Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 曾志威
|
0890deb31a | ||
|
曾志威
|
13918238eb |
+14
-26
@@ -2,29 +2,17 @@ kind: pipeline
|
||||
name: default
|
||||
|
||||
steps:
|
||||
# 步骤2：拉取其他 Git 项目（common-utils）
|
||||
- name: clone-other-project
|
||||
image: alpine/git:latest # 轻量 Git 镜像
|
||||
commands:
|
||||
# 拉取其他项目到指定目录
|
||||
- >
|
||||
git clone
|
||||
-b proj-snd-ess-3.1
|
||||
--depth 1
|
||||
https://zwzeng:glpat-Ht2452yuDgM84iNzu32b@git.ittx.com.cn/edi/edi-wms.git
|
||||
|
||||
# docker 打包
|
||||
- name: deploy
|
||||
image: registry.cn-hangzhou.aliyuncs.com/loghub/wms-system-service:gradle8
|
||||
commands:
|
||||
- cd edi-wms
|
||||
- >
|
||||
gradle jib -stacktrace
|
||||
--parallel
|
||||
-Pmax-workers=16
|
||||
-x test
|
||||
-PdockerBuild=true
|
||||
-Dcybertrans.idp.enabled=false
|
||||
-Djib.from.image=registry.cn-hangzhou.aliyuncs.com/loghub/wms-system-service:snde-jdk
|
||||
-Djib.to.image=registry.cn-hangzhou.aliyuncs.com/loghub/wms-system-service
|
||||
-Djib.to.tags=proj-walle-snde-edi-ess
|
||||
# docker 打包
|
||||
- name: docker
|
||||
image: plugins/docker
|
||||
settings:
|
||||
context: ./
|
||||
dockerfile: ./Dockerfile
|
||||
username:
|
||||
from_secret: docker_username
|
||||
password:
|
||||
from_secret: docker_password
|
||||
registry: https://registry.cn-hangzhou.aliyuncs.com
|
||||
repo: registry.cn-hangzhou.aliyuncs.com/loghub/mongo
|
||||
tags:
|
||||
- 8
|
||||
|
||||
+75
-3
@@ -1,5 +1,77 @@
|
||||
FROM rabbitmq:4.2-management-alpine
|
||||
# https://www.mongodb.com/zh-cn/docs/v8.2/tutorial/install-mongodb-on-red-hat/#install-mongodb-community-edition
|
||||
# https://repo.mongodb.org/yum/redhat/9/mongodb-org/8.2/x86_64/RPMS/
|
||||
|
||||
FROM oraclelinux:9-slim-fips
|
||||
|
||||
# 1. 更新系统并安装核心依赖
|
||||
# add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
|
||||
# RUN set -eux; \
|
||||
# groupadd --gid 999 --system mongodb; \
|
||||
# useradd --uid 999 --system --gid mongodb --home-dir /data/db mongodb; \
|
||||
# mkdir -p /data/db /data/configdb; \
|
||||
# chown -R mongodb:mongodb /data/db /data/configdb
|
||||
|
||||
|
||||
RUN set -eux; \
|
||||
apk update; \
|
||||
apk upgrade ;
|
||||
microdnf update -y; \
|
||||
microdnf upgrade -y;
|
||||
|
||||
|
||||
RUN set -eux; \
|
||||
{ \
|
||||
echo '[mongodb-org-8.2]'; \
|
||||
echo 'name=MongoDB Repository'; \
|
||||
echo 'baseurl=https://repo.mongodb.org/yum/redhat/9/mongodb-org/8.2/x86_64/'; \
|
||||
echo 'gpgcheck=1'; \
|
||||
echo 'enabled=1'; \
|
||||
echo 'gpgkey=https://pgp.mongodb.com/server-8.0.asc'; \
|
||||
} | tee /etc/yum.repos.d/mongodb-org-8.2.repo
|
||||
|
||||
RUN set -eux; \
|
||||
microdnf install -y \
|
||||
"mongodb-org-server"
|
||||
|
||||
# RUN set -eux; \
|
||||
# microdnf install -y \
|
||||
# "mongodb-org" \
|
||||
# "mongodb-org-database" \
|
||||
# "mongodb-mongosh" \
|
||||
# "mongodb-org-tools" ; \
|
||||
# mv /etc/mongod.conf /etc/mongod.conf.orig
|
||||
|
||||
# COPY bin/ /usr/bin/
|
||||
# RUN set -eux; \
|
||||
# chmod +x /usr/bin/mongotop; \
|
||||
# chmod +x /usr/bin/bsondump; \
|
||||
# chmod +x /usr/bin/mongodump; \
|
||||
# chmod +x /usr/bin/mongoexport; \
|
||||
# chmod +x /usr/bin/mongofiles; \
|
||||
# chmod +x /usr/bin/mongoimport; \
|
||||
# chmod +x /usr/bin/mongorestore; \
|
||||
# chmod +x /usr/bin/mongostat;
|
||||
|
||||
|
||||
# RUN set -eux; \
|
||||
# microdnf -y install curl-7.76.1-35.el9_7.3 libcurl-7.76.1-35.el9_7.3;
|
||||
|
||||
RUN set -eux; \
|
||||
microdnf clean all ;
|
||||
|
||||
RUN set -eux; \
|
||||
rpm -e --nodeps expat glib2 curl libcurl libssh libssh-config
|
||||
|
||||
COPY usr/lib64/ /usr/lib64/
|
||||
|
||||
VOLUME /data/db /data/configdb
|
||||
ENV HOME=/data/db
|
||||
|
||||
EXPOSE 27017
|
||||
CMD ["mongod", "--bind_ip_all"]
|
||||
|
||||
|
||||
# docker build -t registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.2 .
|
||||
# docker push registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.2
|
||||
# syft --scope squashed registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.2 -o spdx-json=mongo.json
|
||||
|
||||
# rpmextract.sh libcurl-7.76.1-35.el9_7.3.x86_64.rpm
|
||||
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
|
||||
services:
|
||||
mongo:
|
||||
image: registry.cn-shanghai.aliyuncs.com/hub_z/mongo:8.0
|
||||
container_name: mongo
|
||||
network_mode: "host"
|
||||
restart: unless-stopped # 除非手动停止，否则自动重启
|
||||
volumes:
|
||||
- ./data/db:/data/db
|
||||
environment:
|
||||
- MONGO_INITDB_ROOT_USERNAME=root
|
||||
- MONGO_INITDB_ROOT_PASSWORD=gd5A3EbMcXD#oq2!
|
||||
- TZ=Asia/Shanghai
|
||||
# command: mongod --dbpath /data/db --replSet rs1 --bind_ip_all --wiredTigerCacheSizeGB 1 --auth --keyFile /mongodb-keyfile
|
||||
@@ -0,0 +1,420 @@
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
if [ "${1:0:1}" = '-' ]; then
|
||||
set -- mongod "$@"
|
||||
fi
|
||||
|
||||
originalArgOne="$1"
|
||||
|
||||
# allow the container to be started with `--user`
|
||||
# all mongo* commands should be dropped to the correct user
|
||||
if [[ "$originalArgOne" == mongo* ]] && [ "$(id -u)" = '0' ]; then
|
||||
if [ "$originalArgOne" = 'mongod' ]; then
|
||||
find -L /data/configdb /data/db \! -user mongodb -exec chown mongodb '{}' +
|
||||
fi
|
||||
|
||||
# make sure we can write to stdout and stderr as "mongodb"
|
||||
# (for our "initdb" code later; see "--logpath" below)
|
||||
chown --dereference mongodb "/proc/$$/fd/1" "/proc/$$/fd/2" || :
|
||||
# ignore errors thanks to https://github.com/docker-library/mongo/issues/149
|
||||
|
||||
exec gosu mongodb "$BASH_SOURCE" "$@"
|
||||
fi
|
||||
|
||||
dpkgArch="$(dpkg --print-architecture)"
|
||||
case "$dpkgArch" in
|
||||
amd64) # https://github.com/docker-library/mongo/issues/485#issuecomment-891991814
|
||||
if ! grep -qE '^flags.* avx( .*|$)' /proc/cpuinfo; then
|
||||
{
|
||||
echo
|
||||
echo 'WARNING: MongoDB 5.0+ requires a CPU with AVX support, and your current system does not appear to have that!'
|
||||
echo ' see https://jira.mongodb.org/browse/SERVER-54407'
|
||||
echo ' see also https://www.mongodb.com/community/forums/t/mongodb-5-0-cpu-intel-g4650-compatibility/116610/2'
|
||||
echo ' see also https://github.com/docker-library/mongo/issues/485#issuecomment-891991814'
|
||||
echo
|
||||
} >&2
|
||||
fi
|
||||
;;
|
||||
|
||||
arm64) # https://github.com/docker-library/mongo/issues/485#issuecomment-970864306
|
||||
# https://en.wikichip.org/wiki/arm/armv8#ARMv8_Extensions_and_Processor_Features
|
||||
# http://javathunderx.blogspot.com/2018/11/cheat-sheet-for-cpuinfo-features-on.html
|
||||
if ! grep -qE '^Features.* (fphp|dcpop|sha3|sm3|sm4|asimddp|sha512|sve)( .*|$)' /proc/cpuinfo; then
|
||||
{
|
||||
echo
|
||||
echo 'WARNING: MongoDB requires ARMv8.2-A or higher, and your current system does not appear to implement any of the common features for that!'
|
||||
echo ' applies to all versions ≥5.0, any of 4.4 ≥4.4.19'
|
||||
echo ' see https://jira.mongodb.org/browse/SERVER-71772'
|
||||
echo ' see https://jira.mongodb.org/browse/SERVER-55178'
|
||||
echo ' see also https://en.wikichip.org/wiki/arm/armv8#ARMv8_Extensions_and_Processor_Features'
|
||||
echo ' see also https://github.com/docker-library/mongo/issues/485#issuecomment-970864306'
|
||||
echo
|
||||
} >&2
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
# you should use numactl to start your mongod instances, including the config servers, mongos instances, and any clients.
|
||||
# https://docs.mongodb.com/manual/administration/production-notes/#configuring-numa-on-linux
|
||||
if [[ "$originalArgOne" == mongo* ]]; then
|
||||
numa='numactl --interleave=all'
|
||||
if $numa true &> /dev/null; then
|
||||
set -- $numa "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
# usage: file_env VAR [DEFAULT]
|
||||
# ie: file_env 'XYZ_DB_PASSWORD' 'example'
|
||||
# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
|
||||
# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
|
||||
file_env() {
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
# see https://github.com/docker-library/mongo/issues/147 (mongod is picky about duplicated arguments)
|
||||
_mongod_hack_have_arg() {
|
||||
local checkArg="$1"; shift
|
||||
local arg
|
||||
for arg; do
|
||||
case "$arg" in
|
||||
"$checkArg"|"$checkArg"=*)
|
||||
return 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
return 1
|
||||
}
|
||||
# _mongod_hack_get_arg_val '--some-arg' "$@"
|
||||
_mongod_hack_get_arg_val() {
|
||||
local checkArg="$1"; shift
|
||||
while [ "$#" -gt 0 ]; do
|
||||
local arg="$1"; shift
|
||||
case "$arg" in
|
||||
"$checkArg")
|
||||
echo "$1"
|
||||
return 0
|
||||
;;
|
||||
"$checkArg"=*)
|
||||
echo "${arg#$checkArg=}"
|
||||
return 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
return 1
|
||||
}
|
||||
declare -a mongodHackedArgs
|
||||
# _mongod_hack_ensure_arg '--some-arg' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_arg() {
|
||||
local ensureArg="$1"; shift
|
||||
mongodHackedArgs=( "$@" )
|
||||
if ! _mongod_hack_have_arg "$ensureArg" "$@"; then
|
||||
mongodHackedArgs+=( "$ensureArg" )
|
||||
fi
|
||||
}
|
||||
# _mongod_hack_ensure_no_arg '--some-unwanted-arg' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_no_arg() {
|
||||
local ensureNoArg="$1"; shift
|
||||
mongodHackedArgs=()
|
||||
while [ "$#" -gt 0 ]; do
|
||||
local arg="$1"; shift
|
||||
if [ "$arg" = "$ensureNoArg" ]; then
|
||||
continue
|
||||
fi
|
||||
mongodHackedArgs+=( "$arg" )
|
||||
done
|
||||
}
|
||||
# _mongod_hack_ensure_no_arg '--some-unwanted-arg' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_no_arg_val() {
|
||||
local ensureNoArg="$1"; shift
|
||||
mongodHackedArgs=()
|
||||
while [ "$#" -gt 0 ]; do
|
||||
local arg="$1"; shift
|
||||
case "$arg" in
|
||||
"$ensureNoArg")
|
||||
shift # also skip the value
|
||||
continue
|
||||
;;
|
||||
"$ensureNoArg"=*)
|
||||
# value is already included
|
||||
continue
|
||||
;;
|
||||
esac
|
||||
mongodHackedArgs+=( "$arg" )
|
||||
done
|
||||
}
|
||||
# _mongod_hack_ensure_arg_val '--some-arg' 'some-val' "$@"
|
||||
# set -- "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_arg_val() {
|
||||
local ensureArg="$1"; shift
|
||||
local ensureVal="$1"; shift
|
||||
_mongod_hack_ensure_no_arg_val "$ensureArg" "$@"
|
||||
mongodHackedArgs+=( "$ensureArg" "$ensureVal" )
|
||||
}
|
||||
|
||||
# _js_escape 'some "string" value'
|
||||
_js_escape() {
|
||||
jq --null-input --arg 'str' "$1" '$str'
|
||||
}
|
||||
|
||||
: "${TMPDIR:=/tmp}"
|
||||
jsonConfigFile="$TMPDIR/docker-entrypoint-config.json"
|
||||
tempConfigFile="$TMPDIR/docker-entrypoint-temp-config.json"
|
||||
_parse_config() {
|
||||
if [ -s "$tempConfigFile" ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
local configPath
|
||||
if configPath="$(_mongod_hack_get_arg_val --config "$@")" && [ -s "$configPath" ]; then
|
||||
# if --config is specified, parse it into a JSON file so we can remove a few problematic keys (especially SSL-related keys)
|
||||
# see https://docs.mongodb.com/manual/reference/configuration-options/
|
||||
if grep -vEm1 '^[[:space:]]*(#|$)' "$configPath" | grep -qE '^[[:space:]]*[^=:]+[[:space:]]*='; then
|
||||
# if the first non-comment/non-blank line of the config file looks like "foo = ...", this is probably the 2.4 and older "ini-style config format"
|
||||
# mongod tries to parse config as yaml and then falls back to ini-style parsing
|
||||
# https://github.com/mongodb/mongo/blob/r6.0.3/src/mongo/util/options_parser/options_parser.cpp#L1883-L1894
|
||||
echo >&2
|
||||
echo >&2 "WARNING: it appears that '$configPath' is in the older INI-style format (replaced by YAML in MongoDB 2.6)"
|
||||
echo >&2 ' This script does not parse the older INI-style format, and thus will ignore it.'
|
||||
echo >&2
|
||||
return 1
|
||||
fi
|
||||
if [ "$mongoShell" = 'mongo' ]; then
|
||||
"$mongoShell" --norc --nodb --quiet --eval "load('/js-yaml.js'); printjson(jsyaml.load(cat($(_js_escape "$configPath"))))" > "$jsonConfigFile"
|
||||
else
|
||||
# https://www.mongodb.com/docs/manual/reference/method/js-native/#std-label-native-in-mongosh
|
||||
"$mongoShell" --norc --nodb --quiet --eval "load('/js-yaml.js'); JSON.stringify(jsyaml.load(fs.readFileSync($(_js_escape "$configPath"), 'utf8')))" > "$jsonConfigFile"
|
||||
fi
|
||||
if [ "$(head -c1 "$jsonConfigFile")" != '{' ] || [ "$(tail -c2 "$jsonConfigFile")" != '}' ]; then
|
||||
# if the file doesn't start with "{" and end with "}", it's *probably* an error ("uncaught exception: YAMLException: foo" for example), so we should print it out
|
||||
echo >&2 'error: unexpected "js-yaml.js" output while parsing config:'
|
||||
cat >&2 "$jsonConfigFile"
|
||||
exit 1
|
||||
fi
|
||||
jq 'del(.systemLog, .processManagement, .net, .security, .replication)' "$jsonConfigFile" > "$tempConfigFile"
|
||||
return 0
|
||||
fi
|
||||
|
||||
return 1
|
||||
}
|
||||
dbPath=
|
||||
_dbPath() {
|
||||
if [ -n "$dbPath" ]; then
|
||||
echo "$dbPath"
|
||||
return
|
||||
fi
|
||||
|
||||
if ! dbPath="$(_mongod_hack_get_arg_val --dbpath "$@")"; then
|
||||
if _parse_config "$@"; then
|
||||
dbPath="$(jq -r '.storage.dbPath // empty' "$jsonConfigFile")"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$dbPath" ]; then
|
||||
if _mongod_hack_have_arg --configsvr "$@" || {
|
||||
_parse_config "$@" \
|
||||
&& clusterRole="$(jq -r '.sharding.clusterRole // empty' "$jsonConfigFile")" \
|
||||
&& [ "$clusterRole" = 'configsvr' ]
|
||||
}; then
|
||||
# if running as config server, then the default dbpath is /data/configdb
|
||||
# https://docs.mongodb.com/manual/reference/program/mongod/#cmdoption-mongod-configsvr
|
||||
dbPath=/data/configdb
|
||||
fi
|
||||
fi
|
||||
|
||||
: "${dbPath:=/data/db}"
|
||||
|
||||
echo "$dbPath"
|
||||
}
|
||||
|
||||
if [ "$originalArgOne" = 'mongod' ]; then
|
||||
file_env 'MONGO_INITDB_ROOT_USERNAME'
|
||||
file_env 'MONGO_INITDB_ROOT_PASSWORD'
|
||||
|
||||
mongoShell='mongo'
|
||||
if ! command -v "$mongoShell" > /dev/null; then
|
||||
mongoShell='mongosh'
|
||||
fi
|
||||
|
||||
# pre-check a few factors to see if it's even worth bothering with initdb
|
||||
shouldPerformInitdb=
|
||||
if [ "$MONGO_INITDB_ROOT_USERNAME" ] && [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
# if we have a username/password, let's set "--auth"
|
||||
_mongod_hack_ensure_arg '--auth' "$@"
|
||||
set -- "${mongodHackedArgs[@]}"
|
||||
shouldPerformInitdb='true'
|
||||
elif [ "$MONGO_INITDB_ROOT_USERNAME" ] || [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
cat >&2 <<-'EOF'
|
||||
|
||||
error: missing 'MONGO_INITDB_ROOT_USERNAME' or 'MONGO_INITDB_ROOT_PASSWORD'
|
||||
both must be specified for a user to be created
|
||||
|
||||
EOF
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$shouldPerformInitdb" ]; then
|
||||
# if we've got any /docker-entrypoint-initdb.d/* files to parse later, we should initdb
|
||||
for f in /docker-entrypoint-initdb.d/*; do
|
||||
case "$f" in
|
||||
*.sh|*.js) # this should match the set of files we check for below
|
||||
shouldPerformInitdb="$f"
|
||||
break
|
||||
;;
|
||||
esac
|
||||
done
|
||||
fi
|
||||
|
||||
# check for a few known paths (to determine whether we've already initialized and should thus skip our initdb scripts)
|
||||
if [ -n "$shouldPerformInitdb" ]; then
|
||||
dbPath="$(_dbPath "$@")"
|
||||
for path in \
|
||||
"$dbPath/WiredTiger" \
|
||||
"$dbPath/journal" \
|
||||
"$dbPath/local.0" \
|
||||
"$dbPath/storage.bson" \
|
||||
; do
|
||||
if [ -e "$path" ]; then
|
||||
shouldPerformInitdb=
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [ -n "$shouldPerformInitdb" ]; then
|
||||
mongodHackedArgs=( "$@" )
|
||||
if _parse_config "$@"; then
|
||||
_mongod_hack_ensure_arg_val --config "$tempConfigFile" "${mongodHackedArgs[@]}"
|
||||
fi
|
||||
_mongod_hack_ensure_arg_val --bind_ip 127.0.0.1 "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_arg_val --port 27017 "${mongodHackedArgs[@]}"
|
||||
_mongod_hack_ensure_no_arg --bind_ip_all "${mongodHackedArgs[@]}"
|
||||
|
||||
# remove "--auth" and "--replSet" for our initial startup (see https://docs.mongodb.com/manual/tutorial/enable-authentication/#start-mongodb-without-access-control)
|
||||
# https://github.com/docker-library/mongo/issues/211
|
||||
_mongod_hack_ensure_no_arg --auth "${mongodHackedArgs[@]}"
|
||||
# "keyFile implies security.authorization"
|
||||
# https://docs.mongodb.com/manual/reference/configuration-options/#mongodb-setting-security.keyFile
|
||||
_mongod_hack_ensure_no_arg_val --keyFile "${mongodHackedArgs[@]}"
|
||||
if [ "$MONGO_INITDB_ROOT_USERNAME" ] && [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
_mongod_hack_ensure_no_arg_val --replSet "${mongodHackedArgs[@]}"
|
||||
fi
|
||||
|
||||
# "BadValue: need sslPEMKeyFile when SSL is enabled" vs "BadValue: need to enable SSL via the sslMode flag when using SSL configuration parameters"
|
||||
tlsMode='disabled'
|
||||
if _mongod_hack_have_arg '--tlsCertificateKeyFile' "$@"; then
|
||||
tlsMode='allowTLS'
|
||||
fi
|
||||
_mongod_hack_ensure_arg_val --tlsMode "$tlsMode" "${mongodHackedArgs[@]}"
|
||||
|
||||
if stat "/proc/$$/fd/1" > /dev/null && [ -w "/proc/$$/fd/1" ]; then
|
||||
# https://github.com/mongodb/mongo/blob/38c0eb538d0fd390c6cb9ce9ae9894153f6e8ef5/src/mongo/db/initialize_server_global_state.cpp#L237-L251
|
||||
# https://github.com/docker-library/mongo/issues/164#issuecomment-293965668
|
||||
_mongod_hack_ensure_arg_val --logpath "/proc/$$/fd/1" "${mongodHackedArgs[@]}"
|
||||
else
|
||||
initdbLogPath="$(_dbPath "$@")/docker-initdb.log"
|
||||
echo >&2 "warning: initdb logs cannot write to '/proc/$$/fd/1', so they are in '$initdbLogPath' instead"
|
||||
_mongod_hack_ensure_arg_val --logpath "$initdbLogPath" "${mongodHackedArgs[@]}"
|
||||
fi
|
||||
_mongod_hack_ensure_arg --logappend "${mongodHackedArgs[@]}"
|
||||
|
||||
pidfile="$TMPDIR/docker-entrypoint-temp-mongod.pid"
|
||||
rm -f "$pidfile"
|
||||
_mongod_hack_ensure_arg_val --pidfilepath "$pidfile" "${mongodHackedArgs[@]}"
|
||||
|
||||
"${mongodHackedArgs[@]}" --fork
|
||||
|
||||
mongo=( "$mongoShell" --host 127.0.0.1 --port 27017 --quiet )
|
||||
|
||||
# check to see that our "mongod" actually did start up (catches "--help", "--version", slow prealloc, etc)
|
||||
# https://jira.mongodb.org/browse/SERVER-16292
|
||||
tries=30
|
||||
while true; do
|
||||
if ! { [ -s "$pidfile" ] && ps "$(< "$pidfile")" &> /dev/null; }; then
|
||||
# bail ASAP if "mongod" isn't even running
|
||||
echo >&2
|
||||
echo >&2 "error: $originalArgOne does not appear to have stayed running -- perhaps it had an error?"
|
||||
echo >&2
|
||||
exit 1
|
||||
fi
|
||||
if "${mongo[@]}" 'admin' --eval 'quit(0)' &> /dev/null; then
|
||||
# success!
|
||||
break
|
||||
fi
|
||||
(( tries-- ))
|
||||
if [ "$tries" -le 0 ]; then
|
||||
echo >&2
|
||||
echo >&2 "error: $originalArgOne does not appear to have accepted connections quickly enough -- perhaps it had an error?"
|
||||
echo >&2
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
if [ "$MONGO_INITDB_ROOT_USERNAME" ] && [ "$MONGO_INITDB_ROOT_PASSWORD" ]; then
|
||||
rootAuthDatabase='admin'
|
||||
|
||||
"${mongo[@]}" "$rootAuthDatabase" <<-EOJS
|
||||
db.createUser({
|
||||
user: $(_js_escape "$MONGO_INITDB_ROOT_USERNAME"),
|
||||
pwd: $(_js_escape "$MONGO_INITDB_ROOT_PASSWORD"),
|
||||
roles: [ { role: 'root', db: $(_js_escape "$rootAuthDatabase") } ]
|
||||
})
|
||||
EOJS
|
||||
fi
|
||||
|
||||
export MONGO_INITDB_DATABASE="${MONGO_INITDB_DATABASE:-test}"
|
||||
|
||||
echo
|
||||
for f in /docker-entrypoint-initdb.d/*; do
|
||||
case "$f" in
|
||||
*.sh) echo "$0: running $f"; . "$f" ;;
|
||||
*.js) echo "$0: running $f"; "${mongo[@]}" "$MONGO_INITDB_DATABASE" "$f"; echo ;;
|
||||
*) echo "$0: ignoring $f" ;;
|
||||
esac
|
||||
echo
|
||||
done
|
||||
|
||||
"${mongodHackedArgs[@]}" --shutdown
|
||||
rm -f "$pidfile"
|
||||
|
||||
echo
|
||||
echo 'MongoDB init process complete; ready for start up.'
|
||||
echo
|
||||
fi
|
||||
|
||||
# MongoDB defaults to localhost-only binding
|
||||
haveBindIp=
|
||||
if _mongod_hack_have_arg --bind_ip "$@" || _mongod_hack_have_arg --bind_ip_all "$@"; then
|
||||
haveBindIp=1
|
||||
elif _parse_config "$@" && jq --exit-status '.net.bindIp // .net.bindIpAll' "$jsonConfigFile" > /dev/null; then
|
||||
haveBindIp=1
|
||||
fi
|
||||
if [ -z "$haveBindIp" ]; then
|
||||
# so if no "--bind_ip" is specified, let's add "--bind_ip_all"
|
||||
set -- "$@" --bind_ip_all
|
||||
fi
|
||||
|
||||
unset "${!MONGO_INITDB_@}"
|
||||
fi
|
||||
|
||||
rm -f "$jsonConfigFile" "$tempConfigFile"
|
||||
|
||||
exec "$@"
|
||||
@@ -0,0 +1,4 @@
|
||||
# Parse system-wide crypto configuration file
|
||||
Include /etc/crypto-policies/back-ends/libssh.config
|
||||
# Parse OpenSSH configuration file for consistency
|
||||
Include /etc/ssh/ssh_config
|
||||
@@ -0,0 +1,2 @@
|
||||
# Parse system-wide crypto configuration file
|
||||
Include /etc/crypto-policies/back-ends/libssh.config
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,15 @@
|
||||
Author(s):
|
||||
Aris Adamantiadis <aris@0xbadc0de.be> (project initiator)
|
||||
|
||||
Andreas Schneider <asn@cryptomilk.org> (developer)
|
||||
|
||||
Nick Zitzmann <seiryu (at) comcast (dot) net> (mostly client SFTP stuff)
|
||||
|
||||
Norbert Kiesel <nkiesel (at) tbdnetworks (dot) com> (getaddrinfo and other patches)
|
||||
|
||||
Jean-Philippe Garcia Ballester <giga (at) le-pec (dot) org> (Port to libgcrypt and configure.in voodoo, debian packaging)
|
||||
|
||||
Contributor(s):
|
||||
|
||||
Laurent Bigonville <bigon (at) bigon (dot) be> (debian packaging)
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
Some parts are under the BSDv2 License :
|
||||
|
||||
|
||||
Copyright (c) 2000 Markus Friedl. All rights reserved.
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
1. Redistributions of source code must retain the above copyright
|
||||
notice, this list of conditions and the following disclaimer.
|
||||
2. Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in the
|
||||
documentation and/or other materials provided with the distribution.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
@@ -0,0 +1,586 @@
|
||||
CHANGELOG
|
||||
=========
|
||||
|
||||
version 0.10.4 (released 2022-09-07)
|
||||
* Fixed issues with KDF on big endian
|
||||
|
||||
version 0.10.3 (released 2022-09-05)
|
||||
* Fixed possible infinite loop in known hosts checking
|
||||
|
||||
version 0.10.2 (released 2022-09-02)
|
||||
* Fixed tilde expansion when handling include directives
|
||||
* Fixed building the shared torture library
|
||||
* Made rekey test more robust (fixes running on i586 build systems e.g koji)
|
||||
|
||||
version 0.10.1 (released 2022-08-30)
|
||||
* Fixed proxycommand support
|
||||
* Fixed musl libc support
|
||||
|
||||
version 0.10.0 (released 2022-08-26)
|
||||
* Added support for OpenSSL 3.0
|
||||
* Added support for mbedTLS 3
|
||||
* Added support for Smart Cards (through openssl pkcs11 engine)
|
||||
* Added support for chacha20-poly1305@openssh.com with libgcrypt
|
||||
* Added support ed25519 keys in PEM files
|
||||
* Added support for sk-ecdsa and sk-ed25519 (server side)
|
||||
* Added support for limiting RSA key sizes and not accepting small one by
|
||||
default
|
||||
* Added support for ssh-agent on Windows
|
||||
* Added ssh_userauth_publickey_auto_get_current_identity() API
|
||||
* Added ssh_vlog() API
|
||||
* Added ssh_send_issue_banner() API
|
||||
* Added ssh_session_set_disconnect_message() API
|
||||
* Added new configuration options:
|
||||
+ IdentityAgent
|
||||
+ ModuliFile
|
||||
* Provided X11 client example
|
||||
* Disabled DSA support at build time by default (will be removed in the next
|
||||
release)
|
||||
* Deprecated the SCP API!
|
||||
* Deprecated old pubkey, privatekey API
|
||||
* Avoided some needless large stack buffers to minimize memory footprint
|
||||
* Removed support for OpenSSL < 1.0.1
|
||||
* Fixed parsing username@host in login name
|
||||
* Free global init mutex in the destructor on Windows
|
||||
* Fixed PEM parsing in mbedtls to support both legacy and new PKCS8 formats
|
||||
|
||||
version 0.9.6 (released 2021-08-26)
|
||||
* CVE-2021-3634: Fix possible heap-buffer overflow when rekeying with
|
||||
different key exchange mechanism
|
||||
* Fix several memory leaks on error paths
|
||||
* Reset pending_call_state on disconnect
|
||||
* Fix handshake bug with AEAD ciphers and no HMAC overlap
|
||||
* Use OPENSSL_CRYPTO_LIBRARIES in CMake
|
||||
* Ignore request success and failure message if they are not expected
|
||||
* Support more identity files in configuration
|
||||
* Avoid setting compiler flags directly in CMake
|
||||
* Support build directories with special characters
|
||||
* Include stdlib.h to avoid crash in Windows
|
||||
* Fix sftp_new_channel constructs an invalid object
|
||||
* Fix Ninja multiple rules error
|
||||
* Several tests fixes
|
||||
|
||||
version 0.9.5 (released 2020-09-10)
|
||||
* CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
|
||||
* Improve handling of library initialization (T222)
|
||||
* Fix parsing of subsecond times in SFTP (T219)
|
||||
* Make the documentation reproducible
|
||||
* Remove deprecated API usage in OpenSSL
|
||||
* Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
|
||||
* Define version in one place (T226)
|
||||
* Prevent invalid free when using different C runtimes than OpenSSL (T229)
|
||||
* Compatibility improvements to testsuite
|
||||
|
||||
version 0.9.4 (released 2020-04-09)
|
||||
* Fixed CVE-2020-1730 - Possible DoS in client and server when handling
|
||||
AES-CTR keys with OpenSSL
|
||||
* Added diffie-hellman-group14-sha256
|
||||
* Fixed serveral possible memory leaks
|
||||
|
||||
version 0.9.3 (released 2019-12-10)
|
||||
* Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution
|
||||
* SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
|
||||
* SSH-01-006 General: Various unchecked Null-derefs cause DOS
|
||||
* SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
|
||||
* SSH-01-010 SSH: Deprecated hash function in fingerprinting
|
||||
* SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
|
||||
* SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
|
||||
* SSH-01-001 State Machine: Initial machine states should be set explicitly
|
||||
* SSH-01-002 Kex: Differently bound macros used to iterate same array
|
||||
* SSH-01-005 Code-Quality: Integer sign confusion during assignments
|
||||
* SSH-01-008 SCP: Protocol Injection via unescaped File Names
|
||||
* SSH-01-009 SSH: Update documentation which RFCs are implemented
|
||||
* SSH-01-012 PKI: Information leak via uninitialized stack buffer
|
||||
|
||||
version 0.9.2 (released 2019-11-07)
|
||||
* Fixed libssh-config.cmake
|
||||
* Fixed issues with rsa algorithm negotiation (T191)
|
||||
* Fixed detection of OpenSSL ed25519 support (T197)
|
||||
|
||||
version 0.9.1 (released 2019-10-25)
|
||||
* Added support for Ed25519 via OpenSSL
|
||||
* Added support for X25519 via OpenSSL
|
||||
* Added support for localuser in Match keyword
|
||||
* Fixed Match keyword to be case sensitive
|
||||
* Fixed compilation with LibreSSL
|
||||
* Fixed error report of channel open (T75)
|
||||
* Fixed sftp documentation (T137)
|
||||
* Fixed known_hosts parsing (T156)
|
||||
* Fixed build issue with MinGW (T157)
|
||||
* Fixed build with gcc 9 (T164)
|
||||
* Fixed deprecation issues (T165)
|
||||
* Fixed known_hosts directory creation (T166)
|
||||
|
||||
version 0.9.0 (released 2019-02-xx)
|
||||
* Added support for AES-GCM
|
||||
* Added improved rekeying support
|
||||
* Added performance improvements
|
||||
* Disabled blowfish support by default
|
||||
* Fixed several ssh config parsing issues
|
||||
* Added support for DH Group Exchange KEX
|
||||
* Added support for Encrypt-then-MAC mode
|
||||
* Added support for parsing server side configuration file
|
||||
* Added support for ECDSA/Ed25519 certificates
|
||||
* Added FIPS 140-2 compatibility
|
||||
* Improved known_hosts parsing
|
||||
* Improved documentation
|
||||
* Improved OpenSSL API usage for KEX, DH, and signatures
|
||||
|
||||
version 0.8.0 (released 2018-08-10)
|
||||
* Removed support for deprecated SSHv1 protocol
|
||||
* Added new connector API for clients
|
||||
* Added new known_hosts parsing API
|
||||
* Added support for OpenSSL 1.1
|
||||
* Added support for chacha20-poly1305 cipher
|
||||
* Added crypto backend for mbedtls crypto library
|
||||
* Added ECDSA support with gcrypt backend
|
||||
* Added advanced client and server testing using cwrap.org
|
||||
* Added support for curve25519-sha256 alias
|
||||
* Added support for global known_hosts file
|
||||
* Added support for symbol versioning
|
||||
* Improved ssh_config parsing
|
||||
* Improved threading support
|
||||
|
||||
version 0.7.5 (released 2017-04-13)
|
||||
* Fixed a memory allocation issue with buffers
|
||||
* Fixed PKI on Windows
|
||||
* Fixed some SSHv1 functions
|
||||
* Fixed config hostname expansion
|
||||
|
||||
version 0.7.4 (released 2017-02-03)
|
||||
* Added id_ed25519 to the default identity list
|
||||
* Fixed sftp EOF packet handling
|
||||
* Fixed ssh_send_banner() to confirm with RFC 4253
|
||||
* Fixed some memory leaks
|
||||
|
||||
version 0.7.3 (released 2016-01-23)
|
||||
* Fixed CVE-2016-0739
|
||||
* Fixed ssh-agent on big endian
|
||||
* Fixed some documentation issues
|
||||
|
||||
version 0.7.2 (released 2015-09-15)
|
||||
* Fixed OpenSSL detection on Windows
|
||||
* Fixed return status for ssh_userauth_agent()
|
||||
* Fixed KEX to prefer hmac-sha2-256
|
||||
* Fixed sftp packet handling
|
||||
* Fixed return values of ssh_key_is_(public|private)
|
||||
* Fixed bug in global success reply
|
||||
|
||||
version 0.7.1 (released 2015-06-30)
|
||||
* Fixed SSH_AUTH_PARTIAL auth with auto public key
|
||||
* Fixed memory leak in session options
|
||||
* Fixed allocation of ed25519 public keys
|
||||
* Fixed channel exit-status and exit-signal
|
||||
* Reintroduce ssh_forward_listen()
|
||||
|
||||
version 0.7.0 (released 2015-05-11)
|
||||
* Added support for ed25519 keys
|
||||
* Added SHA2 algorithms for HMAC
|
||||
* Added improved and more secure buffer handling code
|
||||
* Added callback for auth_none_function
|
||||
* Added support for ECDSA private key signing
|
||||
* Added more tests
|
||||
* Fixed a lot of bugs
|
||||
* Improved API documentation
|
||||
|
||||
version 0.6.5 (released 2015-04-29)
|
||||
* Fixed CVE-2015-3146
|
||||
* Fixed port handling in config file
|
||||
* Fixed the build with libgcrypt
|
||||
* Fixed SFTP endian issues (rlo #179)
|
||||
* Fixed uninitilized sig variable (rlo #167)
|
||||
* Fixed polling issues which could result in a hang
|
||||
* Fixed handling of EINTR in ssh_poll() (rlo #186)
|
||||
* Fixed C99 issues with __func__
|
||||
* Fixed some memory leaks
|
||||
* Improved macro detection on Windows
|
||||
|
||||
version 0.6.4 (released 2014-12-19)
|
||||
* Fixed CVE-2014-8132.
|
||||
* Added SHA-2 for session ID signing with ECDSA keys.
|
||||
* Added support for ECDSA host keys.
|
||||
* Added support for more ECDSA hostkey algorithms.
|
||||
* Added ssh_pki_key_ecdsa_name() API.
|
||||
* Fixed setting the bindfd only after successful listen.
|
||||
* Fixed issues with user created sockets.
|
||||
* Fixed several issues in libssh C++ wrapper.
|
||||
* Fixed several documentation issues.
|
||||
* Fixed channel exit-signal request.
|
||||
* Fixed X11 request screen number in messages.
|
||||
* Fixed several memory leaks.
|
||||
|
||||
version 0.6.3 (released 2014-03-04)
|
||||
* Fixed CVE-2014-0017.
|
||||
* Fixed memory leak with ecdsa signatures.
|
||||
|
||||
version 0.6.2 (released 2014-03-04)
|
||||
* security: fix for vulnerability CVE-2014-0017
|
||||
|
||||
version 0.6.1 (released 2014-02-08)
|
||||
* Added support for libgcrypt 1.6.
|
||||
* Added ssh_channel_accept_forward().
|
||||
* Added known_hosts heuristic during connection (#138).
|
||||
* Added getters for session cipher names.
|
||||
* Fixed decrypt of zero length buffer.
|
||||
* Fixed padding in RSA signature blobs.
|
||||
* Fixed DSA signature extraction.
|
||||
* Fixed some memory leaks.
|
||||
* Fixed read of non-connected socket.
|
||||
* Fixed thread dectection.
|
||||
|
||||
version 0.6.0 (released 2014-01-08)
|
||||
* Added new publicy key API.
|
||||
* Added new userauth API.
|
||||
* Added ssh_get_publickey_hash() function.
|
||||
* Added ssh_get_poll_flags() function.
|
||||
* Added gssapi-mic userauth.
|
||||
* Added GSSAPIServerIdentity option.
|
||||
* Added GSSAPIClientIdentity option.
|
||||
* Added GSSAPIDelegateCredentials option.
|
||||
* Added new callback based server API.
|
||||
* Added Elliptic Curve DSA (ECDSA) support (with OpenSSL).
|
||||
* Added Elliptic Curve Diffie Hellman (ECDH) support.
|
||||
* Added Curve25519 for ECDH key exchange.
|
||||
* Added improved logging system.
|
||||
* Added SSH-agent forwarding.
|
||||
* Added key-reexchange.
|
||||
* Added more unit tests.
|
||||
* Improved documentation.
|
||||
* Fixed timeout handling.
|
||||
|
||||
version 0.5.5 (released 2013-07-26)
|
||||
* BUG 103: Fix ProxyCommand parsing.
|
||||
* Fix setting -D_FORTIFY_SOURCE=2.
|
||||
* Fix pollset error return if emtpy.
|
||||
* Fix NULL pointer checks in channel functions.
|
||||
* Several bugfixes.
|
||||
|
||||
version 0.5.4 (released 2013-01-22)
|
||||
* CVE-2013-0176 - NULL dereference leads to denial of service
|
||||
* Fixed several NULL pointer dereferences in SSHv1.
|
||||
* Fixed a free crash bug in options parsing.
|
||||
|
||||
version 0.5.3 (released 2012-11-20)
|
||||
* CVE-2012-4559 Fixed multiple double free() flaws.
|
||||
* CVE-2012-4560 Fixed multiple buffer overflow flaws.
|
||||
* CVE-2012-4561 Fixed multiple invalid free() flaws.
|
||||
* BUG #84 - Fix bug in sftp_mkdir not returning on error.
|
||||
* BUG #85 - Fixed a possible channel infinite loop if the connection dropped.
|
||||
* BUG #88 - Added missing channel request_state and set it to accepted.
|
||||
* BUG #89 - Reset error state to no error on successful SSHv1 authentiction.
|
||||
* Fixed a possible use after free in ssh_free().
|
||||
* Fixed multiple possible NULL pointer dereferences.
|
||||
* Fixed multiple memory leaks in error paths.
|
||||
* Fixed timeout handling.
|
||||
* Fixed regression in pre-connected socket setting.
|
||||
* Handle all unknown global messages.
|
||||
|
||||
version 0.5.2 (released 2011-09-17)
|
||||
* Increased window size x10.
|
||||
* Fixed SSHv1.
|
||||
* Fixed bugged lists.
|
||||
* Fixed use-after-free + inconsistent callbacks call in poll.
|
||||
* Fixed scp documentation.
|
||||
* Fixed possible infinite loop in channel_read().
|
||||
* Fixed handling of short reads of sftp_async_read().
|
||||
* Fixed handling request service timeout in blocking mode.
|
||||
* Fixed ssh_auth_list() documentation.
|
||||
* Fixed incorrect return values in ssh_channel_write().
|
||||
* Fixed an infinite loop in the termination callback.
|
||||
* Fixed handling of SSH_AGAIN in channel_open().
|
||||
* Fixed "status -5 inflating zlib packet"
|
||||
|
||||
version 0.5.1 (released 2011-08-09)
|
||||
* Added checks for NULL pointers in string.c.
|
||||
* Set the channel max packet size to 32768.
|
||||
* Don't (de)compress empty buffers.
|
||||
* Fixed ssh_scp_write so it works when doing recursive copy.
|
||||
* Fixed another source of endless wait.
|
||||
* Fixed an endless loop in case of a channel_open error.
|
||||
* Fixed session timeout handling.
|
||||
* Fixed ssh_channel_from_local() loop.
|
||||
* Fixed permissions of scp example when we copy a file.
|
||||
* Workaround ssh_get_user_home_dir on LDAP users.
|
||||
* Added pkg-config support for libssh_threads.
|
||||
* Fixed compilation without server and sftp modes.
|
||||
* Fix static .lib overwriting on Windows.
|
||||
|
||||
version 0.5.0 (released 2011-06-01)
|
||||
* Added ssh_ prefix to all functions.
|
||||
* Added complete Windows support.
|
||||
* Added improved server support.
|
||||
* Added unit tests for a lot of functions.
|
||||
* Added asynchronous service request.
|
||||
* Added a multiplatform ssh_getpass() function.
|
||||
* Added a tutorial.
|
||||
* Added a lot of documentation.
|
||||
* Fixed a lot of bugs.
|
||||
* Fixed several memory leaks.
|
||||
|
||||
version 0.4.8 (released 2011-01-15)
|
||||
* Fixed memory leaks in session signing.
|
||||
* Fixed memory leak in ssh_print_hexa.
|
||||
* Fixed problem with ssh_connect w/ timeout and fd > 1024.
|
||||
* Fixed some warnings on OS/2.
|
||||
* Fixed installation path for OS/2.
|
||||
|
||||
version 0.4.7 (released 2010-12-28)
|
||||
* Fixed a possible memory leak in ssh_get_user_home().
|
||||
* Fixed a memory leak in sftp_xstat.
|
||||
* Fixed uninitialized fd->revents member.
|
||||
* Fixed timout value in ssh_channel_accept().
|
||||
* Fixed length checks in ssh_analyze_banner().
|
||||
* Fixed a possible data overread and crash bug.
|
||||
* Fixed setting max_fd which breaks ssh_select().
|
||||
* Fixed some pedantic build warnings.
|
||||
* Fixed a memory leak with session->bindaddr.
|
||||
|
||||
version 0.4.6 (released 2010-09-03)
|
||||
* Added a cleanup function to free the ws2_32 library.
|
||||
* Fixed build with gcc 3.4.
|
||||
* Fixed the Windows build on Vista and newer.
|
||||
* Fixed the usage of WSAPoll() on Windows.
|
||||
* Fixed "@deprecated" in doxygen
|
||||
* Fixed some mingw warnings.
|
||||
* Fixed handling of opened channels.
|
||||
* Fixed keepalive problem on older openssh servers.
|
||||
* Fixed testing for big endian on Windows.
|
||||
* Fixed the Windows preprocessor macros and defines.
|
||||
|
||||
version 0.4.5 (released 2010-07-13)
|
||||
* Added option to bind a client to an ip address.
|
||||
* Fixed the ssh socket polling function.
|
||||
* Fixed Windows related bugs in bsd_poll().
|
||||
* Fixed serveral build warnings.
|
||||
|
||||
version 0.4.4 (released 2010-06-01)
|
||||
* Fixed a bug in the expand function for escape sequences.
|
||||
* Fixed a bug in the tilde expand function.
|
||||
* Fixed a bug in setting the options.
|
||||
|
||||
version 0.4.3 (released 2010-05-18)
|
||||
* Added global/keepalive responses.
|
||||
* Added runtime detection of WSAPoll().
|
||||
* Added a select(2) based poll-emulation if poll(2) is not available.
|
||||
* Added a function to expand an escaped string.
|
||||
* Added a function to expand the tilde from a path.
|
||||
* Added a proxycommand support.
|
||||
* Added ssh_privatekey_type public function
|
||||
* Added the possibility to define _OPENSSL_DIR and _ZLIB_DIR.
|
||||
* Fixed sftp_chown.
|
||||
* Fixed sftp_rename on protocol version 3.
|
||||
* Fixed a blocking bug in channel_poll.
|
||||
* Fixed config parsing wich has overwritten user specified values.
|
||||
* Fixed hashed [host]:port format in knownhosts
|
||||
* Fixed Windows build.
|
||||
* Fixed doublefree happening after a negociation error.
|
||||
* Fixed aes*-ctr with <= OpenSSL 0.9.7b.
|
||||
* Fixed some documentation.
|
||||
* Fixed exec example which has broken read usage.
|
||||
* Fixed broken algorithm choice for server.
|
||||
* Fixed a typo that we don't export all symbols.
|
||||
* Removed the unneeded dependency to doxygen.
|
||||
* Build examples only on the Linux plattform.
|
||||
|
||||
version 0.4.2 (released 2010-03-15)
|
||||
* Added owner and group information in sftp attributes.
|
||||
* Added missing SSH_OPTIONS_FD option.
|
||||
* Added printout of owner and group in the sftp example.
|
||||
* Added a prepend function for ssh_list.
|
||||
* Added send back replies to openssh's keepalives.
|
||||
* Fixed documentation in scp code
|
||||
* Fixed longname parsing, this only workings with readdir.
|
||||
* Fixed and added support for several identity files.
|
||||
* Fixed sftp_parse_longname() on Windows.
|
||||
* Fixed a race condition bug in ssh_scp_close()
|
||||
* Remove config support for SSHv1 Cipher variable.
|
||||
* Rename ssh_list_add to ssh_list_append.
|
||||
* Rename ssh_list_get_head to ssh_list_pop_head
|
||||
|
||||
version 0.4.1 (released 2010-02-13)
|
||||
* Added support for aes128-ctr, aes192-ctr and aes256-ctr encryption.
|
||||
* Added an example for exec.
|
||||
* Added private key type detection feature in privatekey_from_file().
|
||||
* Fixed zlib compression fallback.
|
||||
* Fixed kex bug that client preference should be prioritary
|
||||
* Fixed known_hosts file set by the user.
|
||||
* Fixed a memleak in channel_accept().
|
||||
* Fixed underflow when leave_function() are unbalanced
|
||||
* Fixed memory corruption in handle_channel_request_open().
|
||||
* Fixed closing of a file handle case of errors in privatekey_from_file().
|
||||
* Fixed ssh_get_user_home_dir() to be thread safe.
|
||||
* Fixed the doxygen documentation.
|
||||
|
||||
version 0.4.0 (released 2009-12-10)
|
||||
* Added scp support.
|
||||
* Added support for sending signals (RFC 4254, section 6.9).
|
||||
* Added MSVC support.
|
||||
* Added support for ~/.ssh/config.
|
||||
* Added sftp extension support.
|
||||
* Added X11 forwarding support for client.
|
||||
* Added forward listening.
|
||||
* Added support for openssh extensions (statvfs, fstatvfs).
|
||||
* Added a cleaned up interface for setting options.
|
||||
* Added a generic way to handle sockets asynchronously.
|
||||
* Added logging of the sftp flags used to open a file.
|
||||
* Added full poll() support and poll-emulation for win32.
|
||||
* Added missing 64bit functions in sftp.
|
||||
* Added support for ~/ and SSH_DIR/ in filenames instead of %s/.
|
||||
* Fixed Fix channel_get_exit_status bug.
|
||||
* Fixed calltrace logging to make it optional.
|
||||
* Fixed compilation on Solaris.
|
||||
* Fixed resolving of ip addresses.
|
||||
* Fixed libssh compilation without server support.
|
||||
* Fixed possible memory corruptions (ticket #14).
|
||||
|
||||
version 0.3.4 (released 2009-09-14)
|
||||
* Added ssh_basename and ssh_dirname.
|
||||
* Added a portable ssh_mkdir function.
|
||||
* Added a sftp_tell64() function.
|
||||
* Added missing NULL pointer checks to crypt_set_algorithms_server.
|
||||
* Fixed ssh_write_knownhost if ~/.ssh doesn't exist.
|
||||
* Fixed a possible integer overflow in buffer_get_data().
|
||||
* Fixed possible security bug in packet_decrypt().
|
||||
* Fixed a possible stack overflow in agent code.
|
||||
|
||||
version 0.3.3 (released 2009-08-18)
|
||||
* Fixed double free pointer crash in dsa_public_to_string.
|
||||
* Fixed channel_get_exit_status bug.
|
||||
* Fixed ssh_finalize which didn't clear the flag.
|
||||
* Fixed memory leak introduced by previous bugfix.
|
||||
* Fixed channel_poll broken when delayed EOF recvd.
|
||||
* Fixed stupid "can't parse known host key" bug.
|
||||
* Fixed possible memory corruption (ticket #14).
|
||||
|
||||
version 0.3.2 (released 2009-08-05)
|
||||
* Added ssh_init() function.
|
||||
* Added sftp_readlink() function.
|
||||
* Added sftp_symlink() function.
|
||||
* Fixed ssh_write_knownhost().
|
||||
* Fixed compilation on Solaris.
|
||||
* Fixed SSHv1 compilation.
|
||||
|
||||
version 0.3.1 (released 2009-07-14)
|
||||
* Added return code SSH_SERVER_FILE_NOT_FOUND.
|
||||
* Fixed compilation of SSHv1.
|
||||
* Fixed several memory leaks.
|
||||
* Fixed possible infinite loops.
|
||||
* Fixed a possible crash bug.
|
||||
* Fixed build warnings.
|
||||
* Fixed cmake on BSD.
|
||||
|
||||
version 0.3 (released 2009-05-21)
|
||||
* Added support for ssh-agent authentication.
|
||||
* Added POSIX like sftp implementation.
|
||||
* Added error checking to all functions.
|
||||
* Added const to arguments where it was needed.
|
||||
* Added a channel_get_exit_status() function.
|
||||
* Added a channel_read_buffer() function, channel_read() is now
|
||||
a POSIX like function.
|
||||
* Added a more generic auth callback function.
|
||||
* Added printf attribute checking for log and error functions.
|
||||
* Added runtime function tracer support.
|
||||
* Added NSIS build support with CPack.
|
||||
* Added openssh hashed host support.
|
||||
* Added API documentation for all public functions.
|
||||
* Added asynchronous SFTP read function.
|
||||
* Added a ssh_bind_set_fd() function.
|
||||
* Fixed known_hosts parsing.
|
||||
* Fixed a lot of build warnings.
|
||||
* Fixed the Windows build.
|
||||
* Fixed a lot of memory leaks.
|
||||
* Fixed a double free corruption in the server support.
|
||||
* Fixed the "ssh_accept:" bug in server support.
|
||||
* Fixed important channel bugs.
|
||||
* Refactored the socket handling.
|
||||
* Switched to CMake build system.
|
||||
* Improved performance.
|
||||
|
||||
version 0.2 (released 2007-11-29)
|
||||
* General cleanup
|
||||
* More comprehensive API
|
||||
* Up-to-date Doxygen documentation of each public function
|
||||
* Basic server-based support
|
||||
* Libgcrypt support (alternative to openssl and its license)
|
||||
* SSH1 support (disabled by default)
|
||||
* Added 3des-cbc
|
||||
* A lot of bugfixes
|
||||
|
||||
version 0.11-dev
|
||||
* Server implementation development.
|
||||
* Small bug corrected when connecting to sun ssh servers.
|
||||
* Channel weirdness corrected (writing huge data packets)
|
||||
* Channel_read_nonblocking added
|
||||
* Channel bug where stderr wasn't correctly read fixed.
|
||||
* Added sftp_file_set_nonblocking(), which is nonblocking SFTP IO
|
||||
* Connect_status callback.
|
||||
* Priv.h contains the internal functions, libssh.h the public interface
|
||||
* Options_set_timeout (thx marcelo) really working.
|
||||
* Tcp tunneling through channel_open_forward.
|
||||
* Channel_request_exec()
|
||||
* Channel_request_env()
|
||||
* Ssh_get_pubkey_hash()
|
||||
* Ssh_is_server_known()
|
||||
* Ssh_write_known_host()
|
||||
* Options_set_ssh_dir
|
||||
* How could this happen ! there weren't any channel_close !
|
||||
* Nasty channel_free bug resolved.
|
||||
* Removed the unsigned long all around the code. use only u8,u32 & u64.
|
||||
* It now compiles and runs under amd64 !
|
||||
* Channel_request_pty_size
|
||||
* Channel_change_pty_size
|
||||
* Options_copy()
|
||||
* Ported the doc to an HTML file.
|
||||
* Small bugfix in packet.c
|
||||
* Prefixed error constants with SSH_
|
||||
* Sftp_stat, sftp_lstat, sftp_fstat. thanks Michel Bardiaux for the patch.
|
||||
* Again channel number mismatch fixed.
|
||||
* Fixed a bug in ssh_select making the select fail when a signal has been
|
||||
caught.
|
||||
* Keyboard-interactive authentication working.
|
||||
|
||||
version 0.1 (released 2004-03-05)
|
||||
* Begining of sftp subsystem implementation.
|
||||
* Some cleanup into channels implementation
|
||||
* Now every channel functions is called by its CHANNEL handler.
|
||||
* Added channel_poll() and channel_read().
|
||||
* Changed the client so it uses the new channel_poll and channel_read interface
|
||||
* Small use-after-free bug with channels resolved
|
||||
* Changed stupidities in lot of function names.
|
||||
* Removed a debug output file opened by default.
|
||||
* Added API.txt, the libssh programmer handbook.
|
||||
* Various bug fixes from Nick Zitzmann.
|
||||
* Developed a cryptographic structure for handling protocols.
|
||||
* An autoconf script which took me half of a day to set up.
|
||||
* A ssh_select wrapper has been written.
|
||||
|
||||
version 0.0.4 (released 2003-10-10)
|
||||
* Some terminal code (eof handling) added
|
||||
* Channels bugfix (it still needs some tweaking though)
|
||||
* Zlib support
|
||||
* Added a wrapper.c file. The goal is to provide a similar API to every
|
||||
cryptographic functions. bignums and sha/md5 are wrapped now.
|
||||
* More work than it first looks.
|
||||
* Support for other crypto libs planed (lighter libs)
|
||||
* Fixed stupid select() bug.
|
||||
* Libssh now compiles and links with openssl 0.9.6
|
||||
* RSA pubkey authentication code now works !
|
||||
|
||||
version 0.0.3 (released 2003-09-15)
|
||||
* Added install target in makefile
|
||||
* Some cleanup in headers files and source code
|
||||
* Change default banner and project name to libssh.
|
||||
* New file auth.c to support more and more authentication ways
|
||||
* Bugfix(read offbyone) in send_kex
|
||||
* A base64 parser. don't read the source, it's awful. pure 0xbadc0de.
|
||||
* Changed the client filename to "ssh". logic isn't it ?
|
||||
* Dss publickey authentication ! still need to wait for the rsa one
|
||||
* Bugfix in packet.c
|
||||
* New misc.c contains misc functions
|
||||
|
||||
version 0.0.2 (released 2003-09-03)
|
||||
* Initial release.
|
||||
* Client supports both ssh and dss hostkey verification, but doesn't compare them to openssh's files. (~/.ssh/known_hosts)
|
||||
* The only supported authentication method is password.
|
||||
* Compiles on linux and openbsd. freebsd and netbsd should work, too
|
||||
* Lot of work which hasn't been discussed here.
|
||||
@@ -0,0 +1,44 @@
|
||||
_ _ _ _
|
||||
(_) (_) (_) (_)
|
||||
(_) _ (_) _ _ _ _ _ (_) _
|
||||
(_) (_) (_)(_) _ (_)(_) (_)(_) (_)(_) _
|
||||
(_) (_) (_) (_) _ (_) _ (_) (_) (_)
|
||||
(_) (_) (_)(_)(_) (_)(_) (_)(_) (_) (_).org
|
||||
|
||||
The SSH library
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
1* Why ?
|
||||
-_-_-_-_-_
|
||||
|
||||
Why not ? :) I've began to work on my own implementation of the ssh protocol
|
||||
because i didn't like the currently public ones.
|
||||
Not any allowed you to import and use the functions as a powerful library,
|
||||
and so i worked on a library-based SSH implementation which was non-existing
|
||||
in the free and open source software world.
|
||||
|
||||
|
||||
2* How/Who ?
|
||||
-_-_-_-_-_-_-_
|
||||
|
||||
If you downloaded this file, you must know what it is : a library for
|
||||
accessing ssh client services through C libraries calls in a simple manner.
|
||||
Everybody can use this software under the terms of the LGPL - see the COPYING
|
||||
file
|
||||
|
||||
If you ask yourself how to compile libssh, please read INSTALL before anything.
|
||||
|
||||
3* Where ?
|
||||
-_-_-_-_-_-_
|
||||
|
||||
https://www.libssh.org
|
||||
|
||||
4* Contributing
|
||||
-_-_-_-_-_-_-_-_-_
|
||||
|
||||
Please read the file 'CONTRIBUTING.md' next to this README file. It explains
|
||||
our copyright policy and how you should send patches for upstream inclusion.
|
||||
|
||||
Have fun and happy libssh hacking!
|
||||
|
||||
The libssh Team
|
||||
@@ -0,0 +1,22 @@
|
||||
COPYRIGHT AND PERMISSION NOTICE
|
||||
|
||||
Copyright (c) 1996 - 2021, Daniel Stenberg, <daniel@haxx.se>, and many
|
||||
contributors, see the THANKS file.
|
||||
|
||||
All rights reserved.
|
||||
|
||||
Permission to use, copy, modify, and distribute this software for any purpose
|
||||
with or without fee is hereby granted, provided that the above copyright
|
||||
notice and this permission notice appear in all copies.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN
|
||||
NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
||||
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
||||
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
|
||||
OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
Except as contained in this notice, the name of a copyright holder shall not
|
||||
be used in advertising or otherwise to promote the sale, use or other dealings
|
||||
in this Software without prior written authorization of the copyright holder.
|
||||
@@ -0,0 +1,469 @@
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
Version 2.1, February 1999
|
||||
|
||||
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
[This is the first released version of the Lesser GPL. It also counts
|
||||
as the successor of the GNU Library Public License, version 2, hence
|
||||
the version number 2.1.]
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
Licenses are intended to guarantee your freedom to share and change
|
||||
free software--to make sure the software is free for all its users.
|
||||
|
||||
This license, the Lesser General Public License, applies to some
|
||||
specially designated software packages--typically libraries--of the
|
||||
Free Software Foundation and other authors who decide to use it. You
|
||||
can use it too, but we suggest you first think carefully about whether
|
||||
this license or the ordinary General Public License is the better
|
||||
strategy to use in any particular case, based on the explanations below.
|
||||
|
||||
When we speak of free software, we are referring to freedom of use,
|
||||
not price. Our General Public Licenses are designed to make sure that
|
||||
you have the freedom to distribute copies of free software (and charge
|
||||
for this service if you wish); that you receive source code or can get
|
||||
it if you want it; that you can change the software and use pieces of
|
||||
it in new free programs; and that you are informed that you can do
|
||||
these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
distributors to deny you these rights or to ask you to surrender these
|
||||
rights. These restrictions translate to certain responsibilities for
|
||||
you if you distribute copies of the library or if you modify it.
|
||||
|
||||
For example, if you distribute copies of the library, whether gratis
|
||||
or for a fee, you must give the recipients all the rights that we gave
|
||||
you. You must make sure that they, too, receive or can get the source
|
||||
code. If you link other code with the library, you must provide
|
||||
complete object files to the recipients, so that they can relink them
|
||||
with the library after making changes to the library and recompiling
|
||||
it. And you must show them these terms so they know their rights.
|
||||
|
||||
We protect your rights with a two-step method: (1) we copyright the
|
||||
library, and (2) we offer you this license, which gives you legal
|
||||
permission to copy, distribute and/or modify the library.
|
||||
|
||||
To protect each distributor, we want to make it very clear that
|
||||
there is no warranty for the free library. Also, if the library is
|
||||
modified by someone else and passed on, the recipients should know
|
||||
that what they have is not the original version, so that the original
|
||||
author's reputation will not be affected by problems that might be
|
||||
introduced by others.
|
||||
|
||||
Finally, software patents pose a constant threat to the existence of
|
||||
any free program. We wish to make sure that a company cannot
|
||||
effectively restrict the users of a free program by obtaining a
|
||||
restrictive license from a patent holder. Therefore, we insist that
|
||||
any patent license obtained for a version of the library must be
|
||||
consistent with the full freedom of use specified in this license.
|
||||
|
||||
Most GNU software, including some libraries, is covered by the
|
||||
ordinary GNU General Public License. This license, the GNU Lesser
|
||||
General Public License, applies to certain designated libraries, and
|
||||
is quite different from the ordinary General Public License. We use
|
||||
this license for certain libraries in order to permit linking those
|
||||
libraries into non-free programs.
|
||||
|
||||
When a program is linked with a library, whether statically or using
|
||||
a shared library, the combination of the two is legally speaking a
|
||||
combined work, a derivative of the original library. The ordinary
|
||||
General Public License therefore permits such linking only if the
|
||||
entire combination fits its criteria of freedom. The Lesser General
|
||||
Public License permits more lax criteria for linking other code with
|
||||
the library.
|
||||
|
||||
We call this license the "Lesser" General Public License because it
|
||||
does Less to protect the user's freedom than the ordinary General
|
||||
Public License. It also provides other free software developers Less
|
||||
of an advantage over competing non-free programs. These disadvantages
|
||||
are the reason we use the ordinary General Public License for many
|
||||
libraries. However, the Lesser license provides advantages in certain
|
||||
special circumstances.
|
||||
|
||||
For example, on rare occasions, there may be a special need to
|
||||
encourage the widest possible use of a certain library, so that it becomes
|
||||
a de-facto standard. To achieve this, non-free programs must be
|
||||
allowed to use the library. A more frequent case is that a free
|
||||
library does the same job as widely used non-free libraries. In this
|
||||
case, there is little to gain by limiting the free library to free
|
||||
software only, so we use the Lesser General Public License.
|
||||
|
||||
In other cases, permission to use a particular library in non-free
|
||||
programs enables a greater number of people to use a large body of
|
||||
free software. For example, permission to use the GNU C Library in
|
||||
non-free programs enables many more people to use the whole GNU
|
||||
operating system, as well as its variant, the GNU/Linux operating
|
||||
system.
|
||||
|
||||
Although the Lesser General Public License is Less protective of the
|
||||
users' freedom, it does ensure that the user of a program that is
|
||||
linked with the Library has the freedom and the wherewithal to run
|
||||
that program using a modified version of the Library.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow. Pay close attention to the difference between a
|
||||
"work based on the library" and a "work that uses the library". The
|
||||
former contains code derived from the library, whereas the latter must
|
||||
be combined with the library in order to run.
|
||||
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License Agreement applies to any software library or other
|
||||
program which contains a notice placed by the copyright holder or
|
||||
other authorized party saying it may be distributed under the terms of
|
||||
this Lesser General Public License (also called "this License").
|
||||
Each licensee is addressed as "you".
|
||||
|
||||
A "library" means a collection of software functions and/or data
|
||||
prepared so as to be conveniently linked with application programs
|
||||
(which use some of those functions and data) to form executables.
|
||||
|
||||
The "Library", below, refers to any such software library or work
|
||||
which has been distributed under these terms. A "work based on the
|
||||
Library" means either the Library or any derivative work under
|
||||
copyright law: that is to say, a work containing the Library or a
|
||||
portion of it, either verbatim or with modifications and/or translated
|
||||
straightforwardly into another language. (Hereinafter, translation is
|
||||
included without limitation in the term "modification".)
|
||||
|
||||
"Source code" for a work means the preferred form of the work for
|
||||
making modifications to it. For a library, complete source code means
|
||||
all the source code for all modules it contains, plus any associated
|
||||
interface definition files, plus the scripts used to control compilation
|
||||
and installation of the library.
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running a program using the Library is not restricted, and output from
|
||||
such a program is covered only if its contents constitute a work based
|
||||
on the Library (independent of the use of the Library in a tool for
|
||||
writing it). Whether that is true depends on what the Library does
|
||||
and what the program that uses the Library does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Library's
|
||||
complete source code as you receive it, in any medium, provided that
|
||||
you conspicuously and appropriately publish on each copy an
|
||||
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||
all the notices that refer to this License and to the absence of any
|
||||
warranty; and distribute a copy of this License along with the
|
||||
Library.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy,
|
||||
and you may at your option offer warranty protection in exchange for a
|
||||
fee.
|
||||
|
||||
2. You may modify your copy or copies of the Library or any portion
|
||||
of it, thus forming a work based on the Library, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) The modified work must itself be a software library.
|
||||
|
||||
b) You must cause the files modified to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
c) You must cause the whole of the work to be licensed at no
|
||||
charge to all third parties under the terms of this License.
|
||||
|
||||
d) If a facility in the modified Library refers to a function or a
|
||||
table of data to be supplied by an application program that uses
|
||||
the facility, other than as an argument passed when the facility
|
||||
is invoked, then you must make a good faith effort to ensure that,
|
||||
in the event an application does not supply such function or
|
||||
table, the facility still operates, and performs whatever part of
|
||||
its purpose remains meaningful.
|
||||
|
||||
(For example, a function in a library to compute square roots has
|
||||
a purpose that is entirely well-defined independent of the
|
||||
application. Therefore, Subsection 2d requires that any
|
||||
application-supplied function or table used by this function must
|
||||
be optional: if the application does not supply it, the square
|
||||
root function must still compute square roots.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Library,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Library, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote
|
||||
it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Library.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Library
|
||||
with the Library (or with a work based on the Library) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||
License instead of this License to a given copy of the Library. To do
|
||||
this, you must alter all the notices that refer to this License, so
|
||||
that they refer to the ordinary GNU General Public License, version 2,
|
||||
instead of to this License. (If a newer version than version 2 of the
|
||||
ordinary GNU General Public License has appeared, then you can specify
|
||||
that version instead if you wish.) Do not make any other change in
|
||||
these notices.
|
||||
|
||||
Once this change is made in a given copy, it is irreversible for
|
||||
that copy, so the ordinary GNU General Public License applies to all
|
||||
subsequent copies and derivative works made from that copy.
|
||||
|
||||
This option is useful when you wish to copy part of the code of
|
||||
the Library into a program that is not a library.
|
||||
|
||||
4. You may copy and distribute the Library (or a portion or
|
||||
derivative of it, under Section 2) in object code or executable form
|
||||
under the terms of Sections 1 and 2 above provided that you accompany
|
||||
it with the complete corresponding machine-readable source code, which
|
||||
must be distributed under the terms of Sections 1 and 2 above on a
|
||||
medium customarily used for software interchange.
|
||||
|
||||
If distribution of object code is made by offering access to copy
|
||||
from a designated place, then offering equivalent access to copy the
|
||||
source code from the same place satisfies the requirement to
|
||||
distribute the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
5. A program that contains no derivative of any portion of the
|
||||
Library, but is designed to work with the Library by being compiled or
|
||||
linked with it, is called a "work that uses the Library". Such a
|
||||
work, in isolation, is not a derivative work of the Library, and
|
||||
therefore falls outside the scope of this License.
|
||||
|
||||
However, linking a "work that uses the Library" with the Library
|
||||
creates an executable that is a derivative of the Library (because it
|
||||
contains portions of the Library), rather than a "work that uses the
|
||||
library". The executable is therefore covered by this License.
|
||||
Section 6 states terms for distribution of such executables.
|
||||
|
||||
When a "work that uses the Library" uses material from a header file
|
||||
that is part of the Library, the object code for the work may be a
|
||||
derivative work of the Library even though the source code is not.
|
||||
Whether this is true is especially significant if the work can be
|
||||
linked without the Library, or if the work is itself a library. The
|
||||
threshold for this to be true is not precisely defined by law.
|
||||
|
||||
If such an object file uses only numerical parameters, data
|
||||
structure layouts and accessors, and small macros and small inline
|
||||
functions (ten lines or less in length), then the use of the object
|
||||
file is unrestricted, regardless of whether it is legally a derivative
|
||||
work. (Executables containing this object code plus portions of the
|
||||
Library will still fall under Section 6.)
|
||||
|
||||
Otherwise, if the work is a derivative of the Library, you may
|
||||
distribute the object code for the work under the terms of Section 6.
|
||||
Any executables containing that work also fall under Section 6,
|
||||
whether or not they are linked directly with the Library itself.
|
||||
|
||||
6. As an exception to the Sections above, you may also combine or
|
||||
link a "work that uses the Library" with the Library to produce a
|
||||
work containing portions of the Library, and distribute that work
|
||||
under terms of your choice, provided that the terms permit
|
||||
modification of the work for the customer's own use and reverse
|
||||
engineering for debugging such modifications.
|
||||
|
||||
You must give prominent notice with each copy of the work that the
|
||||
Library is used in it and that the Library and its use are covered by
|
||||
this License. You must supply a copy of this License. If the work
|
||||
during execution displays copyright notices, you must include the
|
||||
copyright notice for the Library among them, as well as a reference
|
||||
directing the user to the copy of this License. Also, you must do one
|
||||
of these things:
|
||||
|
||||
a) Accompany the work with the complete corresponding
|
||||
machine-readable source code for the Library including whatever
|
||||
changes were used in the work (which must be distributed under
|
||||
Sections 1 and 2 above); and, if the work is an executable linked
|
||||
with the Library, with the complete machine-readable "work that
|
||||
uses the Library", as object code and/or source code, so that the
|
||||
user can modify the Library and then relink to produce a modified
|
||||
executable containing the modified Library. (It is understood
|
||||
that the user who changes the contents of definitions files in the
|
||||
Library will not necessarily be able to recompile the application
|
||||
to use the modified definitions.)
|
||||
|
||||
b) Use a suitable shared library mechanism for linking with the
|
||||
Library. A suitable mechanism is one that (1) uses at run time a
|
||||
copy of the library already present on the user's computer system,
|
||||
rather than copying library functions into the executable, and (2)
|
||||
will operate properly with a modified version of the library, if
|
||||
the user installs one, as long as the modified version is
|
||||
interface-compatible with the version that the work was made with.
|
||||
|
||||
c) Accompany the work with a written offer, valid for at
|
||||
least three years, to give the same user the materials
|
||||
specified in Subsection 6a, above, for a charge no more
|
||||
than the cost of performing this distribution.
|
||||
|
||||
d) If distribution of the work is made by offering access to copy
|
||||
from a designated place, offer equivalent access to copy the above
|
||||
specified materials from the same place.
|
||||
|
||||
e) Verify that the user has already received a copy of these
|
||||
materials or that you have already sent this user a copy.
|
||||
|
||||
For an executable, the required form of the "work that uses the
|
||||
Library" must include any data and utility programs needed for
|
||||
reproducing the executable from it. However, as a special exception,
|
||||
the materials to be distributed need not include anything that is
|
||||
normally distributed (in either source or binary form) with the major
|
||||
components (compiler, kernel, and so on) of the operating system on
|
||||
which the executable runs, unless that component itself accompanies
|
||||
the executable.
|
||||
|
||||
It may happen that this requirement contradicts the license
|
||||
restrictions of other proprietary libraries that do not normally
|
||||
accompany the operating system. Such a contradiction means you cannot
|
||||
use both them and the Library together in an executable that you
|
||||
distribute.
|
||||
|
||||
7. You may place library facilities that are a work based on the
|
||||
Library side-by-side in a single library together with other library
|
||||
facilities not covered by this License, and distribute such a combined
|
||||
library, provided that the separate distribution of the work based on
|
||||
the Library and of the other library facilities is otherwise
|
||||
permitted, and provided that you do these two things:
|
||||
|
||||
a) Accompany the combined library with a copy of the same work
|
||||
based on the Library, uncombined with any other library
|
||||
facilities. This must be distributed under the terms of the
|
||||
Sections above.
|
||||
|
||||
b) Give prominent notice with the combined library of the fact
|
||||
that part of it is a work based on the Library, and explaining
|
||||
where to find the accompanying uncombined form of the same work.
|
||||
|
||||
8. You may not copy, modify, sublicense, link with, or distribute
|
||||
the Library except as expressly provided under this License. Any
|
||||
attempt otherwise to copy, modify, sublicense, link with, or
|
||||
distribute the Library is void, and will automatically terminate your
|
||||
rights under this License. However, parties who have received copies,
|
||||
or rights, from you under this License will not have their licenses
|
||||
terminated so long as such parties remain in full compliance.
|
||||
|
||||
9. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Library or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Library (or any work based on the
|
||||
Library), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Library or works based on it.
|
||||
|
||||
10. Each time you redistribute the Library (or any work based on the
|
||||
Library), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute, link with or modify the Library
|
||||
subject to these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties with
|
||||
this License.
|
||||
|
||||
11. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Library at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Library by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Library.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under any
|
||||
particular circumstance, the balance of the section is intended to apply,
|
||||
and the section as a whole is intended to apply in other circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
12. If the distribution and/or use of the Library is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Library under this License may add
|
||||
an explicit geographical distribution limitation excluding those countries,
|
||||
so that distribution is permitted only in or among countries not thus
|
||||
excluded. In such case, this License incorporates the limitation as if
|
||||
written in the body of this License.
|
||||
|
||||
13. The Free Software Foundation may publish revised and/or new
|
||||
versions of the Lesser General Public License from time to time.
|
||||
Such new versions will be similar in spirit to the present version,
|
||||
but may differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Library
|
||||
specifies a version number of this License which applies to it and
|
||||
"any later version", you have the option of following the terms and
|
||||
conditions either of that version or of any later version published by
|
||||
the Free Software Foundation. If the Library does not specify a
|
||||
license version number, you may choose any version ever published by
|
||||
the Free Software Foundation.
|
||||
|
||||
14. If you wish to incorporate parts of the Library into other free
|
||||
programs whose distribution conditions are incompatible with these,
|
||||
write to the author to ask for permission. For software which is
|
||||
copyrighted by the Free Software Foundation, write to the Free
|
||||
Software Foundation; we sometimes make exceptions for this. Our
|
||||
decision will be guided by the two goals of preserving the free status
|
||||
of all derivatives of our free software and of promoting the sharing
|
||||
and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||
DAMAGES.
|
||||
|
||||
Linking with OpenSSL
|
||||
|
||||
17. In addition, as a special exception, we give permission to link the code
|
||||
of its release of libssh with the OpenSSL project's "OpenSSL" library (or with
|
||||
modified versions of it that use the same license as the "OpenSSL" library),
|
||||
and distribute the linked executables. You must obey the GNU Lesser General
|
||||
Public License in all respects for all of the code used other than "OpenSSL".
|
||||
If you modify this file, you may extend this exception to your version of the
|
||||
file, but you are not obligated to do so. If you do not wish to do so, delete
|
||||
this exception statement from your version.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
Reference in New Issue
Block a user