local file="$1" line key val

[[ -r "$file" ]] || return 0

while IFS= read -r line || [[ -n "$line" ]]; do

[[ "$line" =~ ^[[:space:]]*# ]] && continue

[[ "$line" =~ ^[[:space:]]*([A-Za-z_][A-Za-z0-9_]*)[[:space:]]*=(.*)$ ]] || continue

key="${BASH_REMATCH[1]}"

val="${BASH_REMATCH[2]}"

# Already in the environment? Then that is the answer, and this line is

# only what the file would have said.

[[ -n "${!key+set}" ]] && continue

# trailing whitespace, then one layer of matching quotes

val="${val%"${val##*[![:space:]]}"}"

if [[ "$val" == \"*\" && ${#val} -ge 2 ]]; then

val="${val:1:${#val}-2}"

elif [[ "$val" == \'*\' && ${#val} -ge 2 ]]; then

val="${val:1:${#val}-2}"

fi

printf -v "$key" '%s' "$val"

done <"$file"

return 0

local desc="$1"; shift

info "$desc"

if ! "$@"; then

warn "$desc -- failed (continuing)"

FAILED+=("$desc")

return 1

fi

local prompt="$1" default="${2:-n}" ans

interactive || { [[ "$default" == y ]]; return; }

read -r -p "$prompt " ans

ans="${ans:-$default}"

[[ "$ans" =~ ^[Yy] ]]

local login="$1"; shift

local home v

home="$(user_home "$login")"

[[ -n "$home" ]] || { warn "no home dir for $login"; return 1; }

# env -i, NOT the inherited environment. runuser -u keeps the caller's

# variables, and root's shell exports plenty that are wrong for anybody

# else. This script points root's shell at our .zshrc, which does

# 'export ZSH="$HOME/.oh-my-zsh"' -- so from the second run onwards root

# carries ZSH=/root/.oh-my-zsh, the oh-my-zsh installer honours it over

# $HOME, and the clone dies with

# fatal: cannot mkdir /root/.oh-my-zsh: Permission denied

# while ostensibly installing for someone else. NVM_DIR, ZDOTDIR,

# CARGO_HOME and the MISE_* family all leak the same way.

#

# Starting clean and letting bash -l rebuild from /etc/profile is the only

# version of this that stays correct as people add exports to the dotfiles.

local -a envs=(

HOME="$home" USER="$login" LOGNAME="$login" SHELL=/bin/bash

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

TERM="${TERM:-dumb}"

)

# a box behind a proxy still has to reach the network

for v in http_proxy https_proxy no_proxy HTTP_PROXY HTTPS_PROXY NO_PROXY; do

[[ -n "${!v:-}" ]] && envs+=("$v=${!v}")

done

# cd happens here, in the parent, while still root -- root can enter any

# directory, and the child then inherits a cwd its own user can reach.

# stdin from /dev/null: these run inside 'while read ... done < <(...)'

# loops, and anything that decides to prompt (a git credential helper on a

# 401, say) would otherwise eat the rest of the list being iterated.

if [[ "$login" == root ]]; then

( cd -- "$home" && env -i "${envs[@]}" bash -lc "$*" </dev/null )

else

( cd -- "$home" && runuser -u "$login" -- \

env -i "${envs[@]}" bash -lc "$*" </dev/null )

fi

local login="$1" url="$2" dest="$3"

if as_user "$login" "test -d '$dest/.git'"; then

as_user "$login" "git -C '$dest' fetch --quiet --depth 1 origin HEAD \

&& git -C '$dest' reset --quiet --hard FETCH_HEAD" \

|| as_user "$login" "git -C '$dest' pull --ff-only --quiet" || true

return

fi

# A directory that exists but is not a git checkout belongs to the user --

# ~/.tmux full of tpm plugins and saved sessions, say. The old 'rm -rf and

# clone' would delete the lot on the first re-run, so refuse instead.

if [[ -e "$dest" ]] && [[ -n "$(ls -A "$dest" 2>/dev/null)" ]]; then

warn "$dest exists and is not a git checkout -- left alone (not installing $url)"

return 1

fi

as_user "$login" "rm -rf '$dest' && git clone --depth 1 --quiet '$url' '$dest'"

local dest="$1" mode="${2:-0644}" tmp

tmp="$(mktemp)" || return 1

cat >"$tmp"

if [[ -f "$dest" ]] && cmp -s "$tmp" "$dest"; then

rm -f "$tmp"

chmod "$mode" "$dest"

return 1

fi

install -m "$mode" "$tmp" "$dest"

rm -f "$tmp"

return 0

local dest="$1" rel="$2" blob want

# No checkout, no history to compare against -- every file then looks

# user-edited, which is the safe answer rather than a wrong one.

[[ -n "$DOTFILES_DIR" ]] || return 1

command -v git >/dev/null || return 1

git -C "$DOTFILES_DIR" rev-parse --git-dir >/dev/null 2>&1 || return 1

blob="$(git -C "$DOTFILES_DIR" hash-object "$dest" 2>/dev/null)" || return 1

[[ -n "$blob" ]] || return 1

want="$(git -C "$DOTFILES_DIR" log --format='%H' --all -- "$rel" 2>/dev/null \

[[ "$want" == yes ]]

local src="$1" dest="$2" owner="$3" mode="${4:-0644}" rel="${5:-}"

local src_sha dest_sha recorded state

[[ -f "$src" ]] || return 0

# repo cloned into the very home we are installing to: same file

[[ "$src" -ef "$dest" ]] && return 0

rel="${rel:-$(basename "$dest")}"

state="$(_state_path "$owner" "$dest")"

src_sha="$(file_sha "$src")"

if [[ -e "$dest" ]]; then

dest_sha="$(file_sha "$dest")"

if [[ -n "$dest_sha" && "$dest_sha" == "$src_sha" ]]; then

_record_managed "$state" "$src_sha"

chown "$owner:$owner" "$dest" 2>/dev/null

return 0

fi

recorded="$(cat "$state" 2>/dev/null || true)"

if [[ "$FORCE_DOTFILES" == 1 ]]; then

cp -p "$dest" "$dest.bak" 2>/dev/null

warn "overwriting $dest (backup: $dest.bak)"

elif [[ -n "$recorded" && "$dest_sha" == "$recorded" ]]; then

: # we wrote it and it has not been touched since

elif _matches_repo_history "$dest" "$rel"; then

: # an older version of this same template

else

# theirs. Show them the new version without taking anything away.

if ! cmp -s "$src" "$dest.new" 2>/dev/null; then

install -m "$mode" -o "$owner" -g "$owner" "$src" "$dest.new" 2>/dev/null

fi

PRESERVED+=("$dest")

return 0

fi

fi

install -D -m "$mode" -o "$owner" -g "$owner" "$src" "$dest" \

|| { warn "could not install $dest"; return 1; }

_record_managed "$state" "$src_sha"

note "updated $dest"

return 0

local state="$1" sha="$2"

[[ -n "$sha" ]] || return 0

install -d -m 0700 "$(dirname "$state")" 2>/dev/null

printf '%s\n' "$sha" >"$state" 2>/dev/null || true

local l

if [[ -s "$USERS_STATE" ]]; then

while read -r l; do

[[ -n "$l" ]] && id -u "$l" >/dev/null 2>&1 && KNOWN_USERS+=("$l")

done <"$USERS_STATE"

fi

# Nothing recorded: this is either a fresh box or one provisioned by an

# older version of the script. Adopt the real humans already on it --

# regular uids, a home under /home, an actual login shell.

if [[ ${#KNOWN_USERS[@]} -eq 0 ]]; then

while IFS=: read -r l _ uid _ _ home shell; do

[[ "$uid" -ge 1000 && "$uid" -lt 65534 ]] || continue

[[ "$home" == /home/* && -d "$home" ]] || continue

[[ "$shell" == */nologin || "$shell" == */false ]] && continue

KNOWN_USERS+=("$l")

done < <(getent passwd)

fi

local login="$1"

install -d -m 0755 "$STATE_DIR"

touch "$USERS_STATE"

grep -qxF "$login" "$USERS_STATE" 2>/dev/null || printf '%s\n' "$login" >>"$USERS_STATE"

local out=() u l

for l in ${KNOWN_USERS[@]+"${KNOWN_USERS[@]}"}; do out+=("$l"); done

for u in ${USERS[@]+"${USERS[@]}"}; do

l="$(user_login "$u")"

printf '%s\n' "${out[@]+"${out[@]}"}" | grep -qxF "$l" || out+=("$l")

done

printf '%s\n' "${out[@]+"${out[@]}"}"

local raw="${SHARE_EXTRA_GROUPS//,/ }" g seen=" "

for g in $raw; do

[[ -n "$g" && "$g" != "$SHARE_GROUP" ]] || continue

[[ "$seen" == *" $g "* ]] && continue

seen+="$g "

printf '%s\n' "$g"

done

local dir="$1" recurse="${2:-0}" grp ok rc=0

local -a extras=()

while read -r grp; do [[ -n "$grp" ]] && extras+=("$grp"); done < <(_extra_share_groups)

[[ ${#extras[@]} -gt 0 ]] || return 0

if ! command -v setfacl >/dev/null 2>&1; then

warn "share: setfacl is missing -- '${extras[*]}' not granted on $dir (apt install acl)"

return 1

fi

for grp in "${extras[@]}"; do

if ! getent group "$grp" >/dev/null; then

warn "share: no group '$grp' -- not granted on $dir"

rc=1; continue

fi

ok=1

if [[ "$recurse" == 1 ]]; then

# rwX with a capital X: execute for directories and for files that

# already had it, nothing else. A flat rwx here would make every

# data file on the volume executable, which is the thing the

# separate $SHARE_FILE_MODE exists to avoid.

setfacl -R -m "g:$grp:rwX" "$dir" 2>/dev/null || ok=0

# Default entries are a directory-only concept, so they cannot ride

# along on the -R above -- it would fail on the first plain file.

[[ "$ok" == 1 ]] && { find "$dir" -type d -exec setfacl -m "d:g:$grp:rwx" {} + 2>/dev/null || ok=0; }

else