AppSecLive.org

Get the source for subversion

Go to the website for subversion and you'll see a link to the sources or go straight to the source code area. Get the latest version of:

• the subversion source (subversion-X.X.X.tar.bz2)
• its signature file (subversion-X.X.X.tar.bz2.asc)
• the subversion client dependencies file (subversion-deps-X.X.X.tar.bz2)
• its signature file (subversion-deps-X.X.X.tar.bz2.asc)

At the time of this writing, subversion-1.5.2.tar.bz2 and subversion-deps-1.5.2.tar.bz2 are the latest. Check both the MD5 sums and digital signatures as explained in Checking sources [PAGE NOT MADE].

Compile the source and create a Slackware package

Since we're doing this from source, its best to download the source into a running version of the Live CD. We can then do the compilation there to make sure the Live CD has all the necessary dependencies.

First get the source into the Live CD. Since you've verified the signatures, scp them over from your primary box and then extract both files in the same directory

 # mkdir build
 # cd build
 # scp matt@matt-box.example.com:/home/matt/download/subversion* ./
 # tar -xjvf subversion-1.5.2.tar.bz2
 # tar -xjvf subversion-deps-1.5.2.tar.bz2

Now we have all the necessary source to compile the client. Regrettably there isn't a configure option for client-only but using the combination below does the trick. Compile and use checkinstall to make a Slackware package for us.

 # cd subversion-1.5.2
 # ./configure --prefix=/usr
 # ./configure \
   --prefix=/usr \
   --without-berkeley-db \
   --without-apache \
   --without-apxs \
   --without-swig \
   --with-ssl
 # make

Here's where things get weird. I've not been successful running checkinstall next. It keeps dying rather quickly. However, if I do a make install then run the checkinstall command, I get a valid package. Its inelegant but it works. When I get more free time, I'll try and figure out why. I also renamed the package to make it clear it was only the client.

 # make install
 # checkinstall -S --install=no
 # mv subversion-1.5.2-i386-1.tgz subversion-client-1.5.2-i386-1.tgz

The program 'checkinstall' will run "make install" for you and, with the command line switches above, it will create a Slackware package and not actually install the program.

Create a module from the Slackware package

This is the easy part.

 # tgz2lzm subversion-client-1.5.2-i386-1.tgz subversion-client-1.5.2-i386-1.lzm
 # mv subversion-client-1.5.2-i386-1.lzm subversion-client-1.5.2.lzm

I also renamed the module to simplify things a bit.

Create and put the module's files into the fakeroot directory

This is a bit out of sequence but I wanted to provide a menu item for the Live CD. We're going to take the module and fill the fakeroot directory from it.

 $ mkdir fakeroot
 $ ./lzm2dir subversion-client-1.5.2.lzm fakeroot/

Because the subversion client is a command line tool, we're going to create two startup scripts to be used by the menu item:

 $ vi fakeroot/usr/bin/startup-svn
   [create script]
 $ cat fakeroot/usr/bin/startup-svn 
#/bin/sh

echo " "
echo " "
echo "     Subversion - A really nice way to wrangle versions"
echo "        (part of the OWASP Live CD 2008)"
echo " "
echo " usage: svn <subcommand> [options] [args]"
echo " Subversion command-line client, version 1.4.6."
echo " Type 'svn help <subcommand>' for help on a specific subcommand."
echo " Type 'svn --version' to see the program version and RA modules"
echo "  or 'svn --version --quiet' to see just the version number."
echo " "

Now a menu item:

 $ mkdir fakeroot/usr/share/applications
 $ vi fakeroot/usr/share/applications/svn.desktop
   [create the file]
 $ cat fakeroot/usr/share/applications/svn.desktop 
[Desktop Entry]
Categories=Application;Network;
Comment=
Encoding=UTF-8
Exec[$e]=startup-svn; bash
GenericName=Subversion client
Icon=/usr/share/pixmaps/svn-icon.png
MimeType=text/html
Name=Manage your source code
Path[$e]=
StartupNotify=false
Terminal=1
TerminalOptions=-T "Subversion - Command Line Client"
Type=Application
X-KDE-StartupNotify=true
X-KDE-SubstituteUID=false
X-KDE-Username=

For the icon, I wasn't quite sure what to sue. I grabbed Subversion logo from the website and pulled out the "S" from the Metasploit using a little Gimp-foo. Then, I moved that into fakeroot.

  mkdir fakeroot/usr/share/pixmaps
 $ cp temp/svn-icon.png fakeroot/usr/share/pixmaps/svn-icon.png

Now just re-generate the module and we're off to the races:

 $ ./dir2lzm fakeroot/ subversion-client-1.5.2.lzm

Test the new modules

SLAX will allow you to add modules to a running system. Before going on, you should install the module and make sure it works like expected. Check out the page Add modules to a running system [PAGE NOT MADE] to see how to do this. Since I had to do a make install before I created the module, I used a freshly booted Live CD to test the module. Verify that subversion works as expected:

# svn co http://metasploit.com/svn/framework3/trunk/

If everything goes as expected, you'll need to add this module to the ISO image. Since we've created the module in the Live CD, you'll need to move it off to a "real" computer. I save both the .lzm modules as well as the Slackware package. The Slackware package is at /root/build/subversion/subversion-client-1.5.2-i386-1.tgz and the module will be in the same directory if you've followed the above instructions. You can use a USB drive, scp or whatever to get the files off the Live CD.

Add the modules to the ISO build directory

Also cake

 $ cp -i subversion-client-1.5.2.lzm ../contents/slax/base/
 $ chmod 775 ../contents/slax/base/subversion-client-1.5.2.lzm

This assumes your subversion-client module was moved into your working directory.  See Creating the base Live CD from SLAX (Create a Working Directory section)

Clean up and archive

Once you've got a working module, lets clean up a bit.

 $ $ mkdir ./completed_modules/subversion-client
 $ mv subversion-client-1.5.2-i386-1.lzm ./completed_modules/subversion-client/
 $ mv temp/subversion-1.5.2.tar.bz2 ./completed_modules/subversion-client/
 $ mv temp/subversion-deps-1.5.2.tar.bz2 ./completed_modules/subversion-client/
 $ rm -rf ./temp/*