Merging upstream version 3.2.5+dfsg.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

16 files changed, 680 insertions, 235 deletions

diff --git a/scripts/crossbuild/README.md b/scripts/crossbuild/README.md
index 0bcc2c4..a5dc205 100644
--- a/scripts/crossbuild/README.md
+++ b/scripts/crossbuild/README.md
@@ -8,6 +8,9 @@ different operating systems, using Docker.
 The primary purpose is for developers to easily test FreeRADIUS on
 different systems.
 
+**Do not use this for running FreeRADIUS in production - see
+`scripts/docker` instead.**
+
 
 ## Common Usage
 
@@ -24,7 +27,7 @@ least on the first run):
 
     make crossbuild
 
-or for the most common systems (Debian, Ubuntu, CentOS):
+or for the most common systems (Debian, Ubuntu, CentOS, Rocky):
 
     make crossbuild.common
 
@@ -41,7 +44,9 @@ The Docker containers are left running, and may be stopped with
     make crossbuild.down
 
 The system tries to be as efficient as possible, so will not
-rebuild from scratch every time.
+rebuild the Docker images from scratch every time, but use an
+existing image and copy just the latest git commits in for
+testing.
 
 
 ## Global make targets
@@ -49,47 +54,47 @@ rebuild from scratch every time.
 The following targets will operate on the crossbuild system
 globally, or on all images (unless otherwise stated):
 
+  - `make crossbuild`
 
-### `make crossbuild`
-
-Create all docker images (if required), start them, build and test
-FreeRADIUS.
+    Create all docker images (if required), start them, build and
+    test FreeRADIUS.
 
 
-### `make crossbuild.common`
+  - `make crossbuild.common`
 
-As `make crossbuild`, but only build and test the most common
-systems.
+    As `make crossbuild`, but only build and test the most common
+    systems.
 
 
-### `make crossbuild.info`
+  - `make crossbuild.info`
 
-List all systems, together with the expected state. See
-`crossbuild.reset`.
+    List all systems, together with the expected state. See
+    `crossbuild.reset`.
 
 
-### `make crossbuild.down`
+  - `make crossbuild.down`
 
-Stop all containers.
+    Stop all containers.
 
 
-### `make crossbuild.reset`
+  - `make crossbuild.reset`
 
-If containers are stopped or started outside Docker, crossbuild
-may get confused. This will clear the internal state which should
-try and start everything from be beginning again.
+    If containers are stopped or started outside Docker,
+    crossbuild may get confused. This will clear the internal
+    state which should try and start everything from be beginning
+    again.
 
 
-### `make crossbuild.clean`
+  - `make crossbuild.clean`
 
-Bring down all containers, clear state. This is a general "tidy
-up".
+    Bring down all containers, clear state. This is a general
+    "tidy up".
 
 
-### `make crossbuild.wipe`
+  - `make crossbuild.wipe`
 
-Don't just stop, but destroy all crossbuild docker images. This
-will mean they need to be recreated again upon next use.
+    Don't just stop, but destroy all crossbuild docker images.
+    This will mean they need to be recreated again upon next use.
 
 
 ## Per-image make targets
@@ -116,7 +121,16 @@ Docker images will be created with names in the form:
 
     freeradius-build/debian10
 
-whil containers will have names like:
+while containers will have names like:
 
     fr-crossbuild-debian10
 
+
+## Re-generating Dockerfiles
+
+The Dockerfiles used for crossbuild are generated from m4
+templates. To regenerate one use `make crossbuild.IMAGE.regen`, or
+`make crossbuild.regen` to generate them all. The m4 templates are
+stored in `scripts/crossbuild/m4/`. This will usually only need to
+be used to add a new operating system, not during standard build
+testing.
diff --git a/scripts/crossbuild/crossbuild.mk b/scripts/crossbuild/crossbuild.mk
index da96506..599a34c 100644
--- a/scripts/crossbuild/crossbuild.mk
+++ b/scripts/crossbuild/crossbuild.mk
@@ -11,13 +11,19 @@ else
 #
 #  Short list of common builds
 #
-CB_COMMON:=centos7 debian10 ubuntu18
+CB_COMMON:=centos7 rocky9 debian11 ubuntu20
+
+# Where to put stamp files (subdirectory of where this makefile is)
+CB_DIR:=$(dir $(realpath $(lastword $(MAKEFILE_LIST))))
 
 # Where the docker directories are
-DT:=scripts/crossbuild/docker
+DT:=$(CB_DIR)/docker
 
 # Where to put stamp files (subdirectory of where this makefile is)
-DD:=$(dir $(realpath $(lastword $(MAKEFILE_LIST))))/build
+DD:=$(CB_DIR)/build
+
+# Location of top-level m4 template
+DOCKER_TMPL:=$(CB_DIR)/../docker/m4/Dockerfile.m4
 
 # List of all the docker images (sorted for "crossbuild.info")
 CB_IMAGES:=$(sort $(patsubst $(DT)/%,%,$(wildcard $(DT)/*)))
@@ -99,6 +105,11 @@ crossbuild.clean: $(foreach IMG,${CB_IMAGES},crossbuild.${IMG}.clean)
 crossbuild.wipe: $(foreach IMG,${CB_IMAGES},crossbuild.${IMG}.wipe)
 
 #
+#  Regenerate all Dockerfiles from m4 templates
+#
+crossbuild.regen: $(foreach IMG,${CB_IMAGES},crossbuild.${IMG}.regen)
+
+#
 #  Define rules for building a particular image
 #
 define CROSSBUILD_IMAGE_RULE
@@ -145,6 +156,7 @@ crossbuild.${1}.up: $(DD)/stamp-up.${1}
 $(DD)/docker.refresh.${1}: $(DD)/stamp-up.${1}
 	${Q}echo "REFRESH ${1}"
 	${Q}docker container exec $(CB_CPREFIX)${1} sh -c 'rsync -a /srv/src/ /srv/local-src/'
+	${Q}docker container exec $(CB_CPREFIX)${1} sh -c 'git config --global --add safe.directory /srv/local-src'
 	${Q}docker container exec $(CB_CPREFIX)${1} sh -c 'git config -f /srv/local-src/config core.bare true'
 	${Q}docker container exec $(CB_CPREFIX)${1} sh -c 'git config -f /srv/local-src/config --unset core.worktree || true'
 	${Q}docker container exec $(CB_CPREFIX)${1} sh -c '[ -d /srv/build ] || git clone /srv/local-src /srv/build'
@@ -218,6 +230,16 @@ crossbuild.${1}.wipe:
 crossbuild.${1}.refresh: $(DD)/docker.refresh.${1}
 
 #
+#  Regenerate the image Dockerfile from the m4 templates
+#
+.PHONY: crossbuild.${1}.regen
+crossbuild.${1}.regen: $(DT)/${1}/Dockerfile
+
+$(DT)/${1}/Dockerfile: $(DOCKER_TMPL) $(CB_DIR)/m4/Dockerfile.deb.m4 $(CB_DIR)/m4/Dockerfile.rpm.m4
+	${Q}echo REGEN ${1}
+	${Q}m4 -I $(CB_DIR)/m4 -D D_NAME=${1} -D D_TYPE=crossbuild $$< > $$@
+
+#
 #  Run the build test
 #
 .PHONY: crossbuild.${1}
diff --git a/scripts/crossbuild/docker/centos7/Dockerfile b/scripts/crossbuild/docker/centos7/Dockerfile
index 2f9e4ac..91f25b3 100644
--- a/scripts/crossbuild/docker/centos7/Dockerfile
+++ b/scripts/crossbuild/docker/centos7/Dockerfile
@@ -1,16 +1,32 @@
-FROM centos:centos7
+# Auto generated for centos7
+# from scripts/crossbuild/m4/Dockerfile.rpm.m4
+#
+# Rebuild this file with `make crossbuild.centos7.regen`
+#
+ARG from=centos:7
+FROM ${from} as build
+
+#
+#  CentOS 7 is now EOL, so we need to fix up the repo source
+#
+RUN sed -i "s/^mirrorlist/#mirrorlist/g" /etc/yum.repos.d/CentOS-*
+RUN sed -i "s|#\s*baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g" /etc/yum.repos.d/CentOS-*
+
 
 #
 #  Install devtools like make and git and the EPEL
 #  repository for freetds and hiredis
 #
 RUN yum update -y
-RUN yum install -y rpmdevtools openssl epel-release git yum-utils rsync
+RUN yum install -y rpmdevtools openssl epel-release git procps yum-utils \
+	rsync 
 
 #
 #  Install GCC that has the requisite support for C11 keywords and atomics
 #
 RUN yum install -y centos-release-scl
+RUN sed -i "s/^mirrorlist/#mirrorlist/g" /etc/yum.repos.d/CentOS-*
+RUN sed -i "s|#\s*baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g" /etc/yum.repos.d/CentOS-*
 RUN yum install -y devtoolset-8-gcc devtoolset-8-gcc-c++
 ENV CC=/opt/rh/devtoolset-8/root/usr/bin/gcc
 
@@ -21,6 +37,8 @@ ENV CC=/opt/rh/devtoolset-8/root/usr/bin/gcc
 RUN rm /etc/yum.repos.d/CentOS-SCLo-scl-rh.repo
 RUN rm /etc/yum.repos.d/CentOS-SCLo-scl.repo
 
+
+
 #
 #  Documentation build dependecies
 #
@@ -28,12 +46,11 @@ RUN rm /etc/yum.repos.d/CentOS-SCLo-scl.repo
 #  - doxygen & JSON.pm
 RUN yum install -y doxygen graphviz perl-JSON
 #  - antora (npm needed)
-RUN curl -sL https://rpm.nodesource.com/setup_10.x | bash -
+RUN curl -sL https://rpm.nodesource.com/setup_16.x | bash -
 RUN yum install -y nodejs
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
 #  - pandoc
 RUN curl -o - -L $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*tar.gz" | cut -d '"' -f 4) | tar xzvf - -C /tmp/
-# "
 RUN mv /tmp/pandoc-*/bin/* /usr/local/bin
 #  - asciidoctor
 RUN yum install -y rubygems-devel
@@ -67,6 +84,7 @@ RUN git clone --depth 1 --no-single-branch ${source}
 #
 #  Install build dependencies for all branches from v3 onwards
 #  Nodesource has issues (no SRPMS in some repos) and is not needed here
+#  CentOS/RHEL 7 do not support "-D" for yum-builddep so do that separately below if needed
 #
 WORKDIR freeradius-server
 RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
@@ -75,6 +93,11 @@ RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin
 		[ -e redhat/freeradius.spec ] && yum-builddep --disablerepo="nodesource*" -y redhat/freeradius.spec; \
 	done
 
+#  Yubikey deps for CentOS/RHEL 7
+RUN yum install -y ykclient-devel ykclient
+
+RUN yum install -y libyubikey-devel
+
 #
 #  Which is required by fixture setup utilities
 #
@@ -85,8 +108,8 @@ RUN yum install -y which
 #
 RUN yum install -y libnl3-devel
 
+
 #
 #  Create the RPM build tree
 #
-ENV BUILDDIR=/root/rpmbuild
 RUN rpmdev-setuptree
diff --git a/scripts/crossbuild/docker/debian10/Dockerfile b/scripts/crossbuild/docker/debian10/Dockerfile
index 3eb13a7..03a9ce5 100644
--- a/scripts/crossbuild/docker/debian10/Dockerfile
+++ b/scripts/crossbuild/docker/debian10/Dockerfile
@@ -1,8 +1,10 @@
-FROM debian:buster
-
-ARG gccver=8
-ARG clangver=8
-ARG osname=buster
+# Auto generated for debian10
+# from scripts/crossbuild/m4/Dockerfile.deb.m4
+#
+# Rebuild this file with `make crossbuild.debian10.regen`
+#
+ARG from=debian:buster
+FROM ${from} as build
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -15,14 +17,14 @@ RUN apt-get update && \
     rm -r /var/lib/apt/lists/*
 
 #  For clang
-RUN add-apt-repository -y "deb http://apt.llvm.org/${osname}/ llvm-toolchain-${osname}-${clangver} main" && \
+RUN add-apt-repository -y "deb http://apt.llvm.org/buster/ llvm-toolchain-buster-8 main" && \
     apt-key adv --fetch-keys http://apt.llvm.org/llvm-snapshot.gpg.key
 
 RUN apt-get update && \
 #  Development utilities
     apt-get install -y devscripts equivs git quilt rsync && \
 #  Compilers
-    apt-get install -y g++-${gccver} llvm-${clangver} clang-${clangver} lldb-${clangver} && \
+    apt-get install -y g++ llvm-8 clang-8 lldb-8 && \
 #  eapol_test dependencies
     apt-get install -y libnl-3-dev libnl-genl-3-dev
 
@@ -33,9 +35,9 @@ RUN apt-get update && \
 #  - doxygen & JSON.pm
 RUN apt-get install -y doxygen graphviz libjson-perl
 #  - antora (npm needed)
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash -
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
 RUN apt-get install -y nodejs
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
 #  - pandoc
 WORKDIR /tmp
 RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
@@ -44,15 +46,13 @@ RUN apt-get install -y ./pandoc-*.deb
 RUN apt-get install -y ruby-dev
 RUN gem install asciidoctor
 
-# set default things
-RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${gccver} 50 \
-                        --slave /usr/bin/g++ g++ /usr/bin/g++-${gccver} && \
-    update-alternatives --config gcc
-
-RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${clangver} 60 && \
+#
+#  Set defaults
+#
+RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-8 60 && \
     update-alternatives --config clang
 
-RUN update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-${clangver} 60 && \
+RUN update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-8 60 && \
     update-alternatives --config lldb
 
 
@@ -70,20 +70,16 @@ WORKDIR /usr/local/src/repositories
 ARG source=https://github.com/FreeRADIUS/freeradius-server.git
 RUN git clone --depth 1 --no-single-branch ${source}
 
-
 #
-#  Install build dependencies for all v3 branches
+#  Install build dependencies for all branches from v3 onwards
 #
 WORKDIR freeradius-server
-RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^v3\..*\.x");\
+RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
 	do \
 		git checkout $i; \
 		if [ -e ./debian/control.in ] ; then \
 			debian/rules debian/control ; \
 		fi ; \
-		echo Installing dependencies for $i ; \
-		mk-build-deps debian/control ; \
-		apt-get --no-install-recommends -y -V install ./freeradius-build-deps*.deb || true ; \
-		apt-get -y -f remove freeradius-build-deps libiodbc2-dev || true ; \
-		rm ./freeradius-build-deps*.deb ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
 	done
diff --git a/scripts/crossbuild/docker/ubuntu16/Dockerfile b/scripts/crossbuild/docker/debian11/Dockerfile
index dbec6f9..0a77893 100644
--- a/scripts/crossbuild/docker/ubuntu16/Dockerfile
+++ b/scripts/crossbuild/docker/debian11/Dockerfile
@@ -1,8 +1,10 @@
-FROM ubuntu:16.04
-
-ARG gccver=4.9
-ARG clangver=5.0
-ARG osname=xenial
+# Auto generated for debian11
+# from scripts/crossbuild/m4/Dockerfile.deb.m4
+#
+# Rebuild this file with `make crossbuild.debian11.regen`
+#
+ARG from=debian:bullseye
+FROM ${from} as build
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -10,24 +12,16 @@ ARG DEBIAN_FRONTEND=noninteractive
 #  Install add-apt-repository
 #
 RUN apt-get update && \
-    apt-get install -y software-properties-common python-software-properties apt-transport-https curl && \
+    apt-get install -y software-properties-common gnupg2 procps && \
     apt-get clean && \
     rm -r /var/lib/apt/lists/*
 
-#  Requires GCC-4.9 as it has support for C11 keywords and atomics
-
-#  For clang
-RUN add-apt-repository -y "deb http://apt.llvm.org/${osname}/ llvm-toolchain-${osname}-${clangver} main" && \
-    curl -o /tmp/llvm-snapshot.gpg.key https://apt.llvm.org/llvm-snapshot.gpg.key && \
-    apt-key add /tmp/llvm-snapshot.gpg.key && \
-#  For GCC
-    add-apt-repository -y ppa:ubuntu-toolchain-r/test
 
 RUN apt-get update && \
 #  Development utilities
     apt-get install -y devscripts equivs git quilt rsync && \
 #  Compilers
-    apt-get install -y g++-${gccver} llvm-${clangver} clang-${clangver} lldb-${clangver} && \
+    apt-get install -y g++ llvm clang lldb && \
 #  eapol_test dependencies
     apt-get install -y libnl-3-dev libnl-genl-3-dev
 
@@ -38,9 +32,9 @@ RUN apt-get update && \
 #  - doxygen & JSON.pm
 RUN apt-get install -y doxygen graphviz libjson-perl
 #  - antora (npm needed)
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash -
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
 RUN apt-get install -y nodejs
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
 #  - pandoc
 WORKDIR /tmp
 RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
@@ -49,16 +43,6 @@ RUN apt-get install -y ./pandoc-*.deb
 RUN apt-get install -y ruby-dev
 RUN gem install asciidoctor
 
-# set default things
-RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${gccver} 50 \
-                        --slave /usr/bin/g++ g++ /usr/bin/g++-${gccver} && \
-    update-alternatives --config gcc
-
-RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${clangver} 60 && \
-    update-alternatives --config clang
-
-RUN update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-${clangver} 60 && \
-    update-alternatives --config lldb
 
 
 #
@@ -82,5 +66,9 @@ WORKDIR freeradius-server
 RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
 	do \
 		git checkout $i; \
-		if [ -e ./debian/control.in ] ; then debian/rules debian/control ; fi ; echo 'y' | mk-build-deps -irt'apt-get -yV' debian/control ; \
+		if [ -e ./debian/control.in ] ; then \
+			debian/rules debian/control ; \
+		fi ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
 	done
diff --git a/scripts/crossbuild/docker/debian12/Dockerfile b/scripts/crossbuild/docker/debian12/Dockerfile
new file mode 100644
index 0000000..78eb501
--- /dev/null
+++ b/scripts/crossbuild/docker/debian12/Dockerfile
@@ -0,0 +1,74 @@
+# Auto generated for debian12
+# from scripts/crossbuild/m4/Dockerfile.deb.m4
+#
+# Rebuild this file with `make crossbuild.debian12.regen`
+#
+ARG from=debian:bookworm
+FROM ${from} as build
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+#
+#  Install add-apt-repository
+#
+RUN apt-get update && \
+    apt-get install -y software-properties-common gnupg2 procps && \
+    apt-get clean && \
+    rm -r /var/lib/apt/lists/*
+
+
+RUN apt-get update && \
+#  Development utilities
+    apt-get install -y devscripts equivs git quilt rsync && \
+#  Compilers
+    apt-get install -y g++ llvm clang lldb && \
+#  eapol_test dependencies
+    apt-get install -y libnl-3-dev libnl-genl-3-dev
+
+#
+#  Documentation build dependecies
+#
+
+#  - doxygen & JSON.pm
+RUN apt-get install -y doxygen graphviz libjson-perl
+#  - antora (npm needed)
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
+RUN apt-get install -y nodejs
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
+#  - pandoc
+WORKDIR /tmp
+RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
+RUN apt-get install -y ./pandoc-*.deb
+#  - asciidoctor
+RUN apt-get install -y ruby-dev
+RUN gem install asciidoctor
+
+
+
+#
+#  Setup a src dir in /usr/local
+#
+RUN mkdir -p /usr/local/src/repositories
+WORKDIR /usr/local/src/repositories
+
+
+#
+#  Shallow clone the FreeRADIUS source
+#
+WORKDIR /usr/local/src/repositories
+ARG source=https://github.com/FreeRADIUS/freeradius-server.git
+RUN git clone --depth 1 --no-single-branch ${source}
+
+#
+#  Install build dependencies for all branches from v3 onwards
+#
+WORKDIR freeradius-server
+RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
+	do \
+		git checkout $i; \
+		if [ -e ./debian/control.in ] ; then \
+			debian/rules debian/control ; \
+		fi ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
+	done
diff --git a/scripts/crossbuild/docker/debian8/Dockerfile b/scripts/crossbuild/docker/debian8/Dockerfile
deleted file mode 100644
index 094faa3..0000000
--- a/scripts/crossbuild/docker/debian8/Dockerfile
+++ /dev/null
@@ -1,84 +0,0 @@
-FROM debian:jessie
-
-ARG gccver=4.9
-ARG clangver=5.0
-ARG osname=jessie
-
-ARG DEBIAN_FRONTEND=noninteractive
-
-#
-#  Install add-apt-repository
-#
-RUN apt-get update && \
-    apt-get install -y software-properties-common python-software-properties apt-transport-https curl && \
-    apt-get clean && \
-    rm -r /var/lib/apt/lists/*
-
-#  Requires GCC-4.9 as it has support for C11 keywords and atomics
-
-#  For clang
-RUN add-apt-repository -y "deb http://apt.llvm.org/${osname}/ llvm-toolchain-${osname}-${clangver} main" && \
-    curl -o /tmp/llvm-snapshot.gpg.key https://apt.llvm.org/llvm-snapshot.gpg.key && \
-    apt-key add /tmp/llvm-snapshot.gpg.key
-
-RUN apt-get update && \
-#  Development utilities
-    apt-get install -y devscripts equivs git quilt rsync && \
-#  Compilers
-    apt-get install -y g++-${gccver} llvm-${clangver} clang-${clangver} lldb-${clangver} && \
-#  eapol_test dependencies
-    apt-get install -y libnl-3-dev libnl-genl-3-dev
-
-#
-#  Documentation build dependecies
-#
-
-#  - doxygen & JSON.pm
-RUN apt-get install -y doxygen graphviz libjson-perl
-#  - antora (npm needed)
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash -
-RUN apt-get install -y nodejs
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
-#  - pandoc
-WORKDIR /tmp
-RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
-RUN dpkg -i ./pandoc-*.deb
-RUN apt-get install -fy
-#  - asciidoctor
-RUN apt-get install -y ruby
-RUN gem install asciidoctor
-
-# set default things
-RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${gccver} 50 \
-                        --slave /usr/bin/g++ g++ /usr/bin/g++-${gccver} && \
-    update-alternatives --config gcc
-
-RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${clangver} 60 && \
-    update-alternatives --config clang
-
-RUN update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-${clangver} 60 && \
-    update-alternatives --config lldb
-
-
-#
-#  Setup a src dir in /usr/local
-#
-RUN mkdir -p /usr/local/src/repositories
-WORKDIR /usr/local/src/repositories
-
-
-#
-#  Shallow clone the FreeRADIUS source
-#
-ARG source=https://github.com/FreeRADIUS/freeradius-server.git
-RUN git clone --depth 1 --no-single-branch ${source}
-
-#
-#  Install build dependencies for all branches from v3 onwards
-#
-WORKDIR freeradius-server
-RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
-	do \
-		git checkout $i; \
-		if [ -e ./debian/control.in ] ; then debian/rules debian/control ; fi ; echo 'y' | mk-build-deps -irt'apt-get -yV' debian/control ; \
-	done
diff --git a/scripts/crossbuild/docker/debian9/README b/scripts/crossbuild/docker/debian9/README
deleted file mode 100644
index f7a6135..0000000
--- a/scripts/crossbuild/docker/debian9/README
+++ /dev/null
@@ -1,15 +0,0 @@
-
-Build source image
-
-    docker build . -f Dockerfile.source -t freeradius:debian9-source
-
-Then either build and run jenkins image
-
-    docker build . -f Dockerfile.jenkins -t freeradius:debian9-jenkins
-    docker run -d -p 2222:22 freeradius:debian9-jenkins
-
-or build and run the server
-
-    docker build . -t freeradius:debian9
-    docker run -d -p 1812:1812/udp -p 1813:1813/udp freeradius:debian9
-
diff --git a/scripts/crossbuild/docker/centos8/Dockerfile b/scripts/crossbuild/docker/rocky8/Dockerfile
index bd856af..ba7fc56 100644
--- a/scripts/crossbuild/docker/centos8/Dockerfile
+++ b/scripts/crossbuild/docker/rocky8/Dockerfile
@@ -1,27 +1,38 @@
-FROM centos:centos8
+# Auto generated for rocky8
+# from scripts/crossbuild/m4/Dockerfile.rpm.m4
+#
+# Rebuild this file with `make crossbuild.rocky8.regen`
+#
+ARG from=rockylinux/rockylinux:8
+FROM ${from} as build
 
 #
 #  Install devtools like make and git and the EPEL
 #  repository for freetds and hiredis
 #
 RUN yum update -y
-RUN yum install -y rpmdevtools openssl epel-release git yum-utils rsync dnf-plugins-core
-RUN dnf config-manager --set-enabled powertools
+RUN yum install -y rpmdevtools openssl epel-release git procps yum-utils \
+	rsync dnf-plugins-core
+
+
+RUN yum config-manager --set-enabled powertools
 
 #
 #  Install GCC that has the requisite support for C11 keywords and atomics
 #
 RUN yum install -y gcc-toolset-9
 
+
 #
 #  Documentation build dependecies
 #
+
 #  - doxygen & JSON.pm
 RUN yum install -y doxygen graphviz perl-JSON
 #  - antora (npm needed)
-RUN curl -sL https://rpm.nodesource.com/setup_10.x | bash -
+RUN curl -sL https://rpm.nodesource.com/setup_20.x | bash -
 RUN yum install -y nodejs
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
 #  - pandoc
 RUN curl -o - -L $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*tar.gz" | cut -d '"' -f 4) | tar xzvf - -C /tmp/
 RUN mv /tmp/pandoc-*/bin/* /usr/local/bin
@@ -56,14 +67,19 @@ RUN git clone --depth 1 --no-single-branch ${source}
 
 #
 #  Install build dependencies for all branches from v3 onwards
+#  Nodesource has issues (no SRPMS in some repos) and is not needed here
+#  CentOS/RHEL 7 do not support "-D" for yum-builddep so do that separately below if needed
 #
 WORKDIR freeradius-server
 RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
 	do \
 		git checkout $i; \
-		[ -e redhat/freeradius.spec ] && yum-builddep -y redhat/freeradius.spec; \
+		[ -e redhat/freeradius.spec ] && yum-builddep -D "_with_rlm_yubikey 1" -y redhat/freeradius.spec; \
 	done
 
+
+RUN yum install -y libyubikey-devel
+
 #
 #  Which is required by fixture setup utilities
 #
@@ -75,7 +91,12 @@ RUN yum install -y which
 RUN yum install -y libnl3-devel
 
 #
+#  We test with TLS1.1, but that is disabled by default on some
+#  newer systems.
+#
+RUN update-crypto-policies --set LEGACY
+
+#
 #  Create the RPM build tree
 #
-ENV BUILDDIR=/root/rpmbuild
 RUN rpmdev-setuptree
diff --git a/scripts/crossbuild/docker/rocky9/Dockerfile b/scripts/crossbuild/docker/rocky9/Dockerfile
new file mode 100644
index 0000000..9936fe4
--- /dev/null
+++ b/scripts/crossbuild/docker/rocky9/Dockerfile
@@ -0,0 +1,91 @@
+# Auto generated for rocky9
+# from scripts/crossbuild/m4/Dockerfile.rpm.m4
+#
+# Rebuild this file with `make crossbuild.rocky9.regen`
+#
+ARG from=rockylinux/rockylinux:9
+FROM ${from} as build
+
+#
+#  Install yum
+#
+RUN dnf install -y yum
+
+#
+#  Install devtools like make and git and the EPEL
+#  repository for freetds and hiredis
+#
+RUN yum update -y
+RUN yum install -y rpmdevtools openssl epel-release git procps yum-utils \
+	rsync dnf-plugins-core
+
+
+
+RUN yum config-manager --set-enabled crb
+
+#
+#  Documentation build dependecies
+#
+
+#  - doxygen & JSON.pm
+RUN yum install -y doxygen graphviz perl-JSON
+#  - antora (npm needed)
+RUN curl -sL https://rpm.nodesource.com/setup_20.x | bash -
+RUN yum install -y nodejs
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
+#  - pandoc
+RUN curl -o - -L $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*tar.gz" | cut -d '"' -f 4) | tar xzvf - -C /tmp/
+RUN mv /tmp/pandoc-*/bin/* /usr/local/bin
+#  - asciidoctor
+RUN yum install -y rubygems-devel
+RUN gem install asciidoctor
+
+#
+#  Setup a src dir in /usr/local
+#
+RUN mkdir -p /usr/local/src/repositories
+WORKDIR /usr/local/src/repositories
+
+
+#
+#  Shallow clone the FreeRADIUS source
+#
+WORKDIR /usr/local/src/repositories
+ARG source=https://github.com/FreeRADIUS/freeradius-server.git
+RUN git clone --depth 1 --no-single-branch ${source}
+
+#
+#  Install build dependencies for all branches from v3 onwards
+#  Nodesource has issues (no SRPMS in some repos) and is not needed here
+#  CentOS/RHEL 7 do not support "-D" for yum-builddep so do that separately below if needed
+#
+WORKDIR freeradius-server
+RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
+	do \
+		git checkout $i; \
+		[ -e redhat/freeradius.spec ] && yum-builddep -D "_with_rlm_yubikey 1" -y redhat/freeradius.spec; \
+	done
+
+
+RUN yum install -y libyubikey-devel
+
+#
+#  Which is required by fixture setup utilities
+#
+RUN yum install -y which
+
+#
+#  Explicitly install libnl3-devel which is required for the EAP tests
+#
+RUN yum install -y libnl3-devel
+
+#
+#  We test with TLS1.1, but that is disabled by default on some
+#  newer systems.
+#
+RUN update-crypto-policies --set LEGACY
+
+#
+#  Create the RPM build tree
+#
+RUN rpmdev-setuptree
diff --git a/scripts/crossbuild/docker/ubuntu18/Dockerfile b/scripts/crossbuild/docker/ubuntu18/Dockerfile
index 874e3ec..1bea0bf 100644
--- a/scripts/crossbuild/docker/ubuntu18/Dockerfile
+++ b/scripts/crossbuild/docker/ubuntu18/Dockerfile
@@ -1,8 +1,10 @@
-FROM ubuntu:18.04
-
-ARG gccver=4.9
-ARG clangver=5.0
-ARG osname=bionic
+# Auto generated for ubuntu18
+# from scripts/crossbuild/m4/Dockerfile.deb.m4
+#
+# Rebuild this file with `make crossbuild.ubuntu18.regen`
+#
+ARG from=ubuntu:18.04
+FROM ${from} as build
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -10,10 +12,11 @@ ARG DEBIAN_FRONTEND=noninteractive
 #  Install add-apt-repository
 #
 RUN apt-get update && \
-    apt-get install -y software-properties-common && \
+    apt-get install -y software-properties-common gnupg2 procps && \
     apt-get clean && \
     rm -r /var/lib/apt/lists/*
 
+
 RUN apt-get update && \
 #  Development utilities
     apt-get install -y devscripts equivs git quilt rsync && \
@@ -29,9 +32,9 @@ RUN apt-get update && \
 #  - doxygen & JSON.pm
 RUN apt-get install -y doxygen graphviz libjson-perl
 #  - antora (npm needed)
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash -
+RUN curl -sL https://deb.nodesource.com/setup_16.x | bash -
 RUN apt-get install -y nodejs
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
 #  - pandoc
 WORKDIR /tmp
 RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
@@ -40,6 +43,8 @@ RUN apt-get install -y ./pandoc-*.deb
 RUN apt-get install -y ruby-dev
 RUN gem install asciidoctor
 
+
+
 #
 #  Setup a src dir in /usr/local
 #
@@ -61,5 +66,9 @@ WORKDIR freeradius-server
 RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
 	do \
 		git checkout $i; \
-		if [ -e ./debian/control.in ] ; then debian/rules debian/control ; fi ; echo 'y' | mk-build-deps -irt'apt-get -yV' debian/control ; \
+		if [ -e ./debian/control.in ] ; then \
+			debian/rules debian/control ; \
+		fi ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
 	done
diff --git a/scripts/crossbuild/docker/ubuntu20/Dockerfile b/scripts/crossbuild/docker/ubuntu20/Dockerfile
index c813b2f..a58e634 100644
--- a/scripts/crossbuild/docker/ubuntu20/Dockerfile
+++ b/scripts/crossbuild/docker/ubuntu20/Dockerfile
@@ -1,8 +1,10 @@
-FROM ubuntu:20.04
-
-ARG gccver=4.9
-ARG clangver=5.0
-ARG osname=bionic
+# Auto generated for ubuntu20
+# from scripts/crossbuild/m4/Dockerfile.deb.m4
+#
+# Rebuild this file with `make crossbuild.ubuntu20.regen`
+#
+ARG from=ubuntu:20.04
+FROM ${from} as build
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -10,10 +12,11 @@ ARG DEBIAN_FRONTEND=noninteractive
 #  Install add-apt-repository
 #
 RUN apt-get update && \
-    apt-get install -y software-properties-common && \
+    apt-get install -y software-properties-common gnupg2 procps && \
     apt-get clean && \
     rm -r /var/lib/apt/lists/*
 
+
 RUN apt-get update && \
 #  Development utilities
     apt-get install -y devscripts equivs git quilt rsync && \
@@ -29,9 +32,9 @@ RUN apt-get update && \
 #  - doxygen & JSON.pm
 RUN apt-get install -y doxygen graphviz libjson-perl
 #  - antora (npm needed)
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash -
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
 RUN apt-get install -y nodejs
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
 #  - pandoc
 WORKDIR /tmp
 RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
@@ -40,6 +43,8 @@ RUN apt-get install -y ./pandoc-*.deb
 RUN apt-get install -y ruby-dev
 RUN gem install asciidoctor
 
+
+
 #
 #  Setup a src dir in /usr/local
 #
@@ -61,5 +66,9 @@ WORKDIR freeradius-server
 RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
 	do \
 		git checkout $i; \
-		if [ -e ./debian/control.in ] ; then debian/rules debian/control ; fi ; echo 'y' | mk-build-deps -irt'apt-get -yV' debian/control ; \
+		if [ -e ./debian/control.in ] ; then \
+			debian/rules debian/control ; \
+		fi ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
 	done
diff --git a/scripts/crossbuild/docker/ubuntu22/Dockerfile b/scripts/crossbuild/docker/ubuntu22/Dockerfile
new file mode 100644
index 0000000..677c912
--- /dev/null
+++ b/scripts/crossbuild/docker/ubuntu22/Dockerfile
@@ -0,0 +1,74 @@
+# Auto generated for ubuntu22
+# from scripts/crossbuild/m4/Dockerfile.deb.m4
+#
+# Rebuild this file with `make crossbuild.ubuntu22.regen`
+#
+ARG from=ubuntu:22.04
+FROM ${from} as build
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+#
+#  Install add-apt-repository
+#
+RUN apt-get update && \
+    apt-get install -y software-properties-common gnupg2 procps && \
+    apt-get clean && \
+    rm -r /var/lib/apt/lists/*
+
+
+RUN apt-get update && \
+#  Development utilities
+    apt-get install -y devscripts equivs git quilt rsync && \
+#  Compilers
+    apt-get install -y g++ llvm clang lldb && \
+#  eapol_test dependencies
+    apt-get install -y libnl-3-dev libnl-genl-3-dev
+
+#
+#  Documentation build dependecies
+#
+
+#  - doxygen & JSON.pm
+RUN apt-get install -y doxygen graphviz libjson-perl
+#  - antora (npm needed)
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
+RUN apt-get install -y nodejs
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
+#  - pandoc
+WORKDIR /tmp
+RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
+RUN apt-get install -y ./pandoc-*.deb
+#  - asciidoctor
+RUN apt-get install -y ruby-dev
+RUN gem install asciidoctor
+
+
+
+#
+#  Setup a src dir in /usr/local
+#
+RUN mkdir -p /usr/local/src/repositories
+WORKDIR /usr/local/src/repositories
+
+
+#
+#  Shallow clone the FreeRADIUS source
+#
+WORKDIR /usr/local/src/repositories
+ARG source=https://github.com/FreeRADIUS/freeradius-server.git
+RUN git clone --depth 1 --no-single-branch ${source}
+
+#
+#  Install build dependencies for all branches from v3 onwards
+#
+WORKDIR freeradius-server
+RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
+	do \
+		git checkout $i; \
+		if [ -e ./debian/control.in ] ; then \
+			debian/rules debian/control ; \
+		fi ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
+	done
diff --git a/scripts/crossbuild/docker/ubuntu24/Dockerfile b/scripts/crossbuild/docker/ubuntu24/Dockerfile
new file mode 100644
index 0000000..966faf0
--- /dev/null
+++ b/scripts/crossbuild/docker/ubuntu24/Dockerfile
@@ -0,0 +1,74 @@
+# Auto generated for ubuntu24
+# from scripts/crossbuild/m4/Dockerfile.deb.m4
+#
+# Rebuild this file with `make crossbuild.ubuntu24.regen`
+#
+ARG from=ubuntu:24.04
+FROM ${from} as build
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+#
+#  Install add-apt-repository
+#
+RUN apt-get update && \
+    apt-get install -y software-properties-common gnupg2 procps && \
+    apt-get clean && \
+    rm -r /var/lib/apt/lists/*
+
+
+RUN apt-get update && \
+#  Development utilities
+    apt-get install -y devscripts equivs git quilt rsync fakeroot && \
+#  Compilers
+    apt-get install -y g++ llvm clang lldb && \
+#  eapol_test dependencies
+    apt-get install -y libnl-3-dev libnl-genl-3-dev
+
+#
+#  Documentation build dependecies
+#
+
+#  - doxygen & JSON.pm
+RUN apt-get install -y doxygen graphviz libjson-perl
+#  - antora (npm needed)
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
+RUN apt-get install -y nodejs
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
+#  - pandoc
+WORKDIR /tmp
+RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
+RUN apt-get install -y ./pandoc-*.deb
+#  - asciidoctor
+RUN apt-get install -y ruby-dev
+RUN gem install asciidoctor
+
+
+
+#
+#  Setup a src dir in /usr/local
+#
+RUN mkdir -p /usr/local/src/repositories
+WORKDIR /usr/local/src/repositories
+
+
+#
+#  Shallow clone the FreeRADIUS source
+#
+WORKDIR /usr/local/src/repositories
+ARG source=https://github.com/FreeRADIUS/freeradius-server.git
+RUN git clone --depth 1 --no-single-branch ${source}
+
+#
+#  Install build dependencies for all branches from v3 onwards
+#
+WORKDIR freeradius-server
+RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
+	do \
+		git checkout $i; \
+		if [ -e ./debian/control.in ] ; then \
+			debian/rules debian/control ; \
+		fi ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
+	done
diff --git a/scripts/crossbuild/docker/debian9/Dockerfile b/scripts/crossbuild/m4/Dockerfile.deb.m4
index 9b47832..a1bfca8 100644
--- a/scripts/crossbuild/docker/debian9/Dockerfile
+++ b/scripts/crossbuild/m4/Dockerfile.deb.m4
@@ -1,8 +1,5 @@
-FROM debian:stretch
-
-ARG gccver=6
-ARG clangver=5.0
-ARG osname=stretch
+ARG from=DOCKER_IMAGE
+FROM ${from} as build
 
 ARG DEBIAN_FRONTEND=noninteractive
 
@@ -10,35 +7,38 @@ ARG DEBIAN_FRONTEND=noninteractive
 #  Install add-apt-repository
 #
 RUN apt-get update && \
-    apt-get install -y software-properties-common gnupg2 apt-transport-https curl && \
+    apt-get install -y software-properties-common gnupg2 procps && \
     apt-get clean && \
     rm -r /var/lib/apt/lists/*
 
-#  Stretch uses GCC-6.3 by default, so it doesn't need to be updated to get C11 functionality.
-
+define(`CLANG_PKGS', `llvm clang lldb')dnl
+ifelse(D_NAME, `debian10', `dnl
+define(`CLANG_VER', `8')dnl
+define(`CLANG_PKGS', `llvm-CLANG_VER clang-CLANG_VER lldb-CLANG_VER')dnl
 #  For clang
-RUN add-apt-repository -y "deb http://apt.llvm.org/${osname}/ llvm-toolchain-${osname}-${clangver} main" && \
-    curl -o /tmp/llvm-snapshot.gpg.key https://apt.llvm.org/llvm-snapshot.gpg.key && \
-    apt-key add /tmp/llvm-snapshot.gpg.key
+RUN add-apt-repository -y "deb http://apt.llvm.org/OS_CODENAME/ llvm-toolchain-OS_CODENAME-CLANG_VER main" && \
+    apt-key adv --fetch-keys http://apt.llvm.org/llvm-snapshot.gpg.key
+')dnl
 
 RUN apt-get update && \
 #  Development utilities
-    apt-get install -y devscripts equivs git quilt rsync && \
+    apt-get install -y devscripts equivs git quilt rsync fakeroot && \
 #  Compilers
-    apt-get install -y g++-${gccver} llvm-${clangver} clang-${clangver} lldb-${clangver} && \
+    apt-get install -y g++ CLANG_PKGS && \
 #  eapol_test dependencies
     apt-get install -y libnl-3-dev libnl-genl-3-dev
 
 #
 #  Documentation build dependecies
 #
+define(`NODE_VER', ifelse(D_NAME, `ubuntu18', `16', `20'))dnl
 
 #  - doxygen & JSON.pm
 RUN apt-get install -y doxygen graphviz libjson-perl
 #  - antora (npm needed)
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash -
-RUN apt-get install -y npm
-RUN npm i -g @antora/cli@2.1 @antora/site-generator-default@2.1
+RUN curl -sL https://deb.nodesource.com/setup_`'NODE_VER.x | bash -
+RUN apt-get install -y nodejs
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
 #  - pandoc
 WORKDIR /tmp
 RUN curl -OL $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*deb" | cut -d '"' -f 4)
@@ -47,17 +47,16 @@ RUN apt-get install -y ./pandoc-*.deb
 RUN apt-get install -y ruby-dev
 RUN gem install asciidoctor
 
-# set default things
-RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${gccver} 50 \
-                        --slave /usr/bin/g++ g++ /usr/bin/g++-${gccver} && \
-    update-alternatives --config gcc
-
-RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${clangver} 60 && \
+ifelse(D_NAME, `debian10', `dnl
+#
+#  Set defaults
+#
+RUN update-alternatives --install /usr/bin/clang clang /usr/bin/clang-CLANG_VER 60 && \
     update-alternatives --config clang
 
-RUN update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-${clangver} 60 && \
+RUN update-alternatives --install /usr/bin/lldb lldb /usr/bin/lldb-CLANG_VER 60 && \
     update-alternatives --config lldb
-
+')
 
 #
 #  Setup a src dir in /usr/local
@@ -80,5 +79,9 @@ WORKDIR freeradius-server
 RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
 	do \
 		git checkout $i; \
-		if [ -e ./debian/control.in ] ; then debian/rules debian/control ; fi ; echo 'y' | mk-build-deps -irt'apt-get -yV' debian/control ; \
+		if [ -e ./debian/control.in ] ; then \
+			debian/rules debian/control ; \
+		fi ; \
+		echo 'y' | \
+		mk-build-deps -irt'apt-get -yV' debian/control ; \
 	done
diff --git a/scripts/crossbuild/m4/Dockerfile.rpm.m4 b/scripts/crossbuild/m4/Dockerfile.rpm.m4
new file mode 100644
index 0000000..714ee6e
--- /dev/null
+++ b/scripts/crossbuild/m4/Dockerfile.rpm.m4
@@ -0,0 +1,146 @@
+ARG from=DOCKER_IMAGE
+FROM ${from} as build
+
+ifelse(OS_VER, 7, `dnl
+#
+#  CentOS 7 is now EOL, so we need to fix up the repo source
+#
+RUN sed -i "s/^mirrorlist/#mirrorlist/g" /etc/yum.repos.d/CentOS-*
+RUN sed -i "s|#\s*baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g" /etc/yum.repos.d/CentOS-*
+')dnl
+
+ifelse(OS_VER, `9', `dnl
+#
+#  Install yum
+#
+RUN dnf install -y yum
+')dnl
+
+#
+#  Install devtools like make and git and the EPEL
+#  repository for freetds and hiredis
+#
+RUN yum update -y
+RUN yum install -y rpmdevtools openssl epel-release git procps yum-utils \
+	rsync ifelse(OS_VER, `7',, `dnf-plugins-core')
+
+ifelse(OS_VER, `7', `dnl
+#
+#  Install GCC that has the requisite support for C11 keywords and atomics
+#
+RUN yum install -y centos-release-scl
+RUN sed -i "s/^mirrorlist/#mirrorlist/g" /etc/yum.repos.d/CentOS-*
+RUN sed -i "s|#\s*baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g" /etc/yum.repos.d/CentOS-*
+RUN yum install -y devtoolset-8-gcc devtoolset-8-gcc-c++
+ENV CC=/opt/rh/devtoolset-8/root/usr/bin/gcc
+
+#
+#  Remove the CentOS-SCLo repo which is apparently not valid?
+#  See: https://bugs.centos.org/view.php?id=14773
+#
+RUN rm /etc/yum.repos.d/CentOS-SCLo-scl-rh.repo
+RUN rm /etc/yum.repos.d/CentOS-SCLo-scl.repo
+')dnl
+
+ifelse(OS_VER, `8', `dnl
+RUN yum config-manager --set-enabled powertools
+
+#
+#  Install GCC that has the requisite support for C11 keywords and atomics
+#
+RUN yum install -y gcc-toolset-9
+')dnl
+
+ifelse(OS_VER, `9', `dnl
+RUN yum config-manager --set-enabled crb
+')dnl
+
+#
+#  Documentation build dependecies
+#
+define(`NODE_VER', ifelse(OS_VER, 7, `16', `20'))dnl
+
+#  - doxygen & JSON.pm
+RUN yum install -y doxygen graphviz perl-JSON
+#  - antora (npm needed)
+RUN curl -sL https://rpm.nodesource.com/setup_`'NODE_VER.x | bash -
+RUN yum install -y nodejs
+RUN npm i -g @antora/cli@3.1.7 @antora/site-generator-default@3.1.7
+#  - pandoc
+RUN curl -o - -L $(curl -s https://api.github.com/repos/jgm/pandoc/releases/latest | grep "browser_download_url.*tar.gz" | cut -d '"' -f 4) | tar xzvf - -C /tmp/
+RUN mv /tmp/pandoc-*/bin/* /usr/local/bin
+#  - asciidoctor
+RUN yum install -y rubygems-devel
+RUN gem install asciidoctor
+
+#
+#  Setup a src dir in /usr/local
+#
+RUN mkdir -p /usr/local/src/repositories
+WORKDIR /usr/local/src/repositories
+
+changequote([{,}])dnl Only add LTB on centos7/rocky8
+ifelse(ifelse(OS_VER, 7, yes,   OS_VER, 8, yes,   no), yes, [{dnl
+#
+#  Use LTB's openldap packages intead of the distribution version to avoid linking against NSS
+#
+RUN echo $'[ltb-project]\n\
+name=LTB project packages\n\
+baseurl=https://ltb-project.org/rpm/$releasever/$basearch\n\
+enabled=1\n\
+gpgcheck=1\n\
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-LTB-project'\
+> /etc/yum.repos.d/ltb-project.repo
+RUN rpm --import https://ltb-project.org/lib/RPM-GPG-KEY-LTB-project
+}])dnl
+changequote(`,')dnl
+
+#
+#  Shallow clone the FreeRADIUS source
+#
+WORKDIR /usr/local/src/repositories
+ARG source=https://github.com/FreeRADIUS/freeradius-server.git
+RUN git clone --depth 1 --no-single-branch ${source}
+
+#
+#  Install build dependencies for all branches from v3 onwards
+#  Nodesource has issues (no SRPMS in some repos) and is not needed here
+#  CentOS/RHEL 7 do not support "-D" for yum-builddep so do that separately below if needed
+#
+define(`BUILDDEP_EXTRA', ifelse(OS_VER, 7, `--disablerepo="nodesource*"', `-D "_with_rlm_yubikey 1"'))dnl
+WORKDIR freeradius-server
+RUN for i in $(git for-each-ref --format='%(refname:short)' refs/remotes/origin 2>/dev/null | sed -e 's#origin/##' | egrep "^(v[3-9]*\.[0-9x]*\.x|master)$");\
+	do \
+		git checkout $i; \
+		[ -e redhat/freeradius.spec ] && yum-builddep BUILDDEP_EXTRA -y redhat/freeradius.spec; \
+	done
+
+ifelse(OS_VER, 7,`dnl
+#  Yubikey deps for CentOS/RHEL 7
+RUN yum install -y ykclient-devel ykclient
+')dnl
+
+RUN yum install -y libyubikey-devel
+
+#
+#  Which is required by fixture setup utilities
+#
+RUN yum install -y which
+
+#
+#  Explicitly install libnl3-devel which is required for the EAP tests
+#
+RUN yum install -y libnl3-devel
+
+ifelse(OS_VER, 7,, `dnl
+#
+#  We test with TLS1.1, but that is disabled by default on some
+#  newer systems.
+#
+RUN update-crypto-policies --set LEGACY
+')dnl
+
+#
+#  Create the RPM build tree
+#
+RUN rpmdev-setuptree