# Maintainer: Christopher Holloway <christopher.j.holloway@outlook.com>
# https://www.progressiverobot.com
# Copyright (c) 2026 Christopher Holloway / Progressive Robot Ltd
# SPDX-License-Identifier: AGPL-3.0-or-later

# The Arch package. SUSE and the RPM distributions consume the .rpm CPack builds;
# Arch has no equivalent of that, so it gets a PKGBUILD that builds from the
# release's source tarball with the same CMakeLists.txt the .deb and .rpm are built
# from - the tarball the release signs (hmailserver/docs/SourceTarball.md); no
# release before the tarball existed can be built with it.
#
# Build it with:  makepkg -si
#
# The AUR's copy is this file as aur-publish renders it for a release
# (build/ci/channels/aur-publish.py; hmailserver/docs/Channels.md): pkgver the
# release's, pkgrel counted up when this file changes between releases, and
# sha256sums the SHA-256 of the tarball it downloaded and verified against the
# release's Sigstore bundle. In the tree the tarball is not made yet when this file
# is committed, so sha256sums is SKIP here: a build from the tree takes the tarball
# on trust from the release's HTTPS address, and the AUR's does not.
#
# WHAT IS DIFFERENT FROM THE .deb AND .rpm, and it is worth knowing before
# reading further: this package installs no maintainer scripts. Arch stopped
# wanting them for this job. The system user is declared in a sysusers.d file,
# the directories in a tmpfiles.d file, and pacman's own hooks - the ones the
# systemd package ships in /usr/share/libalpm/hooks - run systemd-sysusers,
# systemd-tmpfiles and daemon-reload when it sees those files and the unit go in.
# That is the standard install hook on this distribution now; a .install script
# would be a second copy of the same logic for the packager to keep in step, and
# it would run whether or not the hooks had already done the work.
#
# The unit is NOT enabled by this package. Arch packages do not enable services -
# the distribution is explicit about that - and in this case the reason is the
# same one the Debian and RPM scripts give for not STARTING it: nothing here can
# know the database credentials, and a server that cannot reach a database is a
# server writing to the log once a second.
#
# And it is a distribution's build: -DHM_LIVE_UPDATE=OFF, so it carries no
# hmailserver-update and never replaces itself with the project's .deb or .rpm;
# its update check still says when a newer release exists, and names the command
# in build() below (hmailserver/docs/LiveUpdateKinds.md).

pkgname=hmailserver

# THE ONE LINUX VERSION LITERAL, and it is checked rather than trusted.
#
# Everything else on this platform derives its version from
# hmailserver/source/Server/Common/Application/Version.h: the CMakeLists reads
# that header at configure time, and CPACK_PACKAGE_VERSION - and therefore the
# .deb and .rpm file names - comes from it. This file cannot do the same, because
# makepkg parses it as a shell script and never runs CMake, and because
# source= below fetches the release's source tarball of this number rather than
# the tree it was copied out of.
#
# So it is verified instead: build/check-linux-version-stamp.sh compares this
# line with Version.h, and GitLab CI's checkers and linux-build jobs run it.
# Stamping a release means editing Version.h and this line, and the check is what
# says so when only one of the two was done.
pkgver=6.3.6
pkgrel=1
pkgdesc="A mail server for SMTP, IMAP and POP3"
arch=('x86_64' 'aarch64')
# The project's home since GitHub suspended its account on 18 September 2026, at
# the group's path it moved to on 29 September 2026 (its first path,
# Progressiverobot/hmailserver, redirects there).
url="https://gitlab.com/hmailserver/hmailserver"
license=('AGPL-3.0-or-later')

# Matched to what hmailserver/source/Server/CMakeLists.txt actually links:
# Threads, OpenSSL 3.0 or newer, zlib, libpq, OpenLDAP (libldap and liblber, one
# package here), Boost (thread, filesystem, regex, headers) and Iconv. Iconv has
# no package here because glibc carries it - find_package(Iconv) finds nothing
# to link on this libc and that is correct. libldap carries ldap.h itself, so it
# needs no -dev twin in makedepends. ca-certificates: the authorities every HTTPS
# request the server makes is checked against - the update check, a JWKS, an
# object store, a webhook.
depends=('boost-libs' 'openssl' 'zlib' 'postgresql-libs' 'libldap' 'ca-certificates')

# clang is not a matter of taste. Common/Util/StdString.h calls members of its own
# dependent base without this->, which only MSVC and clang's
# -fdelayed-template-parsing accept; the CMakeLists prints a warning and the build
# then fails in that header under GCC. Making that header conforming is its own
# roadmap row, and until it lands this package is a clang build.
#
# boost is here as well as boost-libs because the headers are in the split
# package; postgresql-libs carries libpq-fe.h itself, so it needs no -dev twin.
makedepends=('cmake' 'ninja' 'clang' 'boost')

optdepends=(
   'mariadb-libs: MySQL and MariaDB backend - libmariadb.so.3, which the server
    opens with dlopen at run time rather than linking, so nothing pulls it in
    automatically'
   'logrotate: rotation for /var/log/hmailserver, using the rule this package
    installs'
   'clamav: virus scanning, reached over TCP with clamd INSTREAM'
   'spamassassin: spam scoring, reached over TCP with spamd'
   'python: hmctl, the command-line client of the REST API, in /usr/bin'
   '7zip: the backup archive'
)

# Built without link-time optimisation. Arch's makepkg.conf turns it on for every
# package (OPTIONS=(... lto), LTOFLAGS="-flto=auto"), and with clang that is a full
# LTO link of the whole server: on 28 September 2026 the final link of
# /usr/bin/hmailserver alone passed 6 GB of memory and was killed, in a clean Arch
# Linux container building this file. The project builds, tests and releases the
# server without LTO; a packager with the memory to spare may drop the line.
options=('!lto')

# pacman keeps an edited configuration and leaves the package's version beside it
# as a .pacnew. This is the Arch equivalent of a Debian conffile, and it is why
# an upgrade here does not overwrite database credentials.
backup=('etc/hmailserver/hMailServer.ini')

# The release's source tarball, from the project's package registry by the
# project's id, which a move between namespaces keeps. aur-publish writes its
# SHA-256 here (above).
source=("https://gitlab.com/api/v4/projects/86730559/packages/generic/hmailserver/${pkgver}/hmailserver-${pkgver}.tar.gz")
sha256sums=('SKIP')

build() {
   # See the note on makedepends: clang, and not because the project prefers it.
   export CC=clang
   export CXX=clang++

   # -DCMAKE_INSTALL_PREFIX=/usr is what makes GNUInstallDirs answer /etc and
   # /var for sysconfdir and localstatedir rather than /usr/etc and /usr/var. The
   # install rules in the CMakeLists depend on that: the configuration goes to
   # ${CMAKE_INSTALL_SYSCONFDIR}/hmailserver and the logrotate rule to
   # ${CMAKE_INSTALL_SYSCONFDIR}/logrotate.d.
   #
   # -DHM_LIVE_UPDATE=OFF, and the command the update check names instead: see the
   # note at the top.
   cmake -S "${srcdir}/${pkgname}-${pkgver}/hmailserver/source/Server" -B build -G Ninja \
      -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/usr \
      -DCMAKE_INSTALL_LIBDIR=lib \
      -DHM_LIVE_UPDATE=OFF \
      -DHM_UPDATE_COMMAND="makepkg -si from https://aur.archlinux.org/hmailserver.git"

   cmake --build build
}

package() {
   DESTDIR="${pkgdir}" cmake --install build

   # /usr/bin/hmailserver, /usr/share/hmailserver/DBScripts, the unit, the
   # configuration and the logrotate rule all come from the install rules above.
   # What follows is the part CMake does not describe, because it is about the
   # running system rather than about files.

   # The system user. systemd-sysusers creates it when pacman's hook fires, and
   # creates nothing if it is already there. The home directory is the mail store
   # and the shell is one that cannot log in.
   install -d "${pkgdir}/usr/lib/sysusers.d"
   cat > "${pkgdir}/usr/lib/sysusers.d/hmailserver.conf" <<'SYSUSERS'
# SPDX-License-Identifier: AGPL-3.0-or-later
u hmailserver - "hMailServer mail server" /var/lib/hmailserver /usr/bin/nologin
SYSUSERS

   # The directories, their modes and their ownership. 0750 throughout: this is
   # other people's mail, and logs that name who sent it to whom. The two "z"
   # lines adjust what the package itself installed - the configuration carries
   # the administrator password and the database password, and is readable by the
   # service without being writable by it.
   install -d "${pkgdir}/usr/lib/tmpfiles.d"
   cat > "${pkgdir}/usr/lib/tmpfiles.d/hmailserver.conf" <<'TMPFILES'
# SPDX-License-Identifier: AGPL-3.0-or-later
d /var/lib/hmailserver          0750 hmailserver hmailserver -
d /var/lib/hmailserver/temp     0750 hmailserver hmailserver -
d /var/lib/hmailserver/events   0750 hmailserver hmailserver -
d /var/lib/hmailserver/database 0750 hmailserver hmailserver -
d /var/log/hmailserver          0750 hmailserver hmailserver -
z /etc/hmailserver              0750 root       hmailserver -
z /etc/hmailserver/hMailServer.ini 0640 root    hmailserver -
TMPFILES

   install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" \
      "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"

   install -Dm644 \
      "${srcdir}/${pkgname}-${pkgver}/hmailserver/source/Server/platform/packaging/README.md" \
      "${pkgdir}/usr/share/doc/${pkgname}/README.md"
}
