mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-21 14:08:59 +02:00
Kristian Klausen
09cb1c3ed4
There is no reason for not offering (and using it ourselves) rsync mirroring over TLS these days which provides encryption, authentication and integrity. As the pacman database files are unsigned this also provides some protection against MITM tampering. Fix #298
41 lines
1.2 KiB
Django/Jinja
Executable File
41 lines
1.2 KiB
Django/Jinja
Executable File
#!/bin/bash
|
|
|
|
target="{{ item.value.target }}"
|
|
lock="/run/lock/sync{{ item.key }}.lck"
|
|
source_url='{{ item.value.source }}'
|
|
lastupdate_url='{{ item.value.last_update_url }}'
|
|
|
|
[ ! -d "${target}" ] && mkdir -p "${target}"
|
|
|
|
exec 9>"${lock}"
|
|
flock -n 9 || exit
|
|
|
|
{% set delay_updates = '--delay-updates' if item.value.delay_updates | default(true) %}
|
|
rsync_cmd() {
|
|
local -a cmd=(rsync{{ '-ssl --type=openssl' if item.value.tls | default(true) }} -rlptH --safe-links --delete-delay {{ delay_updates }}
|
|
"--timeout=600" --no-motd)
|
|
|
|
if stty &>/dev/null; then
|
|
cmd+=(-h -v --progress)
|
|
else
|
|
cmd+=("--info=name1")
|
|
fi
|
|
|
|
"${cmd[@]}" "$@"
|
|
}
|
|
|
|
# if we are called without a tty (cronjob) only run when there are changes
|
|
if ! tty -s && [[ -f "$target/{{ item.value.last_update_dst }}" ]] && diff -b <(curl -Ls "$lastupdate_url") "$target/{{ item.value.last_update_dst }}" >/dev/null; then
|
|
{% if item.value.save_lastsync | default(false) %}
|
|
# keep lastsync file in sync for statistics generated by the Arch Linux website
|
|
rsync_cmd "$source_url/lastsync" "$target/lastsync"
|
|
{% endif %}
|
|
exit 0
|
|
fi
|
|
|
|
rsync_cmd \
|
|
{% for opt in item.value.rsync_options | default() %}
|
|
{{ opt }} \
|
|
{% endfor %}
|
|
"${source_url}" "${target}"
|