Ticket #67539: Portfile.openssh9.3.p1_rev2_deux

File Portfile.openssh9.3.p1_rev2_deux, 11.1 KB (added by artkiver (グレェ), 17 months ago)

Further modified Portfile with danielluke's suggestions for improvement.

Line 
1# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4
2
3PortSystem          1.0
4
5PortGroup           compiler_blacklist_versions 1.0
6
7name                openssh
8version             9.3p1
9revision            2
10categories          net
11maintainers         {@artkiver gmail.com:artkiver} openmaintainer
12license             BSD
13installs_libs       no
14conflicts           lsh pkixssh
15
16description         OpenSSH secure login server
17
18long_description    OpenSSH is a FREE version of the SSH protocol suite of \
19                    network connectivity tools that increasing numbers of people on the \
20                    Internet are coming to rely on. Many users of telnet, rlogin, ftp, \
21                    and other such programs might not realize that their password is \
22                    transmitted across the Internet unencrypted, but it is. OpenSSH \
23                    encrypts all traffic (including passwords) to effectively eliminate \
24                    eavesdropping, connection hijacking, and other network-level \
25                    attacks. Additionally, OpenSSH provides a myriad of secure \
26                    tunneling capabilities, as well as a variety of authentication \
27                    methods.
28
29homepage            https://www.openbsd.org/openssh/
30
31checksums           rmd160  29768ab6830484f797d0138d2c7f53791a319d4c \
32                    sha256  e9baba7701a76a51f3d85a62c383a3c9dcd97fa900b859bc7db114c1868af8a8 \
33                    size    1856839
34
35master_sites        openbsd:OpenSSH/portable \
36                    ftp://ftp.cise.ufl.edu/pub/mirrors/openssh/portable/ \
37                    http://openbsd.mirrors.pair.com/OpenSSH/portable
38
39if {${name} eq ${subport}} {
40    depends_lib         path:lib/libssl.dylib:openssl \
41                        port:libedit \
42                        port:ncurses \
43                        port:zlib
44    depends_run         port:ssh-copy-id
45
46    platform darwin 10 {
47        # /usr/bin/ranlib: object: libopenbsd-compat.a(base64.o) malformed object (unknown load command 2)
48        depends_build-append port:cctools
49    }
50
51    patch.args          -p1
52    patchfiles          launchd.patch \
53                        agent.patch \
54                        pam.patch \
55                        patch-sandbox-darwin.c-apple-sandbox-named-external.diff \
56                        patch-sshd.c-apple-sandbox-named-external.diff \
57                        macports-config.patch
58
59    # We need a couple of patches
60    # - pam.patch
61    #   getpwnam(3) on OS X always returns "*********" in the pw_passwd field even
62    #   when run as root, so it can't be used for authentication. This patch just
63    #   forces the use of PAM regardless of the configuration.
64    # - patch-*-apple-sandbox-named-external.diff
65    #   Use Apple's sandbox_init(3) in addition to standard privilege separation.
66    #   This requires a sandbox profile (which we provide) and the sandbox_init(3)
67    #   call before the chroot(2) to privsep-path (${prefix}/var/empty), or it will
68    #   fail to load the sandbox description and libsandbox.1.dylib.
69    # - macports-config.patch
70    #   Changes the default configuration from the upstream-provided one by popular
71    #   request.
72    # - agent.patch
73    #   Adds -l flag to ssh-agent to work with launchd.
74
75    post-patch {
76        # reinplace prefix in path to sandbox definition added by
77        # patch-sandbox-darwin.c-apple-sandbox-named-external.diff
78        reinplace "s|@PREFIX@|${prefix}|g" ${worksrcpath}/sandbox-darwin.c
79    }
80
81    use_autoreconf          yes
82
83    # strnvis(3) isn't actually "broken".  OpenBSD decided to be special and flip
84    # the order of arguments to strnvis and considers everyone else to be broken.
85    configure.cppflags-append -DBROKEN_STRNVIS=1
86
87    # Use Apple's sandboxing feature
88    configure.cppflags-append   -D__APPLE_SANDBOX_NAMED_EXTERNAL__ \
89                                -D__APPLE_API_STRICT_CONFORMANCE
90
91    # Support Apple's launchd in ssh-agent
92    configure.cppflags-append -D__APPLE_LAUNCHD__
93
94    configure.ldflags-append  -Wl,-search_paths_first
95    configure.args      --with-ssl-dir=${prefix} \
96                        --sysconfdir=${prefix}/etc/ssh \
97                        --with-privsep-path=/var/empty \
98                        --with-md5-passwords \
99                        --with-pid-dir=${prefix}/var/run \
100                        --with-pam \
101                        --mandir=${prefix}/share/man \
102                        --with-zlib=${prefix} \
103                        --without-kerberos5 \
104                        --with-libedit \
105                        --with-pie \
106                        --without-xauth \
107                        --without-ldns \
108                        --with-audit=bsm \
109                        --with-keychain=apple
110
111    use_parallel_build  yes
112
113    platform macosx {
114        if {${os.major} < 10 || (${os.major} == 10 && ${configure.build_arch} eq "ppc")} {
115            # See: https://trac.macports.org/ticket/60385
116            # clang does not work for ppc on 10.6.8 Rosetta
117            # See also: https://trac.macports.org/ticket/65613
118            configure.args-delete   --with-keychain=apple
119        } elseif {${os.major} <= 11} {
120            # clang is required to build the new Apple Keychain integration due
121            # to it using the Object Subscripting feature, c.f. #59397.
122            # We'll keep it simple and just blacklist any gcc version, cc
123            # (which could be anything), system clang versions prior to those
124            # shipped with Xcode 4.4.
125            # Regarding the macports-clang versions, any version in the
126            # MacPorts tree should suit our needs, since the clang
127            # documentation lists FOSS clang/llvm 3.1 as the first version to
128            # support Object Subscripting and the oldest version in our tree is
129            # now 3.3.
130            compiler.blacklist-append   *gcc* cc {clang < 421}
131} elseif {(${os.major} >= 13 && ${configure.build_arch} eq "x86_64")} {
132            compiler.blacklist-append   {clang >= 1403 < 1500}
133        }
134    }
135
136    destroot.target     install-nokeys
137
138    test.run            yes
139    test.target         tests
140
141    post-destroot {
142        destroot.keepdirs ${destroot}${prefix}/var/run
143
144        # switch default port to avoid conflict with system sshd
145        reinplace "s|#Port 22|Port 2222|g" ${destroot}${prefix}/etc/ssh/sshd_config
146
147        # install sandbox definition
148        xinstall -m 755 -d ${destroot}${prefix}/share/${name}
149        xinstall -m 644 ${filespath}/com.openssh.sshd.sb ${destroot}${prefix}/share/${name}
150
151        file rename "${destroot}${prefix}/etc/ssh/sshd_config" "${destroot}${prefix}/etc/ssh/sshd_config.example"
152        file rename "${destroot}${prefix}/etc/ssh/ssh_config" "${destroot}${prefix}/etc/ssh/ssh_config.example"
153    }
154
155    post-activate {
156        if {![file exists "${prefix}/etc/ssh/sshd_config"]} {
157            copy "${prefix}/etc/ssh/sshd_config.example" "${prefix}/etc/ssh/sshd_config"
158        }
159        if {![file exists "${prefix}/etc/ssh/ssh_config"]} {
160            copy "${prefix}/etc/ssh/ssh_config.example" "${prefix}/etc/ssh/ssh_config"
161        }
162    }
163
164    variant xauth description {Build with support for xauth} {
165        configure.args-replace  --without-xauth \
166                                --with-xauth=${prefix}/bin/xauth
167        depends_run-append      port:xauth
168    }
169
170    variant kerberos5 description "Add Kerberos5 support" {
171        depends_lib-append      port:kerberos5
172        configure.args-delete   --without-kerberos5
173        configure.args-append   --with-kerberos5=${prefix}
174
175        if {${os.platform} eq "darwin"} {
176            post-extract {
177                xinstall -m 0755 -W "${filespath}" slogin "${worksrcpath}/"
178            }
179
180            pre-configure {
181                reinplace -W "${worksrcpath}" "s|@@PREFIX@@|${prefix}|" slogin
182            }
183
184            post-destroot {
185                xinstall -m 0755 ${worksrcpath}/slogin \
186                                 ${destroot}${prefix}/bin/
187            }
188        }
189    }
190
191    variant ldns description "Use ldns for DNSSEC support" {
192        configure.args-replace  --without-ldns \
193                                --with-ldns
194        depends_lib-append      port:ldns
195    }
196
197    variant fido2 description "Enable fido2 support" {
198        configure.args-delete  --without-security-key-builtin
199        configure.args-append  --with-security-key-builtin
200        depends_lib-append      port:libfido2
201    }
202
203
204    platform darwin {
205        # create link to /usr/include/pam because 'security' was renamed to 'pam'
206        # in OS X.
207        # And then again back to security in 10.6.
208        if {${os.major} < 10} {
209            pre-configure {
210                xinstall -d ${workpath}/include
211                file delete ${workpath}/include/security
212                ln -s /usr/include/pam ${workpath}/include/security
213                configure.cppflags-append "-I${workpath}/include"
214            }
215        }
216    }
217
218    platform darwin 9 {
219        # 10.5/ppc doesn't like the sandbox file we supply
220        configure.cppflags-delete -D__APPLE_SANDBOX_NAMED_EXTERNAL__
221    }
222
223    startupitem.create  yes
224    startupitem.name    OpenSSH
225    startupitem.start   \
226        "if \[ -x ${prefix}/sbin/sshd \]; then
227            if \[ ! -f ${prefix}/etc/ssh/ssh_host_dsa_key \]; then
228                ${prefix}/bin/ssh-keygen -t dsa -f \\
229                ${prefix}/etc/ssh/ssh_host_dsa_key -N \"\" -C `hostname`
230            fi
231            if \[ ! -f ${prefix}/etc/ssh/ssh_host_rsa_key \]; then
232                ${prefix}/bin/ssh-keygen -t rsa -f \\
233                ${prefix}/etc/ssh/ssh_host_rsa_key -N \"\" -C `hostname`
234            fi
235            if \[ ! -f ${prefix}/etc/ssh/ssh_host_ecdsa_key \]; then
236                ${prefix}/bin/ssh-keygen -t ecdsa -f \\
237                ${prefix}/etc/ssh/ssh_host_ecdsa_key -N \"\" -C `hostname`
238            fi
239            if \[ ! -f ${prefix}/etc/ssh/ssh_host_ed25519_key \]; then
240                ${prefix}/bin/ssh-keygen -t ed25519 -f \\
241                ${prefix}/etc/ssh/ssh_host_ed25519_key -N \"\" -C `hostname`
242            fi
243            ${prefix}/sbin/sshd
244        fi"
245    startupitem.stop    \
246        "if \[ -r ${prefix}/var/run/sshd.pid \]; then
247            kill `cat ${prefix}/var/run/sshd.pid`
248        fi"
249}
250
251subport ssh-copy-id {
252    revision            0
253    platforms           any
254    supported_archs     noarch
255    maintainers         {l2dy @l2dy} openmaintainer
256    description         Shell script to install your public key(s) on a remote machine
257    long_description    {*}${description}
258
259    # Make sure to not create multiple copies of the same distfile.
260    distname            openssh-${version}
261    dist_subdir         openssh
262
263    use_configure       no
264    build               {}
265
266    destroot {
267        xinstall -m 755 ${worksrcpath}/contrib/ssh-copy-id ${destroot}${prefix}/bin
268        xinstall -m 644 ${worksrcpath}/contrib/ssh-copy-id.1 ${destroot}${prefix}/share/man/man1
269    }
270}
271
272livecheck.type      regex
273livecheck.url       https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/
274livecheck.regex     openssh-(\[5-9\]+.\[0-9\]+p\[0-9\]+)[quotemeta ${extract.suffix}]