Ticket #50421: Portfile

# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4
# $Id$

PortSystem              1.0
PortGroup               perl5 1.0
perl5.branches          5.24

name                    wallet
version                 1.3
revision                0
categories                  net security
license             MIT
maintainers         kornel.us:karl
description         Kerberos-authenticated secure data management
long_description        The wallet is a system for managing secure data, \
                            authorization rules to retrieve or change that data, \
                                and audit rules for documenting actions taken on that \
                        data.  Objects of various types may be stored in the \
                                wallet or generated on request and retrieved by \
                        authorized users.  The wallet tracks ACLs, metadata, \
                                and trace information.  It uses Kerberos \
                        authentication.  One of the object types it supports \
                                is Kerberos keytabs, making it suitable as a \
                        user-accessible front-end to Kerberos kadmind with \
                            richer ACL and metadata operations.
homepage                http://eyrie.org/~eagle/software/wallet/

platforms               darwin
master_sites            http://archives.eyrie.org/software/kerberos/ \
                                http://archives.eyrie.org/software/ARCHIVE/wallet/
checksums               rmd160 188b3561fcffe99342fcfb1312b58df3f3d919b5 \
                                sha256 676d3d6e407509fc9da1dd87d98fadc71920dabfbc4bdeb8cde5e2bc937268b8

# Start with the dependencies we know we need
depends_lib-append      port:kerberos5 \
                                port:remctl
#
# Add a dependency on Module::Build
if {${perl5.major} != ""} {
        depends_lib-append      port:p${perl5.major}-module-build
}

# wallet 1.3 does not support Perl paths other than /usr/bin/perl, nor does it
# support perl binaries not named "perl".  The perl/Build.PL script is also
# missing some testing prerequisites.
# Since we are patching autoconf and automake files, we need autoreconf.
patchfiles              patch-autogen.diff \
                                patch-configure.ac.diff \
                                patch-Makefile.am.diff \
                                patch-README.diff \
                                patch-perl-Build.PL.diff \
                    patch-portable-system.h.diff \
                            patch-rename-server-keytab-backend.diff \
                        patch-rename-server-wallet-admin.diff \
                        patch-rename-server-wallet-backend.diff \
                            patch-rename-server-wallet-report.diff
use_autoreconf          yes

# Use configure, and pass in the paths to MacPorts kerberos5, remctl, and perl.
use_configure           yes
configure.args          --enable-reduced-depends \
                                --with-remctl=${prefix} \
                                PATH_KRB5_CONFIG=${prefix}/bin/krb5-config \
                                PERL=${prefix}/bin/perl${perl5.major} 

# The Wallet client is just a couple of binaries, plus man pages and docs.
variant client {
        long_description-append The wallet client uses the remctl protocol to \
                                            communicate with a wallet server.
}

# The Wallet server is entirely Perl, spawned by the remctl daemon.
# TODO: Patch wallet remctl config files to use ${destroot}${prefix}
variant server {
        # We can't use perl5.setup because it overrides alot of settings that
        # we need.
        #perl5.setup            Wallet 1.003

        long_description-append The wallet server, run by remctld, maintains \
                                            the database of object metadata and secure \
                                            objects, and responds to requests from the \
                                            wallet client.

        if {${perl5.major} != ""} {
                depends_lib-append      port:p${perl5.major}-datetime \
                                                port:p${perl5.major}-dbi \
                                                port:p${perl5.major}-dbix-class \
                                                    port:p${perl5.major}-digest-md5 \
                                                    port:p${perl5.major}-sql-translator \
                                                    port:p${perl5.major}-timedate
                depends_build-append    port:p${perl5.major}-crypt-generatepassword \
                                                port:p${perl5.major}-datetime-format-sqlite \
                                                    port:p${perl5.major}-module-build
        }

        # TODO: Tests have a Stanford-specific part, and a NetDB-verifier part,
        # which need to be disabled.
        # test.run              yes
        # test.target           check

notes-append "
*************************************************************************
* Before using the Wallet server, you will need to choose a database    *
* backend to use.  MySQL, Postgres, and SQLite are known to work.       *
* Then you will need to install the p5-datetime-format-* and p5-dbd-*   *
* ports that match the database backend you chose.                      *
*                                                                       *
* If you want to support getting keytabs through Wallet, then your KDC  *
* will need to have the wallet+kerberos5_keytab port installed.         *
*                                                                       *
* Other Perl modules may be required, depending on what you want to     *
* support.  Read share/doc/wallet/setup for additional server           *
* configuration instructions.                                           *
*                                                                       *
* Wallet server runs via remctl, so be sure that remctld is running,    *
* and is configured correctly!                                          *
*************************************************************************
"
}

# kdc just installs a couple of helper files that a Kerberos 5 KDC
# can use to generate unchanging keytabs for a Wallet server.
# TODO: Patch keytab and wallet remctl config files to use ${destroot}${prefix}
variant kdc {
        long_description-append This port contains a remctl script, to be \
                                run on the Kerberos 5 KDC, that will generate keytabs \
                                at the request of a Wallet server.  This variant is \
                only meant to be installed on a KDC, and does not \
                inclue Wallet server or client.

    notes-append "
********************************************************************
* To configure your KDC to generate keytabs for the Wallet server, *
* you will need to configure etc/krb5kdc/allow-extract, as well as *
* /etc/remctl/acl/keytab.  This uses remctl, so remctld must also  *
* be running.                                                      *
********************************************************************
"
}

# Only install the client by default
default_variants    +client

# Our install process has some common bits, and some variant-specific bits.
destroot {
    # First, install common files from the distribution
        xinstall -d ${destroot}${prefix}/share/doc/wallet
        xinstall -m 644 ${worksrcpath}/LICENSE \
                ${worksrcpath}/NEWS \
                ${worksrcpath}/README \
                ${worksrcpath}/TODO \
                ${destroot}${prefix}/share/doc/wallet

    # If installing the server or kdc variants, make common directories
    if {[variant_isset server] || [variant_isset kdc]} {
                xinstall -d ${destroot}${prefix}/etc/remctl/acl
                xinstall -d ${destroot}${prefix}/etc/remctl/conf.d
    }

    # If the client variant is active, install client files
    if {[variant_isset client]} {
        # Install the wallet client executables
        # ${destroot}${prefix}/bin already exists
                xinstall -m 755 ${worksrcpath}/client/wallet \
                ${worksrcpath}/client/wallet-rekey \
                        ${destroot}${prefix}/bin

        # Install the wallet client man pages
        xinstall -d ${destroot}${prefix}/share/man/man1
                xinstall -m 644 ${worksrcpath}/client/wallet.1 \
                ${worksrcpath}/client/wallet-rekey.1 \
                    ${destroot}${prefix}/share/man/man1
    }

    # If the server variant is active, install server files.
        if {[variant_isset server]} {
        # Install a set of starter remctl ACLs and configurations
        # ${destroot}${prefix}/etc/remctl/acl is created above
                xinstall -m 644 ${worksrcpath}/config/wallet-report.acl \
                        ${destroot}${prefix}/etc/remctl/acl/wallet-report

        # ${destroot}${prefix}/etc/remctl/conf.d is created above
                xinstall -m 644 ${worksrcpath}/config/wallet \
                        ${destroot}${prefix}/etc/remctl/conf.d/wallet

        # Install the wallet server executables
                # ${destroot}${prefix}/sbin already exists
                xinstall -m 755 ${worksrcpath}/server/wallet-admin \
                        ${worksrcpath}/server/wallet-backend \
                        ${worksrcpath}/server/wallet-report \
                        ${destroot}${prefix}/sbin

        # Install the wallet server man pages
                # ${destroot}${prefix}/share/man/man8 already exists
                xinstall -m 644 ${worksrcpath}/server/wallet-admin.8 \
                        ${worksrcpath}/server/wallet-backend.8 \
                        ${worksrcpath}/server/wallet-report.8 \
                        ${destroot}${prefix}/share/man/man8

        # Install protocol documentataion
                xinstall -m 644 {*}[glob ${worksrcpath}/docs/*] \
                        ${destroot}${prefix}/share/doc/wallet

                # The Perl components of Wallet server are installed by a
                # Module::Build installer that is normally run by the Makefile.
                # PERL_INSTALL_ROOT is used to set the destroot path; we don't
                # set a prefix because that is already configured into MacPorts
                # Perl, and so Module::Build uses it automatically.
                set env(PERL_INSTALL_ROOT) ${destroot}
                ui_info [exec ${prefix}/bin/perl${perl5.major} ${worksrcpath}/perl/Build install]
        }

    # If the KDC variant is active, install KDC files
        if {[variant_isset kdc]} {
        # Install a stub KDC ACL that keytab-backend will use
                xinstall -d ${destroot}${prefix}/etc/krb5kdc
                xinstall -m 640 ${worksrcpath}/config/allow-extract \
                        ${destroot}${prefix}/etc/krb5kdc/allow-extract

        # Install example remctl ACLs and configurations
        # ${destroot}${prefix}/etc/remctl/acl is created above
                xinstall -m 644 ${worksrcpath}/config/keytab.acl \
                        ${destroot}${prefix}/etc/remctl/acl/keytab

        # ${destroot}${prefix}/etc/remctl/conf.d is created above
                xinstall -m 644 ${worksrcpath}/config/keytab \
                        ${destroot}${prefix}/etc/remctl/conf.d/keytab

        # Install the keytab-backend executable
                # ${destroot}${prefix}/sbin already exists
                xinstall -m 755 ${worksrcpath}/server/keytab-backend \
                        ${destroot}${prefix}/sbin

        # Install the keytab-backend man page
                # ${destroot}${prefix}/share/man/man8 already exists
                xinstall -m 644 ${worksrcpath}/server/keytab-backend.8 \
                        ${destroot}${prefix}/share/man/man8/keytab-backend.8
    }
}