#!/usr/bin/make -f

export DEB_BUILD_MAINT_OPTIONS := hardening=+all

include /usr/share/dpkg/default.mk

# Uncomment this to turn on verbose mode.
# export DH_VERBOSE=1

# This has to be exported to make some magic below work.
export DH_OPTIONS

ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
  RUN_TESTS := yes
else
  RUN_TESTS :=
endif

ifeq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
  PARALLEL :=
else
  PARALLEL := \
	-j$(patsubst parallel=%,%,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
endif

ifeq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
  CC := gcc
  PKG_CONFIG = pkg-config
else
  CC := $(DEB_HOST_GNU_TYPE)-gcc
  PKG_CONFIG = $(DEB_HOST_GNU_TYPE)-pkg-config
  RUN_TESTS :=
endif

# Change the version string to reflect distribution
SSH_EXTRAVERSION := $(DEB_VENDOR)-gssapi-$(shell echo '$(DEB_VERSION)' | sed -e 's/.*-//; s/+salsaci+.*/+salsaci/')

UBUNTU := $(shell $(call dpkg_vendor_derives_from,Ubuntu))
ifeq ($(UBUNTU),yes)
DEFAULT_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
else
DEFAULT_PATH := /usr/local/bin:/usr/bin:/bin:/usr/games
endif
SUPERUSER_PATH := /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

ifeq ($(UBUNTU),yes)
server_recommends := ssh-import-id
else
server_recommends :=
endif

# Common path configuration.
confflags += --sysconfdir=/etc/ssh
confflags += --libexecdir=\$${prefix}/lib/openssh

# Common build options.
confflags += --disable-strip
confflags += --with-mantype=doc
confflags += --with-4in6
confflags += --with-privsep-path=/run/sshd
confflags += --with-pid-dir=/run

# Always use the internal mkdtemp; see https://bugs.debian.org/1001186.
confflags += ac_cv_func_mkdtemp=no

# ppc64el doesn't support -fzero-call-used-regs=used, but configure fails to
# detect that.
ifeq ($(DEB_HOST_ARCH),ppc64el)
confflags += ossh_cv_cflag__fzero_call_used_regs_used=no
endif

# passwd isn't otherwise needed and may not be installed at build time.
# Ensure that sshd knows its path.
confflags += PATH_PASSWD_PROG=/usr/bin/passwd

confflags += --with-tcp-wrappers
confflags += --with-pam
confflags += --with-libedit
confflags += --with-kerberos5=/usr
ifeq ($(shell dpkg --compare-versions "$$(dpkg-query -Wf '$${Version}' libssl-dev)" lt 4.0.0 && echo 1),1)
confflags += --with-ssl-engine
endif
confflags += --with-wtmpdb
ifeq ($(DEB_HOST_ARCH_OS),linux)
confflags += --with-selinux
confflags += --with-audit=linux
confflags += --with-security-key-builtin
endif

confflags += --with-xauth=/usr/bin/xauth

# Default paths.
confflags += --with-default-path=$(DEFAULT_PATH) --with-superuser-path=$(SUPERUSER_PATH)

# Compiler flags.
cflags := $(CPPFLAGS) $(CFLAGS)
cflags += -DSSH_EXTRAVERSION=\"$(SSH_EXTRAVERSION)\"
confflags += --with-cflags='$(cflags)'

# Linker flags.
confflags += --with-ldflags='$(strip -Wl,--as-needed $(LDFLAGS))'

%:
	dh $@ --with=runit $(BUILD_PACKAGES)

override_dh_autoreconf-indep:

override_dh_auto_configure-arch:
	dh_auto_configure -Bdebian/build-deb -- $(confflags)

	# Nothing reads /var/log/btmp any more (see
	# https://bugs.debian.org/1072184).
	perl -pi -e 's,.*#define USE_BTMP .*,/* #undef USE_BTMP */,' debian/build-deb/config.h

override_dh_auto_configure-indep:

override_dh_auto_build-arch:
	$(MAKE) -C debian/build-deb $(PARALLEL) ASKPASS_PROGRAM='/usr/bin/ssh-askpass'
	$(MAKE) -C debian/build-deb regress-prep
	$(MAKE) -C debian/build-deb $(PARALLEL) regress-binaries regress-unit-binaries

override_dh_auto_build-indep:

override_dh_auto_test-arch:
ifeq ($(RUN_TESTS),yes)
	$(MAKE) -C debian/build-deb unit compat-tests
	debian/check-ucf-md5sums
endif

override_dh_auto_test-indep:

override_dh_auto_clean:
	rm -rf debian/build-deb

override_dh_auto_install-arch:
	$(MAKE) -C debian/build-deb DESTDIR=`pwd`/debian/tmp install-nokeys

override_dh_auto_install-indep:

execute_before_dh_install-arch:
	# Remove version control tags to avoid unnecessary conffile
	# resolution steps for administrators.
	sed -i '/\$$OpenBSD:/d' \
		debian/tmp/etc/ssh/moduli \
		debian/tmp/etc/ssh/ssh_config \
		debian/tmp/etc/ssh/sshd_config

override_dh_installinit:
	dh_installinit -R --name ssh

override_dh_installsystemd:
	dh_installsystemd -popenssh-server-gssapi ssh.service
	dh_installsystemd -popenssh-server-gssapi --no-enable ssh.socket
	dh_installsystemd -popenssh-server-gssapi --no-start rescue-ssh.target
	dh_installsystemd -popenssh-server-gssapi sshd-keygen.service

debian/openssh-server-gssapi.sshd.pam: debian/openssh-server-gssapi.sshd.pam.in
ifeq ($(DEB_HOST_ARCH_OS),linux)
	sed 's/^@IF_KEYINIT@//' $< > $@
else
	sed '/^@IF_KEYINIT@/d' $< > $@
endif

override_dh_installpam: debian/openssh-server-gssapi.sshd.pam
	dh_installpam --name sshd

override_dh_runit:
	dh_runit -popenssh-server-gssapi

execute_after_dh_fixperms-arch:
	chmod u+s debian/openssh-client-gssapi/usr/lib/openssh/ssh-keysign

# Work around dh-exec https://bugs.debian.org/1121699.
override_dh_missing:
	dh_missing --list-missing

override_dh_gencontrol:
	dh_gencontrol -- -V'openssh-server-gssapi:Recommends=$(server_recommends)'