feat: add Ubuntu 18.04 (bionic) backport support

compile.sh:
- drop libcrypt-dev build-dep when absent (crypt.h in libc6-dev)
- strip runit integration when dh-runit constraint is unsatisfiable
  (avoids uninstallable runit-helper >= 2.17 dep)
- rewrite sysusers named-GID syntax for systemd < 244 (237 cannot
  parse 'u sshd -:nogroup', sshd privsep user was never created)
- install systemd units to /lib on non-merged-usr distros
  (deb-systemd-helper 1.51 only searches /lib/systemd/system)

install_deps.sh:
- install ca-certificates (fixes GitHub TLS verification in pullsrc)
- install libcrypt-dev when available in the archive
- pull dwz from <codename>-backports when too old for debhelper 13.14
- patch debhelper 13.14 for Perl 5.26 (list-context state, dh_missing)
- lower init-system-helpers dep versions and drop
  --skip-systemd-native from invoke-rc.d calls on old distros
- keep dh_installsystemd unit path at /lib on non-merged-usr

CI: add ubuntu:bionic to both workflow matrices

.github/workflows/build-deps-images.yml

@@ -23,7 +23,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, ubuntu-24.04-arm]
-        version: ["ubuntu:noble", "ubuntu:jammy", "ubuntu:focal", "debian:trixie", "debian:bookworm", "debian:bullseye"]
+        version: ["ubuntu:noble", "ubuntu:jammy", "ubuntu:focal", "ubuntu:bionic", "debian:trixie", "debian:bookworm", "debian:bullseye"]
       fail-fast: false
 
     steps:

.github/workflows/create-release.yml

@@ -19,7 +19,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, ubuntu-24.04-arm]
-        version: ["ubuntu:noble", "ubuntu:jammy", "ubuntu:focal", "debian:trixie", "debian:bookworm", "debian:bullseye"]
+        version: ["ubuntu:noble", "ubuntu:jammy", "ubuntu:focal", "ubuntu:bionic", "debian:trixie", "debian:bookworm", "debian:bullseye"]
       fail-fast: false
 
     steps:

compile.sh

@@ -111,6 +111,39 @@ if ! dpkg -l libwtmpdb-dev; then
 	sed -i '/with-wtmpdb/d' debian/rules
 fi
 
+## libcrypt-dev does not exist on older distros (crypt.h ships in libc6-dev,
+## e.g. Ubuntu 18.04): drop it so dpkg-checkbuilddeps passes
+if ! dpkg -s libcrypt-dev >/dev/null 2>&1; then
+	sed -i '/libcrypt-dev/d' debian/control
+fi
+
+## sid packaging needs a dh-runit newer than old distros provide, and the
+## runit-helper dependency it generates is not installable there (e.g. Ubuntu
+## 18.04 only has runit-helper 2.7.1): strip the runit integration entirely
+__dh_runit_bd="$(grep -oP 'dh-runit \([^)]*\)' debian/control | head -n1 || true)"
+if [[ -n $__dh_runit_bd ]] && ! dpkg-checkbuilddeps -d "$__dh_runit_bd" /dev/null >/dev/null 2>&1; then
+	sed -i 's|dh $@ --with=runit|dh $@|' debian/rules
+	sed -i '/^override_dh_runit:/,+1d' debian/rules
+	sed -i '/dh-runit/d' debian/control
+	sed -i '/${runit:Breaks}/d' debian/control
+	rm -f debian/openssh-server.runit
+fi
+
+## named GIDs in sysusers.d (u sshd -:nogroup) need systemd >= 244; older
+## systemd silently fails to parse and the sshd privsep user is never created
+## (e.g. Ubuntu 18.04 ships systemd 237)
+__systemd_ver="$(apt-cache policy systemd 2>/dev/null | awk '/Candidate:/{print $2; exit}')"
+[[ -z $__systemd_ver || $__systemd_ver == "(none)" ]] && __systemd_ver=0
+if dpkg --compare-versions "$__systemd_ver" lt '244~'; then
+	sed -i -E 's/^(u [^ ]+) -:[^ ]+ /\1 - /' debian/*.sysusers
+fi
+
+## on non-merged-usr distros (e.g. Ubuntu 18.04) deb-systemd-helper only
+## searches /lib/systemd/system, so units must be installed there
+if [ ! -L /lib ]; then
+	sed -i 's|usr/lib/systemd/system|lib/systemd/system|g' debian/*.install
+fi
+
 ## fix init-system-helpers version require
 if dpkg --compare-versions $__initsystemhelpers_ver lt '1.66'; then
 	sed -i '/init-system-helpers/s|1.66|1.50|' debian/control

install_deps.sh

@@ -34,7 +34,7 @@ fi
 apt update
 apt upgrade -y
 apt install -y --no-install-recommends lsb-release wget sudo pkgconf build-essential fakeroot \
-	dpkg-dev debhelper debhelper-compat dh-exec dh-runit \
+	dpkg-dev debhelper debhelper-compat dh-exec dh-runit ca-certificates \
 	libaudit-dev libedit-dev libgtk-3-dev libselinux1-dev libsystemd-dev \
 	libkrb5-dev libpam0g-dev libwrap0-dev
 
@@ -42,6 +42,11 @@ if [[ $(apt-cache search --names-only 'libfido2-dev' | wc -l) -gt 0 ]]; then
 	apt install -y libfido2-dev libcbor-dev
 fi
 
+# libcrypt-dev only exists on distros where libxcrypt was split out of libc
+if [[ $(apt-cache search --names-only 'libcrypt-dev' | wc -l) -gt 0 ]]; then
+	apt install -y libcrypt-dev
+fi
+
 
 # install the latest debhelper from debian sid by adding debian sources
 _DEBIAN_DEBHELPER() {
@@ -78,7 +83,45 @@ __debhelper_ver="$(dpkg-query -f '${Version}' -W debhelper || true)"
 echo "DEBUG: __debhelper_ver:$__debhelper_ver"
 if dpkg --compare-versions "$__debhelper_ver" lt '13.12~'; then
    # dh-sequence-movetousr was added to debhelper in 13.11.7
+
+   # debhelper 13.14 needs dwz >= 0.12.20190711, newer than some distros ship
+   # (Ubuntu 18.04 has 0.12-2): pull it from the distro backports pocket.
+   __dwz_ver="$(apt-cache policy dwz 2>/dev/null | awk '/Candidate:/{print $2; exit}')"
+   [[ -z $__dwz_ver || $__dwz_ver == "(none)" ]] && __dwz_ver=0
+   if dpkg --compare-versions "$__dwz_ver" lt '0.12.20190711'; then
+       apt install -y -t "$(lsb_release -sc)-backports" dwz
+   fi
+
    sudo apt install -y "$__dir"/builddep/*.deb
+
+   # debhelper 13.14 uses Perl >= 5.30 syntax (state vars in list context) and
+   # dh_missing declares v5.28; downgrade both for older perls (Ubuntu 18.04: 5.26).
+   __perl_ver="$(perl -MConfig -e 'print $Config{version}')"
+   if dpkg --compare-versions "$__perl_ver" lt '5.28'; then
+       sed -i -E 's/^(\s*)state\s+([%@][^=]+=)/\1my \2/; s/^(\s*)state\s+\(([^)]+)\)/\1my (\2)/' /usr/share/perl5/Debian/Debhelper/Dh_Lib.pm
+       sed -i 's/^use v5\.28;/use v5.26;/' /usr/bin/dh_missing
+   fi
+
+   # debhelper hardcodes versioned deps on init-system-helpers that old distros
+   # predate (Ubuntu 18.04: 1.51); the subcommands used are all supported there.
+   __ish_ver="$(apt-cache policy init-system-helpers 2>/dev/null | awk '/Candidate:/{print $2; exit}')"
+   [[ -z $__ish_ver || $__ish_ver == "(none)" ]] && __ish_ver=0
+   if dpkg --compare-versions "$__ish_ver" lt '1.52'; then
+       sed -i "s/\">= 1\.52\"/\">= $__ish_ver\"/; s/\">= 1\.66~\"/\">= $__ish_ver\"/" /usr/bin/dh_installsystemduser
+   fi
+   # invoke-rc.d only learned --skip-systemd-native in init-system-helpers 1.54;
+   # drop the option on older distros (dh_installinit then also omits its
+   # Pre-Depends on init-system-helpers (>= 1.54~) automatically).
+   if dpkg --compare-versions "$__ish_ver" lt '1.54~'; then
+       sed -i "s/compat(11) ? '' : '--skip-systemd-native '/''/" /usr/bin/dh_installinit
+   fi
+
+   # On non-merged-usr distros (e.g. Ubuntu 18.04) deb-systemd-helper only
+   # searches /lib/systemd/system, but debhelper 13.14 installs units to
+   # /usr/lib: keep units in /lib so services actually get enabled.
+   if [ ! -L /lib ]; then
+       sed -i 's|\$tmpdir/usr/lib/systemd/system|$tmpdir/lib/systemd/system|g' /usr/bin/dh_installsystemd
+   fi
 fi
 
 #CODE_NAME=$(lsb_release -sc)