#!/bin/mkpkg
# description: Secure Shell client and server
# url: https://www.openssh.com

name=openssh
version=10.5p1
release=1
depends=(libressl zlib)
groups=(sshd:user:sshd:/nonexistent:700:22:22)
services=(sshd)
permissions=(
    /etc/ssh/sshd_config:root:root:600
    /etc/ssh/ssh_config:root:root:644
)
source=(https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$name-$version.tar.gz)

sha256sums=(
    "d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11"
)

build() {
    cd $name-$version

    ./configure \
        --prefix=/usr \
        --sbindir=/usr/bin \
        --libexecdir=/usr/lib/ssh \
        --sysconfdir=/etc/ssh \
        --mandir=/usr/share/man \
        --with-pid-dir=/run \
        --with-privsep-user=sshd \
        --with-privsep-path=/var/empty \
        --with-default-path=/usr/bin:/bin \
        --with-superuser-path=/usr/bin:/bin \
        --without-pam \
        --without-xauth

    make
    make DESTDIR=$PKG install

    # ssh-copy-id
    install -m 755 contrib/ssh-copy-id $PKG/usr/bin/ssh-copy-id
    install -m 644 contrib/ssh-copy-id.1 $PKG/usr/share/man/man1/ssh-copy-id.1

    rm -rf $PKG/var
}

post_build() {
    # runit service
    install -d $PKG/etc/sv/sshd/log

    printf '%s\n' \
        '#!/bin/sh' \
        'exec 2>&1' \
        '' \
        '# generate host keys on first boot' \
        'for type in ed25519 ecdsa rsa; do' \
        '    keyfile=/etc/ssh/ssh_host_${type}_key' \
        '    [ -f "$keyfile" ] && continue' \
        '    ssh-keygen -t "$type" -f "$keyfile" -N ""' \
        '    echo "generated $keyfile"' \
        'done' \
        '' \
        'exec /usr/bin/sshd -D -e' \
        > $PKG/etc/sv/sshd/run

    printf '%s\n' \
        '#!/bin/sh' \
        'mkdir -p /var/log/sshd' \
        'exec svlogd -tt /var/log/sshd' \
        > $PKG/etc/sv/sshd/log/run

    chmod 755 $PKG/etc/sv/sshd/run
    chmod 755 $PKG/etc/sv/sshd/log/run

    # Service disabled by default - must explicitly: rm /etc/sv/sshd/down
    touch $PKG/etc/sv/sshd/down
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh