《NGINX 源碼建構》練習 參考解答

$ docker --version
Docker version 24.0.5, build ced0996

docker_run_opts=(
    # 離開容器的作業階段時自動摧毀容器，節省磁碟空間使用
    --rm
    
    # 啟用標準輸入裝置(stdin)支援（使 bash shell 
    # 互動式模式(interactive mode)得以正常運行）
    --interactive
    
    # 啟用偽 Teletype(TTY) 終端機模擬功能（使 bash shell 
    # 互動式模式得以正常運行）
    --tty
    
    # 設定人類可讀的 Docker 容器名稱
    # （於 `docker ps`、`docker container list` 命令中呈現）
    --name nginx-source-build
    
    # 設定容器內的主機名稱（於 Bash 提示字串呈現）
    --hostname nginx-source-build
    
    # 將容器內的 HTTP 跟 HTTPS 標準通訊埠發布到宿主機的回送(loopback)網路界面上，方便測試 NGINX 服務功能
    --publish 127.0.0.1:80:80/tcp
    --publish 127.0.0.1:443:443/tcp
    
    # 規避 Ubuntu Docker 容器無法正確輸入與顯示中文字元的問題
    --env LANG=C.UTF-8
)
docker run "${docker_run_opts[@]}" ubuntu:22.04

$ sudo docker run "${docker_run_opts[@]}" ubuntu:22.04
root@nginx-source-build:/# 

sed_opts=(
    # 直接修改文件而非將修改後的結果輸出到標準輸出裝置(stdout)
    --in-place
    
    # 要套用的 sed 表達式（將每行跟 `//archive\.u` 正規表達式(regular expression)
    # 式樣(pattern)比對(match)到的字串替換為 `//tw.archive.u` 字串）
    --expression='s@//archive\.u@//tw.archive.u@'
)
sed "${sed_opts[@]}" /etc/apt/sources.list

apt update

root@43e688c2defb:/# apt update
Get:1 http://tw.archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:2 http://tw.archive.ubuntu.com/ubuntu jammy-updates InRelease [119 kB]   
Get:3 http://tw.archive.ubuntu.com/ubuntu jammy-backports InRelease [109 kB] 
Get:4 http://tw.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]

    ...stripped...

Fetched 29.1 MB in 4s (8156 kB/s)                           
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
7 packages can be upgraded. Run 'apt list --upgradable' to see them.

apt install curl

curl_opts=(
    # 跟隨 301/302 轉址（如果有）
    --location
    
    # 使用下載網址 URL 末端片段作為下載資源的檔案名稱
    --remote-name
)
curl "${curl_opts[@]}" https://nginx.org/download/nginx-1.25.3.tar.gz

curl_opts=(
    # 跟隨 301/302 轉址（如果有）
    --location
    
    # 使用下載網址 URL 末端片段作為下載資源的檔案名稱
    --remote-name
)
curl "${curl_opts[@]}" https://nginx.org/download/nginx-1.25.3.tar.gz.asc

apt install gnupg

gpg_opts=(
    # 驗證經數位簽名之文件的資料完整性
    --verify nginx-1.25.3.tar.gz.asc nginx-1.25.3.tar.gz
)
gpg "${gpg_opts[@]}"

$ gpg --verify nginx-1.25.3.tar.gz.asc nginx-1.25.3.tar.gz
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: Signature made Tue Oct 24 15:42:51 2023 UTC
gpg:                using RSA key 13C82A63B603576156E30A4EA0EA981B66B0D967
gpg:                issuer "k.pavlov@f5.com"
gpg: Can't check signature: No public key

curl_opts=(
    # 跟隨 301/302 轉址（如果有）
    --location
    
    # 使用下載網址 URL 末端片段作為下載資源的檔案名稱
    --remote-name
)
curl "${curl_opts[@]}" https://nginx.org/keys/thresh.key

gpg --import thresh.key

$ gpg --import thresh.key
gpg: key A0EA981B66B0D967: 10 signatures not checked due to missing keys
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key A0EA981B66B0D967: public key "Konstantin Pavlov <thresh@nginx.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found

$ gpg --verify nginx-1.25.3.tar.gz.asc nginx-1.25.3.tar.gz
gpg: Signature made Tue Oct 24 15:42:51 2023 UTC
gpg:                using RSA key 13C82A63B603576156E30A4EA0EA981B66B0D967
gpg:                issuer "k.pavlov@f5.com"
gpg: Good signature from "Konstantin Pavlov <thresh@nginx.com>" [unknown]
gpg:                 aka "Konstantin Pavlov <k.pavlov@f5.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 13C8 2A63 B603 5761 56E3  0A4E A0EA 981B 66B0 D967

tar_opts=(
  # 選擇解開封存檔 tar 操作模式
  --extract
  
  # 指定要解開的封存檔路徑
  --file nginx-1.25.3.tar.gz
)
tar "${tar_opts[@]}"

$ ls nginx-*
nginx-1.25.3.tar.gz  nginx-1.25.3.tar.gz.asc

nginx-1.25.3:
CHANGES     LICENSE  auto  configure  html  src
CHANGES.ru  README   conf  contrib    man

cd nginx-1.25.3

nginx-1.25.3 $ ./configure --help

  --help                             print this message

  --prefix=PATH                      set installation prefix
  --sbin-path=PATH                   set nginx binary pathname

    ...stripped...

apt install less

./configure --help | less

./configure --with-http_ssl_module

nginx-1.25.3 $ ./configure --with-http_ssl_module
checking for OS
 + Linux 6.1.0-1026-oem x86_64
checking for C compiler ... not found

./configure: error: C compiler cc is not found

apt install gcc

$ ./configure --with-http_ssl_module

    ...stripped...

checking for PCRE2 library ... not found
checking for PCRE library ... not found
checking for PCRE library in /usr/local/ ... not found
checking for PCRE library in /usr/include/pcre/ ... not found
checking for PCRE library in /usr/pkg/ ... not found
checking for PCRE library in /opt/local/ ... not found

./configure: error: the HTTP rewrite module requires the PCRE library.
You can either disable the module by using --without-http_rewrite_module
option, or install the PCRE library into the system, or build the PCRE library
statically from the source with nginx by using --with-pcre=<path> option.

apt_search_opts=(
    # 只比對軟體包名稱而非軟體描述文字
    --names-only
)
apt search "${apt_search_opts[@]}" '^libpcre.*-dev$'

$ apt search --names-only '^libpcre.*-dev'
Sorting... Done
Full Text Search... Done

    ...stripped...

libpcre2-dev/jammy-updates,jammy-security 10.39-3ubuntu0.1 amd64
  New Perl Compatible Regular Expression Library - development files

libpcre3-dev/jammy-updates,jammy-security 2:8.39-13ubuntu0.22.04.1 amd64
  Old Perl 5 Compatible Regular Expression Library - development files

apt install libpcre2-dev

nginx-1.25.3 $ ./configure --with-http_ssl_module

    ...stripped...

checking for PCRE2 library ... found
checking for OpenSSL library ... not found
checking for OpenSSL library in /usr/local/ ... not found
checking for OpenSSL library in /usr/pkg/ ... not found
checking for OpenSSL library in /opt/local/ ... not found

./configure: error: SSL modules require the OpenSSL library.
You can either do not enable the modules, or install the OpenSSL library
into the system, or build the OpenSSL library statically from the source
with nginx by using --with-openssl=<path> option.

apt_search_opts=(
    # 只比對軟體包名稱而非軟體描述文字
    --names-only
)
apt search "${apt_search_opts[@]}" 'libopenssl.*-dev'

$ apt search "${apt_search_opts[@]}" 'libopenssl.*-dev'
Sorting... Done
Full Text Search... Done

$ apt search "${apt_search_opts[@]}" 'openssl.*-dev'
Sorting... Done
Full Text Search... Done
golang-github-mendersoftware-openssl-dev/jammy 1.1.0-2ubuntu2 all
  OpenSSL bindings for Go.

libcurl4-openssl-dev/jammy-updates,jammy-security 7.81.0-1ubuntu1.15 amd64
  development files and documentation for libcurl (OpenSSL flavour)

libghc-hsopenssl-dev/jammy 0.11.4.18-1ubuntu1 amd64
  partial OpenSSL binding for Haskell

libghc-hsopenssl-x509-system-dev/jammy 0.1.0.3-5build4 amd64
  use system's native CA certificate store with HsOpenSSL

    ...stripped...

$ apt search "${apt_search_opts[@]}" openssl
Sorting... Done
Full Text Search... Done

    ...stripped...

openssl/jammy-updates,jammy-security,now 3.0.2-0ubuntu1.12 amd64 [installed,automatic]
  Secure Sockets Layer toolkit - cryptographic utility

    ...stripped...

apt install apt-file

apt-file update

apt_file_search_opts=(
    # 使用 Perl 正規表達式（而非純文字）搜尋
    --regexp
)
apt-file search "${apt_file_search_opts[@]}" 'openssl/ssl\.h$'

$ apt-file search "${apt_file_search_opts[@]}" 'openssl/ssl\.h$'
android-libboringssl-dev: /usr/include/android/openssl/ssl.h
libnode-dev: /usr/include/node/openssl/ssl.h
libssl-dev: /usr/include/openssl/ssl.h
libwolfssl-dev: /usr/include/cyassl/openssl/ssl.h
libwolfssl-dev: /usr/include/wolfssl/openssl/ssl.h
python3-pycparser: /usr/share/python3-pycparser/fake_libc_include/openssl/ssl.h

apt install libssl-dev

nginx-1.25.3 $ ./configure --with-http_ssl_module

    ...stripped...

checking for OpenSSL library ... found
checking for zlib library ... not found

./configure: error: the HTTP gzip module requires the zlib library.
You can either disable the module by using --without-http_gzip_module
option, or install the zlib library into the system, or build the zlib library
statically from the source with nginx by using --with-zlib=<path> option.

$ apt search --names-only '^libzlib.*-dev$'
Sorting... Done
Full Text Search... Done

$ apt search --names-only 'zlib.*-dev$'
Sorting... Done
Full Text Search... Done

    ...stripped...

zlib1g-dev/jammy-updates,jammy-security 1:1.2.11.dfsg-2ubuntu9.2 amd64
  compression library - development

apt install zlib1g-dev

$ ./configure --with-http_ssl_module

    ...stripped...

creating objs/Makefile

Configuration summary
  + using system PCRE2 library
  + using system OpenSSL library
  + using system zlib library

  nginx path prefix: "/usr/local/nginx"
  nginx binary file: "/usr/local/nginx/sbin/nginx"
  nginx modules path: "/usr/local/nginx/modules"
  nginx configuration prefix: "/usr/local/nginx/conf"
  nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
  nginx pid file: "/usr/local/nginx/logs/nginx.pid"
  nginx error log file: "/usr/local/nginx/logs/error.log"
  nginx http access log file: "/usr/local/nginx/logs/access.log"

    ...stripped...

nginx-1.25.3 $ ls
CHANGES     LICENSE   README  conf       contrib  man   src
CHANGES.ru  Makefile  auto    configure  html     objs

apt install make

make_opts=(
    # 開啟平行建構(parallel build)功能，將將平行運行的 sub-make 工作數量限制在
    # 主機的中央處理器總處理器執行緒數以減少軟體建構所需時間
    --jobs="$(nproc)"
)
make "${make_opts[@]}"

nginx-1.25.3 $ make "${make_opts[@]}"
make -f objs/Makefile
make[1]: Entering directory '/nginx-1.25.3'
cc -c -pipe  -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g  -I src/core -I src/event -I src/event/modules -I src/event/quic -I src/os/unix -I objs \
        -o objs/src/core/nginx.o \
        src/core/nginx.c

    ...stripped...

objs/src/http/modules/ngx_http_upstream_zone_module.o \
objs/ngx_modules.o \
-lcrypt -lpcre2-8 -lssl -lcrypto -lz \
-Wl,-E
make[1]: Leaving directory '/nginx-1.25.3'

nginx-1.25.3 $ echo $?
0

make install

    ...stripped...

http {

    ...stripped...

    server {
        listen       80;
        server_name  localhost;

    ...stripped...

        location / {
            root   html;
            index  index.html index.htm;
        }
    }
}

/usr/local/nginx/sbin/nginx

$ pgrep --list-full nginx
26776 nginx: master process /usr/local/nginx/sbin/nginx
26777 nginx: worker process     

$ curl http://localhost
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

    ...stripped...

http {

    ...stripped...

    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}
}

apt install nano

nano /usr/local/nginx/conf/nginx.conf

    ...stripped...

http {

    ...stripped...

    # HTTPS server
    #
    server {
        listen       443 ssl;
        server_name  localhost;

        ssl_certificate      cert.pem;
        ssl_certificate_key  cert.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }
    }
}

/usr/local/nginx/sbin/nginx -t

# /usr/local/nginx/sbin/nginx -t
nginx: [emerg] cannot load certificate "/usr/local/nginx/conf/cert.pem": BIO_new_file() failed (SSL: error:80000002:system library::No such file or directory:calling fopen(/usr/local/nginx/conf/cert.pem, r) error:10000080:BIO routines::no such file)

# 因為私鑰洩漏有資訊安全疑慮所以將預設的群組(group)跟其他人(other)
# 的 Unix 檔案訪問權限設定遮罩掉
umask 077

# 產生一個 2048 位元大小的 RSA 私鑰
openssl genrsa 2048 > cert.key

# 使用前面產生的 RSA 私鑰產生一個給「localhost」這個 Common Name 實體
# 使用的 PKCS#10 憑證簽發請求(CSR)
openssl_req_opts=(
    # 產生新的憑證簽發請求
    -new
    
    # 指定要使用的私鑰文件
    -key cert.key
    
    # 設定新的憑證簽發請求的主體名稱(subject name)
    -subj '/CN=localhost'
)
openssl req "${openssl_req_opts[@]}" > cert.csr

# 使用前面產生的 PKCS#10 憑證簽發請求自行簽發一個新 X.509 憑證
openssl_x509_opts=(
    # 指定輸入文件為一憑證簽發請求
    -req
    
    # 指定輸入的憑證簽發請求文件
    -in cert.csr
    
    # 指定要簽發的 X.509 憑證的效期為一個月（30 天）
    -days 30
    
    # 指定用於簽發 X.509 憑證使用的憑證簽發者(certificate issuer)私鑰
    # 因為是自簽憑證我們使用同一個私鑰文件即可
    -signkey cert.key
    
    # 指定要簽發的 X.509 憑證文件路徑
    -out cert.pem
)
openssl x509 "${openssl_x509_opts[@]}"

# 通用的 install 命令選項
install_opts_common=(
    # 設定擁有者為 root
    --owner root
    
    # 設定擁有群組為 root
    --group root
    
    # 顯示冗餘輸出
    --verbose
)
# 安裝 X.509 證書專用的 install 命令選項
install_opts_cert=(
    "${install_opts_common[@]}"

    # 設定 Unix 檔案訪問權限為 rw-r--r--
    --mode 644
)
# 安裝 RSA 私鑰文件專用的 install 命令選項
install_opts_key=(
    "${install_opts_common[@]}"
    
    # 設定 Unix 檔案訪問權限為 rw-------
    --mode 600
)
install "${install_opts_cert[@]}" cert.pem /usr/local/nginx/conf/cert.pem
install "${install_opts_key[@]}" cert.key /usr/local/nginx/conf/cert.key

# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

/usr/local/nginx/sbin/nginx -s reload

curl_opts=(
    # 略過 SSL/TLS 憑證驗證，非由公認信任之憑證簽發機構(certificate authority(CA))
    # 簽發的憑證是沒辦法過驗證的
    --insecure
)
curl "${curl_opts[@]}" https://localhost