forked from FuelLabs/fuelup
-
Notifications
You must be signed in to change notification settings - Fork 0
/
fuelup-init.sh
executable file
·472 lines (401 loc) · 15.1 KB
/
fuelup-init.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
#!/bin/sh
set -e
FUELUP_DIR=${FUELUP_DIR-"$HOME/.fuelup"}
main() {
need_cmd git
need_cmd curl
need_cmd chmod
need_cmd mkdir
need_cmd rm
need_cmd rmdir
check_cargo_bin forc
check_cargo_bin forc-fmt
check_cargo_bin forc-explore
check_cargo_bin forc-lsp
check_cargo_bin fuel-core
get_architecture || return 1
local _arch="$RETVAL"
assert_nz "$_arch" "arch"
mkdir -p "$FUELUP_DIR/bin"
local _fuelup_version
_published_fuelup_version_url="https://raw.githubusercontent.com/FuelLabs/fuelup/gh-pages/fuelup-version"
_fuelup_version="$(curl -s $_published_fuelup_version_url)"
if echo "$_fuelup_version" | grep -q -E '404|400'; then
warn "fuelup-version was not found on fuelup gh-pages (https://github.com/FuelLabs/fuelup/tree/gh-pages); falling back to using GitHub API."
_fuelup_version="$(curl -s https://api.github.com/repos/FuelLabs/fuelup/releases/latest | grep "tag_name" | cut -d "\"" -f4 | cut -c 2-)"
fi
local _fuelup_url="https://github.com/FuelLabs/fuelup/releases/download/v${_fuelup_version}/fuelup-${_fuelup_version}-${_arch}.tar.gz"
local _dir
_dir="$(ensure mktemp -d)"
local _file="${_dir}/fuelup.tar.gz"
local _ansi_escapes_are_valid=false
if [ -t 2 ]; then
if [ "${TERM+set}" = 'set' ]; then
case "$TERM" in
xterm* | rxvt* | urxvt* | linux* | vt*)
_ansi_escapes_are_valid=true
;;
esac
fi
fi
# always prompt PATH modification, unless --no-modify-path provided
local prompt_modify=yes
# always install latest toolchain (for convenience), unless --skip-toolchain-installation provided
local skip_toolchain_installation=no
for arg in "$@"; do
case "$arg" in
--no-modify-path)
prompt_modify=no
;;
--skip-toolchain-installation)
skip_toolchain_installation=yes
;;
*)
OPTIND=1
if [ "${arg%%--*}" = "" ]; then
# Long option (other than --help);
# don't attempt to interpret it.
continue
fi
;;
esac
done
if [ "$prompt_modify" = "yes" ]; then
case $SHELL in
*/bash)
SHELL_PROFILE=$HOME/.bashrc
;;
*/zsh)
SHELL_PROFILE=$HOME/.zshrc
;;
*/fish)
SHELL_PROFILE=$HOME/.config/fish/config.fish
;;
*)
warn "Failed to detect shell; please add ${FUELUP_DIR}/bin to your PATH manually."
;;
esac
if [ -n "$SHELL_PROFILE" ]; then
preinstall_confirmation
read -r answer </dev/tty
allow_modify=$(echo "$answer" | cut -c1-1)
case $allow_modify in
"y" | "Y")
allow_modify=yes
printf "\nfuelup will modify your PATH variable for you.\n\n"
;;
*)
allow_modify=no
printf "\nfuelup will not modify your PATH variable for you.\n\n"
;;
esac
else
allow_modify=no
fi
fi
if $_ansi_escapes_are_valid; then
printf "\33[1minfo:\33[0m downloading fuelup %s\n" "$_fuelup_version" 1>&2
else
printf 'info: downloading fuelup %s\n' "$_fuelup_version" 1>&2
fi
ensure downloader "$_fuelup_url" "$_file" "$_arch"
ignore tar -xf "$_file" -C "$_dir"
ensure mv "$_dir/fuelup-${_fuelup_version}-${_arch}/fuelup" "$FUELUP_DIR/bin/fuelup"
ensure chmod u+x "$FUELUP_DIR/bin/fuelup"
if [ ! -x "$FUELUP_DIR/bin/fuelup" ]; then
printf '%s\n' "Cannot execute $FUELUP_DIR/bin/fuelup." 1>&2
printf '%s\n' "Please copy the file to a location where you can execute binaries and run ./fuelup." 1>&2
exit 1
fi
if [ "$skip_toolchain_installation" = "no" ]; then
ignore "$FUELUP_DIR/bin/fuelup" "toolchain" "install" "latest"
fi
local _retval=$?
ignore rm "$_file"
ignore rmdir "$_dir/fuelup-${_fuelup_version}-${_arch}"
ignore rmdir "$_dir"
printf '\n'
printf '%s\n' "fuelup ${_fuelup_version} has been installed in $FUELUP_DIR/bin. To fetch the latest toolchain containing the forc and fuel-core binaries, run 'fuelup toolchain install latest'." 1>&2
if [ "$allow_modify" = "yes" ]; then
if echo "$PATH" | grep -q "$FUELUP_DIR/bin"; then
printf "\n%s/bin already exists in your PATH.\n" "$FUELUP_DIR"
else
echo "export PATH=\"\$HOME/.fuelup/bin:\$PATH"\" >>"$SHELL_PROFILE"
printf "\n%s added to PATH. Run 'source %s' or start a new terminal session to use fuelup.\n" "$FUELUP_DIR" "$SHELL_PROFILE"
fi
else
add_path_message
fi
return "$_retval"
}
preinstall_confirmation() {
cat 1>&2 <<EOF
fuelup uses "$FUELUP_DIR" as its home directory to manage the Fuel toolchain, and will install binaries there.
To use the toolchain, you will have to configure your PATH, which tells your machine where to locate fuelup and the Fuel toolchain.
If permitted, fuelup-init will configure your PATH for you by running the following:
echo "export PATH="\$HOME/.fuelup/bin:\$PATH"" >> $SHELL_PROFILE
Would you like fuelup-init to modify your PATH variable for you? (N/y)
EOF
}
add_path_message() {
cat 1>&2 <<EOF
You might have to add $FUELUP_DIR/bin to path:
bash/zsh:
export PATH="\${HOME}/.fuelup/bin:\${PATH}"
fish:
fish_add_path ~/.fuelup/bin
EOF
}
get_architecture() {
local _ostype _cputype
_ostype="$(uname -s)"
_cputype="$(uname -m)"
case "$_ostype" in
Linux)
_ostype="unknown-linux-gnu"
;;
Darwin)
_ostype="apple-darwin"
;;
*)
err "unsupported os type: $_ostype"
;;
esac
case "$_cputype" in
x86_64 | x86-64 | x64 | amd64)
_cputype="x86_64"
;;
aarch64 | arm64)
_cputype="aarch64"
;;
*)
err "unsupported cpu type: $_cputype"
;;
esac
_arch="${_cputype}-${_ostype}"
RETVAL="$_arch"
}
check_cargo_bin() {
if which "${1}" 2>/dev/null | grep -q "[.cargo]"; then
warn "$1 is already installed via cargo and is in use by your system. You should update your PATH, or execute 'cargo uninstall $1'"
fi
}
assert_nz() {
if [ -z "$1" ]; then err "assert_nz $2"; fi
}
say() {
printf 'fuelup: %s\n' "$1"
}
need_cmd() {
if ! check_cmd "$1"; then
err "need '$1' (command not found)"
fi
}
check_cmd() {
command -v "$1" >/dev/null 2>&1
}
# Run a command that should never fail. If the command fails execution
# will immediately terminate with an error showing the failing
# command.
ensure() {
if ! "$@"; then err "command failed: $*"; fi
}
downloader() {
local _dld
local _ciphersuites
local _err
local _status
local _retry
if check_cmd curl; then
_dld=curl
elif check_cmd wget; then
_dld=wget
else
_dld='curl or wget' # to be used in error message of need_cmd
fi
if [ "$1" = --check ]; then
need_cmd "$_dld"
elif [ "$_dld" = curl ]; then
check_curl_for_retry_support
_retry="$RETVAL"
get_ciphersuites_for_curl
_ciphersuites="$RETVAL"
if [ -n "$_ciphersuites" ]; then
_err=$(curl $_retry --proto '=https' --tlsv1.2 --ciphers "$_ciphersuites" --silent --show-error --fail --location "$1" --output "$2" 2>&1)
_status=$?
else
echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
if ! check_help_for "$3" curl --proto --tlsv1.2; then
echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
_err=$(curl $_retry --silent --show-error --fail --location "$1" --output "$2" 2>&1)
_status=$?
else
_err=$(curl $_retry --proto '=https' --tlsv1.2 --silent --show-error --fail --location "$1" --output "$2" 2>&1)
_status=$?
fi
fi
if [ -n "$_err" ]; then
echo "$_err" >&2
if echo "$_err" | grep -q 404; then
err "fuelup ${_fuelup_version} was not found - either the release is not ready yet or the tag is invalid. You can check if the release is available here: https://github.com/FuelLabs/fuelup/releases/v${_fuelup_version}"
fi
fi
return $_status
elif [ "$_dld" = wget ]; then
if [ "$(wget -V 2>&1 | head -2 | tail -1 | cut -f1 -d" ")" = "BusyBox" ]; then
echo "Warning: using the BusyBox version of wget. Not enforcing strong cipher suites for TLS or TLS v1.2, this is potentially less secure"
_err=$(wget "$1" -O "$2" 2>&1)
_status=$?
else
get_ciphersuites_for_wget
_ciphersuites="$RETVAL"
if [ -n "$_ciphersuites" ]; then
_err=$(wget --https-only --secure-protocol=TLSv1_2 --ciphers "$_ciphersuites" "$1" -O "$2" 2>&1)
_status=$?
else
echo "Warning: Not enforcing strong cipher suites for TLS, this is potentially less secure"
if ! check_help_for "$3" wget --https-only --secure-protocol; then
echo "Warning: Not enforcing TLS v1.2, this is potentially less secure"
_err=$(wget "$1" -O "$2" 2>&1)
_status=$?
else
_err=$(wget --https-only --secure-protocol=TLSv1_2 "$1" -O "$2" 2>&1)
_status=$?
fi
fi
fi
if [ -n "$_err" ]; then
echo "$_err" >&2
if echo "$_err" | grep -q ' 404 Not Found$'; then
err "installer for platform '$3' not found, this may be unsupported"
fi
fi
return $_status
else
err "Unknown downloader" # should not reach here
fi
}
# Check if curl supports the --retry flag, then pass it to the curl invocation.
check_curl_for_retry_support() {
local _retry_supported=""
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
if check_help_for "notspecified" "curl" "--retry"; then
_retry_supported="--retry 3"
fi
RETVAL="$_retry_supported"
}
check_help_for() {
local _arch
local _cmd
local _arg
_arch="$1"
shift
_cmd="$1"
shift
local _category
if "$_cmd" --help | grep -q 'For all options use the manual or "--help all".'; then
_category="all"
else
_category=""
fi
case "$_arch" in
*darwin*)
if check_cmd sw_vers; then
case $(sw_vers -productVersion) in
10.*)
# If we're running on macOS, older than 10.13, then we always
# fail to find these options to force fallback
if [ "$(sw_vers -productVersion | cut -d. -f2)" -lt 13 ]; then
# Older than 10.13
echo "Warning: Detected macOS platform older than 10.13"
return 1
fi
;;
11.*)
# We assume Big Sur will be OK for now
;;
*)
# Unknown product version, warn and continue
echo "Warning: Detected unknown macOS major version: $(sw_vers -productVersion)"
echo "Warning TLS capabilities detection may fail"
;;
esac
fi
;;
esac
for _arg in "$@"; do
if ! "$_cmd" --help "$_category" | grep -q -- "$_arg"; then
return 1
fi
done
true # not strictly needed
}
# Return cipher suite string specified by user, otherwise return strong TLS 1.2-1.3 cipher suites
# if support by local tools is detected. Detection currently supports these curl backends:
# GnuTLS and OpenSSL (possibly also LibreSSL and BoringSSL). Return value can be empty.
get_ciphersuites_for_curl() {
if [ -n "${RUSTUP_TLS_CIPHERSUITES-}" ]; then
# user specified custom cipher suites, assume they know what they're doing
RETVAL="$RUSTUP_TLS_CIPHERSUITES"
return
fi
local _openssl_syntax="no"
local _gnutls_syntax="no"
local _backend_supported="yes"
if curl -V | grep -q ' OpenSSL/'; then
_openssl_syntax="yes"
elif curl -V | grep -iq ' LibreSSL/'; then
_openssl_syntax="yes"
elif curl -V | grep -iq ' BoringSSL/'; then
_openssl_syntax="yes"
elif curl -V | grep -iq ' GnuTLS/'; then
_gnutls_syntax="yes"
else
_backend_supported="no"
fi
local _args_supported="no"
if [ "$_backend_supported" = "yes" ]; then
# "unspecified" is for arch, allows for possibility old OS using macports, homebrew, etc.
if check_help_for "notspecified" "curl" "--tlsv1.2" "--ciphers" "--proto"; then
_args_supported="yes"
fi
fi
local _cs=""
if [ "$_args_supported" = "yes" ]; then
if [ "$_openssl_syntax" = "yes" ]; then
_cs=$(get_strong_ciphersuites_for "openssl")
elif [ "$_gnutls_syntax" = "yes" ]; then
_cs=$(get_strong_ciphersuites_for "gnutls")
fi
fi
RETVAL="$_cs"
}
# Return strong TLS 1.2-1.3 cipher suites in OpenSSL or GnuTLS syntax. TLS 1.2
# excludes non-ECDHE and non-AEAD cipher suites. DHE is excluded due to bad
# DH params often found on servers (see RFC 7919). Sequence matches or is
# similar to Firefox 68 ESR with weak cipher suites disabled via about:config.
# $1 must be openssl or gnutls.
get_strong_ciphersuites_for() {
if [ "$1" = "openssl" ]; then
# OpenSSL is forgiving of unknown values, no problems with TLS 1.3 values on versions that don't support it yet.
echo "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
elif [ "$1" = "gnutls" ]; then
# GnuTLS isn't forgiving of unknown values, so this may require a GnuTLS version that supports TLS 1.3 even if wget doesn't.
# Begin with SECURE128 (and higher) then remove/add to build cipher suites. Produces same 9 cipher suites as OpenSSL but in slightly different order.
echo "SECURE128:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS-ALL:-CIPHER-ALL:-MAC-ALL:-KX-ALL:+AEAD:+ECDHE-ECDSA:+ECDHE-RSA:+AES-128-GCM:+CHACHA20-POLY1305:+AES-256-GCM"
fi
}
err() {
say "$1" >&2
exit 1
}
warn() {
say "warning: ${1}" >&2
}
# This is just for indicating that commands' results are being
# intentionally ignored. Usually, because it's being executed
# as part of error handling.
ignore() {
"$@"
}
main "$@" || exit 1