#!/usr/bin/make -f
# https://www.progressiverobot.com
# Copyright (c) 2026 Christopher Holloway / Progressive Robot Ltd
# SPDX-License-Identifier: AGPL-3.0-or-later

# The Debian source package's build (hmailserver/docs/SourcePackages.md): the
# CMake build under hmailserver/source/Server, configured as a distribution
# builds it - without the live update, which the archive stands in for, naming
# the command that updates the server instead, and against the release's own
# shared Boost rather than the static archives the project's own .deb carries.
# Nothing is fetched while it builds.

# No link-time optimisation, which Ubuntu's dpkg-buildflags turn on by default and
# Debian's do not, for the memory, as the RPM spec does: with it a GNU ld of the
# whole static core was sampled at 2.7 GB, and once at 6.0 GB, in the laptop's
# builds of 28 September 2026, besides the LTRANS compilers -flto=auto starts, one
# for each processor the build sees - eight on linix, whose jobs have 8 GB
# (hmailserver/docs/SourcePackages.md).
export DEB_BUILD_MAINT_OPTIONS = hardening=+all optimize=-lto

include /usr/share/dpkg/architecture.mk

BUILDDIR := obj-$(DEB_HOST_GNU_TYPE)

%:
	dh $@ --buildsystem=cmake+ninja --sourcedirectory=hmailserver/source/Server --builddirectory=$(BUILDDIR)

# One link at a time. Six programs link the whole static core, each a large link
# with the debug information the archive builds with, and several at once under -j4,
# with Ubuntu's LTO, ran a 10 GB machine out of memory (28 September 2026). The
# compilers still run in parallel.
override_dh_auto_configure:
	dh_auto_configure -- \
		-DHM_LIVE_UPDATE=OFF \
		"-DHM_UPDATE_COMMAND=apt upgrade hmailserver" \
		-DHM_BOOST_STATIC=OFF \
		-DCMAKE_JOB_POOLS=link=1 \
		-DCMAKE_JOB_POOL_LINK=link

# First the server itself, which has to get as far as printing its version: every
# static constructor runs before main, so a server that cannot start fails the
# build here, as the RPM spec's %check has it fail (a server that died before main
# got past the testers alone in a Fedora build on 29 September 2026; SourcePackages.md).
# Then the tester programs the build makes beside the server: the RFC 7208 suite and
# the SPF testers, the event scripts' JavaScript binding, the SNMP agent's
# decoder and cryptography, the object store's request signatures, the
# singletons, the legacy Blowfish scheme, the backup index's XML, the date class
# with the MIME, IMAP and system-date parsers built on it, the Public Suffix
# List's cut of a host name, the backup's exclusions (a scratch data directory
# under $TMPDIR, removed again), the live update's trust (a configuration file
# of its own under $TMPDIR, read as the server and root's check read theirs) and
# the business objects' copies and first values, the TLS contexts' options, read
# back from the distribution's own OpenSSL, the update feed's release page, who
# may change a stored event by a delivered calendar message (iMIP), a written
# file whose close fails (on /dev/full and a quota under $TMPDIR), the types
# files sent as links and contacts' photos are served under, a stored password
# hash's iteration count, a rewrite of hMailServer.ini (its owner and mode,
# which only root can check; as another user it runs its one case that needs
# no root), the database connection string read back by libpq, COM's languages
# and the live log (scratch files under $TMPDIR as well), the setting profiles'
# lock, the Control Deck's script hash, the webmail signature's reduction, the
# wiping of mailbox encryption's keys however their scope ends, the
# greylisting key schema 6107 gives every row, the auto-ban's never-ban list
# by reverse name and the run a widened ban covers (resolver stand-ins), the
# limit on what IMAP compression inflates, DANE's records held to TLS
# handshakes made in memory against the distribution's own OpenSSL, the
# REST API's OpenAPI document held to its router, UTS 46, which reads a
# link's host as a browser does, held to Unicode's conformance tests, and the
# rules an ACME check is decided by, the certificate the CA issued refused for
# another key, a missing name or its expiry among them, judged against keys and
# certificates made in memory with the distribution's own OpenSSL, the
# statements a search of the quarantine sends, the readers of delivery status
# notifications and abuse feedback reports, an IMAP session's subscription to
# the notification server given back with the servers not running (a scratch
# directory under $TMPDIR), what a task or a session a stop could not end
# reaches after it (a scratch directory too), String::Format's text for every
# character outside ASCII, held to glibc's vswprintf and read back from the
# logs (a scratch directory too), which IMAP moves raise the event script's
# OnIMAPMessageMoved, with a JavaScript handler called as the event calls it (a
# scratch directory too), which IMAP moves teach the spam filter from the
# Junk folder, for SpamAssassin and for Rspamd, and the request a lesson to
# Rspamd is (a scratch directory too), and the narrow forms of text:
# Unicode::ToANSI's bytes, FormatAsAnsi's arguments and spamd's User: header.
# None needs a socket, reads the system's configuration, needs a database or
# needs root, so they run here, with the network refused, in under a minute:
# file-utilities-tests' download, whose server is a loopback one of its own,
# says it did not run where every socket is refused. The list is the spec's
# %check's, and build/check-source-tarball.py holds both to every *-tests
# program CMakeLists.txt makes by add_executable but those it leaves out, each
# with its reason, and the whole of this file, but for its comments and the
# names TESTERS gives, to what it holds line for line.
TESTERS := spf-tests script-binding-tests snmp-tests object-store-signature-tests singleton-tests legacy-blowfish-tests xml-tree-tests datetime-tests public-suffix-tests backup-tests trust-anchor-tests business-object-tests tls-options-tests update-feed-tests imip-tests file-utilities-tests media-type-tests scram-tests ini-file-tests connection-string-tests language-tests live-log-tests profiles-tests inline-script-hash-tests signature-html-sanitizer-tests mailbox-crypto-tests greylist-keys-tests never-ban-tests autoban-widen-tests deflate-tests dane-tests sign-in-budget-tests openapi-tests idna-tests acme-tests quarantine-search-tests report-parser-tests notification-server-tests stopped-servers-tests string-format-tests imap-move-event-tests move-learning-tests unicode-tests

override_dh_auto_test:
ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
ifeq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
	set -e; cd $(BUILDDIR); echo "== hmailserver --version"; ./hmailserver --version; \
	  for tester in $(TESTERS); do echo "== $$tester"; ./$$tester; done
endif
endif

# hmctl goes to hmailserver-cli, which depends on python3; its shebang names the
# interpreter that dependency installs, as Debian asks of a script.
override_dh_auto_install:
	dh_auto_install
	sed -i '1s|^#!/usr/bin/env python3$$|#!/usr/bin/python3|' debian/tmp/usr/bin/hmctl
	# CMake's FILES_MATCHING install of DBScripts leaves the one subdirectory that
	# holds no .sql behind, empty.
	find debian/tmp/usr/share/hmailserver -type d -empty -delete

# dh2048.pem is data the server reads from its own directory, not a program, and
# dh_fixperms makes everything in /usr/bin executable.
override_dh_fixperms:
	dh_fixperms
	chmod 0644 debian/hmailserver/usr/bin/dh2048.pem

# Enabled and not started, on a first install and on an upgrade: nothing in the
# package knows the database the server should use, and one started without it
# writes an error to its log every second. postinst restarts a server that was
# already running, after the schema is upgraded.
override_dh_installsystemd:
	dh_installsystemd --no-start
