MFC r306417: portsnap: only move expected snapshot contents from snap/ to files/

Previously it was possible to smuggle in addional files that would
be used by later portsnap runs. Now we only move those files expected
to be in the snapshot into files/ and require that there are no
unexpected files.

This was used by portsnap attacks 2, 3, and 4 in the "non-cryptanalytic
attacks against FreeBSD update components" anonymous gist.

MFC (part of) r298089 by pfg: Cleanup unnecessary semicolons

MFC r296205: Fix typo.

MFC r305469:

Ensure that we always open only files that is named by explicitly
using shell redirections instead of having gzip(1) to decide what
file to open.

Issue reported in the "non-cryptanalytic attacks against freebsd
update components" anonymous gist.

Reviewed by: allanjude, emaste

MFC 296280:

PR: 202971
Submitted by: adamw@FreeBSD.org
Reviewed by: bdrewery@
Approved by: wblock@
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D5429

MFC r276571: Add a manual page for phttpget(8).

MFC r264400,r265836:

r264400:

NO_MAN= has been deprecated in favor of MAN= for some time, go ahead
and finish the job. ncurses is now the only Makefile in the tree that
uses it since it wasn't a simple mechanical change, and will be
addressed in a future commit.

r265836:

Remove last two NO_MAN= in the tree. In both of these cases, MAN= is
what is needed.

MFC r264740:

Use case insensitive match in portsnap.

PR: bin/186510
Submitted by: olli

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Fix bug in deleting files: If two ports had the same tarball and one of
them changed (or was removed from the tree) then portsnap would delete
that file. This happened earlier today when one of two empty port
directories was removed. Uniquifying the lists of needed files fixes
this.

9.2-RELEASE candidate.

MFC after: 3 days

Make 'portsnap alfred' overwrite ports tree if it's not created by a
portsnap.

Discussed with: alfred
Reviewed by: cperciva

mdoc sweep

mdoc sweep.

Change progress indicator for downloading patches.

Use a percent style indicator instead of emitting one
long line of patch numbers.

Avoid changing IFS in a global context as this can sometimes cause
errors later on.

PR: bin/172715
Submitted by: Matthew D.Fuller <fullermd@over-yonder.net> (older
version)
Submitted by: dteske
Approved by: cperciva
MFC after: 1 week

Remove cvs/cvsup reference.

Change "only only" to "only" in portsnap(8).

Spotted by: Ruslan Mahmatkhanov
Approved by: gabor (mentor, implicit)

Add a note to portsnap(8) about the behaviour of the example cron command.

PR: docs/171759
Submitted by: Paul Hoffman (phoffman at proper dot com)
Approved by: cperciva, gabor (mentor)
MFC after: 3 days

Add interactive option to override portsnap's automagical detection of
a terminal.

Submitted by: Hannes h2+fbsdports@fsfe.org
Approved by: cperciva
MFC after: 1 week

make it easier for users used to a VCS that allows up to be a shortcut
for update.

PR: bin/152856
Approved by: cperciva
MFC after: 3 days

Fix spelling of extract.

Pointed out by: gcooper

Utilize shell's IFS instead of forking ~6 processes to
handle splitting input files on a '|'. This greatly
reduces the time taken to process several databases
during the update process.

Additionally add some more debug logging.

portsnap: Detect error immediately if we can't fetch the snapshot metadata.

Also add some quotes around command substitution where useful and possible.

Reviewed by: cperciva
MFC after: 1 week

Add --numeric-owner to tar extract operations in portsnap.

This is done to speed up extraction significantly (both for portsnap
extract and update) in the case of slow NSS modules (like nss_ldap) as
it avoids having to look up uid and gid for root / wheel.

The reason this is a bigger problem for portsnap than for many other
system operations, is that portsnap executes tar(1) once for each port
so the internal uid/gid caching in tar(1) only helps a bit, resulting
in many user lookup calls.

Discussed with: cperciva

mdoc: drop redundant .Pp and .LP calls

They have no effect when coming in pairs, or before .Bl/.Bd

Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages. Minor corrections by me.

Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

The last big commit: let usr.sbin/ use WARNS=6 by default.

Add undocumented 'portsnap alfred' command, which runs (fetch|cron)
based on whether fd 0 is a terminal, and then runs (extract|update)
based on whether ${PORTSDIR} exists.

Requested by: alfred
MFC after: 1 month

Set SO_NOSIGPIPE on sockets used by phttpget. Without this, if
(1) phttpget is attempting to download enough files that it can't send
all the requests at once, and
(2) the remote server forcibly closes the connection, resulting in RST
packets being sent,
phttpget will receive a SIGPIPE and terminate without downloading all
of the files.

This is probably responsible for a number of hard-to-reproduce errors
with portsnap and freebsd-update.

MFC after: 3 days

- remove superfluous word

PR: docs/127401
Submitted by: Mick Charles Beaver <mick@cs.wisc.edu>
MFC after: 1 week

Add support for specifying which INDEX files to build via portsnap.conf.

Requested by: brooks
Reminded by: brooks, about halfway through his BSDCan talk

Improve conformance to the HTTP specification by using case-insensitive
comparisons for header keywords. Apparently some proxies use creative
capitalization.

Weird proxy found by: brooks
MFC after: 3 days

Attempt to reduce the rate of foot-shooting injuries by adding a new
paragraph clarifying that portsnap does not behave the same way as
cvs and cvsup where local modifications are concerned.

Submitted by: peter
Feet shot: peter, kris, obrien, + many others

When generating ports INDEX files from downloaded "describes" data, build
an index for FreeBSD 7.x too.

MFC After: 1 week
Approved by: re (hrs)

Add support for HTTP/1.0 Persistent Connections to phttpget. Requests are
be marked as HTTP/1.1 but "Connection: Keep-Alive" is added; this convinces
HTTP/1.0 servers and proxies to hold the TCP connection open despite not
being able to use HTTP pipelining.

This dramatically cuts down on the number of TCP connections (and thus port
numbers) used by portsnap when talking to an HTTP/1.0 proxy (e.g., squid),
and has the side benefit of improving performance in those cases.

Tested by: simon
Approved by: re (kensmith)
MFC After: 1 week

Add support for the HTTP_TIMEOUT environment variable (integer number
of seconds, just like in fetch(1)).

Submitted by: rdivacky

Set LC_ALL=C in order to avoid problems with character ranges and
sorting.

PR: bin/104505
MFC after: 3 days

Markup fixes.

s/MAN8/MAN/

Pointed out by: ru

Use some features of sh(1) which I didn't know about until today ("read"
can read two variables at once; and suffix pattern deletion) to make the
extract command fork fewer processes.

With the portsnap snapshot and the ports tree in swap-backed memory
disks on my 1.4GHz laptop, this reduces 178800 processes and 195/56/126
seconds of real/user/sys time to 44600 processes and 103/34/60 seconds.

Fix typo.

Pointed out by: ceri

Add a mechanism for constructing INDEX files which include local ports.

Requested by: brooks

Use 'rm -rf foo/bar' to remove a port instead of 'rm -rf foo/bar/'.
When /usr/ports/foo/bar is a symlink pointing outside the tree, this
deletes the symlink instead of the directory it points to.

Requested by: delphij

Allow the HTTP_PROXY environment variable to be (mis)spelled as
"http_proxy", since some people apparently do this and fetch(3)
allows it.

Fix the test for whether ${HTTP_PROXY} is set -- I got it backwards.

Pointy hat to: cperciva
Pointed out by: pjd

Remove two lines of debugging which I forgot to remove before the last
commit.

Noticed by: simon

The approach portsnap uses of "pick a random HTTP mirror" doesn't
interact very nicely with HTTP proxies: Since proxies do not know
that all the files on portsnap1.freebsd.org are identical to the
files with the same names on portsnap2.freebsd.org, said proxies end
up downloading and storing files in duplicate.

This commit uses the HTTP_PROXY environment variable, if set, to
generate a random number seed for use in selecting a mirror. This
means that if several systems all have the same HTTP_PROXY value set,
they will ask the proxy to fetch files from the same mirror (unless
that mirror fails, in which case all the systems will use the same
second choice, et cetera).

Portsnap still doesn't interact very well with "transparent" HTTP
proxies, but there's nothing I can do about those.

Requested by: simon
Sponsored by: FreeBSD security development fundraiser

Instead of selecting a mirror and failing if it is inaccessible, keep
track of which mirrors we have tried and try a different mirror if we
fail when trying to download the SSL public key or the snapshot
signature.

Failures later in the download process will not result in switching to
a different mirror, for two reasons:
1. If is very unlikely that a mirror will fail partway through the
process of downloading updates.
2. If we switched from a more recently updated mirror to a less
recently updated mirror partway through the download process, we would
end up failing anyway because we would be trying to fetch files which
the second mirror didn't have yet.

PR: bin/96288
Requested by: lots of people
Sponsored by: FreeBSD security development fundraiser

Teach portsnap to parse the output of the host(1) in BIND 8 as well as
the host(1) from BIND 9. This doesn't matter for HEAD, but will help
people who install portsnap from the ports tree onto older versions of
FreeBSD.

PR: ports/93901
Sponsored by: FreeBSD security development fundraiser

Reimplementation of world/kernel build options. For details, see:

http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)

Remove trailing dot from the servername in the serverlist to be able
to use portsnap from behind a http proxy. Some HTTP proxy don't like
trailing dot in the servername.

Approved by: cperciva
MFC after: 2 days

Correct handling of HTTP_PROXY_AUTH. A password may have `:'.

Approved by: cperciva
MFC after: 2 days

Reference sha256(1) instead of sha256(8), which doesn't exist.

Approved by: cognet (mentor)
MFC after: 3 days

Expand contractions.

Merge from accidental commit to RELENG_5:
Correctly identify the host and port values on a failed
getaddrinfo lookup.

Replace "fetch" with "fetch -r" when downloading the initial ~38MB
snapshot in order to avoid unnecessary re-downloading.

Remove the earlier "rm -f ${SNAPSHOTHASH}.tgz" to make this work.

Suggested by: Lars Engels
MFC after: 7 days

Mention that the random time slept by "portsnap cron" is between 1 and
3600 seconds.

Suggested by: Niki Denev
MFC after: 3 days

Make "portsnap extract" automatically create ${PORTSDIR} if necessary
instead of complaining that "Directory does not exist or is not
writable".

Suggested by: {tlp, siep} via IRC
MFC after: 1 week

Make "missing dependency" errors more useful by indicating which port
is trying to depend upon the non-existent port.

Suggested by: kris
MFC after: 3 days

An empty file does not have a positive number of lines.

Make sure that the number of lines read is non-zero before in order to
avoid dumping core.

Reported by: Wojciech A. Koszek
Pointy hat to: cperciva

Correctly handle a TCP connection being shutdown by the server while
we're reading response headers. (Handle it as a connection-killing
error, rather than entering an infinite loop reading zero bytes.)

Reported by: simon
Discovered thanks to: A not-very-transparent transparent HTTP proxy.
MFC after: 3 days

Add HTTP proxy authentication, via the HTTP_PROXY_AUTH environment
variable.

Tested by: Emil Mikulic
X-MFC-After: 6.0-RELEASE

Style fix: "if (pointer)" -> "if (pointer != NULL)"

Add a note pointing out that certain information (IP address, list of
files fetched, FreeBSD release level) is transmitted to the portsnap
server when portsnap is run, but that this information is only used
anonymously and in aggregate.

Handle circular dependencies properly (via errx(3)) rather than dumping
core. This bug was made visible by a recent change to the audio/timidity++
port, which now has itself as a run dependency.

Reported by: Emil Mikulic, Andreas Klemm

Portsnap uses host(1) to search for mirrors, but this is only available
when the base system is not compiled with NO_BIND set. Before we start
searching for mirrors, make sure that host(1) can be found, and if it
doesn't exist then fallback to the A record instead of the SRV records.

Submitted by: Luca Morettoni

Fix typo: ${PORTDIR} -> ${PORTSDIR}.

Apologies to everyone who has run portsnap in 7.0-CURRENT since
Tuesday; if there is a file "/.portsnap.INDEX" on your system, you can
delete it (or even better, move it to /usr/ports/.portsnap.INDEX).

Big pointy hat to: cperciva
Reported that things weren't working properly: Aleksander Fafula

Fix typo: Cowarly -> Cowardly.

Reported by: Joerg Sonnenberger

Teach portsnap how to ignore unwanted parts of the ports tree. A line
of the form "REFUSE foo" in portsnap.conf will result in parts of the
tree matching "^foo" being (a) not extracted by "portsnap extract", (b)
not updated by "portsnap update", and (c) not having any patches or new
ports downloaded by "portsnap fetch" or "portsnap cron". The example
shown in portsnap.conf demonstrates ignoring all the language categories.

As mentioned in portsnap.conf.5, the use of an imcomplete ports tree is
not officially supported; but this is something which many users have
requested, so I'm adding it anyway.

PR: bin/85619 (but not the patch provided therein)
MFC after: 1 month

Spell "cmp > /dev/null" as "cmp -s".

Suggested by: dougb

Correctly exit from extract_run() and update_run() if files needed are
missing from ${WORKDIR}/files/.

This bug was caused by the astonishing interaction of "return" and
pipelines; in the following code, the "return" does not exit the
function, but instead exits the subshell which was spawned for the last
element of the pipeline; consequently, the output produced is "foo".

foo() {
echo bar | while read baz; do
if [ ${baz} = "bar" ]; then
return 1
fi
done

echo foo
}

Reported by: simon

Misc mdoc(7) fixes:
- Bump document date for recent updates.
- Use .Fx for FreeBSD.
- Remove EOL whitespace.
- Start new sentences on new lines.

Reviewed by: cperciva

Allow multiple commands to be specified on a single command line, e.g.,
"portsnap fetch update" or "portsnap -I cron update". They will be
executed in the order that they appear, and duplicates are not removed
(so "portsnap fetch fetch fetch fetch" is meaningful, albeit rather
silly).

Requested by: Roman Divacky

Fix the progress statistics code by printing the right variable. I
missed this when I changed the stats code in the ports -> base
transition.

Pointed out by: simon

When using cmp(1) to determine if the ports tree is already up to date,
we want the exit code, but not the actual output; add a redirect to
/dev/null.

Pointy hat to: cperciva

If the ports tree is already up to date when we run `portsnap update`,
exit early; this avoids spending five seconds rebuilding the INDEX
files.

Requested by: somebody on IRC, but I can't remember who

Remove unused variable.

Reported by: stefanf

Check that malloc() succeeds in makelist.

Submitted by: Roman Divacky (who did a very complete review of both
make_index.c and phttpget.c)

Replace INT_MAX with OFF_MAX. I used INT_MAX originally (in ports)
because OFF_MAX wasn't defined on FreeBSD 4.x.

When parsing the HTTP_PROXY environment variable, strip a trailing /
from the port number (if any exists). This unbreaks
env HTTP_PROXY="http://localhost:3128/" portsnap fetch

While I'm here, list both the host and the port in the error message
output if getaddrinfo() fails, since either of them could be responsible
for the failure.

Add a missing EOL when printing "Latest snapshot on server is older
than what we already have" message. [1]

When operating with the undocumented --debug option, replace "xargs
phttpget" with "xargs -t phttpget", since that might conceivably help
debugging.

Noticed by: simon [1]

Add portsnap to the base system. This is a secure, easy to use,
fast, lightweight, and generally good way for users to keep their
ports trees up to date.

This is version 0.9.4 from the ports tree (sysutils/portsnap) with
the following changes:
1. The experimental pipelined http code is enabled. No seatbelts
in -CURRENT. (^_^)
2. The working directory has moved from /usr/local/portsnap to
/var/db/portsnap (as discussed on -arch two days ago).
3. Portsnap now fetches a list of mirrors (distributed as DNS SRV
records) and selects one randomly. This should help to avoid the
uneven loading which plagues the cvsup mirror network.
4. The license is now 2-clause BSD instead of 3-clause BSD.
5. Various incidental changes to make portsnap fit into the base
system's build mechanics.

X-MFC-After: 6.0-RELEASE
X-MFC-Before: 5.5-RELEASE
X-MFC-To: RELENG_6, RELENG_5, ports
discussed on: -arch and several other places
"yes please" from: simon, remko, flz, Diane Bruce
thinks this is a great idea: bsdimp
Hopes he didn't forget any files: cperciva