summaryrefslogtreecommitdiffstats
path: root/scripts/mkpkg
diff options
context:
space:
mode:
Diffstat (limited to '')
-rwxr-xr-xscripts/mkpkg591
1 files changed, 591 insertions, 0 deletions
diff --git a/scripts/mkpkg b/scripts/mkpkg
new file mode 100755
index 0000000..5871dc8
--- /dev/null
+++ b/scripts/mkpkg
@@ -0,0 +1,591 @@
+#!/bin/sh
+#
+# SPDX-License-Identifier: ISC
+#
+# Copyright (c) 2010-2023 Todd C. Miller <Todd.Miller@sudo.ws>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+# Build a binary package using polypkg
+# Usage: mkpkg [--build-only] [--configure-only] [--debug] [--flavor flavor]
+# [--platform platform] [--osversion ver]
+#
+
+# Make sure IFS is set to space, tab, newline in that order.
+space=' '
+tab=' '
+nl='
+'
+IFS=" $nl"
+
+# Parse arguments
+usage="usage: mkpkg [--build-only] [--configure-only] [--debug] [--flavor flavor] [--platform platform] [--osversion ver]"
+debug=0
+flavor=vanilla
+crossbuild=false
+build_packages=true;
+build_sudo=true;
+while test $# -gt 0; do
+ case "$1" in
+ --debug)
+ set -x
+ debug=1
+ PPFLAGS="--debug${PPFLAGS+$space}${PPFLAGS}"
+ ;;
+ --flavor=?*)
+ flavor=`echo "$1" | sed -n 's/^--flavor=\(.*\)/\1/p'`
+ PPVARS="${PPVARS}${PPVARS+$space}flavor=$flavor"
+ ;;
+ --flavor)
+ if [ $# -lt 2 ]; then
+ echo "$usage" 1>&2
+ exit 1
+ fi
+ flavor="$2"
+ PPVARS="${PPVARS}${PPVARS+$space}flavor=$flavor"
+ shift
+ ;;
+ --platform=?*)
+ arg=`echo "$1" | sed -n 's/^--platform=\(.*\)/\1/p'`
+ PPFLAGS="${PPFLAGS}${PPFLAGS+$space}--platform $arg"
+ ;;
+ --platform)
+ if [ $# -lt 2 ]; then
+ echo "$usage" 1>&2
+ exit 1
+ fi
+ PPFLAGS="${PPFLAGS}${PPFLAGS+$space}--platform $2"
+ shift
+ ;;
+ --osversion=?*)
+ arg=`echo "$1" | sed -n 's/^--osversion=\(.*\)/\1/p'`
+ osversion="$arg"
+ ;;
+ --osversion)
+ if [ $# -lt 2 ]; then
+ echo "$usage" 1>&2
+ exit 1
+ fi
+ osversion="$2"
+ shift
+ ;;
+ --build|--host)
+ crossbuild=true
+ configure_opts="${configure_opts}${configure_opts+$tab}$1"
+ ;;
+ --build-only)
+ build_packages=false
+ ;;
+ --configure-only)
+ build_sudo=false
+ ;;
+ *)
+ # Pass unknown options to configure
+ configure_opts="${configure_opts}${configure_opts+$tab}$1"
+ ;;
+ esac
+ shift
+done
+
+scriptdir=`dirname $0`
+configure="${scriptdir}/../configure"
+
+: ${osversion="`$scriptdir/pp --probe 2>/dev/null || echo unknown`"}
+osrelease=`echo "$osversion" | sed -e 's/^[^0-9]*//' -e 's/-.*$//'`
+: ${MAKE=make}
+
+if [ $build_packages = true -a "$osversion" = "unknown" ]; then
+ echo "unable to determine platform" 1>&2
+ exit 1
+fi
+
+# If using GNU make, set number of jobs
+if ${MAKE} --version 2>&1 | grep GNU >/dev/null; then
+ NJOBS=0
+ case "`uname`" in
+ Darwin)
+ # macOS
+ NJOBS=`sysctl -n hw.ncpu`
+ ;;
+ Linux)
+ if [ -x /usr/bin/nproc ]; then
+ NJOBS=`/usr/bin/nproc`
+ elif [ -r /proc/cpuinfo ]; then
+ NJOBS=`grep ^processor /proc/cpuinfo | wc -l`
+ fi
+ ;;
+ SunOS)
+ # Solaris
+ if [ -x /usr/sbin/psrinfo ]; then
+ NJOBS=`/usr/sbin/psrinfo | wc -l`
+ fi
+ ;;
+ HP-UX)
+ NJOBS=`sar -Mu 1 1 | awk 'END {print NR-5}'`
+ ;;
+ AIX)
+ NJOBS=`bindprocessor -q | awk '{print NF-4}'`
+ ;;
+ esac
+ if [ $NJOBS -gt 1 ]; then
+ if [ $NJOBS -gt 16 ]; then
+ NJOBS=16
+ fi
+ make_opts="-j$NJOBS"
+ fi
+fi
+
+# Choose compiler options by osversion if not cross-compiling.
+if [ "$crossbuild" = "false" ]; then
+ case "$osversion" in
+ FreeBSD*|macos*)
+ # Use clang, not gcc, on FreeBSD and macOS
+ if [ -z "$CC" ]; then
+ CC=clang; export CC
+ fi
+ ;;
+ esac
+fi
+
+# Give configure a hint that we are building a package.
+# Some libc functions are only available on certain OS revisions.
+configure_opts="${configure_opts}${configure_opts+$tab}--enable-package-build"
+
+# Some systems don't have a recent enough OpenSSL for the I/O log server.
+with_openssl=false
+
+# Not all systems have Python 3.
+with_python=false
+
+# Choose configure options by osversion.
+# We use the same configure options as vendor packages when possible.
+case "$osversion" in
+ centos*|rhel*|f[0-9]*)
+ case "$osversion" in
+ centos*|rhel*)
+ osmajor=`sed -n -e 's/^.*release \([0-9][0-9]*\).*$/\1/p' /etc/redhat-release`
+ if [ $osmajor -ge 4 ]; then
+ # RHEL 4 and up support SELinux
+ with_selinux=true
+ if [ $osmajor -ge 5 ]; then
+ # RHEL 5 and up has audit support and uses a
+ # separate PAM config file for "sudo -i".
+ with_linux_audit=true
+ with_pam_login=true
+ if [ $osmajor -ge 6 ]; then
+ # RHEL 6 and above builds sudo with SSSD support
+ with_sssd=true
+ # RHEL 6 and above use /etc/sudo-ldap.conf
+ with_sudo_ldap_conf=true
+ # Encrypted remote I/O log support.
+ with_openssl=true
+ fi
+ if [ $osmajor -ge 6 ]; then
+ # Python plugins
+ with_python=true
+ fi
+ fi
+ fi
+ ;;
+ f[0-9]*)
+ # XXX - investigate which features were in which fedora version
+ with_selinux=true
+ with_linux_audit=true
+ with_pam_login=true
+ with_sssd=true
+ with_openssl=true
+ with_python=true
+ ;;
+ esac
+
+ if [ X"$with_selinux" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-selinux"
+ fi
+ if [ X"$with_linux_audit" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-linux-audit"
+ PPVARS="${PPVARS}${PPVARS+$space}linux_audit=1.4.0"
+ fi
+ if [ X"$with_pam_login" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-pam-login"
+ fi
+ if [ X"$with_sssd" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-sssd"
+ if [ "`getconf LONG_BIT`" = "64" ]; then
+ # SSSD backend needs to know where to find the sssd lib
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-sssd-lib=/usr/lib64"
+ fi
+ fi
+ if [ X"$with_sudo_ldap_conf" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-ldap-conf-file=/etc/sudo-ldap.conf"
+ fi
+ # Note, must indent with tabs, not spaces due to IFS trickery
+ configure_opts="--prefix=/usr
+ --with-logging=syslog
+ --with-logfac=authpriv
+ --with-pam
+ --enable-zlib=system
+ --with-editor=/bin/vi
+ --with-env-editor
+ --with-ignore-dot
+ --with-ldap
+ --with-passprompt=[sudo] password for %p:
+ --with-sendmail=/usr/sbin/sendmail
+ $configure_opts"
+ ;;
+ sles*)
+ if [ $osrelease -ge 10 ]; then
+ if [ $osrelease -ge 11 ]; then
+ # SLES 11 and higher have SELinux
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-selinux"
+ fi
+ if [ $osrelease -ge 12 ]; then
+ # Encrypted remote I/O log support.
+ with_openssl=true
+ # Python plugins
+ with_python=true
+ fi
+ fi
+ # SuSE doesn't have /usr/libexec
+ libexec=lib
+ case "$osversion" in
+ *64*) gcc -v 2>&1 | grep "with-cpu=[^ ]*32" >/dev/null || libexec=lib64
+ ;;
+ esac
+ # Note, must indent with tabs, not spaces due to IFS trickery
+ # XXX - SuSE uses secure path but only for env_reset
+ configure_opts="--prefix=/usr
+ --libexecdir=/usr/$libexec
+ --with-logging=syslog
+ --with-logfac=auth
+ --with-all-insults
+ --with-ignore-dot
+ --enable-shell-sets-home
+ --with-sudoers-mode=0440
+ --with-pam
+ --enable-zlib=system
+ --with-ldap
+ --with-env-editor
+ --with-passprompt=%p\'s password:
+ --with-sendmail=/usr/sbin/sendmail
+ $configure_opts"
+
+ make_opts="${make_opts}${make_opts+ }"'docdir=$(datarootdir)/doc/packages/$(PACKAGE_TARNAME)'
+ ;;
+ deb*|ubu*)
+ # Sudo-specific executables moved to /usr/libexec/sudo starting in
+ # Debian: Debian 12 (Bookworm)
+ # Ubuntu: Ubuntu 22.04 (Jammy Jellyfish)
+ # Previously, they were stored in /usr/lib/sudo.
+ libexec=lib
+
+ # AppArmor is enabled by default starting in
+ # Debian: Debian 10 (Buster)
+ # Ubuntu: Ubuntu 12.04 (Precise Pangolin)
+ osmajor=`sed -n -e 's/^VERSION_ID=\"\([0-9]*\).*$/\1/p' /etc/os-release`
+ case "$osversion" in
+ deb*)
+ if [ -z $osmajor ] || [ $osmajor -ge 10 ]; then
+ with_apparmor=true
+ fi
+ if [ -z $osmajor ] || [ $osmajor -ge 12 ]; then
+ libexec=libexec
+ fi
+ ;;
+ ubu*)
+ if [ -z $osmajor ] || [ $osmajor -ge 14 ]; then
+ with_apparmor=true
+ fi
+ if [ -z $osmajor ] || [ $osmajor -ge 22 ]; then
+ libexec=libexec
+ fi
+ ;;
+ esac
+
+ # Encrypted remote I/O log support.
+ with_openssl=true
+ # Python plugins
+ with_python=true
+ # Man pages should be compressed in .deb files
+ export MANCOMPRESS='gzip -9'
+ export MANCOMPRESSEXT='.gz'
+ # If Ubuntu, add --enable-admin-flag
+ case "$osversion" in
+ ubu*)
+ configure_opts="${configure_opts}${configure_opts+$tab}--enable-admin-flag${tab}--without-lecture"
+ ;;
+ esac
+ # Newer Debian uses arch-specific lib dirs
+ MULTIARCH=`dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null`
+ # Note, must indent with tabs, not spaces due to IFS trickery
+ if [ "$flavor" = "ldap" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-ldap
+ --with-ldap-conf-file=/etc/sudo-ldap.conf"
+ else
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-sssd"
+ if [ -n "$MULTIARCH" ]; then
+ # SSSD backend needs to know where to find the sssd lib
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-sssd-lib=/usr/lib/$MULTIARCH"
+ fi
+ fi
+ if [ X"$with_apparmor" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-apparmor"
+ fi
+ configure_opts="--prefix=/usr
+ --with-all-insults
+ --with-pam
+ --enable-zlib=system
+ --with-fqdn
+ --with-logging=syslog
+ --with-logfac=authpriv
+ --with-env-editor
+ --with-editor=/usr/bin/editor
+ --with-timeout=15
+ --with-password-timeout=0
+ --with-passprompt=[sudo] password for %p:
+ --disable-root-mailer
+ --with-sendmail=/usr/sbin/sendmail
+ --mandir=/usr/share/man
+ --libexecdir=/usr/$libexec
+ --with-linux-audit
+ $configure_opts"
+ # Use correct libaudit dependency
+ for f in /lib/${MULTIARCH}${MULTIARCH:+/}libaudit.so.[0-9]* /lib/libaudit.so.[0-9]*; do
+ if [ -f "$f" ]; then
+ linux_audit=`dpkg-query -S "$f" 2>/dev/null | sed -n 's/:.*//p'`
+ test -n "$linux_audit" && break
+ fi
+ done
+ if [ -z "$linux_audit" ]; then
+ echo "unable to determine package for libaudit" 1>&2
+ exit 1
+ fi
+ PPVARS="${PPVARS}${PPVARS+$space}linux_audit=$linux_audit"
+ # Use correct libssl dependency
+ libssl_dep=`dpkg-query -S /usr/lib/${MULTIARCH}${MULTIARCH:+/}libssl.so.[1-9]* /lib/${MULTIARCH}${MULTIARCH:+/}libssl.so.[1-9]* 2>/dev/null | sort -rn | awk -F: '{ print $1; exit }'`
+ if [ -z "$libssl_dep" ]; then
+ echo "unable to determine package for libssl" 1>&2
+ exit 1
+ fi
+ PPVARS="${PPVARS}${PPVARS+$space}libssl_dep=$libssl_dep"
+ ;;
+ macos*)
+ # TODO: openssl (homebrew?)
+ case "$osversion" in
+ macos10[0-6]-i386|macos10[0-6]-x86_64)
+ # Build intel universal binaries for 10.6 and below
+ : ${ARCH_FLAGS="-arch i386 -arch x86_64"}
+ ;;
+ macos1[1-9]*)
+ # Build arm64/x86_64 universal binaries for macOS 11
+ : ${ARCH_FLAGS="-arch arm64 -arch x86_64"}
+ ;;
+ esac
+ if [ "${osversion}" != "`$scriptdir/pp --probe`" ]; then
+ sdkvers=`echo "${osversion}" | sed -e 's/^macos\([0-9][0-9]\)\([0-9]*\)-.*$/\1.\2/' -e 's/\.$//'`
+ # SDKs may be under Xcode.app or CommandLineTools (for non-Xcode)
+ if [ -d "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs" ]; then
+ SDKS="/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs"
+ elif [ -d "/Library/Developer/CommandLineTools/SDKs" ]; then
+ SDKS="/Library/Developer/CommandLineTools/SDKs"
+ else
+ echo "unable to find macOS SDKs directory" 1>&2
+ exit 1
+ fi
+ while :; do
+ SDK_DIR="${SDKS}/MacOSX${sdkvers}.sdk"
+ if [ -d "${SDK_DIR}" ]; then
+ SDK_FLAGS="-isysroot ${SDK_DIR} -mmacosx-version-min=${sdkvers}"
+ break
+ fi
+ case "$sdkvers" in
+ *.00)
+ # Try MacOSXMM.0.sdk
+ sdkvers=${sdkvers%0}
+ ;;
+ *.0)
+ # Try MacOSXMM.sdk
+ sdkvers=${sdkvers%.0}
+ ;;
+ *)
+ echo "missing $SDK_DIR" 1>&2
+ exit 1
+ ;;
+ esac
+ done
+ fi
+ export CFLAGS="-O2 -g $ARCH_FLAGS $SDK_FLAGS"
+ export LDFLAGS="$ARCH_FLAGS $SDK_FLAGS"
+ # Note, must indent with tabs, not spaces due to IFS trickery
+ configure_opts="--with-pam
+ --with-bsm-audit
+ --with-password-timeout=0
+ --enable-zlib=system
+ --with-ldap
+ --with-insults=disabled
+ --with-logging=syslog
+ --with-logfac=authpriv
+ --with-editor=/usr/bin/vim
+ --with-env-editor
+ $configure_opts"
+ ;;
+ aix*)
+ # TODO: openssl (AIX freeware?)
+ # Use -gxcoff with gcc instead of -g for dbx-style debugging symbols.
+ if test -z "$CC" && gcc -v >/dev/null 2>&1; then
+ CFLAGS="-O2 -gxcoff"; export CFLAGS
+ fi
+ # Note, must indent with tabs, not spaces due to IFS trickery
+ # Note: we include our own zlib instead of relying on the
+ # AIX freeware version being installed.
+ configure_opts="
+ --prefix=/opt/freeware
+ --mandir=/opt/freeware/man
+ --with-insults=disabled
+ --with-logging=syslog
+ --with-logfac=auth
+ --with-editor=/usr/bin/vi
+ --with-env-editor
+ --enable-zlib=builtin
+ --disable-nls
+ --with-sendmail=/usr/sbin/sendmail
+ $configure_opts"
+ PPVARS="${PPVARS}${PPVARS+$space}aix_freeware=true"
+ ;;
+ FreeBSD*|DragonFly*)
+ # Encrypted remote I/O log support.
+ with_openssl=true
+
+ # Python plugins
+ with_python=true
+
+ configure_opts="
+ --sysconfdir=/usr/local/etc
+ --with-ignore-dot
+ --with-tty-tickets
+ --with-env-editor
+ --with-logincap
+ --with-long-otp-prompt
+ --with-rundir=/var/run/sudo
+ --enable-zlib=system
+ --disable-nls
+ $configure_opts"
+ ;;
+ *)
+ # For Solaris, add project support and use let configure choose zlib.
+ # For all others, use the builtin zlib and disable NLS support.
+ case "$osversion" in
+ sol*)
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-project"
+
+ if [ $osrelease -ge 11 ]; then
+ # Build 64-bit binaries on Solaris 11 and above.
+ case "${CC}${CFLAGS}" in
+ *-m32*|*-m64*)
+ # User specified memory model flags
+ ;;
+ *)
+ CFLAGS="${CFLAGS:--O2 -g} -m64"; export CFLAGS
+ LDFLAGS="-m64${LDFLAGS:+ }${LDFLAGS}"; export LDFLAGS
+ ;;
+ esac
+ # Solaris audit is not supported by Illumos
+ if [ X"`uname -o 2>/dev/null`" = X"illumos" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-bsm-audit"
+ else
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-solaris-audit"
+ fi
+ # Encrypted remote I/O log support.
+ with_openssl=true
+ # Python plugins
+ with_python=true
+
+ # We prefer the system version of python3 to the
+ # csw one (which may be 32-bit)
+ if [ -z "$PYTHON" ]; then
+ if [ -x /usr/bin/python3 ]; then
+ PYTHON="/usr/bin/python3"; export PYTHON
+ else
+ # Sometimes the /usr/bin/python3 is missing
+ for f in /usr/bin/python3.11 /usr/bin/python3.10 /usr/bin/python3.9 /usr/bin/python3.8 /usr/bin/python3.7 /usr/bin/python3.6 /usr/bin/python3.5 /usr/bin/python3.4; do
+ if [ -x $f ]; then
+ PYTHON="$f"; export PYTHON
+ break
+ fi
+ done
+ fi
+ fi
+ fi
+ ;;
+ hpux*-ia64)
+ # Build 64-bit binaries on HP-UX ia64
+ if test -z "$CC" && gcc -v >/dev/null 2>&1; then
+ CC="gcc -mlp64"; export CC
+ fi
+ # TODO: openssl
+ configure_opts="${configure_opts}${configure_opts+$tab}--enable-zlib=builtin${tab}--disable-nls"
+ ;;
+ *)
+ # TODO: openssl
+ configure_opts="${configure_opts}${configure_opts+$tab}--enable-zlib=builtin${tab}--disable-nls"
+ ;;
+ esac
+ if [ "$flavor" = "ldap" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--with-ldap"
+ fi
+ # Note, must indent with tabs, not spaces due to IFS trickery
+ configure_opts="
+ --with-insults=disabled
+ --with-logging=syslog
+ --with-logfac=auth
+ --with-editor=/usr/bin/vim:/usr/bin/vi:/bin/vi
+ --with-env-editor
+ $configure_opts"
+ ;;
+esac
+
+# Don't enable OpenSSL or python if disabled by the user.
+case "$configure_opts" in
+ *--disable-openssl*) with_openssl=false;;
+esac
+case "$configure_opts" in
+ *--disable-python*) with_python=false;;
+esac
+if [ X"$with_openssl" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--enable-openssl"
+fi
+if [ X"$with_python" = X"true" ]; then
+ configure_opts="${configure_opts}${configure_opts+$tab}--enable-python"
+fi
+
+# The postinstall script will create tmpfiles.d/sudo.conf for us
+configure_opts="${configure_opts}${configure_opts+$tab}--disable-tmpfiles.d"
+
+# Remove spaces from IFS when setting $@ so that passprompt may include them
+OIFS="$IFS"
+IFS=" $nl"
+set -- $configure_opts $extra_opts
+IFS="$OIFS"
+if [ -r Makefile ]; then
+ ${MAKE} $make_opts distclean
+fi
+${configure} "$@" || exit $?
+if [ $build_sudo = true ]; then
+ ${MAKE} $make_opts || exit $?
+ if [ $build_packages = true ]; then
+ ${MAKE} $make_opts PPFLAGS="$PPFLAGS" PPVARS="$PPVARS" package
+ fi
+fi
+exitval=$?
+test $debug -eq 0 && rm -rf destdir
+
+exit $exitval
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-19 19:30:03 +0000