed_file": "Lo servici {service} gerís ara lo fichièr de configuracion « {conf} ».", + "service_conf_up_to_date": "La configuracion del servici « {service} » es ja actualizada", + "service_conf_would_be_updated": "La configuracion del servici « {service} » seriá estada actualizada", + "service_description_avahi-daemon": "permet d’aténher vòstre servidr via yunohost.local sus vòstre ret local", + "service_description_dnsmasq": "gerís la resolucion dels noms de domeni (DNS)", + "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles..." } From 00ec54991448753c13fbf6ccdc876028b40256e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Mon, 28 May 2018 12:54:12 +0000 Subject: [PATCH 283/313] [i18n] Translated using Weblate (Occitan) Currently translated at 77.9% (315 of 404 strings) --- locales/oc.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index bbfa9af2a..7b481f562 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -302,7 +302,7 @@ "user_updated": "L’utilizaire es estat modificat", "yunohost_ca_creation_failed": "Creacion impossibla de l’autoritat de certificacion", "yunohost_ca_creation_success": "L’autoritat de certificacion locala es creada.", - "service_conf_file_kept_back": "Lo fichièr de configuracion « {conf} » deuriá èsser suprimit pel servici {service} mas es estat servat", + "service_conf_file_kept_back": "Lo fichièr de configuracion « {conf} » deuriá èsser suprimit pel servici {service} mas es estat servat.", "service_conf_file_manually_modified": "Lo fichièr de configuracion « {conf} » es estat modificat manualament e serà pas actualizat", "service_conf_file_manually_removed": "Lo fichièr de configuracion « {conf} » es suprimit manualament e serà pas creat", "service_conf_file_remove_failed": "Supression impossibla del fichièr de configuracion « {conf} »", @@ -313,5 +313,7 @@ "service_conf_would_be_updated": "La configuracion del servici « {service} » seriá estada actualizada", "service_description_avahi-daemon": "permet d’aténher vòstre servidr via yunohost.local sus vòstre ret local", "service_description_dnsmasq": "gerís la resolucion dels noms de domeni (DNS)", - "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles..." + "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles...", + "service_conf_file_backed_up": "Lo fichièr de configuracion « {new} » es salvagardat dins « {backup} »", + "service_conf_file_copy_failed": "Còpia impossibla del nòu fichièr de configuracion « {new} » cap a « {conf} »" } From 0d87b6f7866e64c81a73fe36a5b3863f8738cb88 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Mon, 28 May 2018 12:55:55 +0000 Subject: [PATCH 284/313] [i18n] Translated using Weblate (Occitan) Currently translated at 79.2% (320 of 404 strings) --- locales/oc.json | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index 7b481f562..ba5b09218 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -314,6 +314,11 @@ "service_description_avahi-daemon": "permet d’aténher vòstre servidr via yunohost.local sus vòstre ret local", "service_description_dnsmasq": "gerís la resolucion dels noms de domeni (DNS)", "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles...", - "service_conf_file_backed_up": "Lo fichièr de configuracion « {new} » es salvagardat dins « {backup} »", - "service_conf_file_copy_failed": "Còpia impossibla del nòu fichièr de configuracion « {new} » cap a « {conf} »" + "service_conf_file_backed_up": "Lo fichièr de configuracion « {conf} » es salvagardat dins « {backup} »", + "service_conf_file_copy_failed": "Còpia impossibla del nòu fichièr de configuracion « {new} » cap a « {conf} »", + "server_reboot_confirm": "Lo servidor es per reaviar sul pic, o volètz vertadièrament ?", + "service_add_failed": "Apondon impossible del servici « {service:s} »", + "service_added": "Lo servici « {service:s} » es ajustat", + "service_already_started": "Lo servici « {service:s} » es ja aviat", + "service_already_stopped": "Lo servici « {service:s} » es ja arrestat" } From 61983511ce937e2fe5515d4b260201de819e8b70 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Mon, 28 May 2018 14:17:23 +0000 Subject: [PATCH 285/313] [i18n] Translated using Weblate (Occitan) Currently translated at 83.4% (337 of 404 strings) --- locales/oc.json | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index ba5b09218..343bcd439 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -316,9 +316,26 @@ "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles...", "service_conf_file_backed_up": "Lo fichièr de configuracion « {conf} » es salvagardat dins « {backup} »", "service_conf_file_copy_failed": "Còpia impossibla del nòu fichièr de configuracion « {new} » cap a « {conf} »", - "server_reboot_confirm": "Lo servidor es per reaviar sul pic, o volètz vertadièrament ?", + "server_reboot_confirm": "Lo servidor es per reaviar sul pic, o volètz vertadièrament ? {answers:s}", "service_add_failed": "Apondon impossible del servici « {service:s} »", "service_added": "Lo servici « {service:s} » es ajustat", "service_already_started": "Lo servici « {service:s} » es ja aviat", - "service_already_stopped": "Lo servici « {service:s} » es ja arrestat" + "service_already_stopped": "Lo servici « {service:s} » es ja arrestat", + "restore_cleaning_failed": "Impossible de netejar lo repertòri temporari de salvagarda", + "restore_complete": "Restauracion acabada", + "restore_confirm_yunohost_installed": "Volètz vertadièrament restaurar un sistèma ja installat ? {answers:s}", + "restore_extracting": "Extraccions dels fichièrs necessaris dins de l’archiu…", + "restore_failed": "Impossible de restaurar lo sistèma", + "restore_hook_unavailable": "Lo script de restauracion « {part:s} » es pas disponible sus vòstre sistèma e es pas tampauc dins l’archiu", + "restore_may_be_not_enough_disk_space": "Lo sistèma sembla d’aver pas pro d’espaci disponible (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", + "restore_mounting_archive": "Montatge de l’archiu dins « {path:s} »", + "restore_not_enough_disk_space": "Espaci disponible insufisent (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", + "restore_nothings_done": "Res es pas estat restaurat", + "restore_removing_tmp_dir_failed": "Impossible de levar u ancian repertòri temporari", + "restore_running_app_script": "Lançament del script de restauracion per l’aplicacion « {app:s} »…", + "restore_running_hooks": "Execucion dels scripts de restauracion…", + "restore_system_part_failed": "Restauracion impossibla de la part « {part:s} » del sistèma", + "server_shutdown": "Lo servidor serà atudat", + "server_shutdown_confirm": "Lo servidor es per s’atudar sul pic, o volètz vertadièrament ? {answers:s}", + "server_reboot": "Lo servidor es per reaviar" } From c0b74a0cdc46a4d390399c095aa6078e07f49475 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Mon, 28 May 2018 14:30:43 +0000 Subject: [PATCH 286/313] [i18n] Translated using Weblate (Occitan) Currently translated at 88.1% (356 of 404 strings) --- locales/oc.json | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index 343bcd439..f3f27e274 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -321,7 +321,7 @@ "service_added": "Lo servici « {service:s} » es ajustat", "service_already_started": "Lo servici « {service:s} » es ja aviat", "service_already_stopped": "Lo servici « {service:s} » es ja arrestat", - "restore_cleaning_failed": "Impossible de netejar lo repertòri temporari de salvagarda", + "restore_cleaning_failed": "Impossible de netejar lo repertòri temporari de restauracion", "restore_complete": "Restauracion acabada", "restore_confirm_yunohost_installed": "Volètz vertadièrament restaurar un sistèma ja installat ? {answers:s}", "restore_extracting": "Extraccions dels fichièrs necessaris dins de l’archiu…", @@ -337,5 +337,24 @@ "restore_system_part_failed": "Restauracion impossibla de la part « {part:s} » del sistèma", "server_shutdown": "Lo servidor serà atudat", "server_shutdown_confirm": "Lo servidor es per s’atudar sul pic, o volètz vertadièrament ? {answers:s}", - "server_reboot": "Lo servidor es per reaviar" + "server_reboot": "Lo servidor es per reaviar", + "network_check_mx_ko": "L’enregistrament DNS MX es pas especificat", + "new_domain_required": "Vos cal especificar lo domeni màger", + "no_ipv6_connectivity": "La connectivitat IPv6 es pas disponibla", + "not_enough_disk_space": "Espaci disc insufisent sus « {path:s} »", + "package_unexpected_error": "Una error inesperada es apareguda amb lo paquet « {pkgname} »", + "packages_upgrade_critical_later": "Los paquets critics {packages:s} seràn actualizats mai tard", + "restore_action_required": "Devètz precisar çò que cal restaurar", + "service_cmd_exec_failed": "Impossible d’executar la comanda « {command:s} »", + "service_conf_updated": "La configuracion es estada actualizada pel servici « {service} »", + "service_description_mysql": "garda las donadas de las aplicacions (base de donadas SQL)", + "service_description_php5-fpm": "executa d’aplicacions escrichas en PHP amb nginx", + "service_description_postfix": "emplegat per enviar e recebre de corrièls", + "service_description_rmilter": "verifica mantun paramètres dels corrièls", + "service_description_slapd": "garda los utilizaires, domenis e lors informacions ligadas", + "service_description_ssh": "vos permet de vos connectar a distància a vòstre servidor via un teminal (protocòl SSH)", + "service_description_yunohost-api": "permet las interaccions entre l’interfàcia web de YunoHost e le sistèma", + "service_description_yunohost-firewall": "gerís los pòrts de connexion dobèrts e tampats als servicis", + "ssowat_persistent_conf_read_error": "Error en ligir la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", + "ssowat_persistent_conf_write_error": "Error en salvagardar la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON" } From 9bc24f98f728d58ca1522f3e43d950bba58b615c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Tue, 29 May 2018 09:08:35 +0000 Subject: [PATCH 287/313] [i18n] Translated using Weblate (Occitan) Currently translated at 90.5% (366 of 404 strings) --- locales/oc.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index f3f27e274..3701b5b99 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -356,5 +356,15 @@ "service_description_yunohost-api": "permet las interaccions entre l’interfàcia web de YunoHost e le sistèma", "service_description_yunohost-firewall": "gerís los pòrts de connexion dobèrts e tampats als servicis", "ssowat_persistent_conf_read_error": "Error en ligir la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", - "ssowat_persistent_conf_write_error": "Error en salvagardar la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON" + "ssowat_persistent_conf_write_error": "Error en salvagardar la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", + "certmanager_old_letsencrypt_app_detected": "\nYunohost a detectat que l’aplicacion 'letsencrypt' es installada, aquò es en conflicte amb las novèlas foncionalitats integradas de gestion dels certificats de Yunohost. Se volètz utilizar aquelas foncionalitats integradas, mercés de lançar las comandas seguentas per migrar vòstra installacion :\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B.: aquò probarà de tornar installar los certificats de totes los domenis amb un certificat Let's Encrypt o las auto-signats", + "diagnosis_monitor_disk_error": "Impossible de supervisar los disques : {error}", + "diagnosis_monitor_network_error": "Impossible de supervisar la ret : {error}", + "diagnosis_monitor_system_error": "Impossible de supervisar lo sistèma : {error}", + "executing_command": "Execucion de la comanda « {command:s} »…", + "executing_script": "Execucion del script « {script:s} »…", + "global_settings_cant_serialize_settings": "Fracàs de la serializacion de las donadas de parametratge, rason : {reason:s}", + "ip6tables_unavailable": "Podètz pas jogar amb ip6tables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", + "iptables_unavailable": "Podètz pas jogar amb iptables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", + "update_cache_failed": "Impossible d’actualizar lo cache de l’APT" } From 6db89672946b7b81dd98e6393157fb2538bc734f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Tue, 29 May 2018 09:19:45 +0000 Subject: [PATCH 288/313] [i18n] Translated using Weblate (Occitan) Currently translated at 97.0% (392 of 404 strings) ortho alias --- locales/oc.json | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index 3701b5b99..d575dca4e 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -357,7 +357,7 @@ "service_description_yunohost-firewall": "gerís los pòrts de connexion dobèrts e tampats als servicis", "ssowat_persistent_conf_read_error": "Error en ligir la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", "ssowat_persistent_conf_write_error": "Error en salvagardar la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", - "certmanager_old_letsencrypt_app_detected": "\nYunohost a detectat que l’aplicacion 'letsencrypt' es installada, aquò es en conflicte amb las novèlas foncionalitats integradas de gestion dels certificats de Yunohost. Se volètz utilizar aquelas foncionalitats integradas, mercés de lançar las comandas seguentas per migrar vòstra installacion :\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B.: aquò probarà de tornar installar los certificats de totes los domenis amb un certificat Let's Encrypt o las auto-signats", + "certmanager_old_letsencrypt_app_detected": "\nYunohost a detectat que l’aplicacion 'letsencrypt' es installada, aquò es en conflicte amb las novèlas foncionalitats integradas de gestion dels certificats de Yunohost. Se volètz utilizar aquelas foncionalitats integradas, mercés de lançar las comandas seguentas per migrar vòstra installacion :\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B. : aquò provarà de tornar installar los certificats de totes los domenis amb un certificat Let's Encrypt o las auto-signats", "diagnosis_monitor_disk_error": "Impossible de supervisar los disques : {error}", "diagnosis_monitor_network_error": "Impossible de supervisar la ret : {error}", "diagnosis_monitor_system_error": "Impossible de supervisar lo sistèma : {error}", @@ -366,5 +366,32 @@ "global_settings_cant_serialize_settings": "Fracàs de la serializacion de las donadas de parametratge, rason : {reason:s}", "ip6tables_unavailable": "Podètz pas jogar amb ip6tables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", "iptables_unavailable": "Podètz pas jogar amb iptables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", - "update_cache_failed": "Impossible d’actualizar lo cache de l’APT" + "update_cache_failed": "Impossible d’actualizar lo cache de l’APT", + "mail_alias_remove_failed": "Supression impossibla de l'alias de corrièl « {mail:s} »", + "mail_forward_remove_failed": "Supression impossibla del corrièl de transferiment « {mail:s} »", + "migrate_tsig_start": "L’algorisme de generacion de claus es pas pro securizat per la signatura TSIG del domeni « {domain} », lançament de la migracion cap a hmac-sha512 que’s mai securizat", + "migration_description_0001_change_cert_group_to_sslcert": "Càmbia las permissions de grop dels certificats de « metronome » per « ssl-cert »", + "migration_0003_restoring_origin_nginx_conf": "Vòstre fichièr /etc/nginx/nginx.conf es estat modificat manualament. La migracion reïnicializarà d’en primièr son estat origina… Lo fichièr precedent serà disponible coma {backup_dest}.", + "migration_0003_still_on_jessie_after_main_upgrade": "Quicòm a trucat pendent la mesa a nivèl màger : lo sistèma es encara jos Jessie ?!? Per trobar lo problèma, agachatz {log} …", + "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.", + "migration_0003_problematic_apps_warning": "Notatz que las aplicacions seguentas, saique problematicas, son estadas desactivadas. Semblan d’aver estadas installadas d’una lista d’aplicacions o que son pas marcadas coma «working ». En consequéncia, podèm pas assegurar que tendràn de foncionar aprèp la mesa a nivèl : {problematic_apps}", + "migrations_bad_value_for_target": "Nombre invalid pel paramètre « target », los numèros de migracion son 0 o {}", + "migrations_migration_has_failed": "La migracion {number} {name} a pas capitat amb l’excepcion {exception}, anullacion", + "migrations_skip_migration": "Passatge de la migracion {number} {name}…", + "migrations_to_be_ran_manually": "La migracion {number} {name} deu èsser lançada manualament. Mercés d’anar a Aisias > Migracion dins l’interfàcia admin, o lançar « yunohost tools migrations migrate ».", + "migrations_need_to_accept_disclaimer": "Per lançar la migracion {number} {name} , avètz d’acceptar aquesta clausa de non-responsabilitat :\n---\n{disclaimer}\n---\nS’acceptatz de lançar la migracion, mercés de tornar executar la comanda amb l’opcion accept-disclaimer.", + "monitor_disabled": "La supervision del servidor es desactivada", + "monitor_enabled": "La supervision del servidor es activada", + "mysql_db_initialized": "La basa de donadas MySQL es estada inicializada", + "no_restore_script": "Lo script de salvagarda es pas estat trobat per l’aplicacion « {app:s} »", + "pattern_backup_archive_name": "Deu èsser un nom de fichièr valid compausat de 30 caractèrs alfanumerics al maximum e « -_. »", + "pattern_listname": "Deu èsser compausat solament de caractèrs alfanumerics e de tiret bas", + "service_description_dovecot": "permet als clients de messatjariá d’accedir/recuperar los corrièls (via IMAP e POP3)", + "service_description_fail2ban": "protegís contra los atacs brute-force e d’autres atacs venents d’Internet", + "service_description_glances": "susvelha las informacions sistèma de vòstre servidor", + "service_description_metronome": "gerís los comptes de messatjariás instantanèas XMPP", + "service_description_nginx": "fornís o permet l’accès a totes los sites web albergats sus vòstre servidor", + "service_description_nslcd": "gerís la connexion en linha de comanda dels utilizaires YunoHost", + "service_description_redis-server": "una basa de donadas especializada per un accès rapid a las donadas, las filas d’espèra e la comunicacion entre programas", + "service_description_rspamd": "filtra lo corrièl pas desirat e mai foncionalitats ligadas al corrièl" } From 3d295a4fb267f3dc73b61f6dd29f332c66124352 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Tue, 29 May 2018 13:17:59 +0000 Subject: [PATCH 289/313] [i18n] Translated using Weblate (Occitan) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently translated at 98.0% (396 of 404 strings) ortho endarrièr --- locales/oc.json | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index d575dca4e..51ca785c1 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -393,5 +393,10 @@ "service_description_nginx": "fornís o permet l’accès a totes los sites web albergats sus vòstre servidor", "service_description_nslcd": "gerís la connexion en linha de comanda dels utilizaires YunoHost", "service_description_redis-server": "una basa de donadas especializada per un accès rapid a las donadas, las filas d’espèra e la comunicacion entre programas", - "service_description_rspamd": "filtra lo corrièl pas desirat e mai foncionalitats ligadas al corrièl" + "service_description_rspamd": "filtra lo corrièl pas desirat e mai foncionalitats ligadas al corrièl", + "migrations_backward": "Migracion endarrièr.", + "migrations_forward": "Migracion en avant", + "network_check_smtp_ko": "Lo trafic de corrièl sortent (pòrt 25 SMTP) sembla blocat per vòstra ret", + "network_check_smtp_ok": "Lo trafic de corrièl sortent (pòrt 25 SMTP) es pas blocat", + "pattern_mailbox_quota": "Deu èsser una talha amb lo sufixe b/k/M/G/T o0 per desactivar la quòta" } From f1c7839240904a3f7791266bdd32b566e6a391a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=B2u=20utilizaire?= Date: Tue, 29 May 2018 13:22:03 +0000 Subject: [PATCH 290/313] [i18n] Translated using Weblate (Occitan) Currently translated at 99.0% (400 of 404 strings) --- locales/oc.json | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index 51ca785c1..416ee2e09 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -385,7 +385,7 @@ "mysql_db_initialized": "La basa de donadas MySQL es estada inicializada", "no_restore_script": "Lo script de salvagarda es pas estat trobat per l’aplicacion « {app:s} »", "pattern_backup_archive_name": "Deu èsser un nom de fichièr valid compausat de 30 caractèrs alfanumerics al maximum e « -_. »", - "pattern_listname": "Deu èsser compausat solament de caractèrs alfanumerics e de tiret bas", + "pattern_listname": "Deu èsser compausat solament de caractèrs alfanumerics e de tirets basses", "service_description_dovecot": "permet als clients de messatjariá d’accedir/recuperar los corrièls (via IMAP e POP3)", "service_description_fail2ban": "protegís contra los atacs brute-force e d’autres atacs venents d’Internet", "service_description_glances": "susvelha las informacions sistèma de vòstre servidor", @@ -398,5 +398,9 @@ "migrations_forward": "Migracion en avant", "network_check_smtp_ko": "Lo trafic de corrièl sortent (pòrt 25 SMTP) sembla blocat per vòstra ret", "network_check_smtp_ok": "Lo trafic de corrièl sortent (pòrt 25 SMTP) es pas blocat", - "pattern_mailbox_quota": "Deu èsser una talha amb lo sufixe b/k/M/G/T o0 per desactivar la quòta" + "pattern_mailbox_quota": "Deu èsser una talha amb lo sufixe b/k/M/G/T o0 per desactivar la quòta", + "backup_archive_writing_error": "Impossible d’ajustar los fichièrs a la salvagarda dins l’archiu comprimit", + "backup_cant_mount_uncompress_archive": "Impossible de montar en lectura sola lo repertòri de l’archiu descomprimit", + "backup_no_uncompress_archive_dir": "Lo repertòri de l’archiu descomprimit existís pas", + "pattern_username": "Deu èsser compausat solament de caractèrs alfanumerics en letras minusculas e de tirets basses" } From 53aa3fbf60913123dcccd55e7cebf55095405309 Mon Sep 17 00:00:00 2001 From: Quenti Date: Tue, 29 May 2018 19:20:31 +0000 Subject: [PATCH 291/313] [i18n] Translated using Weblate (Occitan) Currently translated at 99.0% (400 of 404 strings) --- locales/oc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 416ee2e09..e5bf34f4d 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -394,7 +394,7 @@ "service_description_nslcd": "gerís la connexion en linha de comanda dels utilizaires YunoHost", "service_description_redis-server": "una basa de donadas especializada per un accès rapid a las donadas, las filas d’espèra e la comunicacion entre programas", "service_description_rspamd": "filtra lo corrièl pas desirat e mai foncionalitats ligadas al corrièl", - "migrations_backward": "Migracion endarrièr.", + "migrations_backward": "Migracion en darrièr.", "migrations_forward": "Migracion en avant", "network_check_smtp_ko": "Lo trafic de corrièl sortent (pòrt 25 SMTP) sembla blocat per vòstra ret", "network_check_smtp_ok": "Lo trafic de corrièl sortent (pòrt 25 SMTP) es pas blocat", From 054f0d89c3291eac7a3a3cf6eade5a0bb7f5c389 Mon Sep 17 00:00:00 2001 From: Quenti Date: Tue, 29 May 2018 19:21:40 +0000 Subject: [PATCH 292/313] [i18n] Translated using Weblate (Occitan) Currently translated at 99.7% (403 of 404 strings) --- locales/oc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index e5bf34f4d..75830e52f 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -398,7 +398,7 @@ "migrations_forward": "Migracion en avant", "network_check_smtp_ko": "Lo trafic de corrièl sortent (pòrt 25 SMTP) sembla blocat per vòstra ret", "network_check_smtp_ok": "Lo trafic de corrièl sortent (pòrt 25 SMTP) es pas blocat", - "pattern_mailbox_quota": "Deu èsser una talha amb lo sufixe b/k/M/G/T o0 per desactivar la quòta", + "pattern_mailbox_quota": "Deu èsser una talha amb lo sufixe b/k/M/G/T o 0 per desactivar la quòta", "backup_archive_writing_error": "Impossible d’ajustar los fichièrs a la salvagarda dins l’archiu comprimit", "backup_cant_mount_uncompress_archive": "Impossible de montar en lectura sola lo repertòri de l’archiu descomprimit", "backup_no_uncompress_archive_dir": "Lo repertòri de l’archiu descomprimit existís pas", From e41887fb53ef66c34b56e81db878dca3fcc4897e Mon Sep 17 00:00:00 2001 From: Quenti Date: Wed, 30 May 2018 05:31:20 +0000 Subject: [PATCH 293/313] [i18n] Translated using Weblate (Occitan) Currently translated at 100.0% (404 of 404 strings) --- locales/oc.json | 72 ++++++++++++++++++++++++------------------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index 75830e52f..8221d5579 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -1,7 +1,7 @@ { - "admin_password": "Senhal d'administracion", + "admin_password": "Senhal d’administracion", "admin_password_change_failed": "Impossible de cambiar lo senhal", - "admin_password_changed": "Lo senhal d'administracion es ben estat cambiat", + "admin_password_changed": "Lo senhal d’administracion es ben estat cambiat", "app_already_installed": "{app:s} es ja installat", "app_already_up_to_date": "{app:s} es ja a jorn", "installation_complete": "Installacion acabada", @@ -46,7 +46,7 @@ "app_change_url_failed_nginx_reload": "La reaviada de nginx a fracassat. Vaquí la sortida de « nginx -t » :\n{nginx_errors:s}", "app_change_url_identical_domains": "L’ancian e lo novèl coble domeni/camin son identics per {domain:s}{path:s}, pas res a far.", "app_change_url_success": "L’URL de l’aplicacion {app:s} a cambiat per {domain:s}{path:s}", - "app_checkurl_is_deprecated": "Packagers /!\\ 'app checkurl' es obsolèt ! Utilizatz 'app register-url' a la plaça !", + "app_checkurl_is_deprecated": "Packagers /!\\ ’app checkurl’ es obsolèt ! Utilizatz ’app register-url’ a la plaça !", "app_extraction_failed": "Extraccion dels fichièrs d’installacion impossibla", "app_incompatible": "L’aplicacion {app} es pas compatibla amb vòstra version de YunoHost", "app_location_already_used": "L’aplicacion « {app} » es ja installada a aqueste emplaçament ({path})", @@ -120,7 +120,7 @@ "backup_with_no_backup_script_for_app": "L’aplicacion {app:s} a pas cap de script de salvagarda. I fasèm pas cas.", "backup_with_no_restore_script_for_app": "L’aplicacion {app:s} a pas cap de script de restauracion, poiretz pas restaurar automaticament la salvagarda d’aquesta aplicacion.", "certmanager_acme_not_configured_for_domain": "Lo certificat del domeni {domain:s} sembla pas corrèctament installat. Mercés de lançar d’en primièr cert-install per aqueste domeni.", - "certmanager_attempt_to_renew_nonLE_cert": "Lo certificat pel domeni {domain:s} es pas provesit per Let's Encrypt. Impossible de lo renovar automaticament !", + "certmanager_attempt_to_renew_nonLE_cert": "Lo certificat pel domeni {domain:s} es pas provesit per Let’s Encrypt. Impossible de lo renovar automaticament !", "certmanager_attempt_to_renew_valid_cert": "Lo certificat pel domeni {domain:s} es a man d’expirar ! Utilizatz --force per cortcircuitar", "certmanager_cannot_read_cert": "Quicòm a trucat en ensajar de dobrir lo certificat actual pel domeni {domain:s} (fichièr : {file:s}), rason : {reason:s}", "certmanager_cert_install_success": "Installacion capitada del certificat Let’s Encrypt pel domeni {domain:s} !", @@ -232,24 +232,24 @@ "yunohost_not_installed": "YunoHost es pas installat o corrèctament installat. Mercés d’executar « yunohost tools postinstall »", "backup_output_directory_forbidden": "Repertòri de destinacion defendut. Las salvagardas pòdon pas se realizar dins los repertòris bin, /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var ou /home/yunohost.backup/archives", "certmanager_attempt_to_replace_valid_cert": "Sètz a remplaçar un certificat corrècte e valid pel domeni {domain:s} ! (Utilizatz --force per cortcircuitar)", - "certmanager_cert_renew_success": "Renovèlament capitat d’un certificat Let's Encrypt pel domeni {domain:s} !", + "certmanager_cert_renew_success": "Renovèlament capitat d’un certificat Let’s Encrypt pel domeni {domain:s} !", "certmanager_certificate_fetching_or_enabling_failed": "Sembla d’aver fracassat l’activacion d’un nòu certificat per {domain:s}…", "certmanager_conflicting_nginx_file": "Impossible de preparar lo domeni pel desfís ACME : lo fichièr de configuracion nginx {filepath:s} es en conflicte e deu èsser levat d’en primièr", - "certmanager_couldnt_fetch_intermediate_cert": "Expiracion del relambi pendent l’ensag de recuperacion del certificat intermediari dins de Let's Encrypt. L’installacion / lo renovèlament es estat interromput - tornatz ensajar mai tard.", + "certmanager_couldnt_fetch_intermediate_cert": "Expiracion del relambi pendent l’ensag de recuperacion del certificat intermediari dins de Let’s Encrypt. L’installacion / lo renovèlament es estat interromput - tornatz ensajar mai tard.", "certmanager_domain_not_resolved_locally": "Lo domeni {domain:s} pòt pas èsser determinat dins de vòstre servidor YunoHost. Pòt arribar s’avètz recentament modificat vòstre enregistrament DNS. Dins aqueste cas, mercés d’esperar unas oras per l’espandiment. Se lo problèma dura, consideratz ajustar {domain:s} a /etc/hosts. (Se sabètz çò que fasetz, utilizatz --no-checks per desactivar las verificacions.)", - "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let'S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", + "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let’S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_hit_rate_limit": "Tròp de certificats son ja estats demandats recentament per aqueste ensem de domeni {domain:s}. Mercés de tornar ensajar mai tard. Legissètz https://letsencrypt.org/docs/rate-limits/ per mai detalhs", "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via HTTP amb son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafòc/router amont de vòstre servidor es mal configurat.", "domain_dns_conf_is_just_a_recommendation": "Aqueste pagina mòstra la configuracion *recomandada*. Non configura *pas* lo DNS per vos. Sètz responsable de la configuracion de vòstra zòna DNS en çò de vòstre registrar DNS amb aquesta recomandacion.", "domain_dyndns_already_subscribed": "Avètz ja soscrich a un domeni DynDNS", - "domain_dyndns_dynette_is_unreachable": "Impossible de contactar la dynette YunoHost, siá YunoHost pas es pas corrèctament connectat a Internet, siá lo servidor de la dynett es arrestat. Error : {error}", + "domain_dyndns_dynette_is_unreachable": "Impossible de contactar la dynette YunoHost, siá YunoHost pas es pas corrèctament connectat a Internet, siá lo servidor de la dynett es arrestat. Error : {error}", "domain_uninstall_app_first": "Una o mantuna aplicacions son installadas sus aqueste domeni. Mercés de las desinstallar d’en primièr abans de suprimir aqueste domeni", "firewall_reload_failed": "Impossible de recargar lo parafòc", "firewall_reloaded": "Lo parafòc es estat recargat", "firewall_rules_cmd_failed": "Unas règlas del parafòc an fracassat. Per mai informacions, consultatz lo jornal.", - "global_settings_bad_choice_for_enum": "La valor del paramètre {setting:s} es incorrècta. Recebut : {received_type:s}, esperat {expected_type:s}", - "global_settings_bad_type_for_setting": "Lo tipe del paramètre {setting:s} es incorrècte. Recebut : {received_type:s}, esperat {expected_type:s}", - "global_settings_cant_write_settings": "Fracàs de l’escritura del fichièr de configuracion, rason : {reason:s}", + "global_settings_bad_choice_for_enum": "La valor del paramètre {setting:s} es incorrècta. Recebut : {received_type:s}, esperat {expected_type:s}", + "global_settings_bad_type_for_setting": "Lo tipe del paramètre {setting:s} es incorrècte. Recebut : {received_type:s}, esperat {expected_type:s}", + "global_settings_cant_write_settings": "Fracàs de l’escritura del fichièr de configuracion, rason : {reason:s}", "global_settings_setting_example_enum": "Exemple d’opcion de tipe enumeracion", "global_settings_setting_example_int": "Exemple d’opcion de tipe entièr", "global_settings_setting_example_string": "Exemple d’opcion de tipe cadena", @@ -261,29 +261,29 @@ "ldap_init_failed_to_create_admin": "L’inicializacion de LDAP a pas pogut crear l’utilizaire admin", "mail_domain_unknown": "Lo domeni de corrièl « {domain:s} » es desconegut", "mailbox_used_space_dovecot_down": "Lo servici corrièl Dovecot deu èsser aviat, se volètz conéisser l’espaci ocupat per la messatjariá", - "migrate_tsig_failed": "La migracion del domeni dyndns {domain} cap a hmac-sha512 a pas capitat, anullacion de las modificacions. Error : {error_code} - {error}", + "migrate_tsig_failed": "La migracion del domeni dyndns {domain} cap a hmac-sha512 a pas capitat, anullacion de las modificacions. Error : {error_code} - {error}", "migrate_tsig_wait": "Esperem 3 minutas que lo servidor dyndns prenga en compte la novèla clau…", - "migrate_tsig_not_needed": "Sembla qu’utilizatz pas un domeni dyndns, donc cap de migracion es pas necessària !", + "migrate_tsig_not_needed": "Sembla qu’utilizatz pas un domeni dyndns, donc cap de migracion es pas necessària !", "migration_0003_yunohost_upgrade": "Aviada de la mesa a nivèl del paquet YunoHost… La migracion acabarà, mas la mesa a jorn reala se realizarà tot bèl aprèp. Un còp acabada, poiretz vos reconnectar a l’administracion web.", "migration_0003_system_not_fully_up_to_date": "Lo sistèma es pas complètament a jorn. Mercés de lançar una mesa a jorn classica abans de començar la migracion per Stretch.", - "migration_0003_modified_files": "Mercés de notar que los fichièrs seguents son estats detectats coma modificats manualament e poiràn èsser escafats a la fin de la mesa a nivèl : {manually_modified_files}", + "migration_0003_modified_files": "Mercés de notar que los fichièrs seguents son estats detectats coma modificats manualament e poiràn èsser escafats a la fin de la mesa a nivèl : {manually_modified_files}", "monitor_period_invalid": "Lo periòde de temps es incorrècte", "monitor_stats_file_not_found": "Lo fichièr d’estatisticas es introbabe", "monitor_stats_period_unavailable": "Cap d’estatisticas son pas disponiblas pel periòde", "mysql_db_init_failed": "Impossible d’inicializar la basa de donadas MySQL", - "service_disable_failed": "Impossible de desactivar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_disable_failed": "Impossible de desactivar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", "service_disabled": "Lo servici « {service:s} » es desactivat", - "service_enable_failed": "Impossible d’activar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_enable_failed": "Impossible d’activar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", "service_enabled": "Lo servici « {service:s} » es activat", "service_no_log": "Cap de jornal de far veire pel servici « {service:s} »", "service_regenconf_dry_pending_applying": "Verificacion de las configuracions en espèra que poirián èsser aplicadas pel servici « {service} »…", - "service_regenconf_failed": "Regeneracion impossibla de la configuracion pels servicis : {services}", + "service_regenconf_failed": "Regeneracion impossibla de la configuracion pels servicis : {services}", "service_regenconf_pending_applying": "Aplicacion de as configuraion en espèra pel servici « {service} »…", "service_remove_failed": "Impossible de levar lo servici « {service:s} »", "service_removed": "Lo servici « {service:s} » es estat levat", - "service_start_failed": "Impossible d’aviar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_start_failed": "Impossible d’aviar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", "service_started": "Lo servici « {service:s} » es aviat", - "service_stop_failed": "Impossible d’arrestar lo servici « {service:s} »↵\n\nJornals recents : {logs:s}", + "service_stop_failed": "Impossible d’arrestar lo servici « {service:s} »↵\n\nJornals recents : {logs:s}", "ssowat_conf_generated": "La configuracion SSowat es generada", "ssowat_conf_updated": "La configuracion SSOwat es estada actualizada", "system_upgraded": "Lo sistèma es estat actualizat", @@ -316,27 +316,27 @@ "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles...", "service_conf_file_backed_up": "Lo fichièr de configuracion « {conf} » es salvagardat dins « {backup} »", "service_conf_file_copy_failed": "Còpia impossibla del nòu fichièr de configuracion « {new} » cap a « {conf} »", - "server_reboot_confirm": "Lo servidor es per reaviar sul pic, o volètz vertadièrament ? {answers:s}", + "server_reboot_confirm": "Lo servidor es per reaviar sul pic, o volètz vertadièrament ? {answers:s}", "service_add_failed": "Apondon impossible del servici « {service:s} »", "service_added": "Lo servici « {service:s} » es ajustat", "service_already_started": "Lo servici « {service:s} » es ja aviat", "service_already_stopped": "Lo servici « {service:s} » es ja arrestat", "restore_cleaning_failed": "Impossible de netejar lo repertòri temporari de restauracion", "restore_complete": "Restauracion acabada", - "restore_confirm_yunohost_installed": "Volètz vertadièrament restaurar un sistèma ja installat ? {answers:s}", + "restore_confirm_yunohost_installed": "Volètz vertadièrament restaurar un sistèma ja installat ? {answers:s}", "restore_extracting": "Extraccions dels fichièrs necessaris dins de l’archiu…", "restore_failed": "Impossible de restaurar lo sistèma", "restore_hook_unavailable": "Lo script de restauracion « {part:s} » es pas disponible sus vòstre sistèma e es pas tampauc dins l’archiu", - "restore_may_be_not_enough_disk_space": "Lo sistèma sembla d’aver pas pro d’espaci disponible (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", + "restore_may_be_not_enough_disk_space": "Lo sistèma sembla d’aver pas pro d’espaci disponible (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", "restore_mounting_archive": "Montatge de l’archiu dins « {path:s} »", - "restore_not_enough_disk_space": "Espaci disponible insufisent (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", + "restore_not_enough_disk_space": "Espaci disponible insufisent (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", "restore_nothings_done": "Res es pas estat restaurat", "restore_removing_tmp_dir_failed": "Impossible de levar u ancian repertòri temporari", "restore_running_app_script": "Lançament del script de restauracion per l’aplicacion « {app:s} »…", "restore_running_hooks": "Execucion dels scripts de restauracion…", "restore_system_part_failed": "Restauracion impossibla de la part « {part:s} » del sistèma", "server_shutdown": "Lo servidor serà atudat", - "server_shutdown_confirm": "Lo servidor es per s’atudar sul pic, o volètz vertadièrament ? {answers:s}", + "server_shutdown_confirm": "Lo servidor es per s’atudar sul pic, o volètz vertadièrament ? {answers:s}", "server_reboot": "Lo servidor es per reaviar", "network_check_mx_ko": "L’enregistrament DNS MX es pas especificat", "new_domain_required": "Vos cal especificar lo domeni màger", @@ -355,31 +355,31 @@ "service_description_ssh": "vos permet de vos connectar a distància a vòstre servidor via un teminal (protocòl SSH)", "service_description_yunohost-api": "permet las interaccions entre l’interfàcia web de YunoHost e le sistèma", "service_description_yunohost-firewall": "gerís los pòrts de connexion dobèrts e tampats als servicis", - "ssowat_persistent_conf_read_error": "Error en ligir la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", - "ssowat_persistent_conf_write_error": "Error en salvagardar la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", - "certmanager_old_letsencrypt_app_detected": "\nYunohost a detectat que l’aplicacion 'letsencrypt' es installada, aquò es en conflicte amb las novèlas foncionalitats integradas de gestion dels certificats de Yunohost. Se volètz utilizar aquelas foncionalitats integradas, mercés de lançar las comandas seguentas per migrar vòstra installacion :\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B. : aquò provarà de tornar installar los certificats de totes los domenis amb un certificat Let's Encrypt o las auto-signats", - "diagnosis_monitor_disk_error": "Impossible de supervisar los disques : {error}", - "diagnosis_monitor_network_error": "Impossible de supervisar la ret : {error}", - "diagnosis_monitor_system_error": "Impossible de supervisar lo sistèma : {error}", + "ssowat_persistent_conf_read_error": "Error en ligir la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", + "ssowat_persistent_conf_write_error": "Error en salvagardar la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", + "certmanager_old_letsencrypt_app_detected": "\nYunohost a detectat que l’aplicacion ’letsencrypt’ es installada, aquò es en conflicte amb las novèlas foncionalitats integradas de gestion dels certificats de Yunohost. Se volètz utilizar aquelas foncionalitats integradas, mercés de lançar las comandas seguentas per migrar vòstra installacion :\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B. : aquò provarà de tornar installar los certificats de totes los domenis amb un certificat Let’s Encrypt o las auto-signats", + "diagnosis_monitor_disk_error": "Impossible de supervisar los disques : {error}", + "diagnosis_monitor_network_error": "Impossible de supervisar la ret : {error}", + "diagnosis_monitor_system_error": "Impossible de supervisar lo sistèma : {error}", "executing_command": "Execucion de la comanda « {command:s} »…", "executing_script": "Execucion del script « {script:s} »…", - "global_settings_cant_serialize_settings": "Fracàs de la serializacion de las donadas de parametratge, rason : {reason:s}", + "global_settings_cant_serialize_settings": "Fracàs de la serializacion de las donadas de parametratge, rason : {reason:s}", "ip6tables_unavailable": "Podètz pas jogar amb ip6tables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", "iptables_unavailable": "Podètz pas jogar amb iptables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", "update_cache_failed": "Impossible d’actualizar lo cache de l’APT", - "mail_alias_remove_failed": "Supression impossibla de l'alias de corrièl « {mail:s} »", + "mail_alias_remove_failed": "Supression impossibla de l’alias de corrièl « {mail:s} »", "mail_forward_remove_failed": "Supression impossibla del corrièl de transferiment « {mail:s} »", "migrate_tsig_start": "L’algorisme de generacion de claus es pas pro securizat per la signatura TSIG del domeni « {domain} », lançament de la migracion cap a hmac-sha512 que’s mai securizat", "migration_description_0001_change_cert_group_to_sslcert": "Càmbia las permissions de grop dels certificats de « metronome » per « ssl-cert »", "migration_0003_restoring_origin_nginx_conf": "Vòstre fichièr /etc/nginx/nginx.conf es estat modificat manualament. La migracion reïnicializarà d’en primièr son estat origina… Lo fichièr precedent serà disponible coma {backup_dest}.", - "migration_0003_still_on_jessie_after_main_upgrade": "Quicòm a trucat pendent la mesa a nivèl màger : lo sistèma es encara jos Jessie ?!? Per trobar lo problèma, agachatz {log} …", - "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.", - "migration_0003_problematic_apps_warning": "Notatz que las aplicacions seguentas, saique problematicas, son estadas desactivadas. Semblan d’aver estadas installadas d’una lista d’aplicacions o que son pas marcadas coma «working ». En consequéncia, podèm pas assegurar que tendràn de foncionar aprèp la mesa a nivèl : {problematic_apps}", + "migration_0003_still_on_jessie_after_main_upgrade": "Quicòm a trucat pendent la mesa a nivèl màger : lo sistèma es encara jos Jessie ?!? Per trobar lo problèma, agachatz {log} …", + "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.", + "migration_0003_problematic_apps_warning": "Notatz que las aplicacions seguentas, saique problematicas, son estadas desactivadas. Semblan d’aver estadas installadas d’una lista d’aplicacions o que son pas marcadas coma «working ». En consequéncia, podèm pas assegurar que tendràn de foncionar aprèp la mesa a nivèl : {problematic_apps}", "migrations_bad_value_for_target": "Nombre invalid pel paramètre « target », los numèros de migracion son 0 o {}", "migrations_migration_has_failed": "La migracion {number} {name} a pas capitat amb l’excepcion {exception}, anullacion", "migrations_skip_migration": "Passatge de la migracion {number} {name}…", "migrations_to_be_ran_manually": "La migracion {number} {name} deu èsser lançada manualament. Mercés d’anar a Aisias > Migracion dins l’interfàcia admin, o lançar « yunohost tools migrations migrate ».", - "migrations_need_to_accept_disclaimer": "Per lançar la migracion {number} {name} , avètz d’acceptar aquesta clausa de non-responsabilitat :\n---\n{disclaimer}\n---\nS’acceptatz de lançar la migracion, mercés de tornar executar la comanda amb l’opcion accept-disclaimer.", + "migrations_need_to_accept_disclaimer": "Per lançar la migracion {number} {name} , avètz d’acceptar aquesta clausa de non-responsabilitat :\n---\n{disclaimer}\n---\nS’acceptatz de lançar la migracion, mercés de tornar executar la comanda amb l’opcion accept-disclaimer.", "monitor_disabled": "La supervision del servidor es desactivada", "monitor_enabled": "La supervision del servidor es activada", "mysql_db_initialized": "La basa de donadas MySQL es estada inicializada", From 48044b0f5ae966354890a9ae5936e82ef8a99af8 Mon Sep 17 00:00:00 2001 From: Quenti Date: Wed, 30 May 2018 05:33:29 +0000 Subject: [PATCH 294/313] [i18n] Translated using Weblate (Occitan) Currently translated at 100.0% (404 of 404 strings) --- locales/oc.json | 174 ++++++++++++++++++++++++------------------------ 1 file changed, 87 insertions(+), 87 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index 8221d5579..20686ade6 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -34,78 +34,78 @@ "ask_password": "Senhal", "ask_path": "Camin", "backup_action_required": "Devètz precisar çò que cal salvagardar", - "backup_app_failed": "Impossible de salvagardar l’aplicacion « {app:s} »", + "backup_app_failed": "Impossible de salvagardar l’aplicacion « {app:s} »", "backup_applying_method_copy": "Còpia de totes los fichièrs dins la salvagarda…", "backup_applying_method_tar": "Creacion de l’archiu tar de la salvagarda…", "backup_archive_name_exists": "Un archiu de salvagarda amb aquesta nom existís ja", - "backup_archive_name_unknown": "L’archiu local de salvagarda apelat « {name:s} » es desconegut", - "action_invalid": "Accion « {action:s} » incorrècte", - "app_argument_choice_invalid": "Causida invalida pel paramètre « {name:s} », cal que siá un de {choices:s}", - "app_argument_invalid": "Valor invalida pel paramètre « {name:s} » : {error:s}", - "app_argument_required": "Lo paramètre « {name:s} » es requesit", + "backup_archive_name_unknown": "L’archiu local de salvagarda apelat « {name:s} » es desconegut", + "action_invalid": "Accion « {action:s} » incorrècte", + "app_argument_choice_invalid": "Causida invalida pel paramètre « {name:s} », cal que siá un de {choices:s}", + "app_argument_invalid": "Valor invalida pel paramètre « {name:s} » : {error:s}", + "app_argument_required": "Lo paramètre « {name:s} » es requesit", "app_change_url_failed_nginx_reload": "La reaviada de nginx a fracassat. Vaquí la sortida de « nginx -t » :\n{nginx_errors:s}", "app_change_url_identical_domains": "L’ancian e lo novèl coble domeni/camin son identics per {domain:s}{path:s}, pas res a far.", "app_change_url_success": "L’URL de l’aplicacion {app:s} a cambiat per {domain:s}{path:s}", "app_checkurl_is_deprecated": "Packagers /!\\ ’app checkurl’ es obsolèt ! Utilizatz ’app register-url’ a la plaça !", "app_extraction_failed": "Extraccion dels fichièrs d’installacion impossibla", "app_incompatible": "L’aplicacion {app} es pas compatibla amb vòstra version de YunoHost", - "app_location_already_used": "L’aplicacion « {app} » es ja installada a aqueste emplaçament ({path})", + "app_location_already_used": "L’aplicacion « {app} » es ja installada a aqueste emplaçament ({path})", "app_manifest_invalid": "Manifest d’aplicacion incorrècte : {error}", "app_package_need_update": "Lo paquet de l’aplicacion {app} deu èsser mes a jorn per seguir los cambiaments de YunoHost", "app_requirements_checking": "Verificacion dels paquets requesida per {app}...", "app_sources_fetch_failed": "Recuperacion dels fichièrs fonts impossibla", "app_unsupported_remote_type": "Lo tipe alonhat utilizat per l’aplicacion es pas suportat", "appslist_retrieve_error": "Impossible de recuperar la lista d’aplicacions alonhadas {appslist:s} : {error:s}", - "backup_archive_app_not_found": "L’aplicacion « {app:s} » es pas estada trobada dins l’archiu de la salvagarda", + "backup_archive_app_not_found": "L’aplicacion « {app:s} » es pas estada trobada dins l’archiu de la salvagarda", "backup_archive_broken_link": "Impossible d‘accedir a l’archiu de salvagarda (ligam invalid cap a {path:s})", "backup_archive_mount_failed": "Lo montatge de l’archiu de salvagarda a fracassat", "backup_archive_open_failed": "Impossible de dobrir l’archiu de salvagarda", - "backup_archive_system_part_not_available": "La part « {part:s} » del sistèma es pas disponibla dins aquesta salvagarda", + "backup_archive_system_part_not_available": "La part « {part:s} » del sistèma es pas disponibla dins aquesta salvagarda", "backup_cleaning_failed": "Impossible de netejar lo repertòri temporari de salvagarda", "backup_copying_to_organize_the_archive": "Còpia de {size:s} Mio per organizar l’archiu", "backup_created": "Salvagarda acabada", "backup_creating_archive": "Creacion de l’archiu de salvagarda...", "backup_creation_failed": "Impossible de crear la salvagarda", - "app_already_installed_cant_change_url": "Aquesta aplicacion es ja installada. Aquesta foncion pòt pas simplament cambiar l’URL. Agachatz « app changeurl » s’es disponible.", + "app_already_installed_cant_change_url": "Aquesta aplicacion es ja installada. Aquesta foncion pòt pas simplament cambiar l’URL. Agachatz « app changeurl » s’es disponible.", "app_change_no_change_url_script": "L’aplicacion {app_name:s} pren pas en compte lo cambiament d’URL, poiretz aver de la metre a jorn.", "app_change_url_no_script": "L’aplicacion {app_name:s} pren pas en compte lo cambiament d’URL, benlèu que vos cal la metre a jorn.", - "app_make_default_location_already_used": "Impossible de configurar l’aplicacion « {app} » per defaut pel domeni {domain} perque es ja utilizat per l’aplicacion {other_app}", + "app_make_default_location_already_used": "Impossible de configurar l’aplicacion « {app} » per defaut pel domeni {domain} perque es ja utilizat per l’aplicacion {other_app}", "app_location_install_failed": "Impossible d’installar l’aplicacion a aqueste emplaçament per causa de conflicte amb l’aplicacion {other_app} qu’es ja installada sus {other_path}", "app_location_unavailable": "Aquesta URL es pas disponibla o en conflicte amb una aplicacion existenta", "appslist_corrupted_json": "Cargament impossible de la lista d’aplicacion. Sembla que {filename:s} siá gastat.", - "backup_delete_error": "Impossible de suprimir « {path:s} »", + "backup_delete_error": "Impossible de suprimir « {path:s} »", "backup_deleted": "La salvagarda es estada suprimida", - "backup_hook_unknown": "Script de salvagarda « {hook:s} » desconegut", + "backup_hook_unknown": "Script de salvagarda « {hook:s} » desconegut", "backup_invalid_archive": "Archiu de salvagarda incorrècte", "backup_method_borg_finished": "La salvagarda dins Borg es acabada", "backup_method_copy_finished": "La còpia de salvagarda es acabada", "backup_method_tar_finished": "L’archiu tar de la salvagarda es estat creat", "backup_output_directory_not_empty": "Lo dorsièr de sortida es pas void", "backup_output_directory_required": "Vos cal especificar un dorsièr de sortida per la salvagarda", - "backup_running_app_script": "Lançament de l’escript de salvagarda de l’aplicacion « {app:s} »...", + "backup_running_app_script": "Lançament de l’escript de salvagarda de l’aplicacion « {app:s} »...", "backup_running_hooks": "Execucion dels scripts de salvagarda...", - "backup_system_part_failed": "Impossible de salvagardar la part « {part:s} » del sistèma", + "backup_system_part_failed": "Impossible de salvagardar la part « {part:s} » del sistèma", "app_requirements_failed": "Impossible de complir las condicions requesidas per {app} : {error}", "app_requirements_unmeet": "Las condicions requesidas per {app} son pas complidas, lo paquet {pkgname} ({version}) deu èsser {spec}", "appslist_could_not_migrate": "Migracion de la lista impossibla {appslist:s} ! Impossible d’analizar l’URL… L’anciana tasca cron es estada servada dins {bkp_file:s}.", "backup_abstract_method": "Aqueste metòde de salvagarda es pas encara implementat", - "backup_applying_method_custom": "Crida lo metòde de salvagarda personalizat « {method:s} »…", + "backup_applying_method_custom": "Crida lo metòde de salvagarda personalizat « {method:s} »…", "backup_borg_not_implemented": "Lo metòde de salvagarda Bord es pas encara implementat", "backup_couldnt_bind": "Impossible de ligar {src:s} amb {dest:s}.", "backup_csv_addition_failed": "Impossible d’ajustar de fichièrs a la salvagarda dins lo fichièr CSV", - "backup_custom_backup_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « backup »", - "backup_custom_mount_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « mount »", - "backup_custom_need_mount_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « need_mount »", - "backup_method_custom_finished": "Lo metòde de salvagarda personalizat « {method:s} » es acabat", + "backup_custom_backup_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « backup »", + "backup_custom_mount_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « mount »", + "backup_custom_need_mount_error": "Fracàs del metòde de salvagarda personalizat a l’etapa « need_mount »", + "backup_method_custom_finished": "Lo metòde de salvagarda personalizat « {method:s} » es acabat", "backup_nothings_done": "I a pas res de salvagardar", "backup_unable_to_organize_files": "Impossible d’organizar los fichièrs dins l’archiu amb lo metòde rapid", - "service_status_failed": "Impossible dedeterminar l’estat del servici « {service:s} »", - "service_stopped": "Lo servici « {service:s} » es estat arrestat", - "service_unknown": "Servici « {service:s} » desconegut", - "unbackup_app": "L’aplicacion « {app:s} » serà pas salvagardada", - "unit_unknown": "Unitat « {unit:s} » desconeguda", + "service_status_failed": "Impossible dedeterminar l’estat del servici « {service:s} »", + "service_stopped": "Lo servici « {service:s} » es estat arrestat", + "service_unknown": "Servici « {service:s} » desconegut", + "unbackup_app": "L’aplicacion « {app:s} » serà pas salvagardada", + "unit_unknown": "Unitat « {unit:s} » desconeguda", "unlimit": "Cap de quòta", - "unrestore_app": "L’aplicacion « {app:s} » serà pas restaurada", + "unrestore_app": "L’aplicacion « {app:s} » serà pas restaurada", "upnp_dev_not_found": "Cap de periferic compatible UPnP pas trobat", "upnp_disabled": "UPnP es desactivat", "upnp_enabled": "UPnP es activat", @@ -116,7 +116,7 @@ "backup_applying_method_borg": "Mandadís de totes los fichièrs a la salvagarda dins lo repertòri borg-backup…", "backup_csv_creation_failed": "Creacion impossibla del fichièr CSV necessari a las operacions futuras de restauracion", "backup_extracting_archive": "Extraccion de l’archiu de salvagarda…", - "backup_output_symlink_dir_broken": "Avètz un ligam simbolic copat allòc de vòstre repertòri d’archiu « {path:s} ». Poiriatz aver una configuracion personalizada per salvagardar vòstras donadas sus un autre sistèma de fichièrs, en aquel cas, saique oblidèretz de montar o de connectar lo disc o la clau USB.", + "backup_output_symlink_dir_broken": "Avètz un ligam simbolic copat allòc de vòstre repertòri d’archiu « {path:s} ». Poiriatz aver una configuracion personalizada per salvagardar vòstras donadas sus un autre sistèma de fichièrs, en aquel cas, saique oblidèretz de montar o de connectar lo disc o la clau USB.", "backup_with_no_backup_script_for_app": "L’aplicacion {app:s} a pas cap de script de salvagarda. I fasèm pas cas.", "backup_with_no_restore_script_for_app": "L’aplicacion {app:s} a pas cap de script de restauracion, poiretz pas restaurar automaticament la salvagarda d’aquesta aplicacion.", "certmanager_acme_not_configured_for_domain": "Lo certificat del domeni {domain:s} sembla pas corrèctament installat. Mercés de lançar d’en primièr cert-install per aqueste domeni.", @@ -127,7 +127,7 @@ "certmanager_cert_install_success_selfsigned": "Installacion capitada del certificat auto-signat pel domeni {domain:s} !", "certmanager_cert_signing_failed": "Fracàs de la signatura del noù certificat", "certmanager_domain_cert_not_selfsigned": "Lo certificat del domeni {domain:s} es pas auto-signat. Volètz vertadièrament lo remplaçar ? (Utiliatz --force)", - "certmanager_domain_dns_ip_differs_from_public_ip": "L’enregistrament DNS « A » del domeni {domain:s} es diferent de l’adreça IP d’aqueste servidor. Se fa pauc qu’avètz modificat l’enregistrament « A », mercés d’esperar l’espandiment (qualques verificadors d’espandiment son disponibles en linha). (Se sabètz ço que fasèm, utilizatz --no-checks per desactivar aqueles contraròtles)", + "certmanager_domain_dns_ip_differs_from_public_ip": "L’enregistrament DNS « A » del domeni {domain:s} es diferent de l’adreça IP d’aqueste servidor. Se fa pauc qu’avètz modificat l’enregistrament « A », mercés d’esperar l’espandiment (qualques verificadors d’espandiment son disponibles en linha). (Se sabètz ço que fasèm, utilizatz --no-checks per desactivar aqueles contraròtles)", "certmanager_domain_http_not_working": "Sembla que lo domeni {domain:s} es pas accessible via HTTP. Mercés de verificar que las configuracions DNS e nginx son corrèctas", "certmanager_domain_unknown": "Domeni desconegut {domain:s}", "certmanager_no_cert_file": "Lectura impossibla del fichièr del certificat pel domeni {domain:s} (fichièr : {file:s})", @@ -138,7 +138,7 @@ "diagnosis_debian_version_error": "Impossible de determinar la version de Debian : {error}", "diagnosis_kernel_version_error": "Impossible de recuperar la version del nuclèu : {error}", "diagnosis_no_apps": "Pas cap d’aplicacion installada", - "dnsmasq_isnt_installed": "dnsmasq sembla pas èsser installat, mercés de lançar « apt-get remove bind9 && apt-get install dnsmasq »", + "dnsmasq_isnt_installed": "dnsmasq sembla pas èsser installat, mercés de lançar « apt-get remove bind9 && apt-get install dnsmasq »", "domain_cannot_remove_main": "Impossible de levar lo domeni màger. Definissètz un novèl domeni màger d’en primièr", "domain_cert_gen_failed": "Generacion del certificat impossibla", "domain_created": "Lo domeni es creat", @@ -169,10 +169,10 @@ "dyndns_domain_not_provided": "Lo provesidor DynDNS {provider:s} pòt pas fornir lo domeni {domain:s}.", "dyndns_unavailable": "Lo domeni {domain:s} es pas disponible.", "extracting": "Extraccion…", - "field_invalid": "Camp incorrècte : « {:s} »", + "field_invalid": "Camp incorrècte : « {:s} »", "format_datetime_short": "%d/%m/%Y %H:%M", "global_settings_cant_open_settings": "Fracàs de la dobertura del fichièr de configuracion, rason : {reason:s}", - "global_settings_key_doesnt_exists": "La clau « {settings_key:s} » existís pas dins las configuracions globalas, podètz veire totas las claus disponiblas en picant « yunohost settings list »", + "global_settings_key_doesnt_exists": "La clau « {settings_key:s} » existís pas dins las configuracions globalas, podètz veire totas las claus disponiblas en picant « yunohost settings list »", "global_settings_reset_success": "Capitada ! Vòstra configuracion precedenta es estada salvagarda dins {path:s}", "global_settings_setting_example_bool": "Exemple d’opcion booleana", "global_settings_unknown_setting_from_settings_file": "Clau desconeguda dins los paramètres : {setting_key:s}, apartat e salvagardat dins /etc/yunohost/unkown_settings.json", @@ -209,8 +209,8 @@ "mysql_db_creation_failed": "Creacion de la basa de donadas MySQL impossibla", "no_appslist_found": "Cap de lista d’aplicacions pas trobaba", "no_internet_connection": "Lo servidor es pas connectat a Internet", - "package_not_installed": "Lo paquet « {pkgname} » es pas installat", - "package_unknown": "Paquet « {pkgname} » desconegut", + "package_not_installed": "Lo paquet « {pkgname} » es pas installat", + "package_unknown": "Paquet « {pkgname} » desconegut", "packages_no_upgrade": "I a pas cap de paquet d’actualizar", "packages_upgrade_failed": "Actualizacion de totes los paquets impossibla", "path_removal_failed": "Impossible de suprimir lo camin {:s}", @@ -226,10 +226,10 @@ "port_already_opened": "Lo pòrt {port:d} es ja dubèrt per las connexions {ip_version:s}", "port_available": "Lo pòrt {port:d} es disponible", "port_unavailable": "Lo pòrt {port:d} es pas disponible", - "restore_already_installed_app": "Una aplicacion es ja installada amb l’id « {app:s} »", - "restore_app_failed": "Impossible de restaurar l’aplicacion « {app:s} »", + "restore_already_installed_app": "Una aplicacion es ja installada amb l’id « {app:s} »", + "restore_app_failed": "Impossible de restaurar l’aplicacion « {app:s} »", "backup_ask_for_copying_if_needed": "D’unes fichièrs an pas pogut èsser preparatz per la salvagarda en utilizar lo metòde qu’evita de gastar d’espaci sul sistèma de manièra temporària. Per lançar la salvagarda, cal utilizar temporàriament {size:s} Mo. Acceptatz ?", - "yunohost_not_installed": "YunoHost es pas installat o corrèctament installat. Mercés d’executar « yunohost tools postinstall »", + "yunohost_not_installed": "YunoHost es pas installat o corrèctament installat. Mercés d’executar « yunohost tools postinstall »", "backup_output_directory_forbidden": "Repertòri de destinacion defendut. Las salvagardas pòdon pas se realizar dins los repertòris bin, /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var ou /home/yunohost.backup/archives", "certmanager_attempt_to_replace_valid_cert": "Sètz a remplaçar un certificat corrècte e valid pel domeni {domain:s} ! (Utilizatz --force per cortcircuitar)", "certmanager_cert_renew_success": "Renovèlament capitat d’un certificat Let’s Encrypt pel domeni {domain:s} !", @@ -237,7 +237,7 @@ "certmanager_conflicting_nginx_file": "Impossible de preparar lo domeni pel desfís ACME : lo fichièr de configuracion nginx {filepath:s} es en conflicte e deu èsser levat d’en primièr", "certmanager_couldnt_fetch_intermediate_cert": "Expiracion del relambi pendent l’ensag de recuperacion del certificat intermediari dins de Let’s Encrypt. L’installacion / lo renovèlament es estat interromput - tornatz ensajar mai tard.", "certmanager_domain_not_resolved_locally": "Lo domeni {domain:s} pòt pas èsser determinat dins de vòstre servidor YunoHost. Pòt arribar s’avètz recentament modificat vòstre enregistrament DNS. Dins aqueste cas, mercés d’esperar unas oras per l’espandiment. Se lo problèma dura, consideratz ajustar {domain:s} a /etc/hosts. (Se sabètz çò que fasetz, utilizatz --no-checks per desactivar las verificacions.)", - "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let’S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", + "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let’S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_hit_rate_limit": "Tròp de certificats son ja estats demandats recentament per aqueste ensem de domeni {domain:s}. Mercés de tornar ensajar mai tard. Legissètz https://letsencrypt.org/docs/rate-limits/ per mai detalhs", "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via HTTP amb son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafòc/router amont de vòstre servidor es mal configurat.", "domain_dns_conf_is_just_a_recommendation": "Aqueste pagina mòstra la configuracion *recomandada*. Non configura *pas* lo DNS per vos. Sètz responsable de la configuracion de vòstra zòna DNS en çò de vòstre registrar DNS amb aquesta recomandacion.", @@ -254,12 +254,12 @@ "global_settings_setting_example_int": "Exemple d’opcion de tipe entièr", "global_settings_setting_example_string": "Exemple d’opcion de tipe cadena", "global_settings_unknown_type": "Situacion inesperada, la configuracion {setting:s} sembla d’aver lo tipe {unknown_type:s} mas es pas un tipe pres en carga pel sistèma.", - "hook_exec_failed": "Fracàs de l’execucion del script « {path:s} »", - "hook_exec_not_terminated": "L’execucion del escript « {path:s} » es pas acabada", + "hook_exec_failed": "Fracàs de l’execucion del script « {path:s} »", + "hook_exec_not_terminated": "L’execucion del escript « {path:s} » es pas acabada", "hook_list_by_invalid": "La proprietat de tria de las accions es invalida", - "hook_name_unknown": "Nom de script « {name:s} » desconegut", + "hook_name_unknown": "Nom de script « {name:s} » desconegut", "ldap_init_failed_to_create_admin": "L’inicializacion de LDAP a pas pogut crear l’utilizaire admin", - "mail_domain_unknown": "Lo domeni de corrièl « {domain:s} » es desconegut", + "mail_domain_unknown": "Lo domeni de corrièl « {domain:s} » es desconegut", "mailbox_used_space_dovecot_down": "Lo servici corrièl Dovecot deu èsser aviat, se volètz conéisser l’espaci ocupat per la messatjariá", "migrate_tsig_failed": "La migracion del domeni dyndns {domain} cap a hmac-sha512 a pas capitat, anullacion de las modificacions. Error : {error_code} - {error}", "migrate_tsig_wait": "Esperem 3 minutas que lo servidor dyndns prenga en compte la novèla clau…", @@ -271,19 +271,19 @@ "monitor_stats_file_not_found": "Lo fichièr d’estatisticas es introbabe", "monitor_stats_period_unavailable": "Cap d’estatisticas son pas disponiblas pel periòde", "mysql_db_init_failed": "Impossible d’inicializar la basa de donadas MySQL", - "service_disable_failed": "Impossible de desactivar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", - "service_disabled": "Lo servici « {service:s} » es desactivat", - "service_enable_failed": "Impossible d’activar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", - "service_enabled": "Lo servici « {service:s} » es activat", - "service_no_log": "Cap de jornal de far veire pel servici « {service:s} »", - "service_regenconf_dry_pending_applying": "Verificacion de las configuracions en espèra que poirián èsser aplicadas pel servici « {service} »…", + "service_disable_failed": "Impossible de desactivar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_disabled": "Lo servici « {service:s} » es desactivat", + "service_enable_failed": "Impossible d’activar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_enabled": "Lo servici « {service:s} » es activat", + "service_no_log": "Cap de jornal de far veire pel servici « {service:s} »", + "service_regenconf_dry_pending_applying": "Verificacion de las configuracions en espèra que poirián èsser aplicadas pel servici « {service} »…", "service_regenconf_failed": "Regeneracion impossibla de la configuracion pels servicis : {services}", - "service_regenconf_pending_applying": "Aplicacion de as configuraion en espèra pel servici « {service} »…", - "service_remove_failed": "Impossible de levar lo servici « {service:s} »", - "service_removed": "Lo servici « {service:s} » es estat levat", - "service_start_failed": "Impossible d’aviar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", - "service_started": "Lo servici « {service:s} » es aviat", - "service_stop_failed": "Impossible d’arrestar lo servici « {service:s} »↵\n\nJornals recents : {logs:s}", + "service_regenconf_pending_applying": "Aplicacion de as configuraion en espèra pel servici « {service} »…", + "service_remove_failed": "Impossible de levar lo servici « {service:s} »", + "service_removed": "Lo servici « {service:s} » es estat levat", + "service_start_failed": "Impossible d’aviar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", + "service_started": "Lo servici « {service:s} » es aviat", + "service_stop_failed": "Impossible d’arrestar lo servici « {service:s} »↵\n\nJornals recents : {logs:s}", "ssowat_conf_generated": "La configuracion SSowat es generada", "ssowat_conf_updated": "La configuracion SSOwat es estada actualizada", "system_upgraded": "Lo sistèma es estat actualizat", @@ -297,56 +297,56 @@ "user_deletion_failed": "Supression impossibla de l’utilizaire", "user_home_creation_failed": "Creacion impossibla del repertòri personal a l’utilizaire", "user_info_failed": "Recuperacion impossibla de las informacions tocant l’utilizaire", - "user_unknown": "Utilizaire « {user:s} » desconegut", + "user_unknown": "Utilizaire « {user:s} » desconegut", "user_update_failed": "Modificacion impossibla de l’utilizaire", "user_updated": "L’utilizaire es estat modificat", "yunohost_ca_creation_failed": "Creacion impossibla de l’autoritat de certificacion", "yunohost_ca_creation_success": "L’autoritat de certificacion locala es creada.", - "service_conf_file_kept_back": "Lo fichièr de configuracion « {conf} » deuriá èsser suprimit pel servici {service} mas es estat servat.", - "service_conf_file_manually_modified": "Lo fichièr de configuracion « {conf} » es estat modificat manualament e serà pas actualizat", - "service_conf_file_manually_removed": "Lo fichièr de configuracion « {conf} » es suprimit manualament e serà pas creat", - "service_conf_file_remove_failed": "Supression impossibla del fichièr de configuracion « {conf} »", - "service_conf_file_removed": "Lo fichièr de configuracion « {conf} » es suprimit", - "service_conf_file_updated": "Lo fichièr de configuracion « {conf} » es actualizat", - "service_conf_new_managed_file": "Lo servici {service} gerís ara lo fichièr de configuracion « {conf} ».", - "service_conf_up_to_date": "La configuracion del servici « {service} » es ja actualizada", - "service_conf_would_be_updated": "La configuracion del servici « {service} » seriá estada actualizada", + "service_conf_file_kept_back": "Lo fichièr de configuracion « {conf} » deuriá èsser suprimit pel servici {service} mas es estat servat.", + "service_conf_file_manually_modified": "Lo fichièr de configuracion « {conf} » es estat modificat manualament e serà pas actualizat", + "service_conf_file_manually_removed": "Lo fichièr de configuracion « {conf} » es suprimit manualament e serà pas creat", + "service_conf_file_remove_failed": "Supression impossibla del fichièr de configuracion « {conf} »", + "service_conf_file_removed": "Lo fichièr de configuracion « {conf} » es suprimit", + "service_conf_file_updated": "Lo fichièr de configuracion « {conf} » es actualizat", + "service_conf_new_managed_file": "Lo servici {service} gerís ara lo fichièr de configuracion « {conf} ».", + "service_conf_up_to_date": "La configuracion del servici « {service} » es ja actualizada", + "service_conf_would_be_updated": "La configuracion del servici « {service} » seriá estada actualizada", "service_description_avahi-daemon": "permet d’aténher vòstre servidr via yunohost.local sus vòstre ret local", "service_description_dnsmasq": "gerís la resolucion dels noms de domeni (DNS)", "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles...", - "service_conf_file_backed_up": "Lo fichièr de configuracion « {conf} » es salvagardat dins « {backup} »", - "service_conf_file_copy_failed": "Còpia impossibla del nòu fichièr de configuracion « {new} » cap a « {conf} »", + "service_conf_file_backed_up": "Lo fichièr de configuracion « {conf} » es salvagardat dins « {backup} »", + "service_conf_file_copy_failed": "Còpia impossibla del nòu fichièr de configuracion « {new} » cap a « {conf} »", "server_reboot_confirm": "Lo servidor es per reaviar sul pic, o volètz vertadièrament ? {answers:s}", - "service_add_failed": "Apondon impossible del servici « {service:s} »", - "service_added": "Lo servici « {service:s} » es ajustat", - "service_already_started": "Lo servici « {service:s} » es ja aviat", - "service_already_stopped": "Lo servici « {service:s} » es ja arrestat", + "service_add_failed": "Apondon impossible del servici « {service:s} »", + "service_added": "Lo servici « {service:s} » es ajustat", + "service_already_started": "Lo servici « {service:s} » es ja aviat", + "service_already_stopped": "Lo servici « {service:s} » es ja arrestat", "restore_cleaning_failed": "Impossible de netejar lo repertòri temporari de restauracion", "restore_complete": "Restauracion acabada", "restore_confirm_yunohost_installed": "Volètz vertadièrament restaurar un sistèma ja installat ? {answers:s}", "restore_extracting": "Extraccions dels fichièrs necessaris dins de l’archiu…", "restore_failed": "Impossible de restaurar lo sistèma", - "restore_hook_unavailable": "Lo script de restauracion « {part:s} » es pas disponible sus vòstre sistèma e es pas tampauc dins l’archiu", + "restore_hook_unavailable": "Lo script de restauracion « {part:s} » es pas disponible sus vòstre sistèma e es pas tampauc dins l’archiu", "restore_may_be_not_enough_disk_space": "Lo sistèma sembla d’aver pas pro d’espaci disponible (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", - "restore_mounting_archive": "Montatge de l’archiu dins « {path:s} »", + "restore_mounting_archive": "Montatge de l’archiu dins « {path:s} »", "restore_not_enough_disk_space": "Espaci disponible insufisent (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", "restore_nothings_done": "Res es pas estat restaurat", "restore_removing_tmp_dir_failed": "Impossible de levar u ancian repertòri temporari", - "restore_running_app_script": "Lançament del script de restauracion per l’aplicacion « {app:s} »…", + "restore_running_app_script": "Lançament del script de restauracion per l’aplicacion « {app:s} »…", "restore_running_hooks": "Execucion dels scripts de restauracion…", - "restore_system_part_failed": "Restauracion impossibla de la part « {part:s} » del sistèma", + "restore_system_part_failed": "Restauracion impossibla de la part « {part:s} » del sistèma", "server_shutdown": "Lo servidor serà atudat", "server_shutdown_confirm": "Lo servidor es per s’atudar sul pic, o volètz vertadièrament ? {answers:s}", "server_reboot": "Lo servidor es per reaviar", "network_check_mx_ko": "L’enregistrament DNS MX es pas especificat", "new_domain_required": "Vos cal especificar lo domeni màger", "no_ipv6_connectivity": "La connectivitat IPv6 es pas disponibla", - "not_enough_disk_space": "Espaci disc insufisent sus « {path:s} »", - "package_unexpected_error": "Una error inesperada es apareguda amb lo paquet « {pkgname} »", + "not_enough_disk_space": "Espaci disc insufisent sus « {path:s} »", + "package_unexpected_error": "Una error inesperada es apareguda amb lo paquet « {pkgname} »", "packages_upgrade_critical_later": "Los paquets critics {packages:s} seràn actualizats mai tard", "restore_action_required": "Devètz precisar çò que cal restaurar", - "service_cmd_exec_failed": "Impossible d’executar la comanda « {command:s} »", - "service_conf_updated": "La configuracion es estada actualizada pel servici « {service} »", + "service_cmd_exec_failed": "Impossible d’executar la comanda « {command:s} »", + "service_conf_updated": "La configuracion es estada actualizada pel servici « {service} »", "service_description_mysql": "garda las donadas de las aplicacions (base de donadas SQL)", "service_description_php5-fpm": "executa d’aplicacions escrichas en PHP amb nginx", "service_description_postfix": "emplegat per enviar e recebre de corrièls", @@ -361,30 +361,30 @@ "diagnosis_monitor_disk_error": "Impossible de supervisar los disques : {error}", "diagnosis_monitor_network_error": "Impossible de supervisar la ret : {error}", "diagnosis_monitor_system_error": "Impossible de supervisar lo sistèma : {error}", - "executing_command": "Execucion de la comanda « {command:s} »…", - "executing_script": "Execucion del script « {script:s} »…", + "executing_command": "Execucion de la comanda « {command:s} »…", + "executing_script": "Execucion del script « {script:s} »…", "global_settings_cant_serialize_settings": "Fracàs de la serializacion de las donadas de parametratge, rason : {reason:s}", "ip6tables_unavailable": "Podètz pas jogar amb ip6tables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", "iptables_unavailable": "Podètz pas jogar amb iptables aquí. Siá sèts dins un contenedor, siá vòstre nuclèu es pas compatible amb aquela opcion", "update_cache_failed": "Impossible d’actualizar lo cache de l’APT", - "mail_alias_remove_failed": "Supression impossibla de l’alias de corrièl « {mail:s} »", - "mail_forward_remove_failed": "Supression impossibla del corrièl de transferiment « {mail:s} »", - "migrate_tsig_start": "L’algorisme de generacion de claus es pas pro securizat per la signatura TSIG del domeni « {domain} », lançament de la migracion cap a hmac-sha512 que’s mai securizat", - "migration_description_0001_change_cert_group_to_sslcert": "Càmbia las permissions de grop dels certificats de « metronome » per « ssl-cert »", + "mail_alias_remove_failed": "Supression impossibla de l’alias de corrièl « {mail:s} »", + "mail_forward_remove_failed": "Supression impossibla del corrièl de transferiment « {mail:s} »", + "migrate_tsig_start": "L’algorisme de generacion de claus es pas pro securizat per la signatura TSIG del domeni « {domain} », lançament de la migracion cap a hmac-sha512 que’s mai securizat", + "migration_description_0001_change_cert_group_to_sslcert": "Càmbia las permissions de grop dels certificats de « metronome » per « ssl-cert »", "migration_0003_restoring_origin_nginx_conf": "Vòstre fichièr /etc/nginx/nginx.conf es estat modificat manualament. La migracion reïnicializarà d’en primièr son estat origina… Lo fichièr precedent serà disponible coma {backup_dest}.", "migration_0003_still_on_jessie_after_main_upgrade": "Quicòm a trucat pendent la mesa a nivèl màger : lo sistèma es encara jos Jessie ?!? Per trobar lo problèma, agachatz {log} …", "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.", "migration_0003_problematic_apps_warning": "Notatz que las aplicacions seguentas, saique problematicas, son estadas desactivadas. Semblan d’aver estadas installadas d’una lista d’aplicacions o que son pas marcadas coma «working ». En consequéncia, podèm pas assegurar que tendràn de foncionar aprèp la mesa a nivèl : {problematic_apps}", - "migrations_bad_value_for_target": "Nombre invalid pel paramètre « target », los numèros de migracion son 0 o {}", + "migrations_bad_value_for_target": "Nombre invalid pel paramètre « target », los numèros de migracion son 0 o {}", "migrations_migration_has_failed": "La migracion {number} {name} a pas capitat amb l’excepcion {exception}, anullacion", "migrations_skip_migration": "Passatge de la migracion {number} {name}…", - "migrations_to_be_ran_manually": "La migracion {number} {name} deu èsser lançada manualament. Mercés d’anar a Aisias > Migracion dins l’interfàcia admin, o lançar « yunohost tools migrations migrate ».", + "migrations_to_be_ran_manually": "La migracion {number} {name} deu èsser lançada manualament. Mercés d’anar a Aisias > Migracion dins l’interfàcia admin, o lançar « yunohost tools migrations migrate ».", "migrations_need_to_accept_disclaimer": "Per lançar la migracion {number} {name} , avètz d’acceptar aquesta clausa de non-responsabilitat :\n---\n{disclaimer}\n---\nS’acceptatz de lançar la migracion, mercés de tornar executar la comanda amb l’opcion accept-disclaimer.", "monitor_disabled": "La supervision del servidor es desactivada", "monitor_enabled": "La supervision del servidor es activada", "mysql_db_initialized": "La basa de donadas MySQL es estada inicializada", - "no_restore_script": "Lo script de salvagarda es pas estat trobat per l’aplicacion « {app:s} »", - "pattern_backup_archive_name": "Deu èsser un nom de fichièr valid compausat de 30 caractèrs alfanumerics al maximum e « -_. »", + "no_restore_script": "Lo script de salvagarda es pas estat trobat per l’aplicacion « {app:s} »", + "pattern_backup_archive_name": "Deu èsser un nom de fichièr valid compausat de 30 caractèrs alfanumerics al maximum e « -_. »", "pattern_listname": "Deu èsser compausat solament de caractèrs alfanumerics e de tirets basses", "service_description_dovecot": "permet als clients de messatjariá d’accedir/recuperar los corrièls (via IMAP e POP3)", "service_description_fail2ban": "protegís contra los atacs brute-force e d’autres atacs venents d’Internet", From 2f868f6c9cf1366e7f080acae3b23828e6a0e15d Mon Sep 17 00:00:00 2001 From: htmk Date: Wed, 30 May 2018 05:12:59 +0000 Subject: [PATCH 295/313] [i18n] Translated using Weblate (Portuguese) Currently translated at 29.4% (119 of 404 strings) --- locales/pt.json | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/locales/pt.json b/locales/pt.json index ee94b6352..1dddf2498 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -2,14 +2,14 @@ "action_invalid": "Acção Inválida '{action:s}'", "admin_password": "Senha de administração", "admin_password_change_failed": "Não foi possível alterar a senha", - "admin_password_changed": "Senha de administração alterada com êxito", + "admin_password_changed": "A palavra-passe de administração foi alterada com sucesso", "app_already_installed": "{app:s} já está instalada", "app_extraction_failed": "Não foi possível extrair os ficheiros para instalação", "app_id_invalid": "A ID da aplicação é inválida", "app_install_files_invalid": "Ficheiros para instalação corrompidos", - "app_location_already_used": "Já existe uma aplicação instalada neste diretório", - "app_location_install_failed": "Não é possível instalar a aplicação neste diretório", - "app_manifest_invalid": "Manifesto da aplicação inválido", + "app_location_already_used": "A aplicação {app} Já está instalada nesta localização ({path})", + "app_location_install_failed": "Não é possível instalar a aplicação neste diretório porque está em conflito com a aplicação '{other_app}', que já está instalada no diretório '{other_path}'", + "app_manifest_invalid": "Manifesto da aplicação inválido: {error}", "app_no_upgrade": "Não existem aplicações para atualizar", "app_not_installed": "{app:s} não está instalada", "app_recent_version_required": "{:s} requer uma versão mais recente da moulinette", @@ -145,10 +145,10 @@ "yunohost_configured": "YunoHost configurada com êxito", "yunohost_installing": "A instalar a YunoHost...", "yunohost_not_installed": "YunoHost ainda não está corretamente configurado. Por favor execute as 'ferramentas pós-instalação yunohost'.", - "app_incompatible": "A aplicação é incompatível com a sua versão de Yunohost", + "app_incompatible": "A aplicação {app} é incompatível com a sua versão de Yunohost", "app_not_correctly_installed": "{app:s} parece não estar corretamente instalada", "app_not_properly_removed": "{app:s} não foi corretamente removido", - "app_requirements_checking": "Verificando os pacotes necessários...", + "app_requirements_checking": "Verificando os pacotes necessários para {app}...", "app_unsupported_remote_type": "Remoto tipo utilizado para a aplicação não suportado", "backup_archive_app_not_found": "A aplicação '{app:s}' não foi encontrada no arquivo de backup", "backup_archive_broken_link": "Impossível acessar o arquivo de backup (link quebrado para {path:s} )", @@ -168,5 +168,9 @@ "app_argument_choice_invalid": "Escolha inválida para o argumento '{name:s}', deve ser um dos {choices:s}", "app_argument_invalid": "Valor inválido de argumento '{name:s}': {error:s}", "app_argument_required": "O argumento '{name:s}' é obrigatório", - "app_change_url_failed_nginx_reload": "Falha ao reiniciar o nginx. Aqui está o retorno de 'nginx -t':\n{nginx_errors:s}" + "app_change_url_failed_nginx_reload": "Falha ao reiniciar o nginx. Aqui está o retorno de 'nginx -t':\n{nginx_errors:s}", + "app_change_no_change_url_script": "A aplicação {app_name:s} ainda não permite mudança da URL, talvez seja necessário atualiza-la.", + "app_location_unavailable": "Esta url não está disponível ou está em conflito com outra aplicação já instalada", + "app_package_need_update": "O pacote da aplicação {app} precisa ser atualizado para aderir as mudanças do YunoHost", + "app_requirements_failed": "Não foi possível atender às requisições da aplicação {app}: {error}" } From f46b12ac340ebd585c28e839f109c8ce51e846da Mon Sep 17 00:00:00 2001 From: htmk Date: Wed, 30 May 2018 05:33:58 +0000 Subject: [PATCH 296/313] [i18n] Translated using Weblate (Portuguese) Currently translated at 29.9% (121 of 404 strings) --- locales/pt.json | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/locales/pt.json b/locales/pt.json index 1dddf2498..e701288c6 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -14,9 +14,9 @@ "app_not_installed": "{app:s} não está instalada", "app_recent_version_required": "{:s} requer uma versão mais recente da moulinette", "app_removed": "{app:s} removida com êxito", - "app_sources_fetch_failed": "Impossível obter os ficheiros fonte", + "app_sources_fetch_failed": "Incapaz obter os ficheiros fonte", "app_unknown": "Aplicação desconhecida", - "app_upgrade_failed": "Impossível atualizar {app:s}", + "app_upgrade_failed": "Impossibilitado de atualizar {app:s}", "app_upgraded": "{app:s} atualizada com sucesso", "appslist_fetched": "Lista de aplicações processada com sucesso", "appslist_removed": "Lista de aplicações removida com sucesso", @@ -149,7 +149,7 @@ "app_not_correctly_installed": "{app:s} parece não estar corretamente instalada", "app_not_properly_removed": "{app:s} não foi corretamente removido", "app_requirements_checking": "Verificando os pacotes necessários para {app}...", - "app_unsupported_remote_type": "Remoto tipo utilizado para a aplicação não suportado", + "app_unsupported_remote_type": "A aplicação não possui suporte ao tipo remoto utilizado", "backup_archive_app_not_found": "A aplicação '{app:s}' não foi encontrada no arquivo de backup", "backup_archive_broken_link": "Impossível acessar o arquivo de backup (link quebrado para {path:s} )", "backup_archive_hook_not_exec": "O gancho '{hook:s}' não foi executado neste backup", @@ -172,5 +172,7 @@ "app_change_no_change_url_script": "A aplicação {app_name:s} ainda não permite mudança da URL, talvez seja necessário atualiza-la.", "app_location_unavailable": "Esta url não está disponível ou está em conflito com outra aplicação já instalada", "app_package_need_update": "O pacote da aplicação {app} precisa ser atualizado para aderir as mudanças do YunoHost", - "app_requirements_failed": "Não foi possível atender às requisições da aplicação {app}: {error}" + "app_requirements_failed": "Não foi possível atender aos requisitos da aplicação {app}: {error}", + "app_upgrade_app_name": "Atualizando aplicação {app}…", + "app_upgrade_some_app_failed": "Não foi possível atualizar algumas aplicações" } From c72aa4fbff16cb606f4bfeb7cbfd3360dcc405aa Mon Sep 17 00:00:00 2001 From: htmk Date: Wed, 30 May 2018 05:47:13 +0000 Subject: [PATCH 297/313] [i18n] Translated using Weblate (Portuguese) Currently translated at 32.1% (130 of 404 strings) --- locales/pt.json | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/locales/pt.json b/locales/pt.json index e701288c6..61a88eb98 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -16,17 +16,17 @@ "app_removed": "{app:s} removida com êxito", "app_sources_fetch_failed": "Incapaz obter os ficheiros fonte", "app_unknown": "Aplicação desconhecida", - "app_upgrade_failed": "Impossibilitado de atualizar {app:s}", + "app_upgrade_failed": "Não foi possível atualizar {app:s}", "app_upgraded": "{app:s} atualizada com sucesso", - "appslist_fetched": "Lista de aplicações processada com sucesso", - "appslist_removed": "Lista de aplicações removida com sucesso", - "appslist_retrieve_error": "Não foi possível obter a lista de aplicações remotas", - "appslist_unknown": "Lista de aplicaçoes desconhecida", - "ask_current_admin_password": "Senha de administração atual", - "ask_email": "Correio eletrónico", + "appslist_fetched": "A lista de aplicações, {appslist:s}, foi trazida com sucesso", + "appslist_removed": "A Lista de aplicações {appslist:s} foi removida", + "appslist_retrieve_error": "Não foi possível obter a lista de aplicações remotas {appslist:s}: {error:s}", + "appslist_unknown": "Desconhece-se a lista de aplicaçoes {appslist:s}.", + "ask_current_admin_password": "Senha atual da administração", + "ask_email": "Endereço de Email", "ask_firstname": "Primeiro nome", "ask_lastname": "Último nome", - "ask_list_to_remove": "Lista para remover", + "ask_list_to_remove": "Lista à remover", "ask_main_domain": "Domínio principal", "ask_new_admin_password": "Senha de administração nova", "ask_password": "Senha", @@ -174,5 +174,10 @@ "app_package_need_update": "O pacote da aplicação {app} precisa ser atualizado para aderir as mudanças do YunoHost", "app_requirements_failed": "Não foi possível atender aos requisitos da aplicação {app}: {error}", "app_upgrade_app_name": "Atualizando aplicação {app}…", - "app_upgrade_some_app_failed": "Não foi possível atualizar algumas aplicações" + "app_upgrade_some_app_failed": "Não foi possível atualizar algumas aplicações", + "appslist_corrupted_json": "Falha ao carregar a lista de aplicações. O arquivo {filename:s} aparenta estar corrompido.", + "appslist_migrating": "Migando lista de aplicações {appslist:s}…", + "appslist_name_already_tracked": "Já existe uma lista de aplicações registrada com o nome {name:s}.", + "appslist_retrieve_bad_format": "O arquivo recuperado para a lista de aplicações {appslist:s} é invalido", + "appslist_url_already_tracked": "Já existe uma lista de aplicações registrada com a url {url:s}." } From 4fe8c7430db2e5abc765ca11a22c653c9f176db4 Mon Sep 17 00:00:00 2001 From: htmk Date: Wed, 30 May 2018 06:02:13 +0000 Subject: [PATCH 298/313] [i18n] Translated using Weblate (Portuguese) Currently translated at 33.1% (134 of 404 strings) --- locales/pt.json | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/locales/pt.json b/locales/pt.json index 61a88eb98..0595ff107 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -26,9 +26,9 @@ "ask_email": "Endereço de Email", "ask_firstname": "Primeiro nome", "ask_lastname": "Último nome", - "ask_list_to_remove": "Lista à remover", + "ask_list_to_remove": "Lista para remover", "ask_main_domain": "Domínio principal", - "ask_new_admin_password": "Senha de administração nova", + "ask_new_admin_password": "Nova senha de administração", "ask_password": "Senha", "backup_created": "Backup completo", "backup_creating_archive": "A criar ficheiro de backup...", @@ -179,5 +179,9 @@ "appslist_migrating": "Migando lista de aplicações {appslist:s}…", "appslist_name_already_tracked": "Já existe uma lista de aplicações registrada com o nome {name:s}.", "appslist_retrieve_bad_format": "O arquivo recuperado para a lista de aplicações {appslist:s} é invalido", - "appslist_url_already_tracked": "Já existe uma lista de aplicações registrada com a url {url:s}." + "appslist_url_already_tracked": "Já existe uma lista de aplicações registrada com a url {url:s}.", + "ask_path": "Caminho", + "backup_abstract_method": "Este metodo de backup ainda não foi implementado", + "backup_action_required": "Deve-se especificar algo a salvar", + "backup_app_failed": "Não foi possível de fazer o backup dos aplicativos '{app:s}'" } From 414f9db5c33e85650d88bee513a4be9913b0ecb8 Mon Sep 17 00:00:00 2001 From: htmk Date: Wed, 30 May 2018 06:05:34 +0000 Subject: [PATCH 299/313] [i18n] Translated using Weblate (Portuguese) Currently translated at 35.1% (142 of 404 strings) --- locales/pt.json | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/locales/pt.json b/locales/pt.json index 0595ff107..e024b6787 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -151,11 +151,11 @@ "app_requirements_checking": "Verificando os pacotes necessários para {app}...", "app_unsupported_remote_type": "A aplicação não possui suporte ao tipo remoto utilizado", "backup_archive_app_not_found": "A aplicação '{app:s}' não foi encontrada no arquivo de backup", - "backup_archive_broken_link": "Impossível acessar o arquivo de backup (link quebrado para {path:s} )", + "backup_archive_broken_link": "Impossível acessar o arquivo de backup (link quebrado ao {path:s})", "backup_archive_hook_not_exec": "O gancho '{hook:s}' não foi executado neste backup", "backup_archive_name_exists": "O nome do arquivo de backup já existe", - "backup_archive_open_failed": "Impossível abrir o arquivo de backup", - "backup_cleaning_failed": "Impossível apagar o diretório temporário de backup", + "backup_archive_open_failed": "Não é possível abrir o arquivo de backup", + "backup_cleaning_failed": "Não é possível limpar a pasta de backup temporário", "backup_creation_failed": "A criação do backup falhou", "backup_delete_error": "Impossível apagar '{path:s}'", "backup_deleted": "O backup foi suprimido", @@ -183,5 +183,13 @@ "ask_path": "Caminho", "backup_abstract_method": "Este metodo de backup ainda não foi implementado", "backup_action_required": "Deve-se especificar algo a salvar", - "backup_app_failed": "Não foi possível de fazer o backup dos aplicativos '{app:s}'" + "backup_app_failed": "Não foi possível fazer o backup dos aplicativos '{app:s}'", + "backup_applying_method_custom": "Chamando o metodo personalizado de backup '{method:s}'…", + "backup_applying_method_tar": "Criando o arquivo tar de backup…", + "backup_archive_mount_failed": "Falha ao montar o arquivo de backup", + "backup_archive_name_unknown": "Desconhece-se o arquivo local de backup de nome '{name:s}'", + "backup_archive_system_part_not_available": "A seção do sistema '{part:s}' está indisponivel neste backup", + "backup_ask_for_copying_if_needed": "Alguns arquivos não consiguiram ser preparados para backup utilizando o metodo que não gasta espaço de disco temporariamente. Para realizar o backup {size:s}MB precisam ser usados temporariamente. Você concorda?", + "backup_borg_not_implemented": "O método de backup Borg ainda não foi implementado.", + "backup_cant_mount_uncompress_archive": "Não foi possível montar em modo leitura o diretorio de arquivos não comprimido" } From 8fd75ea014235deb6c320afefa366fa3f9edca28 Mon Sep 17 00:00:00 2001 From: Quenti Date: Wed, 30 May 2018 17:11:22 +0000 Subject: [PATCH 300/313] [i18n] Translated using Weblate (Occitan) Currently translated at 100.0% (404 of 404 strings) --- locales/oc.json | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index 20686ade6..f5f9f911d 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -39,7 +39,7 @@ "backup_applying_method_tar": "Creacion de l’archiu tar de la salvagarda…", "backup_archive_name_exists": "Un archiu de salvagarda amb aquesta nom existís ja", "backup_archive_name_unknown": "L’archiu local de salvagarda apelat « {name:s} » es desconegut", - "action_invalid": "Accion « {action:s} » incorrècte", + "action_invalid": "Accion « {action:s} » incorrècta", "app_argument_choice_invalid": "Causida invalida pel paramètre « {name:s} », cal que siá un de {choices:s}", "app_argument_invalid": "Valor invalida pel paramètre « {name:s} » : {error:s}", "app_argument_required": "Lo paramètre « {name:s} » es requesit", @@ -99,7 +99,7 @@ "backup_method_custom_finished": "Lo metòde de salvagarda personalizat « {method:s} » es acabat", "backup_nothings_done": "I a pas res de salvagardar", "backup_unable_to_organize_files": "Impossible d’organizar los fichièrs dins l’archiu amb lo metòde rapid", - "service_status_failed": "Impossible dedeterminar l’estat del servici « {service:s} »", + "service_status_failed": "Impossible de determinar l’estat del servici « {service:s} »", "service_stopped": "Lo servici « {service:s} » es estat arrestat", "service_unknown": "Servici « {service:s} » desconegut", "unbackup_app": "L’aplicacion « {app:s} » serà pas salvagardada", @@ -125,9 +125,9 @@ "certmanager_cannot_read_cert": "Quicòm a trucat en ensajar de dobrir lo certificat actual pel domeni {domain:s} (fichièr : {file:s}), rason : {reason:s}", "certmanager_cert_install_success": "Installacion capitada del certificat Let’s Encrypt pel domeni {domain:s} !", "certmanager_cert_install_success_selfsigned": "Installacion capitada del certificat auto-signat pel domeni {domain:s} !", - "certmanager_cert_signing_failed": "Fracàs de la signatura del noù certificat", + "certmanager_cert_signing_failed": "Fracàs de la signatura del nòu certificat", "certmanager_domain_cert_not_selfsigned": "Lo certificat del domeni {domain:s} es pas auto-signat. Volètz vertadièrament lo remplaçar ? (Utiliatz --force)", - "certmanager_domain_dns_ip_differs_from_public_ip": "L’enregistrament DNS « A » del domeni {domain:s} es diferent de l’adreça IP d’aqueste servidor. Se fa pauc qu’avètz modificat l’enregistrament « A », mercés d’esperar l’espandiment (qualques verificadors d’espandiment son disponibles en linha). (Se sabètz ço que fasèm, utilizatz --no-checks per desactivar aqueles contraròtles)", + "certmanager_domain_dns_ip_differs_from_public_ip": "L’enregistrament DNS « A » del domeni {domain:s} es diferent de l’adreça IP d’aqueste servidor. Se fa pauc qu’avètz modificat l’enregistrament « A », mercés d’esperar l’espandiment (qualques verificadors d’espandiment son disponibles en linha). (Se sabètz çò que fasèm, utilizatz --no-checks per desactivar aqueles contraròtles)", "certmanager_domain_http_not_working": "Sembla que lo domeni {domain:s} es pas accessible via HTTP. Mercés de verificar que las configuracions DNS e nginx son corrèctas", "certmanager_domain_unknown": "Domeni desconegut {domain:s}", "certmanager_no_cert_file": "Lectura impossibla del fichièr del certificat pel domeni {domain:s} (fichièr : {file:s})", @@ -175,7 +175,7 @@ "global_settings_key_doesnt_exists": "La clau « {settings_key:s} » existís pas dins las configuracions globalas, podètz veire totas las claus disponiblas en picant « yunohost settings list »", "global_settings_reset_success": "Capitada ! Vòstra configuracion precedenta es estada salvagarda dins {path:s}", "global_settings_setting_example_bool": "Exemple d’opcion booleana", - "global_settings_unknown_setting_from_settings_file": "Clau desconeguda dins los paramètres : {setting_key:s}, apartat e salvagardat dins /etc/yunohost/unkown_settings.json", + "global_settings_unknown_setting_from_settings_file": "Clau desconeguda dins los paramètres : {setting_key:s}, apartada e salvagardada dins /etc/yunohost/unkown_settings.json", "installation_failed": "Fracàs de l’installacion", "invalid_url_format": "Format d’URL pas valid", "ldap_initialized": "L’annuari LDAP es inicializat", @@ -207,7 +207,7 @@ "monitor_stats_no_update": "Cap de donadas d’estat del servidor d’actualizar", "mountpoint_unknown": "Ponch de montatge desconegut", "mysql_db_creation_failed": "Creacion de la basa de donadas MySQL impossibla", - "no_appslist_found": "Cap de lista d’aplicacions pas trobaba", + "no_appslist_found": "Cap de lista d’aplicacions pas trobada", "no_internet_connection": "Lo servidor es pas connectat a Internet", "package_not_installed": "Lo paquet « {pkgname} » es pas installat", "package_unknown": "Paquet « {pkgname} » desconegut", @@ -236,7 +236,7 @@ "certmanager_certificate_fetching_or_enabling_failed": "Sembla d’aver fracassat l’activacion d’un nòu certificat per {domain:s}…", "certmanager_conflicting_nginx_file": "Impossible de preparar lo domeni pel desfís ACME : lo fichièr de configuracion nginx {filepath:s} es en conflicte e deu èsser levat d’en primièr", "certmanager_couldnt_fetch_intermediate_cert": "Expiracion del relambi pendent l’ensag de recuperacion del certificat intermediari dins de Let’s Encrypt. L’installacion / lo renovèlament es estat interromput - tornatz ensajar mai tard.", - "certmanager_domain_not_resolved_locally": "Lo domeni {domain:s} pòt pas èsser determinat dins de vòstre servidor YunoHost. Pòt arribar s’avètz recentament modificat vòstre enregistrament DNS. Dins aqueste cas, mercés d’esperar unas oras per l’espandiment. Se lo problèma dura, consideratz ajustar {domain:s} a /etc/hosts. (Se sabètz çò que fasetz, utilizatz --no-checks per desactivar las verificacions.)", + "certmanager_domain_not_resolved_locally": "Lo domeni {domain:s} pòt pas èsser determinat dins de vòstre servidor YunoHost. Pòt arribar s’avètz recentament modificat vòstre enregistrament DNS. Dins aqueste cas, mercés d’esperar unas oras per l’espandiment. Se lo problèma dura, consideratz ajustar {domain:s} a /etc/hosts. (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let’S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_hit_rate_limit": "Tròp de certificats son ja estats demandats recentament per aqueste ensem de domeni {domain:s}. Mercés de tornar ensajar mai tard. Legissètz https://letsencrypt.org/docs/rate-limits/ per mai detalhs", "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via HTTP amb son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafòc/router amont de vòstre servidor es mal configurat.", @@ -268,7 +268,7 @@ "migration_0003_system_not_fully_up_to_date": "Lo sistèma es pas complètament a jorn. Mercés de lançar una mesa a jorn classica abans de començar la migracion per Stretch.", "migration_0003_modified_files": "Mercés de notar que los fichièrs seguents son estats detectats coma modificats manualament e poiràn èsser escafats a la fin de la mesa a nivèl : {manually_modified_files}", "monitor_period_invalid": "Lo periòde de temps es incorrècte", - "monitor_stats_file_not_found": "Lo fichièr d’estatisticas es introbabe", + "monitor_stats_file_not_found": "Lo fichièr d’estatisticas es introbable", "monitor_stats_period_unavailable": "Cap d’estatisticas son pas disponiblas pel periòde", "mysql_db_init_failed": "Impossible d’inicializar la basa de donadas MySQL", "service_disable_failed": "Impossible de desactivar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", @@ -278,7 +278,7 @@ "service_no_log": "Cap de jornal de far veire pel servici « {service:s} »", "service_regenconf_dry_pending_applying": "Verificacion de las configuracions en espèra que poirián èsser aplicadas pel servici « {service} »…", "service_regenconf_failed": "Regeneracion impossibla de la configuracion pels servicis : {services}", - "service_regenconf_pending_applying": "Aplicacion de as configuraion en espèra pel servici « {service} »…", + "service_regenconf_pending_applying": "Aplicacion de las configuracions en espèra pel servici « {service} »…", "service_remove_failed": "Impossible de levar lo servici « {service:s} »", "service_removed": "Lo servici « {service:s} » es estat levat", "service_start_failed": "Impossible d’aviar lo servici « {service:s} »↵\n↵\nJornals recents : {logs:s}", @@ -311,7 +311,7 @@ "service_conf_new_managed_file": "Lo servici {service} gerís ara lo fichièr de configuracion « {conf} ».", "service_conf_up_to_date": "La configuracion del servici « {service} » es ja actualizada", "service_conf_would_be_updated": "La configuracion del servici « {service} » seriá estada actualizada", - "service_description_avahi-daemon": "permet d’aténher vòstre servidr via yunohost.local sus vòstre ret local", + "service_description_avahi-daemon": "permet d’aténher vòstre servidor via yunohost.local sus vòstre ret local", "service_description_dnsmasq": "gerís la resolucion dels noms de domeni (DNS)", "updating_apt_cache": "Actualizacion de la lista dels paquets disponibles...", "service_conf_file_backed_up": "Lo fichièr de configuracion « {conf} » es salvagardat dins « {backup} »", @@ -326,7 +326,7 @@ "restore_confirm_yunohost_installed": "Volètz vertadièrament restaurar un sistèma ja installat ? {answers:s}", "restore_extracting": "Extraccions dels fichièrs necessaris dins de l’archiu…", "restore_failed": "Impossible de restaurar lo sistèma", - "restore_hook_unavailable": "Lo script de restauracion « {part:s} » es pas disponible sus vòstre sistèma e es pas tampauc dins l’archiu", + "restore_hook_unavailable": "Lo script de restauracion « {part:s} » es pas disponible sus vòstre sistèma e es pas tanpauc dins l’archiu", "restore_may_be_not_enough_disk_space": "Lo sistèma sembla d’aver pas pro d’espaci disponible (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", "restore_mounting_archive": "Montatge de l’archiu dins « {path:s} »", "restore_not_enough_disk_space": "Espaci disponible insufisent (liure : {free_space:d} octets, necessari : {needed_space:d} octets, marge de seguretat : {margin:d} octets)", @@ -355,7 +355,7 @@ "service_description_ssh": "vos permet de vos connectar a distància a vòstre servidor via un teminal (protocòl SSH)", "service_description_yunohost-api": "permet las interaccions entre l’interfàcia web de YunoHost e le sistèma", "service_description_yunohost-firewall": "gerís los pòrts de connexion dobèrts e tampats als servicis", - "ssowat_persistent_conf_read_error": "Error en ligir la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", + "ssowat_persistent_conf_read_error": "Error en legir la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", "ssowat_persistent_conf_write_error": "Error en salvagardar la configuracion duradissa de SSOwat : {error:s}. Modificatz lo fichièr /etc/ssowat/conf.json.persistent per reparar la sintaxi JSON", "certmanager_old_letsencrypt_app_detected": "\nYunohost a detectat que l’aplicacion ’letsencrypt’ es installada, aquò es en conflicte amb las novèlas foncionalitats integradas de gestion dels certificats de Yunohost. Se volètz utilizar aquelas foncionalitats integradas, mercés de lançar las comandas seguentas per migrar vòstra installacion :\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B. : aquò provarà de tornar installar los certificats de totes los domenis amb un certificat Let’s Encrypt o las auto-signats", "diagnosis_monitor_disk_error": "Impossible de supervisar los disques : {error}", @@ -378,7 +378,7 @@ "migrations_bad_value_for_target": "Nombre invalid pel paramètre « target », los numèros de migracion son 0 o {}", "migrations_migration_has_failed": "La migracion {number} {name} a pas capitat amb l’excepcion {exception}, anullacion", "migrations_skip_migration": "Passatge de la migracion {number} {name}…", - "migrations_to_be_ran_manually": "La migracion {number} {name} deu èsser lançada manualament. Mercés d’anar a Aisias > Migracion dins l’interfàcia admin, o lançar « yunohost tools migrations migrate ».", + "migrations_to_be_ran_manually": "La migracion {number} {name} deu èsser lançada manualament. Mercés d’anar a Aisinas > Migracion dins l’interfàcia admin, o lançar « yunohost tools migrations migrate ».", "migrations_need_to_accept_disclaimer": "Per lançar la migracion {number} {name} , avètz d’acceptar aquesta clausa de non-responsabilitat :\n---\n{disclaimer}\n---\nS’acceptatz de lançar la migracion, mercés de tornar executar la comanda amb l’opcion accept-disclaimer.", "monitor_disabled": "La supervision del servidor es desactivada", "monitor_enabled": "La supervision del servidor es activada", From e59f1427d2790c41183fa144db3721aad3116598 Mon Sep 17 00:00:00 2001 From: Quenti Date: Wed, 30 May 2018 17:48:04 +0000 Subject: [PATCH 301/313] [i18n] Translated using Weblate (Occitan) Currently translated at 100.0% (404 of 404 strings) --- locales/oc.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/locales/oc.json b/locales/oc.json index f5f9f911d..979afcd13 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -239,14 +239,14 @@ "certmanager_domain_not_resolved_locally": "Lo domeni {domain:s} pòt pas èsser determinat dins de vòstre servidor YunoHost. Pòt arribar s’avètz recentament modificat vòstre enregistrament DNS. Dins aqueste cas, mercés d’esperar unas oras per l’espandiment. Se lo problèma dura, consideratz ajustar {domain:s} a /etc/hosts. (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_error_no_A_record": "Cap d’enregistrament DNS « A » pas trobat per {domain:s}. Vos cal indicar que lo nom de domeni mene a vòstra maquina per poder installar un certificat Let’S Encrypt ! (Se sabètz çò que fasètz, utilizatz --no-checks per desactivar las verificacions.)", "certmanager_hit_rate_limit": "Tròp de certificats son ja estats demandats recentament per aqueste ensem de domeni {domain:s}. Mercés de tornar ensajar mai tard. Legissètz https://letsencrypt.org/docs/rate-limits/ per mai detalhs", - "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via HTTP amb son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafòc/router amont de vòstre servidor es mal configurat.", + "certmanager_http_check_timeout": "Expiracion del relambi d’ensag del servidor de se contactar via HTTP amb son adreça IP publica {domain:s} amb l’adreça {ip:s}. Coneissètz benlèu de problèmas d’hairpinning o lo parafuòc/router amont de vòstre servidor es mal configurat.", "domain_dns_conf_is_just_a_recommendation": "Aqueste pagina mòstra la configuracion *recomandada*. Non configura *pas* lo DNS per vos. Sètz responsable de la configuracion de vòstra zòna DNS en çò de vòstre registrar DNS amb aquesta recomandacion.", "domain_dyndns_already_subscribed": "Avètz ja soscrich a un domeni DynDNS", "domain_dyndns_dynette_is_unreachable": "Impossible de contactar la dynette YunoHost, siá YunoHost pas es pas corrèctament connectat a Internet, siá lo servidor de la dynett es arrestat. Error : {error}", "domain_uninstall_app_first": "Una o mantuna aplicacions son installadas sus aqueste domeni. Mercés de las desinstallar d’en primièr abans de suprimir aqueste domeni", - "firewall_reload_failed": "Impossible de recargar lo parafòc", - "firewall_reloaded": "Lo parafòc es estat recargat", - "firewall_rules_cmd_failed": "Unas règlas del parafòc an fracassat. Per mai informacions, consultatz lo jornal.", + "firewall_reload_failed": "Impossible de recargar lo parafuòc", + "firewall_reloaded": "Lo parafuòc es estat recargat", + "firewall_rules_cmd_failed": "Unas règlas del parafuòc an fracassat. Per mai informacions, consultatz lo jornal.", "global_settings_bad_choice_for_enum": "La valor del paramètre {setting:s} es incorrècta. Recebut : {received_type:s}, esperat {expected_type:s}", "global_settings_bad_type_for_setting": "Lo tipe del paramètre {setting:s} es incorrècte. Recebut : {received_type:s}, esperat {expected_type:s}", "global_settings_cant_write_settings": "Fracàs de l’escritura del fichièr de configuracion, rason : {reason:s}", From 5f4a38818365df20847034f377655de757c2d113 Mon Sep 17 00:00:00 2001 From: htmk Date: Wed, 30 May 2018 06:25:44 +0000 Subject: [PATCH 302/313] [i18n] Translated using Weblate (Portuguese) Currently translated at 35.3% (143 of 404 strings) --- locales/pt.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/locales/pt.json b/locales/pt.json index e024b6787..e1db1c618 100644 --- a/locales/pt.json +++ b/locales/pt.json @@ -155,7 +155,7 @@ "backup_archive_hook_not_exec": "O gancho '{hook:s}' não foi executado neste backup", "backup_archive_name_exists": "O nome do arquivo de backup já existe", "backup_archive_open_failed": "Não é possível abrir o arquivo de backup", - "backup_cleaning_failed": "Não é possível limpar a pasta de backup temporário", + "backup_cleaning_failed": "Não é possível limpar a pasta temporária de backups", "backup_creation_failed": "A criação do backup falhou", "backup_delete_error": "Impossível apagar '{path:s}'", "backup_deleted": "O backup foi suprimido", @@ -191,5 +191,6 @@ "backup_archive_system_part_not_available": "A seção do sistema '{part:s}' está indisponivel neste backup", "backup_ask_for_copying_if_needed": "Alguns arquivos não consiguiram ser preparados para backup utilizando o metodo que não gasta espaço de disco temporariamente. Para realizar o backup {size:s}MB precisam ser usados temporariamente. Você concorda?", "backup_borg_not_implemented": "O método de backup Borg ainda não foi implementado.", - "backup_cant_mount_uncompress_archive": "Não foi possível montar em modo leitura o diretorio de arquivos não comprimido" + "backup_cant_mount_uncompress_archive": "Não foi possível montar em modo leitura o diretorio de arquivos não comprimido", + "backup_copying_to_organize_the_archive": "Copiando {size:s}MB para organizar o arquivo" } From 577cd2c85834227c8de75bf0ea6c81321c65c89a Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Wed, 30 May 2018 20:17:29 +0000 Subject: [PATCH 303/313] [i18n] Translated using Weblate (Arabic) Currently translated at 91.8% (371 of 404 strings) --- locales/ar.json | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index d2bc735f2..2ec29d7e7 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -16,7 +16,7 @@ "app_change_url_success": "Successfully changed {app:s} url to {domain:s}{path:s}", "app_extraction_failed": "Unable to extract installation files", "app_id_invalid": "Invalid app id", - "app_incompatible": "The app {app} is incompatible with your YunoHost version", + "app_incompatible": "إن التطبيق {app} غير متوافق مع إصدار واي يونوهوست YunoHost الخاص بك", "app_install_files_invalid": "Invalid installation files", "app_location_already_used": "The app '{app}' is already installed on that location ({path})", "app_make_default_location_already_used": "Can't make the app '{app}' the default on the domain {domain} is already used by the other app '{other_app}'", @@ -26,7 +26,7 @@ "app_no_upgrade": "البرمجيات لا تحتاج إلى تحديث", "app_not_correctly_installed": "يبدو أن التطبيق {app:s} لم يتم تنصيبه بشكل صحيح", "app_not_installed": "إنّ التطبيق {app:s} غير مُنصَّب", - "app_not_properly_removed": "{app:s} has not been properly removed", + "app_not_properly_removed": "لم يتم حذف تطبيق {app:s} بشكلٍ جيّد", "app_package_need_update": "The app {app} package needs to be updated to follow YunoHost changes", "app_removed": "تمت إزالة تطبيق {app:s}", "app_requirements_checking": "Checking required packages for {app}...", @@ -129,7 +129,7 @@ "certmanager_hit_rate_limit": "Too many certificates already issued for exact set of domains {domain:s} recently. Please try again later. See https://letsencrypt.org/docs/rate-limits/ for more details", "certmanager_http_check_timeout": "Timed out when server tried to contact itself through HTTP using public IP address (domain {domain:s} with ip {ip:s}). You may be experiencing hairpinning issue or the firewall/router ahead of your server is misconfigured.", "certmanager_no_cert_file": "تعذرت عملية قراءة شهادة نطاق {domain:s} (الملف : {file:s})", - "certmanager_old_letsencrypt_app_detected": "\nYunohost detected that the 'letsencrypt' app is installed, which conflits with the new built-in certificate management features in Yunohost. If you wish to use the new built-in features, please run the following commands to migrate your installation:\n\n yunohost app remove letsencrypt\n yunohost domain cert-install\n\nN.B.: this will attempt to re-install certificates for all domains with a Let's Encrypt certificate or self-signed certificate", + "certmanager_old_letsencrypt_app_detected": "", "certmanager_self_ca_conf_file_not_found": "Configuration file not found for self-signing authority (file: {file:s})", "certmanager_unable_to_parse_self_CA_name": "Unable to parse name of self-signing authority (file: {file:s})", "custom_app_url_required": "You must provide a URL to upgrade your custom app {app:s}", @@ -324,7 +324,7 @@ "service_regenconf_failed": "Unable to regenerate the configuration for service(s): {services}", "service_regenconf_pending_applying": "Applying pending configuration for service '{service}'...", "service_remove_failed": "Unable to remove service '{service:s}'", - "service_removed": "The service '{service:s}' has been removed", + "service_removed": "تمت إزالة خدمة '{service:s}'", "service_start_failed": "", "service_started": "The service '{service:s}' has been started", "service_status_failed": "Unable to determine status of service '{service:s}'", @@ -364,10 +364,21 @@ "yunohost_ca_creation_success": "تم إنشاء هيئة الشهادات المحلية.", "yunohost_configured": "YunoHost has been configured", "yunohost_installing": "عملية تنصيب يونوهوست جارية …", - "yunohost_not_installed": "YunoHost is not or not correctly installed. Please execute 'yunohost tools postinstall'", + "yunohost_not_installed": "إنَّ واي يونوهوست ليس مُنَصَّب أو هو مثبت حاليا بشكل خاطئ. قم بتنفيذ الأمر 'yunohost tools postinstall'", "migration_description_0003_migrate_to_stretch": "تحديث النظام إلى ديبيان ستريتش و واي يونوهوست 3.0", "migration_0003_patching_sources_list": "عملية تعديل ملف المصادر sources.lists جارية ...", "migration_0003_main_upgrade": "بداية عملية التحديث الأساسية ...", "migration_0003_fail2ban_upgrade": "بداية عملية تحديث fail2ban ...", - "migration_0003_not_jessie": "إن توزيعة ديبيان الحالية تختلف عن جيسي !" + "migration_0003_not_jessie": "إن توزيعة ديبيان الحالية تختلف عن جيسي !", + "migration_description_0002_migrate_to_tsig_sha256": "يقوم بتحسين أمان TSIG لنظام أسماء النطاقات الديناميكة باستخدام SHA512 بدلًا مِن MD5", + "migration_0003_backward_impossible": "لا يُمكن إلغاء عملية الإنتقال إلى ستريتش.", + "migration_0003_system_not_fully_up_to_date": "إنّ نظامك غير مُحدَّث بعدُ لذا يرجى القيام بتحديث عادي أولا قبل إطلاق إجراء الإنتقال إلى نظام ستريتش.", + "migrations_list_conflict_pending_done": "لا يمكنك استخدام --previous و --done معًا على نفس سطر الأوامر.", + "service_description_avahi-daemon": "يسمح لك بالنفاذ إلى خادومك عبر الشبكة المحلية باستخدام yunohost.local", + "service_description_glances": "يقوم بمراقبة معلومات النظام على خادومك", + "service_description_metronome": "يُدير حسابات الدردشة الفورية XMPP", + "service_description_nginx": "يقوم بتوفير النفاذ و السماح بالوصول إلى كافة مواقع الويب المستضافة على خادومك", + "service_description_php5-fpm": "يقوم بتشغيل تطبيقات الـ PHP مع خادوم الويب nginx", + "service_description_postfix": "يقوم بإرسال و تلقي الرسائل البريدية الإلكترونية", + "service_description_yunohost-api": "يقوم بإدارة التفاعلات ما بين واجهة الويب لواي يونوهوست و النظام" } From ff9e9a10789572047eff32a052c74a20886ee9c4 Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Sun, 10 Jun 2018 01:28:14 +0000 Subject: [PATCH 304/313] [i18n] Translated using Weblate (Arabic) Currently translated at 91.8% (371 of 404 strings) --- locales/ar.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/ar.json b/locales/ar.json index 2ec29d7e7..c6f576536 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -29,7 +29,7 @@ "app_not_properly_removed": "لم يتم حذف تطبيق {app:s} بشكلٍ جيّد", "app_package_need_update": "The app {app} package needs to be updated to follow YunoHost changes", "app_removed": "تمت إزالة تطبيق {app:s}", - "app_requirements_checking": "Checking required packages for {app}...", + "app_requirements_checking": "جار فحص الحزم اللازمة لـ {app} ...", "app_requirements_failed": "Unable to meet requirements for {app}: {error}", "app_requirements_unmeet": "Requirements are not met for {app}, the package {pkgname} ({version}) must be {spec}", "app_sources_fetch_failed": "تعذرت عملية جلب مصادر الملفات", From 1c7b5a7ac977b0e304f20b9f77d1cd623bb2a866 Mon Sep 17 00:00:00 2001 From: Jean-Baptiste Holcroft Date: Tue, 12 Jun 2018 21:16:54 +0000 Subject: [PATCH 305/313] [i18n] Translated using Weblate (French) Currently translated at 100.0% (404 of 404 strings) --- locales/fr.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/fr.json b/locales/fr.json index 3939503f9..ad04bc46f 100644 --- a/locales/fr.json +++ b/locales/fr.json @@ -393,7 +393,7 @@ "migration_0003_not_jessie": "La distribution Debian actuelle n’est pas Jessie !", "migration_0003_system_not_fully_up_to_date": "Votre système n’est pas complètement à jour. Veuillez mener une mise à jour classique avant de lancer à migration à Stretch.", "migration_0003_still_on_jessie_after_main_upgrade": "Quelque chose s’est ma passé pendant la mise à niveau principale : le système est toujours sur Jessie ?!? Pour investiguer le problème, veuillez regarder {log} 🙁…", - "migration_0003_general_warning": "Veuillez noter que cette migration est une opération délicate. Si l’équipe YunoHost a fait de son mieux pour la relire et la tester, la migration pourrait tout de même casser des parties de votre système ou de vos applications.\n\nEn conséquence, nous vous recommandons :\n - de lancer une sauvegarde de vos données ou applications critiques ;\n - d’être patient après avoir lancé la migration : selon votre connexion internet et matériel, cela pourrait prendre jusqu'à quelques heures pour que tout soit à niveau.", + "migration_0003_general_warning": "Veuillez noter que cette migration est une opération délicate. Si l’équipe YunoHost a fait de son mieux pour la relire et la tester, la migration pourrait tout de même casser des parties de votre système ou de vos applications.\n\nEn conséquence, nous vous recommandons :\n - de lancer une sauvegarde de vos données ou applications critiques. Plus d’informations sur https://yunohost.org/backup ;\n - d’être patient après avoir lancé la migration : selon votre connexion internet et matériel, cela pourrait prendre jusqu'à quelques heures pour que tout soit à niveau.\n\nDe plus, le port SMTP utilisé par les clients de messagerie externes comme (Thunderbird ou K9-Mail) a été changé de 465 (SSL/TLS) à 587 (STARTTLS). L’ancien port 465 sera automatiquement fermé et le nouveau port 587 sera ouvert dans le pare-feu. Vous et vos utilisateurs *devront* adapter la configuration de vos clients de messagerie en conséquence !", "migration_0003_problematic_apps_warning": "Veuillez noter que les applications suivantes, éventuellement problématiques, ont été détectées. Il semble qu’elles n’aient pas été installées depuis une liste d’application ou qu’elles ne soit pas marquées «working ». En conséquence, nous ne pouvons pas garantir qu’elles fonctionneront après la mise à niveau : {problematic_apps}", "migration_0003_modified_files": "Veuillez noter que les fichiers suivants ont été détectés comme modifiés manuellement et pourraient être écrasés à la fin de la mise à niveau : {manually_modified_files}", "migrations_list_conflict_pending_done": "Vous ne pouvez pas utiliser --previous et --done simultanément.", From 8c6e91ceed9c64eedc5579e45ca2e09053a545be Mon Sep 17 00:00:00 2001 From: Quenti Date: Tue, 12 Jun 2018 19:50:12 +0000 Subject: [PATCH 306/313] [i18n] Translated using Weblate (Occitan) Currently translated at 100.0% (404 of 404 strings) --- locales/oc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index 979afcd13..c68c51b4b 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -373,7 +373,7 @@ "migration_description_0001_change_cert_group_to_sslcert": "Càmbia las permissions de grop dels certificats de « metronome » per « ssl-cert »", "migration_0003_restoring_origin_nginx_conf": "Vòstre fichièr /etc/nginx/nginx.conf es estat modificat manualament. La migracion reïnicializarà d’en primièr son estat origina… Lo fichièr precedent serà disponible coma {backup_dest}.", "migration_0003_still_on_jessie_after_main_upgrade": "Quicòm a trucat pendent la mesa a nivèl màger : lo sistèma es encara jos Jessie ?!? Per trobar lo problèma, agachatz {log} …", - "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.", + "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas. Mai d’informacions a https://yunohost.org/backup ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.\n\nEn mai, lo pòrt per SMTP, utilizat pels clients de corrièls extèrns coma (Thunderbird o K9-Mail) foguèt cambiat de 465 (SSL/TLS) per 587 (STARTTLS). L’ancian pòrt 465 serà automaticament tampat e lo nòu pòrt 587 serà dobèrt dins lo parafuòc. Vosautres e vòstres utilizaires *auretz* d’adaptar la configuracion de vòstre client de corrièl segon aqueles cambiaments !", "migration_0003_problematic_apps_warning": "Notatz que las aplicacions seguentas, saique problematicas, son estadas desactivadas. Semblan d’aver estadas installadas d’una lista d’aplicacions o que son pas marcadas coma «working ». En consequéncia, podèm pas assegurar que tendràn de foncionar aprèp la mesa a nivèl : {problematic_apps}", "migrations_bad_value_for_target": "Nombre invalid pel paramètre « target », los numèros de migracion son 0 o {}", "migrations_migration_has_failed": "La migracion {number} {name} a pas capitat amb l’excepcion {exception}, anullacion", From 4e135b6546665234bd1d2c638eeada0ce765f605 Mon Sep 17 00:00:00 2001 From: Passaire Date: Wed, 13 Jun 2018 17:44:27 +0000 Subject: [PATCH 307/313] [i18n] Translated using Weblate (Occitan) Currently translated at 100.0% (404 of 404 strings) --- locales/oc.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/locales/oc.json b/locales/oc.json index c68c51b4b..103c0d3e6 100644 --- a/locales/oc.json +++ b/locales/oc.json @@ -373,7 +373,7 @@ "migration_description_0001_change_cert_group_to_sslcert": "Càmbia las permissions de grop dels certificats de « metronome » per « ssl-cert »", "migration_0003_restoring_origin_nginx_conf": "Vòstre fichièr /etc/nginx/nginx.conf es estat modificat manualament. La migracion reïnicializarà d’en primièr son estat origina… Lo fichièr precedent serà disponible coma {backup_dest}.", "migration_0003_still_on_jessie_after_main_upgrade": "Quicòm a trucat pendent la mesa a nivèl màger : lo sistèma es encara jos Jessie ?!? Per trobar lo problèma, agachatz {log} …", - "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas. Mai d’informacions a https://yunohost.org/backup ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.\n\nEn mai, lo pòrt per SMTP, utilizat pels clients de corrièls extèrns coma (Thunderbird o K9-Mail) foguèt cambiat de 465 (SSL/TLS) per 587 (STARTTLS). L’ancian pòrt 465 serà automaticament tampat e lo nòu pòrt 587 serà dobèrt dins lo parafuòc. Vosautres e vòstres utilizaires *auretz* d’adaptar la configuracion de vòstre client de corrièl segon aqueles cambiaments !", + "migration_0003_general_warning": "Notatz qu’aquesta migracion es una operacion delicata. Encara que la còla YunoHost aguèsse fach çò melhor per la tornar legir e provar, la migracion poiriá copar de parts del sistèma o de las aplicacions.\n\nEn consequéncia, vos recomandam :\n· · · · - de lançar una salvagarda de vòstras donadas o aplicacions criticas. Mai d’informacions a https://yunohost.org/backup ;\n· · · · - d’èsser pacient aprèp aver lançat la migracion : segon vòstra connexion Internet e material, pòt trigar qualques oras per que tot siá mes al nivèl.\n\nEn mai, lo pòrt per SMTP, utilizat pels clients de corrièls extèrns (coma Thunderbird o K9-Mail per exemple) foguèt cambiat de 465 (SSL/TLS) per 587 (STARTTLS). L’ancian pòrt 465 serà automaticament tampat e lo nòu pòrt 587 serà dobèrt dins lo parafuòc. Vosautres e vòstres utilizaires *auretz* d’adaptar la configuracion de vòstre client de corrièl segon aqueles cambiaments !", "migration_0003_problematic_apps_warning": "Notatz que las aplicacions seguentas, saique problematicas, son estadas desactivadas. Semblan d’aver estadas installadas d’una lista d’aplicacions o que son pas marcadas coma «working ». En consequéncia, podèm pas assegurar que tendràn de foncionar aprèp la mesa a nivèl : {problematic_apps}", "migrations_bad_value_for_target": "Nombre invalid pel paramètre « target », los numèros de migracion son 0 o {}", "migrations_migration_has_failed": "La migracion {number} {name} a pas capitat amb l’excepcion {exception}, anullacion", From ac5183665a88ce30b007b8c106b2f925bbdd635c Mon Sep 17 00:00:00 2001 From: ButterflyOfFire Date: Thu, 14 Jun 2018 16:05:46 +0000 Subject: [PATCH 308/313] [i18n] Translated using Weblate (Arabic) Currently translated at 91.8% (371 of 404 strings) --- locales/ar.json | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/locales/ar.json b/locales/ar.json index c6f576536..cda9c2c8b 100644 --- a/locales/ar.json +++ b/locales/ar.json @@ -14,10 +14,10 @@ "app_change_url_identical_domains": "The old and new domain/url_path are identical ('{domain:s}{path:s}'), nothing to do.", "app_change_url_no_script": "This application '{app_name:s}' doesn't support url modification yet. Maybe you should upgrade the application.", "app_change_url_success": "Successfully changed {app:s} url to {domain:s}{path:s}", - "app_extraction_failed": "Unable to extract installation files", + "app_extraction_failed": "تعذر فك الضغط عن ملفات التنصيب", "app_id_invalid": "Invalid app id", "app_incompatible": "إن التطبيق {app} غير متوافق مع إصدار واي يونوهوست YunoHost الخاص بك", - "app_install_files_invalid": "Invalid installation files", + "app_install_files_invalid": "ملفات التنصيب خاطئة", "app_location_already_used": "The app '{app}' is already installed on that location ({path})", "app_make_default_location_already_used": "Can't make the app '{app}' the default on the domain {domain} is already used by the other app '{other_app}'", "app_location_install_failed": "Unable to install the app in this location because it conflit with the app '{other_app}' already installed on '{other_path}'", @@ -41,7 +41,7 @@ "app_upgraded": "تم تحديث التطبيق {app:s}", "appslist_corrupted_json": "Could not load the application lists. It looks like {filename:s} is corrupted.", "appslist_could_not_migrate": "Could not migrate app list {appslist:s} ! Unable to parse the url... The old cron job has been kept in {bkp_file:s}.", - "appslist_fetched": "The application list {appslist:s} has been fetched", + "appslist_fetched": "تم جلب قائمة تطبيقات {appslist:s}", "appslist_migrating": "Migrating application list {appslist:s} ...", "appslist_name_already_tracked": "There is already a registered application list with name {name:s}.", "appslist_removed": "تم حذف قائمة البرمجيات {appslist:s}", @@ -91,16 +91,16 @@ "backup_deleted": "The backup has been deleted", "backup_extracting_archive": "Extracting the backup archive...", "backup_hook_unknown": "Backup hook '{hook:s}' unknown", - "backup_invalid_archive": "Invalid backup archive", + "backup_invalid_archive": "نسخة إحتياطية غير صالحة", "backup_method_borg_finished": "Backup into borg finished", - "backup_method_copy_finished": "Backup copy finished", + "backup_method_copy_finished": "إنتهت عملية النسخ الإحتياطي", "backup_method_custom_finished": "Custom backup method '{method:s}' finished", "backup_method_tar_finished": "Backup tar archive created", "backup_no_uncompress_archive_dir": "Uncompress archive directory doesn't exist", - "backup_nothings_done": "There is nothing to save", + "backup_nothings_done": "ليس هناك أي شيء للحفظ", "backup_output_directory_forbidden": "Forbidden output directory. Backups can't be created in /bin, /boot, /dev, /etc, /lib, /root, /run, /sbin, /sys, /usr, /var or /home/yunohost.backup/archives sub-folders", "backup_output_directory_not_empty": "The output directory is not empty", - "backup_output_directory_required": "You must provide an output directory for the backup", + "backup_output_directory_required": "يتوجب عليك تحديد مجلد لتلقي النسخ الإحتياطية", "backup_output_symlink_dir_broken": "You have a broken symlink instead of your archives directory '{path:s}'. You may have a specific setup to backup your data on an other filesystem, in this case you probably forgot to remount or plug your hard dirve or usb key.", "backup_running_app_script": "Running backup script of app '{app:s}'...", "backup_running_hooks": "Running backup hooks...", @@ -113,7 +113,7 @@ "certmanager_attempt_to_renew_valid_cert": "The certificate for domain {domain:s} is not about to expire! Use --force to bypass", "certmanager_attempt_to_replace_valid_cert": "You are attempting to overwrite a good and valid certificate for domain {domain:s}! (Use --force to bypass)", "certmanager_cannot_read_cert": "Something wrong happened when trying to open current certificate for domain {domain:s} (file: {file:s}), reason: {reason:s}", - "certmanager_cert_install_success": "تمت عملية تنصيب شهادة Let's Encrypt بنجاح على النطاق {domain:s}!", + "certmanager_cert_install_success": "تمت عملية تنصيب شهادة Let's Encrypt بنجاح على النطاق {domain:s} !", "certmanager_cert_install_success_selfsigned": "Successfully installed a self-signed certificate for domain {domain:s}!", "certmanager_cert_renew_success": "نجحت عملية تجديد شهادة Let's Encrypt الخاصة باسم النطاق {domain:s} !", "certmanager_cert_signing_failed": "فشل إجراء توقيع الشهادة الجديدة", @@ -318,15 +318,15 @@ "service_disable_failed": "", "service_disabled": "The service '{service:s}' has been disabled", "service_enable_failed": "", - "service_enabled": "The service '{service:s}' has been enabled", - "service_no_log": "No log to display for service '{service:s}'", + "service_enabled": "تم تنشيط خدمة '{service:s}'", + "service_no_log": "ليس لخدمة '{service:s}' أي سِجلّ للعرض", "service_regenconf_dry_pending_applying": "Checking pending configuration which would have been applied for service '{service}'...", "service_regenconf_failed": "Unable to regenerate the configuration for service(s): {services}", "service_regenconf_pending_applying": "Applying pending configuration for service '{service}'...", "service_remove_failed": "Unable to remove service '{service:s}'", "service_removed": "تمت إزالة خدمة '{service:s}'", "service_start_failed": "", - "service_started": "The service '{service:s}' has been started", + "service_started": "تم إطلاق تشغيل خدمة '{service:s}'", "service_status_failed": "Unable to determine status of service '{service:s}'", "service_stop_failed": "", "service_stopped": "The service '{service:s}' has been stopped", From 5e77e6e1083d513adb74c2f74e8759a7b8ea59a4 Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Sun, 17 Jun 2018 01:39:22 +0200 Subject: [PATCH 309/313] [fix] local variables and various fix on psql helpers --- data/helpers.d/psql | 52 ++++++++++++++++++++++----------------------- 1 file changed, 25 insertions(+), 27 deletions(-) diff --git a/data/helpers.d/psql b/data/helpers.d/psql index ddacbef8c..2ef13482a 100644 --- a/data/helpers.d/psql +++ b/data/helpers.d/psql @@ -7,16 +7,15 @@ ynh_psql_test_if_first_run() { then echo "PostgreSQL is already installed, no need to create master password" else - pgsql=$(ynh_string_random) - pg_hba="" - echo "$pgsql" >> /etc/yunohost/psql + local pgsql="$(ynh_string_random)" + echo "$pgsql" > /etc/yunohost/psql if [ -e /etc/postgresql/9.4/ ] then - pg_hba=/etc/postgresql/9.4/main/pg_hba.conf + local pg_hba=/etc/postgresql/9.4/main/pg_hba.conf elif [ -e /etc/postgresql/9.6/ ] then - pg_hba=/etc/postgresql/9.6/main/pg_hba.conf + local pg_hba=/etc/postgresql/9.6/main/pg_hba.conf else ynh_die "postgresql shoud be 9.4 or 9.6" fi @@ -29,7 +28,7 @@ ynh_psql_test_if_first_run() { # Note: we can't use peer since YunoHost create users with nologin # See: https://github.com/YunoHost/yunohost/blob/unstable/data/helpers.d/user sed -i '/local\s*all\s*all\s*peer/i \ - local all all password' "$pg_hba" + local all all password' "$pg_hba" systemctl enable postgresql systemctl reload postgresql fi @@ -45,9 +44,9 @@ ynh_psql_test_if_first_run() { # | arg: pwd - the user password # | arg: db - the database to connect to ynh_psql_connect_as() { - user="$1" - pwd="$2" - db="$3" + local user="$1" + local pwd="$2" + local db="$3" sudo --login --user=postgres PGUSER="$user" PGPASSWORD="$pwd" psql "$db" } @@ -55,9 +54,8 @@ ynh_psql_connect_as() { # # usage: ynh_psql_execute_as_root sql [db] # | arg: sql - the SQL command to execute -# | arg: db - the database to connect to ynh_psql_execute_as_root () { - sql="$1" + local sql="$1" sudo --login --user=postgres psql <<< "$sql" } @@ -67,8 +65,8 @@ ynh_psql_execute_as_root () { # | arg: file - the file containing SQL commands # | arg: db - the database to connect to ynh_psql_execute_file_as_root() { - file="$1" - db="$2" + local file="$1" + local db="$2" sudo --login --user=postgres psql "$db" < "$file" } @@ -82,11 +80,11 @@ ynh_psql_execute_file_as_root() { # | arg: name - Name of the database # | arg: pwd - Password of the database. If not given, a password will be generated ynh_psql_setup_db () { - db_user="$1" - db_name="$2" - new_db_pwd=$(ynh_string_random) # Generate a random password + local db_user="$1" + local db_name="$2" + local new_db_pwd=$(ynh_string_random) # Generate a random password # If $3 is not given, use new_db_pwd instead for db_pwd. - db_pwd="${3:-$new_db_pwd}" + local db_pwd="${3:-$new_db_pwd}" ynh_psql_create_db "$db_name" "$db_user" "$db_pwd" # Create the database ynh_app_setting_set "$app" psqlpwd "$db_pwd" # Store the password in the app's config } @@ -98,9 +96,9 @@ ynh_psql_setup_db () { # | arg: user - the user to grant privilegies # | arg: pwd - the user password ynh_psql_create_db() { - db="$1" - user="$2" - pwd="$3" + local db="$1" + local user="$2" + local pwd="$3" ynh_psql_create_user "$user" "$pwd" sudo --login --user=postgres createdb --owner="$user" "$db" } @@ -111,8 +109,8 @@ ynh_psql_create_db() { # | arg: db - the database name to drop # | arg: user - the user to drop ynh_psql_remove_db() { - db="$1" - user="$2" + local db="$1" + local user="$2" sudo --login --user=postgres dropdb "$db" ynh_psql_drop_user "$user" } @@ -125,7 +123,7 @@ ynh_psql_remove_db() { # | arg: db - the database name to dump # | ret: the psqldump output ynh_psql_dump_db() { - db="$1" + local db="$1" sudo --login --user=postgres pg_dump "$db" } @@ -135,9 +133,9 @@ ynh_psql_dump_db() { # usage: ynh_psql_create_user user pwd [host] # | arg: user - the user name to create ynh_psql_create_user() { - user="$1" - pwd="$2" - sudo --login --user=postgres psql -c"CREATE USER $user WITH PASSWORD '$pwd'" postgres + local user="$1" + local pwd="$2" + sudo --login --user=postgres psql -c"CREATE USER $user WITH PASSWORD '$pwd'" postgres } # Drop a user @@ -145,6 +143,6 @@ ynh_psql_create_user() { # usage: ynh_psql_drop_user user # | arg: user - the user name to drop ynh_psql_drop_user() { - user="$1" + local user="$1" sudo --login --user=postgres dropuser "$user" } From e240fe8659180a3c4477295c5fa4dd94e6ce6cd5 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 17 Jun 2018 01:17:26 +0000 Subject: [PATCH 310/313] Update changelog for 2.7.14 release --- debian/changelog | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index 2e480e1bb..c9f5408dd 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +yunohost (2.7.14) stable; urgency=low + + * Last minute fix : install php7.0-acpu to hopefully make stretch still work after the upgrade + * Improve Occitan, French, Portuguese, Arabic translations + * [fix] local variables and various fix on psql helpers + + -- Alexandre Aubin Sun, 17 Jun 2018 01:16:13 +0000 yunohost (2.7.13.6) testing; urgency=low @@ -5,7 +12,7 @@ yunohost (2.7.13.6) testing; urgency=low * [stretch-migration] Disable predictable network interface names Fixes by Bram and Aleks - + -- Alexandre Aubin Fri, 15 Jun 2018 16:20:00 +0000 yunohost (2.7.13.5) testing; urgency=low From b3b3062d62642dd6c00aa44484401e94ac9e6128 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Sun, 17 Jun 2018 01:26:50 +0000 Subject: [PATCH 311/313] Update changelog --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian/changelog b/debian/changelog index bca1f40f8..849a7c312 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +yunohost (3.0.0) stable; urgency=low + + * Merge with jessie's branches + * Release as stable + + -- Alexandre Aubin Sun, 17 Jun 2018 03:25:00 +0000 + yunohost (3.0.0~beta1.7) testing; urgency=low * Merge with jessie's branches From e55cbb401fe840b0611fb0283cbe30d2121afdc4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 18 Jun 2018 18:28:02 +0200 Subject: [PATCH 312/313] [fix] [microdecision] Remove --verbose and --ignore-system in backup/restore during app upgrades --- data/helpers.d/utils | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/helpers.d/utils b/data/helpers.d/utils index 33d6bffd4..07b4d4bb1 100644 --- a/data/helpers.d/utils +++ b/data/helpers.d/utils @@ -48,7 +48,7 @@ ynh_restore_upgradebackup () { # Remove the application then restore it sudo yunohost app remove $app # Restore the backup - sudo yunohost backup restore --ignore-system $app_bck-pre-upgrade$backup_number --apps $app --force --verbose + sudo yunohost backup restore $app_bck-pre-upgrade$backup_number --apps $app --force ynh_die "The app was restored to the way it was before the failed upgrade." fi else @@ -87,7 +87,7 @@ ynh_backup_before_upgrade () { fi # Create backup - sudo BACKUP_CORE_ONLY=1 yunohost backup create --ignore-system --apps $app --name $app_bck-pre-upgrade$backup_number --verbose + sudo BACKUP_CORE_ONLY=1 yunohost backup create --apps $app --name $app_bck-pre-upgrade$backup_number if [ "$?" -eq 0 ] then # If the backup succeeded, remove the previous backup From 933c56bb7ec3d0f9a5fd54b1f360ff4ab26dfbaa Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Mon, 18 Jun 2018 18:32:00 +0200 Subject: [PATCH 313/313] Upgrade changelog --- debian/changelog | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian/changelog b/debian/changelog index 849a7c312..a47b0b42d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +yunohost (3.0.0.1) stable; urgency=low + + * Fix remaining use of --verbose and --ignore-system during backup/restore + of app upgrades + + -- Alexandre Aubin Mon, 18 Jun 2018 18:31:00 +0000 + yunohost (3.0.0) stable; urgency=low * Merge with jessie's branches