#!/usr/bin/make -f

export CARGO_TARGET_DIR := $(CURDIR)/daemon/target
DESTDIR := $(CURDIR)/debian/openussd

%:
	dh $@ --buildsystem=none

# debtransform (quilt) carries this as an opaque file, never an overlay.
override_dh_auto_configure:
	set -- openussd-vendor-*.tar.gz; test "$$#" = 1; tar -xzf "$$1" ./daemon/vendor
	mkdir -p daemon/.cargo
	printf '%s\n' '[build]' 'rustflags = ["-C", "target-feature=-crt-static"]' '' '[source.crates-io]' 'replace-with = "vendored-sources"' '' '[source."git+https://github.com/nbdd0121/nfq-rs?rev=fc838b4d8e4dcade5324cf1719a4f05122754019"]' 'git = "https://github.com/nbdd0121/nfq-rs"' 'rev = "fc838b4d8e4dcade5324cf1719a4f05122754019"' 'replace-with = "vendored-sources"' '' '[source.vendored-sources]' 'directory = "vendor"' > daemon/.cargo/config.toml

override_dh_auto_build:
	rm -rf daemon/ebpf-probes/target
	test -s daemon/ebpf-probes/openuss-ebpf-ring.bpf.o
	test -s daemon/ebpf-probes/openuss-ebpf-perf.bpf.o
	cd daemon && timeout 30m cargo build --offline --locked --release --features ebpf --bin open_uss --bin openuss-netns-agent

# Like the RPM, run no tests (including when nocheck is absent).
override_dh_auto_test:

override_dh_auto_clean:
	rm -rf daemon/target daemon/vendor

override_dh_auto_install:
	install -D -m 0755 daemon/target/release/open_uss \
	    $(DESTDIR)/usr/sbin/openussd
	install -D -m 0755 daemon/target/release/openuss-netns-agent \
	    $(DESTDIR)/usr/sbin/openuss-netns-agent
	install -d -m 0750 $(DESTDIR)/etc/openussd
	install -d -m 0750 $(DESTDIR)/var/lib/openuss
	for state_root in exclusions watchdog exploit clean_cache file_shield quarantine; do \
	    install -d -m 0700 $(DESTDIR)/var/lib/openuss/$$state_root; \
	done
	install -d -m 0700 $(DESTDIR)/var/lib/openuss/network_shield
	for config_file in config.toml file-shield.toml behaviour-shield.toml exploit-shield.toml network-shield.toml; do \
	    install -m 0640 packaging/presets/desktop/$$config_file \
	        $(DESTDIR)/etc/openussd/$$config_file; \
	done
	for preset in desktop server; do \
	    install -d -m 0755 $(DESTDIR)/usr/share/openussd/presets/$$preset; \
	    for config_file in config.toml file-shield.toml behaviour-shield.toml exploit-shield.toml network-shield.toml; do \
	        install -m 0444 packaging/presets/$$preset/$$config_file \
	            $(DESTDIR)/usr/share/openussd/presets/$$preset/$$config_file; \
	    done; \
	done
	install -D -m 0644 daemon/packaging/openussd.service $(DESTDIR)/usr/lib/systemd/system/openussd.service
	install -D -m 0644 daemon/packaging/org.openussd.policy \
	    $(DESTDIR)/usr/share/polkit-1/actions/org.openussd.policy
	install -D -m 0644 daemon/packaging/org.openussd.conf \
	    $(DESTDIR)/usr/share/dbus-1/system.d/org.openussd.conf
	install -D -m 0644 daemon/packaging/org.openussd.rules \
	    $(DESTDIR)/usr/share/polkit-1/rules.d/org.openussd.rules
	install -D -m 0644 COPYING $(DESTDIR)/usr/share/doc/openussd/COPYING
	install -m 0644 daemon/lib/fanotify-rs/LICENSE-APACHE-2.0 $(DESTDIR)/usr/share/doc/openussd/

# Restore the RPM modes after debhelper's normal permission normalization.
# The dynamic openuss GID is applied on the installed host by postinst.
override_dh_fixperms:
	dh_fixperms
	chmod 0750 $(DESTDIR)/etc/openussd $(DESTDIR)/var/lib/openuss
	chmod 0640 $(DESTDIR)/etc/openussd/*.toml
	chmod 0700 $(DESTDIR)/var/lib/openuss/*
	chmod 0444 $(DESTDIR)/usr/share/openussd/presets/*/*.toml

override_dh_installsystemd:
	dh_installsystemd --no-enable --no-start

# Keep embedded BTF probe bytes intact; do not generate a separate debug package.
override_dh_strip:

override_dh_dwz:

override_dh_compress:
	dh_compress -XCOPYING -XLICENSE-APACHE-2.0
