[debug/dev] loosen riot username check; autoload zcalc (#40)

* riot: loosen username check as sometimes it's not a unix username

* Revert "riot: loosen username check as sometimes it's not a unix username"

This reverts commit bdb64ce1f2.

* riot: loosen username check as sometimes it's not a unix username

* zshrc: autoload zcalc

---------

Co-authored-by: xiongdian.me <xiongdian.me@bytedance.com>

.github/workflows/gitee_sync_dependencies.yml

@@ -38,6 +38,23 @@ jobs:
         force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
         static_list: "antigen,zsh-syntax-highlighting,zsh-autosuggestions,zsh-completions"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
         timeout: '600s'  # git超时设置，超时后会自动重试git操作
+  zdharma-continuum:
+    runs-on: ubuntu-20.04
+    steps:
+    - name: zdharma-continuum repos  # 名字随便起
+      uses: Yikun/hub-mirror-action@v1.2  # 使用Yikun/hub-mirror-action
+      with:
+        src: github/zdharma-continuum  # 源端账户名(github)
+        dst: gitee/dictxiong  # 目的端账户名(gitee)
+        dst_key: ${{ secrets.GITEE_PRIVATE_KEY }}  # SSH密钥对中的私钥
+        dst_token:  ${{ secrets.GITEE_TOKEN }}  # Gitee账户的私人令牌
+        src_account_type: org
+        dst_account_type: user  # 账户类型
+        clone_style: "https"  # 使用https方式进行clone，也可以使用ssh
+        debug: true  # 启用后会显示所有执行命令
+        force_update: true  # 启用后，强制同步，即强制覆盖目的端仓库
+        static_list: "fast-syntax-highlighting"  # 静态同步列表，在此填写需要同步的仓库名称，可填写多个
+        timeout: '600s'  # git超时设置，超时后会自动重试git操作
   tmux-mem-cpu-load:
     runs-on: ubuntu-20.04
     steps:

.ssh/authorized_keys2

@@ -1,13 +1,8 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPmMImRSAhksHUfCwNpcj61izGn0Xkv1KRIuxb0OSdJl pc0/old
-
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4K5S3zDYbxlw7B45zOdmKud95nXU1V6kSxEvbTOsy2 pc1/old
-
 # keys below are the new security system starting from 2022-07
-sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGdLJYOrBhWERmkQ+sNM8tGzJ37UBEKkEuhbtE9B65mOAAAABHNzaDo= sk0/fido
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGakUcSuNhuH7tk+Nj9gDfRtxYfGPL9yb8toQ/EpSJAM openpgp:0xD9271B01
 
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUN7IXF4nlFcVfgHesgik3LIAiXlVMYJPm3yD13EVarQx5jqdBgk8Dwgkgf4rPO6MFpvIpinOyEO8zOS6HHQrCLZUv5yTFaDkUuB7eQ0EmpicGbmk9bHqj1HkOZxaobkpEfQUmFKYvkp4EexVw66sO0qfXvjHZ4H6yCAJLK5aUnKfgrE8tODzP82sU/mpJjW+Pq3uanNq754gaHwhxCIXG143/zp8qzBAeKe38xVqqDq9fTkG4hvzFvkRdS88i6l1z++0P3n0HGdOjtSg7P7fO7+7ZyPYr0gO5vB720Om/zxqPrGd9cicWi4P+aVKa+0ujWH/pqufWG6uCjKWHnBs7 sk0.ibd.ink/piv/9a
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUN7IXF4nlFcVfgHesgik3LIAiXlVMYJPm3yD13EVarQx5jqdBgk8Dwgkgf4rPO6MFpvIpinOyEO8zOS6HHQrCLZUv5yTFaDkUuB7eQ0EmpicGbmk9bHqj1HkOZxaobkpEfQUmFKYvkp4EexVw66sO0qfXvjHZ4H6yCAJLK5aUnKfgrE8tODzP82sU/mpJjW+Pq3uanNq754gaHwhxCIXG143/zp8qzBAeKe38xVqqDq9fTkG4hvzFvkRdS88i6l1z++0P3n0HGdOjtSg7P7fO7+7ZyPYr0gO5vB720Om/zxqPrGd9cicWi4P+aVKa+0ujWH/pqufWG6uCjKWHnBs7 sk0/piv/9a
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGV/6cLUGA5YWVI6uPhIBOBZvlNBlZLkehHQN0Gxnc+B ltp0/ubuntu
 
@@ -21,9 +16,7 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBN24pvN1RMN+iSZyHPdyExA1Rvt8pdr3e6ih6iX+KrQ
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZFTyR+R86fUpZBDkDR9yYzJpmeNsIv2CMHTh6EuEeq pc0/windows
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8WHIpwdZl7+HIZfQpwIAhpxT1huI9sd6Ydeokilg5l pc1/windows
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLYgVj+NPino6sOmahULN7SbAMaVAgzqPfDjz2S8zDv pc1/windows
-
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ/+BWSTv3w1Ru9ksfse3EUbu4ukJruUU94fCG7Sk+5g3+F80KqJGykP9tHueU07iZfAuaYj7Zcy+IWx9Ih+eYA= ph0/sep
 
 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNvHya5i3GNniGww9Yx5ikos4Z5jevu8zz8hCQi05++SgejFPnbw9UjbHFjODK2M+ZHuhRF5mdf996r4/BxWyP8= pad0/sep
 
@@ -32,3 +25,4 @@ ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC5gu+U4
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF52mPmbLEriZ+DfmrMHFtvg2kiO2JpRpitvs7PbJowh home0
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhS4voo3K/Dvzqckr0bouO1WkCI5XxswstHWnuuyKBz ltp1-bd
+

.update.sh

@@ -13,6 +13,11 @@ apost_beacon "sys.online"
 # update dns
 if [[ "$DFS_DDNS_ENABLE" == "1" ]]; then
     fmt_info "updating dns ..."
+    if ! is_tty; then
+        time_to_sleep=$((RANDOM%600))
+        fmt_note "sleep for $time_to_sleep seconds"
+        sleep $time_to_sleep
+    fi
     "$THIS_DIR/tools/frigg-client.sh" ddns || (fmt_error "failed to update dns" && apost_beacon "dfs.ddns.fail")
 fi
 

.zshrc2

@@ -22,7 +22,7 @@ if [[ "$DFS_NO_WALL" == "1" ]]; then
     ANTIGEN_URL="https://raw.githubusercontent.com/zsh-users/antigen/develop/bin/antigen.zsh"
     ANTIGEN_OMZ_REPO_URL="https://github.com/ohmyzsh/ohmyzsh.git"
     ANTIGEN_PLUGINS=(
-        "https://github.com/zsh-users/zsh-syntax-highlighting"
+        "https://github.com/zdharma-continuum/fast-syntax-highlighting"
         "https://github.com/zsh-users/zsh-completions"
         "https://github.com/zsh-users/zsh-autosuggestions"
     )
@@ -30,7 +30,7 @@ else
     ANTIGEN_URL="https://gitee.com/dictxiong/antigen/raw/develop/bin/antigen.zsh"
     ANTIGEN_OMZ_REPO_URL="https://gitee.com/dictxiong/ohmyzsh.git"
     ANTIGEN_PLUGINS=(
-        "https://gitee.com/dictxiong/zsh-syntax-highlighting"
+        "https://gitee.com/dictxiong/fast-syntax-highlighting"
         "https://gitee.com/dictxiong/zsh-completions"
         "https://gitee.com/dictxiong/zsh-autosuggestions"
     )
@@ -140,6 +140,9 @@ bindkey "\e[1;5D" backward-word  # alt+left_arrow; termius
 
 bindkey "\ed" delete-char  # alt+d
 
+# mods
+autoload zcalc
+
 # dfs
 dfs()
 {

install.sh

@@ -197,6 +197,9 @@ install_crontab()
 {
     if [[ -x $(command -v crontab) ]]; then
         fmt_note "installing \"$CRON_JOB\" to crontab ..."
+        if ! crontab -l 1>/dev/null 2>&1; then
+            echo -n | crontab -
+        fi
         ( crontab -l | grep -vxF "${CRON_JOB}" | grep -v "no crontab for"; echo "$CRON_JOB" ) | crontab -
     else
         fmt_warning "crontab does not exist. skipping ..."
@@ -319,9 +322,7 @@ for i in ${GOT_OPTS[@]}; do
     case $i in
         -i ) FUNC=install ;;
         -r ) FUNC=uninstall ;;
-        -d|--dev ) export DFS_DEV=1; set -x ;;
         -a|--auto ) INSTALL_DEP=1 ;;
-        -s|--secure ) export DFS_DEV=0 ;;
         -H|--hist|--history ) store_hist=1 ;;
         -x ) store_config=1 ;;
         * ) fmt_fatal "unknown option \"$i\"" ;;

scripts/riot

@@ -2,57 +2,156 @@
 # connect to iot services
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/../tools/common.sh"
+RIOT_TRUST_CLIENT=${RIOT_TRUST_CLIENT:-${DFS_TRUST:-0}}
+RIOT_TRUST_SERVER=${RIOT_TRUST_SERVER:-0}
 
-# get target settings
+# check if port number valid
-# provides:
+check_port() {
-SERVER=""
+    ( echo $1 | grep -qxE "[1-9][0-9]{0,4}" ) || return 1
-PORT=""
+    test $1 -lt 65536 -a $1 -gt 0 || return 1
-SSH_USERNAME=""
+    return 0
-SSH_OPTIONS=""
+}
-get_server_meta()
+
-{
+# check if username valid
-    local domain=${1##*.}
+check_username() {
-    local host=${1%.*}
+    ( echo $1 | grep -qxE "^[a-z][-a-z0-9_]*\$" ) || return 1
-    if [[ "$host" == "$domain" ]]; then
+    return 0
-        domain=""
+}
+
+# get single server setting
+# may be called more than once
+get_server_meta() {
+    # returns:
+    RET_HOSTNAME=""
+    RET_TRUST_SERVER=0
+    RET_PORT=""  # optional
+    RET_USERNAME=""  # optional
+    RET_JUMP_SERVER=""  # optional
+    # body
+    local remote="$1"
+    # if in the form user@...
+    if [[ "$remote" == *@* ]]; then
+        RET_USERNAME=${remote%%@*}
+        remote=${remote#*@}
+        check_username $RET_USERNAME || fmt_warning \"$RET_USERNAME\" is not a valid unix username
+    fi
+    # if in the form ...:22
+    if [[ "$remote" == "["*"]":* || ( "$remote" != "["*"]" && "$remote" == *:* ) ]]; then
+        RET_PORT=${remote##*:}
+        remote=${remote%:*}
+        check_port $RET_PORT || fmt_fatal invalid port number \"$RET_PORT\"
+    fi
+    # presets -- match domain
+    local domain=${remote##*.}
+    local host=${remote%.*}
+    # if there's no dot
+    if [[ "$host" == "$domain" && "$host" != "["*"]" ]]; then
+        domain="ibd"
     fi
     case $domain in
-        ibd|ebd )
+        i|ibd )
-            SERVER=$host.$domain.ink
+            RET_HOSTNAME=$host.ibd.ink
-            PORT=12022
+            RET_PORT=${RET_PORT:-12022}
-            SSH_USERNAME=root
+            RET_USERNAME=${RET_USERNAME:-root}
+            RET_TRUST_SERVER=1
             ;;
         nasp )
-            SERVER=$host
+            RET_HOSTNAME=$host
-            PORT=12022
+            RET_PORT=${RET_PORT:-12022}
-            SSH_USERNAME=dictxiong
+            RET_USERNAME=${RET_USERNAME:-dictxiong}
-            SSH_OPTIONS='-o ProxyJump="ssh@nasp.ob.ac.cn:36022"'
+            RET_JUMP_SERVER="ssh@nasp.ob.ac.cn:36022"
+            RET_TRUST_SERVER=1
             ;;
-        "" )
+        x|proxied )
-            SERVER=proxy.beardic.cn
+            RET_HOSTNAME=proxy.beardic.cn
             local tmp=$(sha256sum <<< "$host" | tr -cd "[:digit:]")
             tmp=${tmp:0:4}
-            PORT=$((10#$tmp+36000))
+            RET_PORT=$((10#$tmp+36000))
-            SSH_USERNAME=root
+            RET_USERNAME=root
+            RET_TRUST_SERVER=1
             ;;
         * )
-            fmt_fatal "unknown domain: $domain"
+            test -z "$domain" || fmt_warning "unknown domain: \"$domain\". will try as host name"
+            RET_HOSTNAME="$remote"
     esac
 }
 
+# remote setting, including jump servers
+# will be called only once
+# provides:
+SERVER=""
+TRUST_SERVER=1
+PORT=""  # optional
+USERNAME=""  # optional
+SSH_OPTIONS=""  # optional
+if [[ "$RIOT_TRUST_CLIENT" == "1" ]]; then
+    SSH_OPTIONS='-o ControlMaster=auto -o ControlPath=/tmp/sshcm-%C -o PermitLocalCommand=yes'
+fi
+parse_remote() {
+    local remote="$1"
+    local jump_servers=""
+    # loop for jump servers
+    while [[ -n $remote ]]; do
+        local server=${remote%%,*}
+        remote=${remote#*,}
+        get_server_meta "$server"
+        if [[ -n "$RET_JUMP_SERVER" ]]; then
+            jump_servers="$jump_servers${jump_servers:+,}$RET_JUMP_SERVER"
+        fi
+        # only if all servers are trusted
+        TRUST_SERVER=$((TRUST_SERVER*RET_TRUST_SERVER))
+        if [[ "$server" == "$remote" || -z "$remote" ]]; then
+            SERVER="$RET_HOSTNAME"
+            PORT="$RET_PORT"
+            USERNAME="$RET_USERNAME"
+            remote=""
+        else
+            jump_servers="$jump_servers${jump_servers:+,}$RET_USERNAME${RET_USERNAME:+@}$RET_HOSTNAME${RET_PORT:+:}$RET_PORT"
+        fi
+    done
+    # construct cmd
+    if [[ "$RIOT_TRUST_SERVER" == "1" || "$TRUST_SERVER" == "1" ]]; then
+        SSH_OPTIONS="$SSH_OPTIONS -o ForwardX11=yes -o ForwardAgent=yes"
+    fi
+    if [[ -n "$jump_servers" ]]; then
+        SSH_OPTIONS="$SSH_OPTIONS -o ProxyJump=$jump_servers"
+    fi
+}
+
+eval_or_echo() {
+    if [[ "$DFS_DRY_RUN" == "1" ]]; then
+        echo $@
+    else
+        eval $@
+    fi
+}
+
+# ssh series
+prepare_ssh_cmd() {
+    local ssh_bin="${1:-ssh}"
+    if [[ "$ssh_bin" == "scp" || "$ssh_bin" == "sftp" ]]; then
+        local port_param='-P'
+    else
+        local port_param='-p'
+    fi
+    echo "$ssh_bin ${PORT:+$port_param} $PORT $SSH_OPTIONS $SCP_SRC $USERNAME${USERNAME:+@}$SERVER $SCP_DST"
+}
+
 # ssh
 run_ssh()
 {
-    CMD="ssh -p $PORT $SSH_OPTIONS $SSH_USERNAME@$SERVER"
+    local cmd="$(prepare_ssh_cmd $1)"
-    fmt_note "-->" $CMD
+    fmt_note "-->" $cmd
-    eval $CMD
+    eval_or_echo $cmd
 }
 
 # sshl
 run_sshl()
 {
-    if [[ -z "$1" || "$1" != *":"* ]]; then
+    local arg="$1"
-        fmt_fatal "invalid remote address: $1"
+    if [[ "$arg" != *":"* ]]; then
+        # treat as a port number
+        arg=localhost:$arg
     fi
     while
         local port=$(shuf -n 1 -i 49152-65535)
@@ -60,26 +159,50 @@ run_sshl()
     do
         continue
     done
-    CMD="ssh -p $PORT $SSH_OPTIONS -NC -L $port:$1 $SSH_USERNAME@$SERVER"
+
-    fmt_note "-->" $CMD
+    SSH_OPTIONS="$SSH_OPTIONS -NC -L $port:$arg"
+    local cmd="$(prepare_ssh_cmd ssh)"
+    fmt_note "-->" $cmd
     fmt_note "  > please access localhost:$port"
-    eval $CMD
+    eval_or_echo $cmd
+}
+
+# scp
+run_scp() {
+    local src="$1"
+    local dst="$2"
+    local dst_is_remote=1
+    # whoever is ./*, it can't be the remote; whoever not exists on local, it's possible the remote.
+    # it is suggested to use ./* for local files.
+    if [[ "$src" != "./"* && ( "$dst" == "./"* || ( ! -e "$src" && -e "$dst" ) ) ]]; then
+        dst_is_remote=0
+    fi
+    if [[ "$dst_is_remote" == "1" ]]; then
+        SCP_SRC=\""$src"\"
+        SERVER="$SERVER":\""$dst"\"
+    else
+        SERVER="$SERVER":\""$src"\"
+        SCP_DST=\""$dst"\"
+    fi
+    SSH_OPTIONS="$SSH_OPTIONS -r"
+    local cmd="$(prepare_ssh_cmd scp)"
+    fmt_note "-->" $cmd
+    eval_or_echo $cmd
 }
 
 # main
 print_help()
 {
     fmt_info "usage: $0 <service> [command] [options]"
-    echo "available commands: ssh (default), sshl (ssh -L)"
+    echo "available commands: ssh (default), sshl (ssh -L), zssh, sftp"
 }
 
-router()
+router() {
-{
     if [[ -z "$1" || "$1" == "-h" || "$1" == "--help" ]]; then
         print_help
         exit
     fi
-    get_server_meta "$1"
+    parse_remote "$1"
     case $2 in
         -h|--help)
             print_help
@@ -88,9 +211,21 @@ router()
         ssh|"" )
             run_ssh
             ;;
+        zssh )
+            run_ssh zssh
+            ;;
+        sftp )
+            run_ssh sftp
+            ;;
         sshl )
+            test -n "$3" || fmt_fatal "no target address provided"
             run_sshl "$3"
             ;;
+        scp )
+            test -n "$3" || fmt_fatal "no source path specified"
+            test -n "$4" || fmt_fatal "no destination path specified"
+            run_scp "$3" "$4"
+            ;;
         * )
             print_help
             fmt_fatal "unknown command: $2"

tools/common.sh

@@ -3,7 +3,7 @@ set -e
 THIS_DIR_COMMON_SH=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 export DOTFILES=$( cd "$THIS_DIR_COMMON_SH/.." && pwd )
 if [[ -f ~/.config/dotfiles/env ]]; then set -a; source ~/.config/dotfiles/env; set +a; fi
-if [[ "$DFS_DEBUG" == "1" ]]; then set -x; fi
+if [[ "$DFS_DEV" == "1" ]]; then set -x; fi
 DFS_CURL_OPTIONS="--retry 2 --max-time 20"
 
 # parse args and set env, when it is sourced
@@ -17,8 +17,9 @@ if [[ "${BASH_SOURCE[0]}" != "${0}" ]]; then
         case $ARG in
             -q*|--quite ) export DFS_QUIET=1 ;;
             -l*|--lite ) export DFS_LITE=1 ;;
+            -d*|--dev ) export DFS_DEV=1; set -x ;;
+            -D*|--dry-run ) export DFS_DRY_RUN=1 ;;
             --color ) export DFS_COLOR=1 ;;
-            --dry-run ) export DFS_DRY_RUN=1 ;;  # TODO!!!
             --*=* ) GOT_OPTS+=("${ARG%%=*}" "${ARG#*=}") ;;
             --* ) GOT_OPTS+=("$ARG") ;;
             -* ) GOT_OPTS+=("${ARG:0:2}") ;;

tools/sagent.sh

@@ -79,6 +79,10 @@ all()
 
 route()
 {
+    os_type="$(get_os_type)"
+    if [[ "$os_type" == "msys" || "$os_type" == "cygwin" ]]; then
+        fmt_fatal "unsupported platform: $os_type. you may use WinCryptSSHAgent."
+    fi
     if [[ $# -eq 0 ]]; then
         all
         return

tools/test.zsh

@@ -31,6 +31,7 @@ test $(echo n | tools/common.sh ask_for_yN "test") = "0"
 test $(echo | tools/common.sh ask_for_yN "test") = "0"
 test $(echo | tools/common.sh ask_for_Yn "test") = "1"
 test $(DFS_QUIET=1 tools/common.sh ask_for_Yn "test") = "1"
+test "$(DFS_TRUST=1 riot time@is.impt:2222,yes@you-r.right,you@are.really.recht.,ibd.,try@it scp /tmp/ ./tmp -D 2>/dev/null)" = 'scp -P 12022 -o ControlMaster=auto -o ControlPath=/tmp/sshcm-%C -o PermitLocalCommand=yes -o ProxyJump=time@is.impt:2222,yes@you-r.right,you@are.really.recht.,ibd. -r try@it.ibd.ink:"/tmp/" "./tmp"'
 
 # check alias
 alias p114