服务器上面的apache添加了一个gnutls的证书，启动报错：

GnuTLS: Failed to Import Private Key ‘xxx.private.key’: (-207) Base64 unexpected header error.

查找问题原因：

Turns out that what it actually means is not “Base64 decoding error”. What it actually means is “You didn’t remove the pass phrase from the key”.

To do that:

$ cp foo.key foo.key.orig
$ openssl rsa -in foo.key.orig --out foo.key

原帖： https://forums.gentoo.org/viewtopic-t-784340-start-0.html
useful links: http://en.gentoo-wiki.com/wiki/Initramfs

Here’s my way to boot from a squashed root filesystem wich is readonly. The squashed image is in this example located on a harddisk partition and not on a cdrom drive. With the help of this forum and http://en.gentoo-wiki.com/wiki/Initramfs I managed it to work (copy-paste…).

My partitions in the following example:
/dev/sda1 /boot
/dev/sda2 / (this is the root wich will be squashed; later unused)
/dev/sda3 /mnt/imgpart (this is the partition where the squash image resides)

0. Forget genkernel -> it’s too complicated

1a. You have a running Gentoo system
1b. You need a compiled kernel in /usr/linux

my current conditions:
* Found kernel source directory:
* /usr/src/linux
* Found kernel object directory:
* /lib/modules/2.6.29-gentoo-r6/build
* Found sources for kernel version:
* 2.6.29-gentoo-r6
2. Emerge some stuff
代码:

emerge -pv git aufs2 busybox
[ebuild R ] sys-apps/busybox-1.14.2 USE="pam static -debug -make-symlinks -savedconfig (-selinux)" 0 kB
[ebuild U ] dev-util/git-1.6.4 [1.6.3.3] USE="bash-completion curl -gtk iconv perl xinetd -cgi -cvs -doc -emacs -mozsha1 (-ppcsha1) -subversion -threads -tk -webdav" 2,357 kB
[ebuild U ] sys-fs/aufs2-0_p20090727 [0_p20090601-r1] USE="kernel-patch -debug -inotify -ramfs" 0 kB

note: aufs2-0_p20090727 doesn’t work with gentoo-sources-2.6.29, but aufs2-0_p20090601-r1 works out of the box

3. Create the initramfs directory
Do the steps according to http://en.gentoo-wiki.com/wiki/Initramfs and hirakendu examples
代码:

mount /boot
mkdir /usr/src/initramfs
cd /usr/src/initramfs
mkdir -p bin lib dev etc proc sbin sys mnt/union mnt/static mnt/dynamic mnt/imgpart
mkdir -p lib/modules/2.6.29-gentoo-r6/misc # used for "aufs" kernel module
cp -a /lib/modules/2.6.29-gentoo-r6/misc/aufs.ko lib/modules/2.6.29-gentoo-r6/misc/
cp -a /bin/busybox bin/
ln -s busybox bin/sh
touch etc/mdev.conf
cp -a /lib/{ld-*,libc-*,libc.so*,libdl*} lib/
cp -a /lib/{libm-*,libm.so*,libpam.so*,libpam_misc*} lib/

4. Create a new init shell script
This one is a bit raw, but you can use it as a good starting point.

nano -w init
代码:

#!/bin/busybox sh

# Mount the /proc and /sys filesystems.
mount -t proc none /proc
mount -t sysfs none /sys

busybox --install -s

mknod /dev/null c 1 3
mknod /dev/tty c 5 0

# Do your stuff here.
echo "This script mounts rootfs RO with an aufs RW layer."
modprobe aufs

sleep 7
mdev -s

# Parse the kernel command line from grub
CMDLINE="$(cat /proc/cmdline)"
parse_disk() {
    if [ "$(echo $1|cut -c -5)" = "UUID=" ]; then
        # $1 is a UUID
        echo $(findfs $1)
    elif [ "$(echo $1|cut -c -6)" = "LABEL=" ]; then
        # $1 is a LABEL
        echo $(findfs $1)
    elif [ "$(echo $1|cut -c -5)" = "/dev/" ]; then
        # $1 is a device name
        echo $1
    else
         # $1 is unrecognized.
        echo "unknow-disk"
    fi
}
for p in ${CMDLINE};
do
    key=${p%%=*}
    value=${p#*=}

    case $key in
        imgpart)
            IMGPART=`parse_disk $value`
        ;;
        imgfile)
            IMGFILE=$value
        ;;
    esac
done
if [ -z "${IMGPART}" ]; then
    echo "Specify the squash image partition after the kernel command ${CMDLINE}"
    echo "example: kenrel... imgpart=/dev/sda2 imgfile=/gentoo.sqs"
    exec /bin/sh
    exit 0
fi
if [ -z "${IMGFILE}" ]; then
    echo "Specify the squash image file after the kernel command ${CMDLINE}"
    echo "example: kenrel... imgpart=/dev/sda2 imgfile=/gentoo.sqs"
    exec /bin/sh
    exit 0
fi
echo IMGPART=${IMGPART}
echo IMGFILE=${IMGFILE}
if [ ! -b "${IMGPART}" ]; then
    echo No partition with ${IMGPART} has been found
    exec /bin/sh
    exit 0
fi
# ok, parsing done
# Mount the partitions
# 1) mount the partition where the squash image resides
mount -o ro ${IMGPART} /mnt/imgpart
# 2) init a loop pointing to the image file
loop_free=$(losetup -f | sed s#p/#p#)
losetup $loop_free /mnt/imgpart/${IMGFILE}
# 3) mount the squashfs to /mnt/static
mount -t squashfs $loop_free /mnt/static
# Note: if you don't want to use a squashed image, you just
# can mount your read only root to /mnt/static
# example: mount -o ro /dev/sda2 /mnt/static
# 4) mount a memory filesystem for the write access to the static image
# unclear: memory size? -o size=1024M
mount -t tmpfs tmpfs /mnt/dynamic
# 5) mount the writable overlay to the static image
mount -t aufs -o br=/mnt/dynamic:/mnt/static=ro none /mnt/union
# Clean up.
mount --move /mnt/dynamic /mnt/union/mnt/dynamic
mount --move /mnt/static /mnt/union/mnt/static
mount --move /mnt/imgpart /mnt/union/mnt/imgpart
umount /proc
umount /sys
# Boot the real thing.
exec switch_root /mnt/union /sbin/init
echo "Failed to switch_root, dropping to a shell"
exec /bin/sh

5. Create your own initramfs
Attention: it’s created in /boot!
代码:

mount /boot
chmod a+x /usr/src/initramfs/init
find . -print0 | cpio -ov -0 --format=newc | gzip -9 > /boot/my-initramfs.cpio.gz

6. Edit your grub.conf
nano -w /boot/grub/grub.conf

代码:
title=My initramfs with 2.6.29
root (hd0,0)
kernel /kernel-2.6.29-generic-a imgpart=/dev/sda3 imgfile=/gentoo-lxde.squash
initrd /my-initramfs.cpio.gz

7. Create the squash image of the root
(Note: remove the root / entry from /etc/fstab)
Do this NOT from a running system but take a Live Distro and mount the root device:

代码:
mount /dev/sda2 /mnt/gentoo
mount /dev/sda3 /mnt/imgpart
cd /mnt/gentoo
mksquashfs . /mnt/imgpart/gentoo-lxde.squash

Note
There is a problem on unmounting the disks on system halt:
- Unmounting loopback devices failed: in use but fuser finds nothing
- the same for /mnt/dynamic /mnt/static /mnt/imgpart
-> maybe somebody has a solution for this…

Good luck!
claudio

#!/bin/sh -x

SVNROOT="http://172.16.24.11/mc/accessplatform/cixml/tags/"
DATE=`date +%Y%m%d%H%M%S`
DISTFILE="${DATE}.tgz"
APPLICATION="cixml"
DEPLOY_TO_ROOT="/usr/local"
DEPLOY_TO="${DEPLOY_TO_ROOT}/${APPLICATION}"
JUMPHOST="121.52.216.20"
DISTHOST="9161"

COMMANDLIST="tar zxf /tmp/${DISTFILE} -C ${DEPLOY_TO}/releases && ln -shf ${DEPLOY_TO}/releases/${DATE} ${DEPLOY_TO}/current"
ROLLBACK_COMMAND="cd ${DEPLOY_TO}/releases && /bin/ls -r | head -1 | xargs rm -vrf && /bin/ls -r | head -1 | xargs -t -I {} ln -shf ${DEPLOY_TO}/releases/\\\"{}\\\" ${DEPLOY_TO}/current && echo Current Release Version: && cat ${DEPLOY_TO}/current/TAGS"
EXTRA_COMMAND=""

[ $# -eq 1 ] || {
   echo "usage: $0 (tagname|setup|rollback)"
   exit 1
}

if [ $1 = "setup" ]
then
   for DHOST in ${DISTHOST}
   do
       ssh ${JUMPHOST} "ssh localhost -p ${DHOST} \"sudo mkdir -pv ${DEPLOY_TO}/releases && sudo chown -R mc:wheel ${DEPLOY_TO}\""
   done
   exit 0
fi

if [ $1 = "rollback" ]
then
   for DHOST in ${DISTHOST}
   do
       ssh ${JUMPHOST} "ssh localhost -p ${DHOST} \"${ROLLBACK_COMMAND}\""
   done
   exit 0
fi

SVNPATH=${SVNROOT}${1}
TMPDIR="/tmp/"

# CHECK SVN URL
svn info ${SVNPATH} | grep ${1} || {
   echo "SVN URL not exsit"
   exit 1
}

# CHECK REMOTEHOST HAS BEEN CREATE DIR
for DHOST in ${DISTHOST}
do
    ssh ${JUMPHOST} "ssh localhost -p ${DHOST} \"[ -d ${DEPLOY_TO}/releases ]\"" || exit 1
done

# CHECKOUT FROM SVN
svn export ${SVNPATH} ${TMPDIR}${DATE} || {
    echo "SVN Export Error"
    exit 1
}

# TAR PACKAGE
cd ${TMPDIR}
echo ${1} > ${DATE}/TAGS
tar zcf ${DISTFILE} ${DATE}

# CREATE JUMP SCRIPTS
echo "#!/bin/sh" >> ${DATE}.sh

for DHOST in ${DISTHOST}
do
   echo "scp -P ${DHOST} ${DISTFILE} localhost:/tmp/ || {" >> ${DATE}.sh
   echo "    echo \"SCP TO ${DHOST} Error\"" >> ${DATE}.sh
   echo "    exit 1" >> ${DATE}.sh
   echo "}" >> ${DATE}.sh
   echo "ssh localhost -p ${DHOST} \"${COMMANDLIST}\" || {" >> ${DATE}.sh
   echo "    echo \"HOST ${DHOST} EXEC COMMAND ERROR\"" >> ${DATE}.sh
   echo "    exit 1" >> ${DATE}.sh
   echo "}" >> ${DATE}.sh
   [ -z "${EXTRA_COMMAND}" ] || echo "ssh localhost -p ${DHOST} \"sudo ${EXTRA_COMMAND}\"" >> ${DATE}.sh
done

# SCP PACKAGE&SCRIPTs TO JUMPHOST  
scp ${DISTFILE} ${DATE}.sh ${JUMPHOST}:~/ || {
    echo "SCP TO JUMPHOST Error"
    exit 1
}

# EXEC SCRIPTS TO DEPLOY PACKAGE
ssh ${JUMPHOST} "sh -x ${DATE}.sh"

# REMOVE TEMPFILE
ssh ${JUMPHOST} "rm -f ~/${DATE}.sh ~/${DATE}.tgz"
rm -rf ${DATE}
rm -rf ${DATE}.tgz
rm -rf ${DATE}.sh

软件版本：openssl-0.9.8l, lzo-2.02, openvpn-2.1.1

1. 编译openssl

    ./config --prefix=/data/app/openssl no-shared no-dso && make && make install

2. 编译lzo

    ./configure --prefix=/data/app/lzo --enable-static && make && make install

3. 编译openvpn

    ./configure --with-ssl-header=/data/app/openssl/include --with-ssl-lib=/data/app/openssl/lib --with-lzo-header=/data/app/lzo/include --with-lzo-lib=/data/app/lzo/lib --disable-plugins --with-openssl=static
    ## 增加gcc静态编译参数:
    sed -i '/^LIBS/s/LIBS = /LIBS = -static /g' Makefile
    make

4. 编译出来的结果

 X86-64  root@02:05:41 openvpn-2.1.1 >> ldd openvpn
 not a dynamic executable
 X86-64  root@02:05:46 openvpn-2.1.1 >> file openvpn
openvpn: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped