swiyu-verifier (3497B)
1 #!/bin/sh 2 # This file is part of KyCH. 3 # Copyright (C) 2026 Taler Systems SA 4 # 5 # KyCH is free software; you can redistribute it and/or modify it under the 6 # terms of the GNU Affero General Public License as published by the Free 7 # Software Foundation; either version 3, or (at your option) any later version. 8 # 9 # KyCH is distributed in the hope that it will be useful, but WITHOUT ANY 10 # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR 11 # A PARTICULAR PURPOSE. See the GNU Affero General Public License for more 12 # details. 13 # 14 # You should have received a copy of the GNU Affero General Public License 15 # along with KyCH; see the file COPYING. If not, see 16 # <http://www.gnu.org/licenses/> 17 # 18 # 19 # Start the SWIYU Generic Verifier. This is what swiyu-verifier.service runs; 20 # it exists because three things have to be decided before the JVM starts and 21 # a systemd unit cannot decide them: 22 # 23 # * which Java to use -- the jar is built for Java 25, so the system default 24 # "java" is not necessarily the right one; 25 # * whether the private truststore built by the package's postinst exists, 26 # which it does not on a system without keytool; 27 # * the configuration files to add, which are under /etc and not in the jar. 28 # 29 # Arguments are passed on to the application, so Spring Boot's 30 # --property=value form works: 31 # 32 # swiyu-verifier --server.port=8081 33 # 34 set -eu 35 36 JAR=/usr/share/swiyu-verifier/swiyu-verifier.jar 37 CONFIG=/etc/swiyu-verifier/application.yml 38 TRUSTSTORE=/var/lib/swiyu-verifier/cacerts 39 40 if [ ! -r "$JAR" ]; then 41 echo "$JAR is missing; reinstall the swiyu-verifier package" 1>&2 42 exit 1 43 fi 44 45 # JAVA_HOME from the environment file wins, so that an administrator can point 46 # this at another runtime; otherwise prefer the Java the jar was built for and 47 # fall back to whatever is the system default. 48 if [ -n "${JAVA_HOME:-}" ] && [ -x "${JAVA_HOME}/bin/java" ]; then 49 JAVA="${JAVA_HOME}/bin/java" 50 else 51 JAVA= 52 for home in /usr/lib/jvm/java-25-openjdk-*; do 53 if [ -x "${home}/bin/java" ]; then 54 JAVA="${home}/bin/java" 55 break 56 fi 57 done 58 if [ -z "$JAVA" ]; then 59 JAVA=$(command -v java || true) 60 if [ -z "$JAVA" ]; then 61 echo "No Java runtime found; install openjdk-25-jre-headless" 1>&2 62 exit 1 63 fi 64 fi 65 fi 66 67 # Options for the JVM itself. Word splitting below is intentional and safe: 68 # every value here is a fixed, space-free path or literal. Note that Spring 69 # Boot reads spring.* from system properties as well as from the command line, 70 # which is what lets the configuration be passed as -D and keeps "$@" free for 71 # the caller's own arguments. 72 # 73 # The verifier timestamps its authorization requests in Swiss local time, as 74 # the upstream container image does. 75 JVM_OPTS="-Duser.timezone=Europe/Zurich -Dfile.encoding=UTF-8" 76 77 if [ -r "$CONFIG" ]; then 78 JVM_OPTS="${JVM_OPTS} -Dspring.config.additional-location=file:${CONFIG}" 79 fi 80 81 # The Swiss Government Root CA VI is not in the public trust store that the 82 # JVM uses by default. The postinst imports it into a truststore of this 83 # service's own; it is used only if that worked, so that a missing keytool 84 # leaves the service running with the default store rather than not running. 85 if [ -r "$TRUSTSTORE" ]; then 86 JVM_OPTS="${JVM_OPTS} -Djavax.net.ssl.trustStore=${TRUSTSTORE}" 87 JVM_OPTS="${JVM_OPTS} -Djavax.net.ssl.trustStorePassword=changeit" 88 fi 89 90 # shellcheck disable=SC2086 # see the note on word splitting above 91 exec "$JAVA" ${JVM_OPTS} -jar "$JAR" "$@"