blob: 974f2937ec858798c4e5ed09da639a38bf171332 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
|
#!/bin/sh
#########################################################################
#
# Builds Lynis distribution
#
# Usage: this script creates Lynis builds
#
# *** NOTE ***
# This script is not fully functional yet, several options like digital
# signing, RPM/DEB package creation are missing.
#
#########################################################################
#
# Options:
echo "[*] Activity [V] Successful [X] Error [=] Result"
echo ""
# Umask used when creating files/directories
OPTION_UMASK="027"
# Directory name used to create package related directories (like /usr/local/include/lynis)
OPTION_PACKAGE_DIRNAME="lynis"
# Binary to test
OPTION_BINARY_FILE="../lynis"
# Check number of parameters
if [ $# -eq 0 ]; then
echo "[X] This build tool needs at least a version number (--version). Use --help for all parameters."
exit 1
fi
# Check parameters
case $1 in
--help)
echo "Define version:"
echo "--version 1.2.3"
exit 1
;;
--version)
shift
LYNIS_VERSION=$1
;;
*)
echo "[X] Incorrect parameter"
exit 1
;;
esac
#
#########################################################################
#
# Functions:
# Clean temporary files up
CleanUp() {
if [ ! "${TMPDIR}" = "" -a -d "${TMPDIR}" ]; then
rm -rf ${TMPDIR}
fi
}
Exit() {
CleanUp
exit 0
}
ExitFatal() {
CleanUp
exit 1
}
#
#########################################################################
#
# Clean files up if we get interrupted
trap CleanUp INT
#
#########################################################################
#
MYUSER=$(whoami)
if [ "${MYUSER}" = "" ]; then
echo "[X] Could not determine user"
fi
if [ "${MYUSER}" = "root" ]; then
echo "[X] This script should not be executed as root"
fi
MYWORKDIR=$(pwd | awk -F / '{ for (i=1;i<=NF-2;i++){ printf $i"/" }; printf "\n"}' | sed 's./$..')
if [ ! -d ${MYWORKDIR} ]; then
echo "[X] Could not determine workdir (result: ${MYWORKDIR} seems invalid)"
ExitFatal
else
echo "[=] workdir: ${MYWORKDIR}"
fi
MYBUILDDIR="/home/${MYUSER}/lynis-build"
if [ ! -d ${MYBUILDDIR} ]; then
echo "[X] ${MYBUILDDIR} not found"
echo " Hint: create it with mkdir ${MYBUILDDIR}"
ExitFatal
else
echo "[=] builddir: ${MYBUILDDIR}"
fi
NEEDED_DIRS="debbuild rpmbuild rpmbuild/BUILD rpmbuild/BUILDROOT rpmbuild/RPMS rpmbuild/SOURCES rpmbuild/SRPMS"
for I in ${NEEDED_DIRS}; do
if [ ! -d "${MYBUILDDIR}/${I}" ]; then
echo "[X] Missing directory: ${MYBUILDDIR}/${I}"
echo " Hint: create subdirs with cd ${MYBUILDDIR} && mkdir -p ${NEEDED_DIRS}"
ExitFatal
fi
done
DEBWORKDIR="${MYBUILDDIR}/debbuild"
RPMWORKDIR="${MYBUILDDIR}/rpmbuild"
echo "[=] RPM workdir: ${RPMWORKDIR}"
#echo "Use: cd ${MYBUILDDIR} && mkdir rpm"
# Check binaries
GITBUILDPACKAGEBINARY=$(which git-buildpackage)
if [ ! "${GITBUILDPACKAGEBINARY}" = "" ]; then
echo "[=] git-buildpackage = ${GITBUILDPACKAGEBINARY}"
else
echo "[X] Can not find git-buildpackage binary"
echo " Hint: install git-buildpackage"
ExitFatal
fi
RPMBUILDBINARY=$(which rpmbuild)
if [ ! "${RPMBUILDBINARY}" = "" ]; then
echo "[=] rpmbuild = ${RPMBUILDBINARY}"
else
echo "[X] Can not find rpmbuild binary"
echo " Hint: install rpmbuild"
ExitFatal
fi
# Set umask
umask ${OPTION_UMASK}
if [ $? -eq 0 ]; then
echo "[V] Setting umask to ${OPTION_UMASK}"
else
echo "[X] Could not set umask"
ExitFatal
fi
# Check if we are in dev directory
if [ -f ../lynis -a -f ./build-lynis.sh ]; then
echo "[V] Active in proper directory"
else
echo "[X] This script should be executed from dev directory itself"
ExitFatal
fi
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Create temporary build directory
TMPDIR=$(mktemp -d /tmp/lynis-BUILDROOT.XXXXXX)
if [ $? -eq 0 ]; then
echo "[V] Creating temporary build directory"
#echo " BUILDROOT: ${TMPDIR}"
else
echo "[X] Could not create temporary build directory"
ExitFatal
fi
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
echo "[*] Starting with building tarball"
TARBALL="${MYBUILDDIR}/lynis_${LYNIS_VERSION}.orig.tar.gz"
#if [ -f ${TARBALL} ]; then
# echo "[X] Tarball already exists "
# echo " Hint: remove ${TARBALL}"
# ExitFatal
#fi
# Create tarball
if [ -f ${TARBALL} ]; then
echo "Tarball already exists for this version, not overwriting it"
else
tar -C ${MYWORKDIR} --exclude=debian --exclude=README.md --exclude=.bzr* --exclude=.git* -c -z -f ${TARBALL} lynis 2> /dev/null
if [ -f ${TARBALL} ]; then
echo "[V] Tarball created"
else
echo "[X] Tarball ${TARBALL} could not be created"
ExitFatal
fi
fi
TARBALL_MD5=$(md5sum ${TARBALL})
TARBALL_SHA1=$(sha1sum ${TARBALL})
echo "[*] Starting with RPM building process"
# RPM creation
SOURCEFILE_RPM="${RPMWORKDIR}/SOURCES/lynis-${LYNIS_VERSION}.tar.gz"
if [ -f ${SOURCEFILE_RPM} ]; then
if [ -f lynis.spec ]; then
# adjust version in spec file
VERSION_IN_SPECFILE=$(awk '/^Version:/ { print $2 }' lynis.spec)
echo "[=] Found version ${VERSION_IN_SPECFILE}"
if [ ${VERSION_IN_SPECFILE} = "" -o ! "${VERSION_IN_SPECFILE}" = "${LYNIS_VERSION}" ]; then
echo "[X] Version in specfile is outdated"
ExitFatal
fi
echo "[*] Start RPM building"
#${RPMBUILDBINARY} --quiet -ba -bl lynis.spec 2> /dev/null
else
echo "[X] lynis.spec not found"
ExitFatal
fi
RPMFILE="${RPMWORKDIR}/RPMS/noarch/lynis-${LYNIS_VERSION}-1.noarch.rpm"
if [ -f ${RPMFILE} ]; then
echo "[V] Building RPM successful!"
else
echo "[X] Could not find RPM file, most likely failed"
echo " Expected: ${RPMFILE}"
ExitFatal
fi
else
echo "[X] Could not find source file (${SOURCEFILE_RPM})"
echo " Hint: cp <lynis.tar.gz> ${SOURCEFILE_RPM}"
#ExitFatal
fi
echo "[*] Starting with DEB building process"
DEBCHANGELOGFULLVERSION=$(head -1 ../debian/changelog | awk '{ print $2 }' | sed 's/(//' | sed 's/)//')
DEBCHANGELOGVERSION=$(echo ${DEBCHANGELOGFULLVERSION} | awk -F- '{ print $1 }')
DEBCHANGELOGVERSIONREV=$(echo ${DEBCHANGELOGFULLVERSION} | awk -F- '{ print $2 }')
if [ "${LYNIS_VERSION}" = "${DEBCHANGELOGVERSION}" ]; then
echo "[V] Debian/changelog up-to-date"
else
echo "[X] Debian/changelog outdated"
ExitFatal
fi
# BZRSTATUS=$(${BZRBINARY} status . 2>&1 > /dev/null; echo $?)
# if [ "${BZRSTATUS}" = "0" ]; then
# echo "[V] bzr has proper directory tree"
# DEBCHANGELOGFULLVERSION=$(head -1 debian/changelog | awk '{ print $2 }' | sed 's/(//' | sed 's/)//')
# DEBCHANGELOGVERSION=$(echo ${DEBCHANGELOGFULLVERSION} | awk -F- '{ print $1 }')
# DEBCHANGELOGVERSIONREV=$(echo ${DEBCHANGELOGFULLVERSION} | awk -F- '{ print $2 }')
# echo "[=] Version in Debian changelog: ${DEBCHANGELOGVERSION} (revision: ${DEBCHANGELOGVERSIONREV})"
# if [ "${LYNIS_VERSION}" = "${DEBCHANGELOGVERSION}" ]; then
# echo "[V] Debian/changelog up-to-date"
# else
# echo "[X] Debian/changelog outdated"
## ExitFatal
# fi
# # execute command
# # bzr builddeb . --build-dir ${DEBWORKDIR}/build-area/ --result-dir ${DEBWORKDIR}
# elif [ "${BZRSTATUS}" = "3" ]; then
# echo "[X] Tree is not initialized for BZR"
# echo " Hint: run bzr init while being in lynis directory (or bzr init ..)"
# ExitFatal
# else
# echo "[X] Unknown error"
# echo "Output: ${BZRSTATUS}"
# fi
if [ ! -d ${MYBUILDDIR}/git ]; then
mkdir ${MYBUILDDIR}/git
fi
if [ -d ${MYBUILDDIR}/git/Lynis ]; then
echo "git clone already exists"
rm -rf ${MYBUILDDIR}/git/Lynis
#git checkout tags/${LYNIS_VERSION}
fi
git clone https://github.com/CISOfy/Lynis.git ${MYBUILDDIR}/git/Lynis
if [ -d ${MYBUILDDIR}/git/Lynis/debian/ ]; then
echo "Copying build files into new tree"
cp -R ../debian/* ${MYBUILDDIR}/git/Lynis/debian/
cd ${MYBUILDDIR}/git/Lynis/debian/
git add .
git commit -m "Building process for Lynis release version ${LYNIS_VERSION}"
else
echo "[X] Could not copy debian directory and commit changes"
fi
#git tag -l ${MYBUILDDIR}/git/Lynis
cd ..
echo "Executing: ${GITBUILDPACKAGEBINARY} --git-tarball-dir=${MYBUILDDIR} --git-export-dir=${DEBWORKDIR} --git-ignore-new"
${GITBUILDPACKAGEBINARY} -S --git-tarball-dir=${MYBUILDDIR} --git-export-dir=${DEBWORKDIR} --git-ignore-new
cd ${MYWORKDIR}
echo "[V] Done"
echo ""
echo "---------------------------------------------"
echo "RPM file: ${RPMFILE}"
echo "DEB file: ${DEBWORKDIR}/lynis_${LYNIS_VERSION}_amd64.deb"
echo "Tarball: ${TARBALL}"
echo "Tarball (SHA1): ${TARBALL_SHA1}"
echo ""
echo "Actions:"
echo " - Upload Debian package with dput (-f) my-ppa <source.changes>"
#=====================================================================
# Stop the script at this stage, rest is under development
Exit
#=====================================================================
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Test script for errors
echo -n "- Test Lynis script "
# Is file there?
if [ ! -f ${OPTION_BINARY_FILE} ]; then echo "BAD (can't find ${OPTION_BINARY_FILE})"; exit 1; fi
# Check script
FIND=$(sh -n ${OPTION_BINARY_FILE} ; echo $?)
if [ $FIND -eq 0 ]; then
echo "OK"
else
echo "BAD"
fi
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Create SHA1 hashes
echo -n "- Create SHA1 hashes "
SHA1HASH_LYNIS=$(grep -v '^#' ${OPTION_BINARY_FILE} | sha1)
echo "DONE"
echo " Lynis (SHA1): ${SHA1HASH_LYNIS}"
# Add hashes to script
echo -n "- Injecting SHA1 hash into Lynis script "
echo "-NOT DONE-"
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
echo -n "- Cleaning up OpenBSD package build... "
if [ -f openbsd/+CONTENTS ]; then rm openbsd/+CONTENTS; fi
echo "DONE"
OPENBSD_CONTENTS="openbsd/+CONTENTS"
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
echo -n "- Creating MD5 hashes..."
PACKAGE_LIST_FILES=$(grep "^file:" files.dat | cut -d ':' -f3)
for I in ${PACKAGE_LIST_FILES}; do
echo -n "${I} "
#FULLNAME=$(grep ":file:include:" files.dat)
#echo "${FULLNAME}" >> ${OPENBSD_CONTENTS}
echo "${I}" >> ${OPENBSD_CONTENTS}
FILE="../${I}"
MD5HASH=$(md5 -q ${FILE})
echo "@md5 ${MD5HASH}" >> ${OPENBSD_CONTENTS}
echo "@size 0000" >> ${OPENBSD_CONTENTS}
done
echo ""
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
echo -n "- Cleaning up... "
# Exit cleanly
Exit
echo "DONE"
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# The End!
|