use automake tools to install systemd files
PATCH 1/2 use automake tools to install systemd files
From: Christian Hesse <[email protected]...>
If systemd is enabled we install unit files to $libdir/systemd/system (or the path specified by SYSTEMD_UNIT_DIR).
The unit files are generated on the fly with matching $sbindir.
--- configure.ac | 10 ++++++++ distro/Makefile.am | 4 +--- distro/systemd/.gitignore | 1 + distro/systemd/Makefile.am | 27 ++++++++++++++++++++++ [email protected]... => [email protected]...} | 2 +- [email protected]... => [email protected]...} | 2 +- 6 files changed, 41 insertions(+), 5 deletions(-) create mode 100644 distro/systemd/.gitignore create mode 100644 distro/systemd/Makefile.am rename distro/systemd/{[email protected]... => [email protected]...} (89%) rename distro/systemd/{[email protected]... => [email protected]...} (83%)
configure.ac +10 -0
@@ -378,6 +378,7 @@ AC_ARG_VAR([NETSTAT], [path to netstat utility]) # tests AC_ARG_VAR([MAN2HTML], [path to man2html utility]) AC_ARG_VAR([GIT], [path to git utility]) AC_ARG_VAR([SYSTEMD_ASK_PASSWORD], [path to systemd-ask-password utility]) +AC_ARG_VAR([SYSTEMD_UNIT_DIR], [Path of systemd unit directory @<:@default=LIBDIR/systemd/system@:>@]) AC_PATH_PROGS([IFCONFIG], [ifconfig],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([ROUTE], [route],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([IPROUTE], [ip],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin])
@@ -1075,6 +1076,12 @@ if test "$enable_systemd" = "yes" ; then OPTIONAL_SYSTEMD_LIBS="${libsystemd_LIBS}" AC_DEFINE(ENABLE_SYSTEMD, 1, [Enable systemd integration]) LIBS="${saved_LIBS}" + + if test -n "${SYSTEMD_UNIT_DIR}"; then + systemdunitdir="${SYSTEMD_UNIT_DIR}" + else + systemdunitdir="\${libdir}/systemd/system" + fi fi
@@ -1250,6 +1257,8 @@ sampledir="\$(docdir)/sample" AC_SUBST([plugindir]) AC_SUBST([sampledir]) +AC_SUBST([systemdunitdir]) + VENDOR_SRC_ROOT="\$(abs_top_srcdir)/vendor/" VENDOR_DIST_ROOT="\$(abs_top_builddir)/vendor/dist" VENDOR_BUILD_ROOT="\$(abs_top_builddir)/vendor/.build"
@@ -1288,6 +1297,7 @@ AC_CONFIG_FILES([ distro/Makefile distro/rpm/Makefile distro/rpm/openvpn.spec + distro/systemd/Makefile include/Makefile src/Makefile src/compat/Makefile
distro/Makefile.am +1 -3
@@ -12,6 +12,4 @@ MAINTAINERCLEANFILES = \ $(srcdir)/Makefile.in -SUBDIRS = rpm - -EXTRA_DIST = systemd/[email protected]... systemd/[email protected]... +SUBDIRS = rpm systemd
distro/systemd/.gitignore new file +1 -0
@@ -0,0 +1 @@ +*.service
distro/systemd/Makefile.am new file +27 -0
@@ -0,0 +1,27 @@ +# +# OpenVPN -- An application to securely tunnel IP networks +# over a single UDP port, with support for SSL/TLS-based +# session authentication and key exchange, +# packet encryption, packet authentication, and +# packet compression. +# +# Copyright (C) 2017 OpenVPN Technologies, Inc. <[email protected]...> +# + +%.service: %.service.in Makefile + $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ + $< > [email protected] && mv [email protected] $@ + +EXTRA_DIST = \ + [email protected]... \ + [email protected]... + +if ENABLE_SYSTEMD +systemdunitdir = $(systemdunitdir) +systemdunit_DATA = \ + [email protected]... \ + [email protected]... +endif + +MAINTAINERCLEANFILES = \ + $(srcdir)/Makefile.in
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +1 -1
@@ -12,7 +12,7 @@ PrivateTmp=true RuntimeDirectory=openvpn-client RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/client -ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +ExecStart=@sbindir@ --suppress-timestamps --nobind --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +1 -1
@@ -12,7 +12,7 @@ PrivateTmp=true RuntimeDirectory=openvpn-server RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/server -ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf +ExecStart=@sbindir@ --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw
Signature · 1 line
2.11.0
PATCH 2/2 do not race on RuntimeDirectory
From: Christian Hesse <[email protected]...>
Different unit instances create and destroy the same RuntimeDirectory. This leads to running instances where the status file (and possibly more runtime data) is no longer accessible.
So do not handle this in unit files but provide a tmpfiles.d configuration and let systemd-tmpfiles do the work.
Nobody will (unintentionally) delete the directories and its content. As /run is volatile we do not have to care about cleanup.
--- configure.ac | 8 ++++++++ distro/systemd/Makefile.am | 8 ++++++++ distro/systemd/[email protected]... | 2 -- distro/systemd/[email protected]... | 2 -- distro/systemd/openvpn.conf | 2 ++ 5 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 distro/systemd/openvpn.conf
configure.ac +8 -0
@@ -379,6 +379,7 @@ AC_ARG_VAR([MAN2HTML], [path to man2html utility]) AC_ARG_VAR([GIT], [path to git utility]) AC_ARG_VAR([SYSTEMD_ASK_PASSWORD], [path to systemd-ask-password utility]) AC_ARG_VAR([SYSTEMD_UNIT_DIR], [Path of systemd unit directory @<:@default=LIBDIR/systemd/system@:>@]) +AC_ARG_VAR([TMPFILES_DIR], [Path of tmpfiles directory @<:@default=LIBDIR/tmpfiles.d@:>@]) AC_PATH_PROGS([IFCONFIG], [ifconfig],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([ROUTE], [route],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([IPROUTE], [ip],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin])
@@ -1082,6 +1083,12 @@ if test "$enable_systemd" = "yes" ; then else systemdunitdir="\${libdir}/systemd/system" fi + + if test -n "${TMPFILES_DIR}"; then + tmpfilesdir="${TMPFILES_DIR}" + else + tmpfilesdir="\${libdir}/tmpfiles.d" + fi fi
@@ -1258,6 +1265,7 @@ AC_SUBST([plugindir]) AC_SUBST([sampledir]) AC_SUBST([systemdunitdir]) +AC_SUBST([tmpfilesdir]) VENDOR_SRC_ROOT="\$(abs_top_srcdir)/vendor/" VENDOR_DIST_ROOT="\$(abs_top_builddir)/vendor/dist"
distro/systemd/Makefile.am +8 -0
@@ -12,7 +12,12 @@ $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ $< > [email protected] && mv [email protected] $@ +install-data-local: + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-client + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-server + EXTRA_DIST = \ + openvpn.conf \ [email protected]... \ [email protected]...
@@ -21,6 +26,9 @@ systemdunitdir = $(systemdunitdir) systemdunit_DATA = \ [email protected]... \ [email protected]... +tmpfilesdir = $(tmpfilesdir) +tmpfiles_DATA = \ + openvpn.conf endif MAINTAINERCLEANFILES = \
distro/systemd/[email protected]... +0 -2
@@ -9,8 +9,6 @@ Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] Type=notify PrivateTmp=true -RuntimeDirectory=openvpn-client -RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/client ExecStart=@sbindir@ --suppress-timestamps --nobind --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
distro/systemd/[email protected]... +0 -2
@@ -9,8 +9,6 @@ Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] Type=notify PrivateTmp=true -RuntimeDirectory=openvpn-server -RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/server ExecStart=@sbindir@ --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
distro/systemd/openvpn.conf new file +2 -0
@@ -0,0 +1,2 @@ +d /run/openvpn-client 0710 root root - +d /run/openvpn-server 0710 root root -
Signature · 1 line
2.11.0
Re: [Openvpn-devel] [PATCH 2/2] do not race on RuntimeDirectory
Quoted 21 lines · Christian Hesse
From: Christian Hesse <[email protected]...>
Different unit instances create and destroy the same RuntimeDirectory. This leads to running instances where the status file (and possibly more runtime data) is no longer accessible.
So do not handle this in unit files but provide a tmpfiles.d configuration and let systemd-tmpfiles do the work.
Nobody will (unintentionally) delete the directories and its content. As /run is volatile we do not have to care about cleanup.Signed-off-by Christian Hesse <[email protected]...>--- configure.ac | 8 ++++++++ distro/systemd/Makefile.am | 8 ++++++++ distro/systemd/[email protected]... | 2 -- distro/systemd/[email protected]... | 2 -- distro/systemd/openvpn.conf | 2 ++ 5 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 distro/systemd/openvpn.conf
[...snip...]
distro/systemd/Makefile.am line 17
Quoted 11 lines
distro/systemd/Makefile.am +3
-0@@ -12,7 +12,12 @@ $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ $< > [email protected] && mv [email protected] $@ +install-data-local: + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-client + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-server
Hmm ... that doesn't make much sense, does it?
$ mount | grep '/run ' tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755)
IIRC, upstream systemd recommends /run to be a ramdisk, as it should always be clean on freshly rebooted systems. And it probably saves a lot of SSD/flash storage write cycles, for those using that.
[...snip...]
distro/systemd/Makefile.am systemdunitdir = $(systemdunitdir) · line 29
Quoted 5 lines
distro/systemd/Makefile.am +1
-0@@ -21,6 +26,9 @@ systemdunitdir = $(systemdunitdir) systemdunit_DATA = \ [email protected]... \ [email protected]... +tmpfilesdir = $(tmpfilesdir)
This conflicts with AC_SUBST([tmpfilesdir])
$ autoreconf -vi autoreconf: Entering directory `.' autoreconf: configure.ac: not using Gettext autoreconf: running: aclocal -I m4 autoreconf: configure.ac: tracing autoreconf: running: libtoolize --copy autoreconf: running: /usr/bin/autoconf autoreconf: running: /usr/bin/autoheader autoreconf: running: automake --add-missing --copy --no-force distro/systemd/Makefile.am:28: warning: tmpfilesdir was already defined in condition TRUE, which includes condition ENABLE_SYSTEMD ... configure.ac:1293: ... 'tmpfilesdir' previously defined here autoreconf: Leaving directory `.' $ rpm -q autoconf autoconf-2.69-11.el7.noarch
Removing that tmpfilesdir declaration line in Makefile.am resolves this issue, and it still works as expected.
[...snip...]
distro/systemd/openvpn.conf line 2
Quoted 9 lines
distro/systemd/openvpn.conf new file +2
-0@@ -0,0 +1,2 @@ +d /run/openvpn-client 0710 root root - +d /run/openvpn-server 0710 root root -
This makes more sense though, as this will tell systemd to create these directories with the proper attributes.
But I'm not too happy about the filename in our git repository. The destination file may very well be called openvpn.conf, as then it should reside in $libdir/tmpfiles.d/ ... but openvpn.conf causes quite a bit of ambiguity inside the openvpn source tree, and unaware users might more see this as a sample configuration for OpenVPN and be even more confused.
I propose ... either rename this file to tmpfiles.d--openvpn.conf or move this openvpn.conf inside a tmpfiles.d/ subdirectory inside the ./distro/systemd/ directory.
Otherwise, this looks very reasonable.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Re: [Openvpn-devel] [PATCH 2/2] do not race on RuntimeDirectory
David Sommerseth <[email protected]...> on Fri, 2017/01/20 21:55:
Quoted 39 lines · Christian Hesse
Quoted 21 lines
From: Christian Hesse <[email protected]...>
Different unit instances create and destroy the same RuntimeDirectory. This leads to running instances where the status file (and possibly more runtime data) is no longer accessible.
So do not handle this in unit files but provide a tmpfiles.d configuration and let systemd-tmpfiles do the work.
Nobody will (unintentionally) delete the directories and its content. As /run is volatile we do not have to care about cleanup.Signed-off-by Christian Hesse <[email protected]...>--- configure.ac | 8 ++++++++ distro/systemd/Makefile.am | 8 ++++++++ distro/systemd/[email protected]... | 2 -- distro/systemd/[email protected]... | 2 -- distro/systemd/openvpn.conf | 2 ++ 5 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 distro/systemd/openvpn.conf[...snip...]
distro/systemd/Makefile.am line 17
Quoted 11 lines
distro/systemd/Makefile.am +3
-0@@ -12,7 +12,12 @@ $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ $< > [email protected] && mv [email protected] $@ +install-data-local: + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-client + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-serverHmm ... that doesn't make much sense, does it?
Quoted 6 lines
$ mount | grep '/run ' tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755)IIRC, upstream systemd recommends /run to be a ramdisk, as it should always be clean on freshly rebooted systems. And it probably saves a lot of SSD/flash storage write cycles, for those using that.
Well, the idea is: Files in /usr/lib/tmpfiles.d/ are handled by systemd-tmpfiles at boot time. We want these directories after installation (without a reboot) to be present - so just create them. Yes, these reside on tmpfs, but are created automatically after reboot.
As package managers should run a hook if files in /usr/lib/tmpfiles.d/ change (pacman does now) I am fine with removing this rule.
People installing manually may still stumble on this...
Quoted 26 lines
[...snip...]
distro/systemd/Makefile.am systemdunitdir = $(systemdunitdir) · line 29
Quoted 5 lines
distro/systemd/Makefile.am +1
-0@@ -21,6 +26,9 @@ systemdunitdir = $(systemdunitdir) systemdunit_DATA = \ [email protected]... \ [email protected]... +tmpfilesdir = $(tmpfilesdir)This conflicts with
AC_SUBST([tmpfilesdir])$ autoreconf -vi autoreconf: Entering directory `.' autoreconf: configure.ac: not using Gettext autoreconf: running: aclocal -I m4 autoreconf: configure.ac: tracing autoreconf: running: libtoolize --copy autoreconf: running: /usr/bin/autoconf autoreconf: running: /usr/bin/autoheader autoreconf: running: automake --add-missing --copy --no-force distro/systemd/Makefile.am:28: warning: tmpfilesdir was already defined in condition TRUE, which includes condition ENABLE_SYSTEMD ... configure.ac:1293: ... 'tmpfilesdir' previously defined here autoreconf: Leaving directory `.' $ rpm -q autoconf autoconf-2.69-11.el7.noarch
Quoted 2 lines
Removing that tmpfilesdir declaration line in Makefile.am resolves this issue, and it still works as expected.
Removed.
Quoted 21 lines
[...snip...]
distro/systemd/openvpn.conf line 2
Quoted 9 lines
distro/systemd/openvpn.conf new file +2
-0@@ -0,0 +1,2 @@ +d /run/openvpn-client 0710 root root - +d /run/openvpn-server 0710 root root -This makes more sense though, as this will tell systemd to create these directories with the proper attributes.
But I'm not too happy about the filename in our git repository. The destination file may very well be called openvpn.conf, as then it should reside in $libdir/tmpfiles.d/ ... but openvpn.conf causes quite a bit of ambiguity inside the openvpn source tree, and unaware users might more see this as a sample configuration for OpenVPN and be even more confused.
Quoted 5 lines
I propose ... either rename this file to tmpfiles.d--openvpn.conf or move this openvpn.conf inside a tmpfiles.d/ subdirectory inside the ./distro/systemd/ directory.
Otherwise, this looks very reasonable.
Reworked this... Are we ok renaming the file in automake target install-data-hook? Could not come up with a better solution.
I will send an updated patch soon.
Signature · 3 lines
main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH"
"CX:;",b;for(a/* Best regards my address: */=0;b=c[a++];)
putchar(b-1/(/* Chris cc -ox -xc - && ./x */b/42*2-3)*42);}Re: [Openvpn-devel] [PATCH 2/2] do not race on RuntimeDirectory
Quoted 52 lines · Christian Hesse
David Sommerseth <[email protected]...> on Fri, 2017/01/20 21:55:
Quoted 39 lines · Christian Hesse
Quoted 21 lines
From: Christian Hesse <[email protected]...>
Different unit instances create and destroy the same RuntimeDirectory. This leads to running instances where the status file (and possibly more runtime data) is no longer accessible.
So do not handle this in unit files but provide a tmpfiles.d configuration and let systemd-tmpfiles do the work.
Nobody will (unintentionally) delete the directories and its content. As /run is volatile we do not have to care about cleanup.Signed-off-by Christian Hesse <[email protected]...>--- configure.ac | 8 ++++++++ distro/systemd/Makefile.am | 8 ++++++++ distro/systemd/[email protected]... | 2 -- distro/systemd/[email protected]... | 2 -- distro/systemd/openvpn.conf | 2 ++ 5 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 distro/systemd/openvpn.conf[...snip...]
distro/systemd/Makefile.am line 17
Quoted 11 lines
distro/systemd/Makefile.am +3
-0@@ -12,7 +12,12 @@ $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ $< > [email protected] && mv [email protected] $@ +install-data-local: + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-client + $(INSTALL) -d -m0710 $(DESTDIR)/run/openvpn-serverHmm ... that doesn't make much sense, does it?
Quoted 6 lines
$ mount | grep '/run ' tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755)IIRC, upstream systemd recommends /run to be a ramdisk, as it should always be clean on freshly rebooted systems. And it probably saves a lot of SSD/flash storage write cycles, for those using that.
Well, the idea is: Files in
/usr/lib/tmpfiles.d/are handled by systemd-tmpfiles at boot time. We want these directories after installation (without a reboot) to be present - so just create them. Yes, these reside on tmpfs, but are created automatically after reboot.
Quoted 4 lines
As package managers should run a hook if files in
/usr/lib/tmpfiles.d/change (pacman does now) I am fine with removing this rule.People installing manually may still stumble on this...
Ahh I see. I've not done any 'make install' on my systems for years; I build proper packages through mock/rpmbuild and install those. So much of that magic happens there. And I believe rpmbuild can complain loudly if it tries to own directories on a tmpfs.
Okay, I'll ponder a little bit on this one and see what others do as well. You do have a valid point where users run 'make install' on a "production box".
Quoted 52 lines
Quoted 26 lines
[...snip...]
distro/systemd/Makefile.am systemdunitdir = $(systemdunitdir) · line 29
Quoted 5 lines
distro/systemd/Makefile.am +1
-0@@ -21,6 +26,9 @@ systemdunitdir = $(systemdunitdir) systemdunit_DATA = \ [email protected]... \ [email protected]... +tmpfilesdir = $(tmpfilesdir)This conflicts with
AC_SUBST([tmpfilesdir])$ autoreconf -vi autoreconf: Entering directory `.' autoreconf: configure.ac: not using Gettext autoreconf: running: aclocal -I m4 autoreconf: configure.ac: tracing autoreconf: running: libtoolize --copy autoreconf: running: /usr/bin/autoconf autoreconf: running: /usr/bin/autoheader autoreconf: running: automake --add-missing --copy --no-force distro/systemd/Makefile.am:28: warning: tmpfilesdir was already defined in condition TRUE, which includes condition ENABLE_SYSTEMD ... configure.ac:1293: ... 'tmpfilesdir' previously defined here autoreconf: Leaving directory `.' $ rpm -q autoconf autoconf-2.69-11.el7.noarchQuoted 2 lines
Removing that tmpfilesdir declaration line in Makefile.am resolves this issue, and it still works as expected.
Removed.
Quoted 21 lines
[...snip...]
distro/systemd/openvpn.conf line 2
Quoted 9 lines
distro/systemd/openvpn.conf new file +2
-0@@ -0,0 +1,2 @@ +d /run/openvpn-client 0710 root root - +d /run/openvpn-server 0710 root root -This makes more sense though, as this will tell systemd to create these directories with the proper attributes.
But I'm not too happy about the filename in our git repository. The destination file may very well be called openvpn.conf, as then it should reside in $libdir/tmpfiles.d/ ... but openvpn.conf causes quite a bit of ambiguity inside the openvpn source tree, and unaware users might more see this as a sample configuration for OpenVPN and be even more confused.
Quoted 8 lines
Quoted 5 lines
I propose ... either rename this file to tmpfiles.d--openvpn.conf or move this openvpn.conf inside a tmpfiles.d/ subdirectory inside the ./distro/systemd/ directory.
Otherwise, this looks very reasonable.
Reworked this... Are we ok renaming the file in automake target install-data-hook? Could not come up with a better solution.
Perhaps using a tmpfiles.d/ subdir inside distro/systemd is cleaner then.
Quoted 1 line
I will send an updated patch soon.
Thanks!
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Quoted 7 lines · Christian Hesse
From: Christian Hesse <[email protected]...>
If systemd is enabled we install unit files to $libdir/systemd/system (or the path specified by
SYSTEMD_UNIT_DIR).
The unit files are generated on the fly with matching $sbindir.Signed-off-by Christian Hesse <[email protected]...>
Quoted 12 lines
--- configure.ac | 10 ++++++++ distro/Makefile.am | 4 +--- distro/systemd/.gitignore | 1 + distro/systemd/Makefile.am | 27 ++++++++++++++++++++++ [email protected]... => [email protected]...} | 2 +- [email protected]... => [email protected]...} | 2 +- 6 files changed, 41 insertions(+), 5 deletions(-) create mode 100644 distro/systemd/.gitignore create mode 100644 distro/systemd/Makefile.am rename distro/systemd/{[email protected]... => [email protected]...} (89%) rename distro/systemd/{[email protected]... => [email protected]...} (83%)
Finally had some time to look at this! Some comments below.
[...snip...]
distro/systemd/.gitignore line 1
Quoted 5 lines
distro/systemd/.gitignore new file +1
-0@@ -0,0 +1 @@ +*.service
I think it is better to put all of these things into the .gitignore file in the project root directory. I see that this have slipped through a few times (./vendor, ./test/unit_tests and sample/sample-keys/) ... but as do ignore directories in the "master" .gitignore, I think we should have everything there. It will be easier to know where to look. And rather split things up when that master file gets too long and complicated.
Quoted 16 lines
distro/systemd/Makefile.am new file +10
-0@@ -0,0 +1,27 @@ +# +# OpenVPN -- An application to securely tunnel IP networks +# over a single UDP port, with support for SSL/TLS-based +# session authentication and key exchange, +# packet encryption, packet authentication, and +# packet compression. +# +# Copyright (C) 2017 OpenVPN Technologies, Inc. <[email protected]...> +# +
distro/systemd/Makefile.am line 20
Quoted 10 lines
distro/systemd/Makefile.am new file +10
-0+%.service: %.service.in Makefile + $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ + $< > [email protected] && mv [email protected] $@ + +EXTRA_DIST = \ + [email protected]... \ + [email protected]... + +if ENABLE_SYSTEMD +systemdunitdir = $(systemdunitdir)
This conflicts with AC_SUBST([systemdunitdir]) in configure.ac. So this line should not be here.
[...snip....]
distro/systemd/[email protected]... PrivateTmp=true · line 15
Quoted 13 lines
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +1
-1@@ -12,7 +12,7 @@ PrivateTmp=true RuntimeDirectory=openvpn-client RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/client -ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf [email protected]...@ --suppress-timestamps --nobind --config %i.conf
It should be: [email protected]...@/openvpn .... otherwise the generated files are pointing at a only a directory.
[...snip....]
distro/systemd/[email protected]... PrivateTmp=true · line 15
Quoted 13 lines
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +1
-1@@ -12,7 +12,7 @@ PrivateTmp=true RuntimeDirectory=openvpn-server RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/server -ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf [email protected]...@ --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
Same as above.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
David Sommerseth <[email protected]...> on Fri, 2017/01/20 21:39:
Quoted 28 lines · Christian Hesse
Quoted 18 lines
From: Christian Hesse <[email protected]...>
If systemd is enabled we install unit files to $libdir/systemd/system (or the path specified by
SYSTEMD_UNIT_DIR).
The unit files are generated on the fly with matching $sbindir.Signed-off-by Christian Hesse <[email protected]...>--- configure.ac | 10 ++++++++ distro/Makefile.am | 4 +--- distro/systemd/.gitignore | 1 + distro/systemd/Makefile.am | 27 ++++++++++++++++++++++ [email protected]... => [email protected]...} | 2 +- [email protected]... => [email protected]...} | 2 +- 6 files changed, 41 insertions(+), 5 deletions(-) create mode 100644 distro/systemd/.gitignore create mode 100644 distro/systemd/Makefile.am rename distro/systemd/{[email protected]... =>Quoted 3 lines
[email protected]...} (89%) rename distro/systemd/{[email protected]... => [email protected]....} (83%)
Finally had some time to look at this! Some comments below.
[...snip...]
Quoted 12 lines
distro/systemd/.gitignore line 1
Quoted 5 lines
distro/systemd/.gitignore new file +1
-0@@ -0,0 +1 @@ +*.serviceI think it is better to put all of these things into the .gitignore file in the project root directory. I see that this have slipped through a few times (./vendor, ./test/unit_tests and sample/sample-keys/) ... but as do ignore directories in the "master" .gitignore, I think we should have everything there. It will be easier to know where to look. And rather split things up when that master file gets too long and complicated.
I was not sure where you want this...
Moved it up to the root.
Quoted 21 lines
Quoted 21 lines
distro/systemd/Makefile.am new file +15
-0@@ -0,0 +1,27 @@ +# +# OpenVPN -- An application to securely tunnel IP networks +# over a single UDP port, with support for SSL/TLS-based +# session authentication and key exchange, +# packet encryption, packet authentication, and +# packet compression. +# +# Copyright (C) 2017 OpenVPN Technologies, Inc. <[email protected]...> +# + +%.service: %.service.in Makefile + $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ + $< > [email protected] && mv [email protected] $@ + +EXTRA_DIST = \
Quoted 8 lines
distro/systemd/Makefile.am line 20
Quoted 5 lines
distro/systemd/Makefile.am new file +5
-0+ [email protected]... \ + [email protected]... + +if ENABLE_SYSTEMD +systemdunitdir = $(systemdunitdir)This conflicts with
AC_SUBST([systemdunitdir])in configure.ac. So this line should not be here.
Removed.
Quoted 11 lines
[...snip....]
Quoted 9 lines
(quoted diff) +0
-0b/distro/systemd/[email protected]... similarity index 89% rename from distro/systemd/[email protected]... rename to distro/systemd/[email protected]... index 5618af3..d9fd6b0 100644
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +0
-0@@ -12,7 +12,7 @@ PrivateTmp=true RuntimeDirectory=openvpn-client
Quoted 8 lines
Quoted 5 lines
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +0
-1RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/client -ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config%i.conf [email protected]...@ --suppress-timestamps --nobind --config %i.conf
It should be: [email protected]...@/openvpn .... otherwise the generated files are pointing at a only a directory.
Ups, stupid me... Looks like I broke this with my final patch preparation. :-p
I will send updated patches soon.
Signature · 3 lines
main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH"
"CX:;",b;for(a/* Best regards my address: */=0;b=c[a++];)
putchar(b-1/(/* Chris cc -ox -xc - && ./x */b/42*2-3)*42);}PATCH 1/2 use automake tools to install systemd files
In reply to David SommersethFrom: Christian Hesse <[email protected]...>
If systemd is enabled we install unit files to $libdir/systemd/system (or the path specified by SYSTEMD_UNIT_DIR).
The unit files are generated on the fly with matching $sbindir.
--- .gitignore | 1 + configure.ac | 10 +++++++++ distro/Makefile.am | 4 +--- distro/systemd/Makefile.am | 26 ++++++++++++++++++++++ [email protected]... => [email protected]...} | 2 +- [email protected]... => [email protected]...} | 2 +- 6 files changed, 40 insertions(+), 5 deletions(-) create mode 100644 distro/systemd/Makefile.am rename distro/systemd/{[email protected]... => [email protected]...} (90%) rename distro/systemd/{[email protected]... => [email protected]...} (91%)
.gitignore +1 -0
@@ -51,6 +51,7 @@ config-msvc-local.h config-msvc-version.h doc/openvpn.8.html distro/rpm/openvpn.spec +distro/systemd/*.service sample/sample-keys/sample-ca/ vendor/.build vendor/dist
configure.ac +10 -0
@@ -378,6 +378,7 @@ AC_ARG_VAR([NETSTAT], [path to netstat utility]) # tests AC_ARG_VAR([MAN2HTML], [path to man2html utility]) AC_ARG_VAR([GIT], [path to git utility]) AC_ARG_VAR([SYSTEMD_ASK_PASSWORD], [path to systemd-ask-password utility]) +AC_ARG_VAR([SYSTEMD_UNIT_DIR], [Path of systemd unit directory @<:@default=LIBDIR/systemd/system@:>@]) AC_PATH_PROGS([IFCONFIG], [ifconfig],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([ROUTE], [route],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([IPROUTE], [ip],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin])
@@ -1099,6 +1100,12 @@ if test "$enable_systemd" = "yes" ; then OPTIONAL_SYSTEMD_LIBS="${libsystemd_LIBS}" AC_DEFINE(ENABLE_SYSTEMD, 1, [Enable systemd integration]) LIBS="${saved_LIBS}" + + if test -n "${SYSTEMD_UNIT_DIR}"; then + systemdunitdir="${SYSTEMD_UNIT_DIR}" + else + systemdunitdir="\${libdir}/systemd/system" + fi fi
@@ -1275,6 +1282,8 @@ sampledir="\$(docdir)/sample" AC_SUBST([plugindir]) AC_SUBST([sampledir]) +AC_SUBST([systemdunitdir]) + VENDOR_SRC_ROOT="\$(abs_top_srcdir)/vendor/" VENDOR_DIST_ROOT="\$(abs_top_builddir)/vendor/dist" VENDOR_BUILD_ROOT="\$(abs_top_builddir)/vendor/.build"
@@ -1313,6 +1322,7 @@ AC_CONFIG_FILES([ distro/Makefile distro/rpm/Makefile distro/rpm/openvpn.spec + distro/systemd/Makefile include/Makefile src/Makefile src/compat/Makefile
distro/Makefile.am +1 -3
@@ -12,6 +12,4 @@ MAINTAINERCLEANFILES = \ $(srcdir)/Makefile.in -SUBDIRS = rpm - -EXTRA_DIST = systemd/[email protected]... systemd/[email protected]... +SUBDIRS = rpm systemd
distro/systemd/Makefile.am new file +26 -0
@@ -0,0 +1,26 @@ +# +# OpenVPN -- An application to securely tunnel IP networks +# over a single UDP port, with support for SSL/TLS-based +# session authentication and key exchange, +# packet encryption, packet authentication, and +# packet compression. +# +# Copyright (C) 2017 OpenVPN Technologies, Inc. <[email protected]...> +# + +%.service: %.service.in Makefile + $(AM_V_GEN)sed -e 's|\@sbindir\@|$(sbindir)|' \ + $< > [email protected] && mv [email protected] $@ + +EXTRA_DIST = \ + [email protected]... \ + [email protected]... + +if ENABLE_SYSTEMD +systemdunit_DATA = \ + [email protected]... \ + [email protected]... +endif + +MAINTAINERCLEANFILES = \ + $(srcdir)/Makefile.in
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +1 -1
@@ -12,7 +12,7 @@ PrivateTmp=true RuntimeDirectory=openvpn-client RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/client -ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config %i.conf +ExecStart=@sbindir@/openvpn --suppress-timestamps --nobind --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw
distro/systemd/[email protected]... renamed from distro/systemd/[email protected]... +1 -1
@@ -12,7 +12,7 @@ PrivateTmp=true RuntimeDirectory=openvpn-server RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/server -ExecStart=/usr/sbin/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf +ExecStart=@sbindir@/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw
Signature · 1 line
2.11.0
PATCH 2/2 do not race on RuntimeDirectory
From: Christian Hesse <[email protected]...>
Different unit instances create and destroy the same RuntimeDirectory. This leads to running instances where the status file (and possibly more runtime data) is no longer accessible.
So do not handle this in unit files but provide a tmpfiles.d configuration and let systemd-tmpfiles do the work.
Nobody will (unintentionally) delete the directories and its content. As /run is volatile we do not have to care about cleanup.
--- configure.ac | 8 ++++++++ distro/systemd/Makefile.am | 6 ++++++ distro/systemd/[email protected]... | 2 -- distro/systemd/[email protected]... | 2 -- distro/systemd/tmpfiles-openvpn.conf | 2 ++ 5 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 distro/systemd/tmpfiles-openvpn.conf
configure.ac +8 -0
@@ -379,6 +379,7 @@ AC_ARG_VAR([MAN2HTML], [path to man2html utility]) AC_ARG_VAR([GIT], [path to git utility]) AC_ARG_VAR([SYSTEMD_ASK_PASSWORD], [path to systemd-ask-password utility]) AC_ARG_VAR([SYSTEMD_UNIT_DIR], [Path of systemd unit directory @<:@default=LIBDIR/systemd/system@:>@]) +AC_ARG_VAR([TMPFILES_DIR], [Path of tmpfiles directory @<:@default=LIBDIR/tmpfiles.d@:>@]) AC_PATH_PROGS([IFCONFIG], [ifconfig],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([ROUTE], [route],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin]) AC_PATH_PROGS([IPROUTE], [ip],, [$PATH:/usr/local/sbin:/usr/sbin:/sbin])
@@ -1106,6 +1107,12 @@ if test "$enable_systemd" = "yes" ; then else systemdunitdir="\${libdir}/systemd/system" fi + + if test -n "${TMPFILES_DIR}"; then + tmpfilesdir="${TMPFILES_DIR}" + else + tmpfilesdir="\${libdir}/tmpfiles.d" + fi fi
@@ -1283,6 +1290,7 @@ AC_SUBST([plugindir]) AC_SUBST([sampledir]) AC_SUBST([systemdunitdir]) +AC_SUBST([tmpfilesdir]) VENDOR_SRC_ROOT="\$(abs_top_srcdir)/vendor/" VENDOR_DIST_ROOT="\$(abs_top_builddir)/vendor/dist"
distro/systemd/Makefile.am +6 -0
@@ -13,6 +13,7 @@ $< > [email protected] && mv [email protected] $@ EXTRA_DIST = \ + tmpfiles-openvpn.conf \ [email protected]... \ [email protected]...
@@ -20,6 +21,11 @@ if ENABLE_SYSTEMD systemdunit_DATA = \ [email protected]... \ [email protected]... +tmpfiles_DATA = \ + tmpfiles-openvpn.conf + +install-data-hook: + mv $(DESTDIR)$(tmpfilesdir)/tmpfiles-openvpn.conf $(DESTDIR)$(tmpfilesdir)/openvpn.conf endif MAINTAINERCLEANFILES = \
distro/systemd/[email protected]... +0 -2
@@ -9,8 +9,6 @@ Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] Type=notify PrivateTmp=true -RuntimeDirectory=openvpn-client -RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/client ExecStart=@sbindir@/openvpn --suppress-timestamps --nobind --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
distro/systemd/[email protected]... +0 -2
@@ -9,8 +9,6 @@ Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] Type=notify PrivateTmp=true -RuntimeDirectory=openvpn-server -RuntimeDirectoryMode=0710 WorkingDirectory=/etc/openvpn/server ExecStart=@sbindir@/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
distro/systemd/tmpfiles-openvpn.conf new file +2 -0
@@ -0,0 +1,2 @@ +d /run/openvpn-client 0710 root root - +d /run/openvpn-server 0710 root root -
Signature · 1 line
2.11.0
Re: [Openvpn-devel] [PATCH 2/2] do not race on RuntimeDirectory
Just a very quick comment before I review and test the rest.
On 24/01/17 15:39, Christian Hesse wrote:
[...snip...]
distro/systemd/Makefile.am if ENABLE_SYSTEMD · line 29
Quoted 10 lines
distro/systemd/Makefile.am +5
-0@@ -20,6 +21,11 @@ if ENABLE_SYSTEMD systemdunit_DATA = \ [email protected]... \ [email protected]... +tmpfiles_DATA = \ + tmpfiles-openvpn.conf + +install-data-hook: + mv $(DESTDIR)$(tmpfilesdir)/tmpfiles-openvpn.conf $(DESTDIR)$(tmpfilesdir)/openvpn.conf endif
Disregard my earlier comment about subdir. I think this is reasonable enough in this case. It was not as hacky as I feared. And this Makefile.am is so small and isolated it is good enough for me.
If we regret it later on, it's an easy move into a tmpfiles.d subdir.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc
Re: [Openvpn-devel] [PATCH applied] systemd: Do not race on RuntimeDirectory
In reply to Christian Hesse-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ACK. I've tested this a bit, and it is very reasonable.
Your patch has been applied to the following branches
commit 3de7be7b17de879a78eea4afe4c918c6104c635d (master) commit e5492222a9ae5d31d69cc9e5cb57dc094cda556e (release/2.4)
Author: Christian Hesse Date: Tue Jan 24 15:39:47 2017 +0100
systemd: Do not race on RuntimeDirectory
Signed-off-by: Christian Hesse <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg13939.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYiPNEAAoJEIbPlEyWcf3yG3YQAKxRuzhC5wn8iEfNYlyTyc8+ UTs3L/sU2pp/jNwfcyjVTJxl0B5ZQb/o4Z3Br519dzXYU+UYMHYKwQpAjWDL0pyU Ma4XF1em4cnadY7AGtKnCer8JBZzIUDyjWZxmKNBOlzXoy5uKETJSxS0snuMJydC r6IgzsZqASeCUw5Z8s1WdM9bH3H+a6sjaVTgKOkd2VVfpgbTi4cEvhAusON6SFg2 j8PSrdqUwmG5TEUSGr6o8fTwmp0B6EAocMUQGuOzNON3yNifR7KlPDPu2s8IQVZL ee3mR0KFSaPrMm/EA2eJ7wWlqECCDAndlV4VdFLkJj5eXQ56dlkkPrXbxHSIKJpY 155fqL6aKunj6dDghIK3eoJbMVHSh9L9h6blSPhbZB635w75LILj0a0ocTPsRSvp OdnVP0sUj3XoWntG5iBYZzV09T9v6xEPMw6GuKskwfeWA5PdGf9qICX1ElpJ0oxm 3Rpo5+UqMQyyDD27jMmkI1bvx5Txs9M2r+JW3MP5+bAqsuIvn1rqjY0N/5EGxJiG 7CdL5TbT5FuO7n+gChWrSRGlKZIERVdOi1XVsstzqDQSBgYgKlKy5+9VEIxX2LKS fv6IEFwtX6pncOZ+kO/44GI1t8iajKhmDMf3kay8nKVu5UuzLMANR6jK0a6YsZAG 0SiQO+2n1Ly710IcCuqy
=5MIX
-----END PGP SIGNATURE-----
Re: [Openvpn-devel] [PATCH applied] systemd: Use automake tools to install unit files
In reply to Christian Hesse-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ACK. This works wonderfully, and I've tested a few different approaches.
I slightly modified the commit subject line, so it is clearer this is related to systemd.
Your patch has been applied to the following branches
commit ca5b4c2aad2370be7862660d274b7485f2d0af71 (master) commit a125229f509b593dff7ecc24e21b3de384b3fa98 (release/2.4)
Author: Christian Hesse Date: Tue Jan 24 15:39:46 2017 +0100
systemd: Use automake tools to install unit files
Signed-off-by: Christian Hesse <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg13940.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJYiPLCAAoJEIbPlEyWcf3yILQP/RvF3k2eicGox2aYmjrIALoU rVxFeM2M3nlv2KtJ79HqdN4p3TRvzziijdWFxvVrtRTzbediCqIPZEHrrNYvcfkp pU9QiPJr+SofPwWPr2Yv7UGMoJ8Rrj96Jx5FlZHUuPeCBLMlYPqIBXAZmVIM8osD wshPbBO9rumvAaNx9GkaNe+GNDYH909nmL79a1Mw/OQc+7huw7R7Xy37DorukQ3U tOUcs6Z/PV7j1Uc6sx1+DzFBTCh3whVvnJnK9PAHMomv8cgf4W81Zb0z0QEKmLBI llyVdQVaj3LBmZVhjPQ+Zq7GgP08znU0GHFrmoqSoGoa2+GHX6XGa4ox8Jeh0uTe 6yVNHFQFSL5TKXx0jxWSDiuZ5SWYTU3YNLKzipaYNaUvrs5m4lFOXuwac3w9NhSf uFOFBlNYgpWxrJhDulBd2TlXTf6zGEZHQZQvuCigfP34LnVr3CU7cegXdWA+JdSj YppOivlpKsHc0Mh6WUQGZgaLzulWhz2Dt+BFeHzCktOTS8pC1e3Wn/NqPLyCpJh2 xnMvMhYJsVBqx35Svrsvcm/5M7C+TtnqaEo0KaZT2VSTPIi6gMUdYtfnh7sFSf5J gBc6Y7WmrR9PmrdmjxDCKnadQNQ7L9Wg1aMHKT5ak18rRcKbxj7dLtvcjB2gtyGp O51NWaY63QLzXpsQsnE6
=Cyhw
-----END PGP SIGNATURE-----