[SOLVED]droopy - antiX shell script works BUT NOT with https

Ninho · posted: 2016-11-04 18:43

All in subj ! The included shell script fails to launch a secure droopy instance where a certificate.pem file is properly defined and advertised in the droopy.conf __{{emoticon}}__
There seem to be 2 errors reported, one of which about a missing env variable, and the script aborts without spawning a server console. Unfortunately I'm just a dummy who can't fix complex shell scripts, doesn't do python either, and I probably can't find my way to try and launch the pythonic droopy directly either. Did someone even test the setup with HTTPS ? Can they please attempt to fix it up ? Without https, the service's usefulness is severely impacted - limited to file exchanges on a private LAN, IMHO __{{emoticon}}__

...thank you !
--
Ninho

SamK · posted: 2016-11-04 18:59

As mentioned It is a bug in the script. I will fix it in due course.

Ninho wrote:Did someone even test the setup with HTTPS ?

Snarky comments are not well received and do not encourage a speedy response.

Ninho · posted: 2016-11-04 20:00

SamK wrote:As mentioned It is a bug in the script. I will fix it in due course.

As mentioned... where ? My bad, I must've missed the mention - else I would not have opened a thread, obviously.

Ninho wrote:Did someone even test the setup with HTTPS ?
Snarky comments are not well received and do not encourage a speedy response.

It was an honest question no offense or attack intended on anybody, I swear. Namely the perceived bug could've been attributable to the python program itself, and/or the shell script, and/or something wrong on my side. Glad to hear that it's not just me, that it's a known issue and one that is going to be fixed eventually. __{{emoticon}}__

I was going to enquire about an estimated date of arrival but I gonna keep my mouth shut in an attempt to avoid further misunderstanding... __{{emoticon}}__

Thank you very much...

skidoo · posted: 2016-11-04 20:40

I had forgotten (no credits/copyright in the sh script, right?) that SamK maintains the wrapper script.
Yesterday I drafted the following, but held off posting it.
Posting it now to suggest that antiX could (should?) ship a patched-and-maintained inhouse version of droopy rather than the dated version present in debian repos.

antiX (and debian repos) lack the latest version of droopy.

========= SCRAPER REMOVED AN EMBEDDED LINK HERE ===========
url was:"https://github.com/stackp/Droopy"
linktext was:"https://github.com/stackp/Droopy"
====================================

Before proceeding Ninho, I suggest you replace the content of /usr/local/bin/droopy with the content found here:

========= SCRAPER REMOVED AN EMBEDDED LINK HERE ===========
url was:"https://raw.githubusercontent.com/stackp/Droopy/master/droopy"
linktext was:"https://raw.githubusercontent.com/stack ... ter/droopy"
====================================

FWIW, working from that copy retrieved from github, for use on my machines, I would perform further modifications:

(security) @line 326

Code: Select all

                if filename =="":
                    continue

change to

Code: Select all

                if filename =="":
                    continue
                if filename.lower() =="index.html" or filename.lower() =="index.htm" or filename.lower() =="index.php":
                    self.log_message("an attempted indexfile upload was blocked")
                    self.send_response(303)
                    self.send_header('Location', '/')
                    self.end_headers()
                    continue

(security) @line 611

Code: Select all

<a href="http://stackp.online.fr/droopy-ip.php?port=%(port)d&ssl=%(ssl")d"> %(discover)s

change to

Code: Select all

<!-- Hi. I'm calling via plaintext http to letcha know I'm running a webserver. Come root my box. -->

SamK · posted: 2016-11-05 07:26

Ninho wrote:...no offense or attack intended on anybody...

Accepted. We can put it behind us and move on.

Ninho wrote:...I gonna keep my mouth shut in an attempt to avoid further misunderstanding... __{{emoticon}}__

No need to do that. Misunderstandings happen. The antiiX forum has a long-standing reputation for being friendly, polite and considerate of other members. The forum is actively and very well moderated, so keep posting.

skidoo wrote:...ship a patched-and-maintained inhouse version of droopy...

When someone thinks an app needs a patch, the usual route is to offer the patch directly to the author of the app. In that way the author can decide whether or not it should be adopted and result in a new version being released. When dealing with ones own machines only, it is of course, completely at the owner's discretion to make whatever modifications are desired. The author of Droopy is Pierre Duquesne with a published address of stackp@online.fr.

skidoo wrote:...rather than the dated version present in debian repos.

Have you requested the Debian maintainer of Droopy to update it to the 2015 version? That will produce the greatest benefit to the largest number of users. The maintainer is Benjamin Drung with published addresses of:
bdrung@debian.org
bdrung@ubuntu.com
benjamin.drung@profitbricks.com

Ninho · posted: 2016-11-05 10:44

@Skidoo : thanks, I replaced the upgraded version of the script. I don't pretend to understand the changes - is that mainly the fact that the new version is compatible to python3 ? - Whatever, new script is still not working with https - was to be expected, right ?

@SamK : sure thing, this forum collectively has been friendly and welcoming, and I have no intention of fueling arguments or rows albeit involuntarily.

skidoo · posted: 2016-11-05 17:20

published address(es) and... I would not pursue such an"excercise in futility".
Clearly the app is not well-maintained, vis the 2yr-old actionable pull requests at the github project homepage I linked.

As for Debian, in my experience, Debian BTS filings (same for launchpad.net) have proven futile in terms of achieving issue resolution. Their only merit seems to be raising awareness, so that other affected users realize"hey, it's not just you, the issue not specific to your system". FWIW, in the past,"for the greater good" to achieve upstream issue resolution, I've corresponded directly with the developers of: aufs, recoll, fotoxx, spacefm, cherrytree, etc.

Ninho · posted: 2016-11-06 17:15

Guys, I have solved it FWIW. The antiX stock 'droopy.sh' script lost a parameter when starting the server on line 147. A probable lapsus calami, the kind of stoopid inattentive mistake even a noob like me can catch __{{emoticon}}__

To correct, edit droopy.sh, line 147, so it reads :

Code: Select all

STARTSERVER="python /usr/local/bin/droopy $DOWNLOAD $AUTHORISE $PICTURE $MODE $PEMFILE"

$PEMFILE was missing from the original file.

Enjoy !

skidoo · posted: 2016-11-06 19:36

thanks for posting the solution.

SamK · posted: 2016-11-07 06:25

skidoo wrote:I would not pursue such an"excercise in futility".
Clearly the app is not well-maintained...

User contributions have been offered and accepted into the project. The most recent fix is dated August 29th 2016. A superficial skim of the closed issues indicates the author responds to them.

========= SCRAPER REMOVED AN EMBEDDED LINK HERE ===========
url was:"https://github.com/stackp/Droopy/commits/master"
linktext was:"https://github.com/stackp/Droopy/commits/master"
====================================

========= SCRAPER REMOVED AN EMBEDDED LINK HERE ===========
url was:"https://github.com/stackp/Droopy/issues?q=is%3Aissue+is%3Aclosed"
linktext was:"https://github.com/stackp/Droopy/issues ... s%3Aclosed"
====================================

skidoo wrote:As for Debian, in my experience, Debian BTS filings (same for launchpad.net) have proven futile in terms of achieving issue resolution.

Your experience of the Debian bug tracking system differs markedly mine. On the occasions I have used it, the Debian maintainers and the app authors have willingly become involved in pursuing the matters raised.

I make no criticism of your choice to decline to become involved with the usual change mechanisms, neither do I dispute your absolute right to do so. I merely remark that the one certain outcome of such a choice is that nothing changes upstream.