#!/bin/mkpkg
# description: User space IEEE 802.1X/WPA supplicant
# url: https://hostap.epitest.fi/wpa_supplicant/

name=wpa_supplicant
version=2.12
release=2
depends=(libressl libnl libcap2)
groups=(wpa_supplicant:user:wpa_supplicant:/var/lib/wpa_supplicant:750:905:905)
services=(wpa_supplicant)
permissions=(
    /sbin/wpa_supplicant:root:wpa_supplicant:750
    /sbin/wpa_cli:root:wpa_supplicant:750
    /etc/wpa_supplicant.conf:root:wpa_supplicant:640
)
source=(https://w1.fi/releases/$name-$version.tar.gz)

patch() {
    cd $name-$version

    # Fix LibreSSL compatibility - add const to callback signature
    sed -i 's/SSL_CIPHER \*\*cipher/const SSL_CIPHER **cipher/' \
        src/crypto/tls_openssl.c

    # Make client sockets group-writable after bind() so the
    # unprivileged daemon can sendto() replies.  fchmod() before
    # bind() has no effect on musl, so we chmod() the path after.
    # Combined with client sockets in /run/wpa_supplicant/ (setgid),
    # the socket inherits group wpa_supplicant and becomes writable
    # by the daemon.
    sed -i '/ctrl->dest.sun_family = AF_UNIX;/i\\tchmod(ctrl->local.sun_path, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);' \
        src/common/wpa_ctrl.c
}

sha256sums=(
    "08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6"
)

build() {
    cd $name-$version/$name

    cp defconfig .config

    # Enable libnl3
    sed -i 's/^#CONFIG_LIBNL32=y/CONFIG_LIBNL32=y/' .config

    # Disable dbus
    sed -i 's/^CONFIG_CTRL_IFACE_DBUS_NEW=y/#CONFIG_CTRL_IFACE_DBUS_NEW=y/' .config
    sed -i 's/^CONFIG_CTRL_IFACE_DBUS_INTRO=y/#CONFIG_CTRL_IFACE_DBUS_INTRO=y/' .config

    # Disable MACsec (not needed, avoids link issues)
    sed -i 's/^CONFIG_DRIVER_MACSEC_LINUX=y/#CONFIG_DRIVER_MACSEC_LINUX=y/' .config

    # Add libnl3 include path
    echo "CFLAGS += -I/include/libnl3" >> .config

    # Internal line editing for wpa_cli: history, tab completion
    sed -i 's/^#CONFIG_WPA_CLI_EDIT=y/CONFIG_WPA_CLI_EDIT=y/' .config

    # Both dir defines must point to /run/wpa_supplicant:
    # CLIENT_DIR: where wpa_cli creates its own client socket
    # DIR: where wpa_cli scans for the server socket (default: /var/run/wpa_supplicant)
    echo 'CFLAGS += -DCONFIG_CTRL_IFACE_CLIENT_DIR=\"/run/wpa_supplicant\"' >> .config
    echo 'CFLAGS += -DCONFIG_CTRL_IFACE_DIR=\"/run/wpa_supplicant\"' >> .config

    make BINDIR=/sbin LIBDIR=/lib
    make DESTDIR=$PKG BINDIR=/sbin LIBDIR=/lib install

    # Man pages
    install -d $PKG/usr/share/man/man8
    install -m 644 doc/docbook/*.8 $PKG/usr/share/man/man8/

    # Default config
    install -d $PKG/etc
    printf '%s\n' \
        'ctrl_interface=DIR=/run/wpa_supplicant GROUP=wpa_supplicant' \
        'p2p_disabled=1' \
        > $PKG/etc/wpa_supplicant.conf

    # Remove man pages for binaries not included
    rm -f $PKG/usr/share/man/man8/eapol_test.8
    rm -f $PKG/usr/share/man/man8/wpa_gui.8
}

post_build() {
    # runit service with capsh privilege separation
    # Sequence: --keep=1 preserves caps across setuid,
    # --user drops to unprivileged, --inh + --addamb
    # raise ambient caps for the exec'd process.
    # -O overrides ctrl_interface so wpa_supplicant uses
    # the pre-created directory without attempting chown/chmod.
    # IFACE must be exported so the capsh subshell can see it.
    install -d $PKG/etc/sv/wpa_supplicant/log

    printf '%s\n' \
        '#!/bin/sh' \
        'exec 2>&1' \
        'install -d -m 2770 -o root -g wpa_supplicant /run/wpa_supplicant' \
        '# find first wireless interface' \
        'for dev in /sys/class/net/*/wireless; do' \
        '    [ -e "$dev" ] || continue' \
        '    IFACE=${dev%%/wireless}' \
        '    IFACE=${IFACE##*/}' \
        '    break' \
        'done' \
        '[ -z "$IFACE" ] && exit 1' \
        'export IFACE' \
        'exec capsh --keep=1 --user=wpa_supplicant \' \
        '    --inh=cap_net_admin,cap_net_raw \' \
        '    --addamb=cap_net_admin \' \
        '    --addamb=cap_net_raw \' \
        '    -- -c "exec /sbin/wpa_supplicant -i \$IFACE -c /etc/wpa_supplicant.conf -O /run/wpa_supplicant"' \
        > $PKG/etc/sv/wpa_supplicant/run

    printf '%s\n' \
        '#!/bin/sh' \
        'rm -rf /run/wpa_supplicant' \
        > $PKG/etc/sv/wpa_supplicant/finish

    printf '%s\n' \
        '#!/bin/sh' \
        'mkdir -p /var/log/wpa_supplicant' \
        'exec svlogd -tt /var/log/wpa_supplicant' \
        > $PKG/etc/sv/wpa_supplicant/log/run

    chmod 755 $PKG/etc/sv/wpa_supplicant/run
    chmod 755 $PKG/etc/sv/wpa_supplicant/finish
    chmod 755 $PKG/etc/sv/wpa_supplicant/log/run
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh