#!/bin/mkpkg
# description: rawnix initramfs: static /init that unlocks a LUKS root
# url: https://rawnix.org
#
# The image is generic (no modules, no config), so one package serves every
# kernel and nothing regenerates it.  Staged in /boot; limine-sync mirrors it.
#
# libcryptsetup and libdevmapper are built here as private static libraries
# and never installed.  The system ports stay shared-only, and the initramfs
# wants a different configuration anyway:
#   - libdevmapper without udev_sync  (no udev before root; the system one
#     has it, and would drag in libudev.a)
#   - kernel crypto backend           (no libcrypto.a; needs CRYPTO_USER_API_HASH=y)
#   - internal argon2, no blkid, no tokens
#
# Versions are literal below (source= and the two cd lines): keep cryptsetup
# equal to the cryptsetup port and LVM2 equal to device-mapper.  A security fix in either reaches the initramfs only by bumping release here.

name=tinyrd
version=0.1
release=2
depends=()
makedeps=(pkgconf popt util-linux json-c)
source=(tinyrd.c
        https://www.kernel.org/pub/linux/utils/cryptsetup/v2.8/cryptsetup-2.8.8.tar.xz
        https://sourceware.org/pub/lvm2/LVM2.2.03.35.tgz)

sha256sums=(
    "79dc8126afab289ff924f382face04ad18ae53d3257a7349dbef52d864c6b590"
    "3acfa685f2dd7fcc832e0b77bc7093aa7da554a51ce8dafbb4138eaa854eee35"
    "ebf28b3427535e2b5abd9991cd839b61622a0dbfb8c86df0f7af1f69dcaa8371"
)

build() {
    top=$PWD
    _p=$top/static        # private prefix, never packaged
    export CC=clang
    export PKG_CONFIG_PATH=$_p/lib/pkgconfig:$PKG_CONFIG_PATH

    cd $top/LVM2.2.03.35
    ./configure --prefix=$_p --enable-static_link --disable-udev_sync \
        --disable-selinux --disable-blkid_wiping --disable-readline --disable-nls \
        --with-thin=none --with-cache=none --with-vdo=none \
        --with-writecache=none --with-integrity=none
    make -C libdm ioctl/libdevmapper.a
    install -Dm644 libdm/libdevmapper.h       $_p/include/libdevmapper.h
    install -Dm644 libdm/ioctl/libdevmapper.a $_p/lib/libdevmapper.a
    install -Dm644 libdm/libdevmapper.pc      $_p/lib/pkgconfig/devmapper.pc

    # configure insists on popt even with every tool disabled; only the lib is built
    cd $top/cryptsetup-2.8.8
    CPPFLAGS="-I$_p/include $CPPFLAGS" LDFLAGS="-L$_p/lib $LDFLAGS" \
    ./configure --prefix=$_p --disable-shared --enable-static \
        --with-crypto_backend=kernel \
        --enable-internal-argon2 --enable-internal-sse-argon2 --disable-libargon2 \
        --disable-blkid --disable-udev --disable-selinux \
        --disable-external-tokens --disable-ssh-token --disable-hw-opal \
        --disable-cryptsetup --disable-veritysetup --disable-integritysetup \
        --disable-pwquality --disable-asciidoc --disable-nls
    make libcryptsetup.la
    make install-libLTLIBRARIES install-includeHEADERS install-pkgconfigDATA

    cd $top
    $CC $CFLAGS -I$_p/include -static -o tinyrd tinyrd.c \
        -L$_p/lib $LDFLAGS $(pkg-config --static --libs libcryptsetup)
    ./tinyrd -o tinyrd.img
    install -Dm644 tinyrd.img $PKG/boot/tinyrd.img
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh