mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/boypt/openssh-deb.git
synced 2026-09-20 08:03:46 +08:00
d58fe29375
sid 10.5p1-1 pool only provides orig.tar.xz and no .asc; previous hard-coded gz/.asc caused wget 404 and set -e abort in pullsrc.sh (failing Create release 33487065147 19s quick fail across all codenames). Parse .dsc for actual orig filename dynamically with fallback to xz, and make compile.sh SOURCES expect xz with compat fallback to gz for old caches (e.g. 10.4).
184 lines
6.1 KiB
Bash
Executable File
184 lines
6.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Bash3 Boilerplate. Copyright (c) 2014, kvz.io
|
|
|
|
set -o errexit
|
|
set -o pipefail
|
|
set -o nounset
|
|
# set -o xtrace
|
|
|
|
trap 'echo -e "Aborted, error $? in command: $BASH_COMMAND"; trap ERR; exit 1' ERR
|
|
|
|
# Set magic variables for current file & dir
|
|
__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
__file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
|
|
__base="$(basename ${__file} .sh)"
|
|
__root="$(cd "$(dirname "${__dir}")" && pwd)" # <-- change this as it depends on your app
|
|
|
|
__libssl="$(dpkg-query -f '${Version}' -W libssl-dev || true)"
|
|
[[ -z $__libssl ]] && __libssl="0.0.0"
|
|
__libfido2_ver="$(dpkg-query -f '${Version}' -W libfido2-dev || true)"
|
|
[[ -z $__libfido2_ver ]] && __libfido2_ver="0.0.0"
|
|
__initsystemhelpers_ver="$(dpkg-query -f '${Version}' -W init-system-helpers || true)"
|
|
[[ -z $__initsystemhelpers_ver ]] && __initsystemhelpers_ver="0.0.0"
|
|
|
|
STATIC_OPENSSL=0
|
|
|
|
echo "Getting version from version.env ..."
|
|
source $__dir/version.env
|
|
|
|
RETRY_COUNT=0
|
|
MAX_RETRIES=10
|
|
while [[ -z ${OPENSSH_SIDPKG:-} ]]; do
|
|
RETRY_COUNT=$((RETRY_COUNT+1))
|
|
if [[ $RETRY_COUNT -gt $MAX_RETRIES ]]; then
|
|
echo "Error: Failed to get OPENSSH_SIDPKG from version.env after $MAX_RETRIES retries." >&2
|
|
exit 1
|
|
fi
|
|
echo "Warning: OPENSSH_SIDPKG is not set. Retrying in 3 seconds... (Attempt ${RETRY_COUNT}/${MAX_RETRIES})"
|
|
source $__dir/version.env
|
|
sleep 3
|
|
done
|
|
|
|
if dpkg --compare-versions $__libssl lt '3.0.0' || [[ -n ${FORCESSL+x} ]]; then
|
|
STATIC_OPENSSL=1
|
|
fi
|
|
|
|
BUILD_CODENAME=$(lsb_release -sc)
|
|
|
|
SOURCES=(
|
|
openssh_${OPENSSH_SIDPKG}.debian.tar.xz \
|
|
openssh_${OPENSSH_SIDPKG}.dsc \
|
|
openssh_${OPENSSHVER}.orig.tar.xz \
|
|
)
|
|
|
|
echo "-- Build OpenSSH : ${OPENSSH_SIDPKG}"
|
|
if [[ $STATIC_OPENSSL -eq 1 ]]; then
|
|
echo "-- Linked OpenSSL: ${OPENSSLSRC/.tar.gz/}"
|
|
SOURCES+=("$OPENSSLSRC")
|
|
else
|
|
echo "-- Linked OpenSSL: libssl-dev ${__libssl}"
|
|
fi
|
|
|
|
CHECKEXISTS() {
|
|
if [[ ! -f $__dir/downloads/$1 ]];then
|
|
echo "-- Error: $1 not found, run 'pullsrc.sh', or manually put it in the downloads dir."
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
for fn in "${SOURCES[@]}"; do
|
|
# compat: allow .orig.tar.gz for old versions (e.g. 10.4) if .xz not present
|
|
if [[ "$fn" == *.orig.tar.xz ]] && [[ ! -f "$__dir/downloads/$fn" ]] && compgen -G "$__dir/downloads/openssh_${OPENSSHVER}.orig.tar.*" > /dev/null; then
|
|
continue
|
|
fi
|
|
CHECKEXISTS "$fn"
|
|
done
|
|
|
|
cd $__dir
|
|
[[ -d build ]] && rm -rf build
|
|
mkdir -p build && pushd build
|
|
|
|
#### Build OPENSSL
|
|
if [[ $STATIC_OPENSSL -eq 1 ]]; then
|
|
mkdir -p openssl
|
|
tar xfz $__dir/downloads/$OPENSSLSRC --strip-components=1 -C openssl
|
|
pushd openssl
|
|
./config no-dgram no-tests shared zlib -fPIC
|
|
make -j$(nproc)
|
|
OPENSSLDIR=$PWD
|
|
popd
|
|
fi
|
|
#################
|
|
|
|
## Extract dpkg source
|
|
dpkg-source -x $__dir/downloads/openssh_${OPENSSH_SIDPKG}.dsc
|
|
pushd openssh-${OPENSSHVER}
|
|
|
|
## disable fido support on older distro
|
|
if dpkg --compare-versions $__libfido2_ver lt '1.5.0'; then
|
|
sed -i '/libfido2-dev/d' debian/control
|
|
sed -i "s|with-security-key-builtin|disable-security-key|" debian/rules
|
|
fi
|
|
|
|
## link openssl staticlly on older distro / or forced with `FORCESSL=1`
|
|
if [[ $STATIC_OPENSSL -eq 1 ]]; then
|
|
sed -i "s|-lcrypto|${OPENSSLDIR}/libcrypto.a -lz -ldl -pthread|g" configure configure.ac
|
|
sed -i '/libssl-dev/d' debian/control
|
|
sed -i "/^confflags += --with-ssl-engine/aconfflags += --with-ssl-dir=${OPENSSLDIR}\nconfflags_udeb += --with-ssl-dir=${OPENSSLDIR}" debian/rules
|
|
sed -i "/^override_dh_auto_configure-arch:/iDEB_CONFIGURE_SCRIPT_ENV += LD_LIBRARY_PATH=${OPENSSLDIR}" debian/rules
|
|
fi
|
|
|
|
## wtmpdb not available in older distros
|
|
if ! dpkg -l libwtmpdb-dev; then
|
|
sed -i '/libwtmpdb-dev/d' debian/control
|
|
sed -i '/with-wtmpdb/d' debian/rules
|
|
fi
|
|
|
|
## libcrypt-dev does not exist on older distros (crypt.h ships in libc6-dev,
|
|
## e.g. Ubuntu 18.04): drop it so dpkg-checkbuilddeps passes
|
|
if ! dpkg -s libcrypt-dev >/dev/null 2>&1; then
|
|
sed -i '/libcrypt-dev/d' debian/control
|
|
fi
|
|
|
|
## sid packaging needs a dh-runit newer than old distros provide, and the
|
|
## runit-helper dependency it generates is not installable there (e.g. Ubuntu
|
|
## 18.04 only has runit-helper 2.7.1): strip the runit integration entirely
|
|
__dh_runit_bd="$(grep -oP 'dh-runit \([^)]*\)' debian/control | head -n1 || true)"
|
|
if [[ -n $__dh_runit_bd ]] && ! dpkg-checkbuilddeps -d "$__dh_runit_bd" /dev/null >/dev/null 2>&1; then
|
|
sed -i 's|dh $@ --with=runit|dh $@|' debian/rules
|
|
sed -i '/^override_dh_runit:/,+1d' debian/rules
|
|
sed -i '/dh-runit/d' debian/control
|
|
sed -i '/${runit:Breaks}/d' debian/control
|
|
rm -f debian/openssh-server.runit
|
|
fi
|
|
|
|
## named GIDs in sysusers.d (u sshd -:nogroup) need systemd >= 244; older
|
|
## systemd silently fails to parse and the sshd privsep user is never created
|
|
## (e.g. Ubuntu 18.04 ships systemd 237)
|
|
__systemd_ver="$(apt-cache policy systemd 2>/dev/null | awk '/Candidate:/{print $2; exit}')"
|
|
[[ -z $__systemd_ver || $__systemd_ver == "(none)" ]] && __systemd_ver=0
|
|
if dpkg --compare-versions "$__systemd_ver" lt '244~'; then
|
|
sed -i -E 's/^(u [^ ]+) -:[^ ]+ /\1 - /' debian/*.sysusers
|
|
fi
|
|
|
|
## on non-merged-usr distros (e.g. Ubuntu 18.04) deb-systemd-helper only
|
|
## searches /lib/systemd/system, so units must be installed there
|
|
if [ ! -L /lib ]; then
|
|
sed -i 's|usr/lib/systemd/system|lib/systemd/system|g' debian/*.install
|
|
fi
|
|
|
|
## fix init-system-helpers version require
|
|
if dpkg --compare-versions $__initsystemhelpers_ver lt '1.66'; then
|
|
sed -i '/init-system-helpers/s|1.66|1.50|' debian/control
|
|
fi
|
|
|
|
## PATCH 10.4p1-1
|
|
sed -i '/chmod +x debian\/openssh-tests/s|^|#|' debian/rules
|
|
|
|
## Check build deps
|
|
if ! dpkg-checkbuilddeps; then
|
|
echo "The build dependencies are not met, run ./install_deps.sh first."
|
|
exit 1
|
|
fi
|
|
|
|
## Adding distro codename to package names
|
|
sed -i "1s|)|~${BUILD_CODENAME})|" debian/changelog
|
|
|
|
## SKIP openssh-tests pkg
|
|
sed -i "/^%:/iBUILD_PACKAGES += -Nopenssh-tests\n" debian/rules
|
|
|
|
echo "INFO: Building Package: $(head -n1 debian/changelog)"
|
|
|
|
### Build OpenSSH Package
|
|
env \
|
|
DEB_BUILD_OPTIONS="noddebs nocheck" \
|
|
DEB_BUILD_PROFILES="noudeb pkg.openssh.nognome" \
|
|
dpkg-buildpackage --no-sign -rfakeroot -b
|
|
popd
|
|
|
|
# Move all files into output dir
|
|
cd $__dir
|
|
mkdir -p output
|
|
mv -f build/*.deb output/ 2> /dev/null || echo "No deb packages created!"
|
|
#mv -f build/*.udeb output/ 2> /dev/null || echo "No udeb packages created!"
|