abuild.in

#!/bin/ash -e

# abuild - build apk packages (light version of makepkg)
# Copyright (c) 2008-2015 Natanael Copa <ncopa@alpinelinux.org>
# Copyright (c) 2016 Timo Teräs <timo.teras@iki.fi>
#
# Distributed under GPL-2
#

program_version=@VERSION@
sysconfdir=@sysconfdir@
datadir=@datadir@

abuild_path=$(readlink -f $0)

if ! [ -f "$datadir/functions.sh" ]; then
	echo "$datadir/functions.sh: not found" >&2
	exit 1
fi
. "$datadir/functions.sh"

# defaults
: ${FAKEROOT:="fakeroot"}
: ${SUDO_APK:="abuild-apk"}
: ${APK:="apk"}
: ${ADDUSER:="abuild-adduser"}
: ${ADDGROUP:="abuild-addgroup"}

apk_opt_wait="--wait 30"

umask 022

# run optional log command for remote logging
logcmd() {
	${ABUILD_LOG_CMD:-true} "$@"
	return 0
}

# we override the default msg, warning and error as we want the pkgname
msg() {
	[ -n "$quiet" ] && return 0
	local prompt="$GREEN>>>${NORMAL}"
	local fake="${FAKEROOTKEY:+${BLUE}*${NORMAL}}"
	local name="${STRONG}${subpkgname:-$pkgname}${NORMAL}"
	printf "${prompt} ${name}${fake}: %s\n" "$1" >&2
}

warning() {
	local prompt="${YELLOW}>>> WARNING:${NORMAL}"
	local fake="${FAKEROOTKEY:+${BLUE}*${NORMAL}}"
	local name="${STRONG}${subpkgname:-$pkgname}${NORMAL}"
	printf "${prompt} ${name}${fake}: %s\n" "$1" >&2
}

error() {
	local prompt="${RED}>>> ERROR:${NORMAL}"
	local fake="${FAKEROOTKEY:+${BLUE}*${NORMAL}}"
	local name="${STRONG}${subpkgname:-$pkgname}${NORMAL}"
	printf "${prompt} ${name}${fake}: %s\n" "$1" >&2
	logcmd "ERROR: $pkgname: $1"
}

cross_creating() {
	test "$CHOST" != "$CTARGET" -a -n "$CBUILDROOT"
}

cross_compiling() {
	test "$CBUILD" != "$CHOST" -a -n "$CBUILDROOT"
}

want_check() {
	[ -n "$ABUILD_BOOTSTRAP" ] && return 1
	cross_compiling && return 1
	options_has "!check" && return 1
	return 0
}

cleanup() {
	local i=
	[ -z "$subpkgdir" ] && set_xterm_title ""
	if [ -n "$keep_build" ]; then
		return 0
	fi
	for i; do
		case $i in
		bldroot)
			if [ "$BUILD_ROOT" ]; then
				msg "Cleaning up build chroot"
				abuild-rmtemp "$BUILD_ROOT"
			fi;;
		pkgdir) msg "Cleaning up pkgdir"; rm -rf "$pkgbasedir";;
		srcdir) msg "Cleaning up srcdir"; rm -rf "$srcdir";;
		deps)
			if [ -z "$install_after" ] && [ -n "$uninstall_after" ]; then
				msg "Uninstalling dependencies..."
				undeps
			fi
			;;
		esac
	done
}

die() {
	trap - EXIT
	error "$@"
	cleanup $ERROR_CLEANUP
	exit 1
}

spell_error() {
	die "APKBUILD contains '$1'. It should be '$2'"
}

print_version() {
	msg "$program $program_version"
}

# check if apkbuild is basicly sane
default_sanitycheck() {
	local i= j= suggestion=
	msg "Checking sanity of $APKBUILD..."
	[ -z "$pkgname" ] && die "Missing pkgname in APKBUILD"
	[ -z "${pkgname##* *}" ] && die "pkgname contains spaces"
	[ -z "$pkgver" ] && die "Missing pkgver in APKBUILD"
	if [ "$pkgver" != "volatile" ] && [ -z "$nodeps" ]; then
		$APK version --check --quiet "$pkgver" ||\
			die "$pkgver is not a valid version"
	fi
	[ -z "$pkgrel" ] && die "Missing pkgrel in APKBUILD"
	[ -z "$pkgdesc" ] && die "Missing pkgdesc in APKBUILD"
	[ -z "$url" ] && die "Missing url in APKBUILD"
	[ -z "$license" ] && die "Missing license in APKBUILD"
	if [ $(echo "$pkgdesc" | wc -c) -gt 128 ]; then
		die "pkgdesc is too long"
	fi
	is_function package || warning "Missing package() function in APKBUILD"

	if [ -n "$replaces_priority" ] \
		&& ! echo $replaces_priority | egrep -q '^[0-9]+$'; then
		die "replaces_priority must be a number"
	fi

	if [ -n "$provider_priority" ] \
		&& ! echo $provider_priority | egrep -q '^[0-9]+$'; then
		die "provider_priority must be a number"
	fi

	# check so no package names starts with -
	for i in $pkgname $subpackages; do
		case $i in
		-*) die "${i%%:*} is not a valid package name";;
		esac
	done

	for i in $install; do
		local n=${i%.*}
		local suff=${i##*.}
		case "$suff" in
		pre-install|post-install|pre-upgrade|post-upgrade|pre-deinstall|post-deinstall);;
		*) die "$i: unknown install script suffix"
		esac
		if ! subpackages_has "$n" && [ "$n" != "$pkgname" ]; then
			die "$i: install script does not match pkgname or any subpackage"
		fi
		[ -e "$startdir/$i" ] || die "install script $i is missing"
		for j in chown chmod chgrp; do
			if grep -q $j "$startdir"/$i; then
				warning "$i: found $j"
				warning2 "Permissions should be fixed in APKBUILD package()"
			fi
		done
	done

	for i in $triggers; do
		local f=${i%=*}
		local p=${f%.trigger}
		[ "$f" = "$i" ] && die "$f: triggers must contain '='"
		[ "$p" = "$f" ] && die "$f: triggers scripts must have .trigger suffix"
		if ! subpackages_has "$p" && [ "$p" != "$pkgname" ]; then
			die "$p: trigger script does not match pkgname or any subpackage"
		fi

		if source_has "$f"; then
			warning "You should not have \$triggers in source"
			continue
		fi

		[ -e "$startdir"/$f ] || die "trigger script $f is missing"
	done
	if [ -n "$source" ]; then
		for i in $source; do
			if install_has "$i"; then
				warning "You should not have \$install in source"
				continue
			fi
			case "$i" in
				*::*) i=${i%%::*};;
				https://*) makedepends_has wget && warning "wget no longer need to be in makedepends when source has https://" ;;
			esac
			list_has ${i##*/} $md5sums $sha256sums $sha512sums \
				|| die "${i##*/} is missing in checksums"

			# verify that our source does not have git tag version
			# name as tarball (typicallly github)
			if is_remote "$i" && [ "${i#*::}" = "$i" ]; then
				case ${i##*/} in
				v$pkgver.tar.*|$pkgver.tar.*)
					die "source ${i##*/} needs to be renamed to avoid possible collisions"
					;;
				esac
			fi
		done
	fi

	# verify that things listed in checksum also is listed in source
	local algo=
	for algo in md5 sha256 sha512; do
		eval set -- \$${algo}sums
		while [ $# -gt 1 ]; do
			local file="$2"
			shift 2
			source_has $file || die "$file exists in ${algo}sums but is missing in source"
		done
	done

	# common spelling errors
	[ -n "$depend" ] && spell_error depend depends
	[ -n "$makedepend" ] && spell_error makedepend makedepends
	[ -n "$pkguser" ] && spell_error pkguser pkgusers
	[ -n "$pkggroup" ] && spell_error pkggroup pkggroups
	[ -n "$subpackage" ] && spell_error subpackage subpackages
	[ -n "$checkdepend" ] && spell_error checkdepend checkdepends

	check_maintainer || die "Provide a valid RFC822 maintainer address"

	check_depends_dev || warning "depends_dev found but no development subpackage found"
	check_secfixes_comment || return 1

	makedepends_has 'g++' && ! options_has toolchain && warning "g++ should not be in makedepends"

	if ! options_has "!check" && [ -n "$REQUIRE_CHECK" ]; then
		(unset check; . "$APKBUILD"; type check >/dev/null 2>&1) || \
			die "Testsuites (abuild check) are required or needs to be explicitly disabled!"
	fi

	check_provides || die "provides must not contain $pkgname"

	return 0
}

sanitycheck() {
	default_sanitycheck
}

sumcheck() {
	local algo="$1" sums="$2"
	local dummy f endreturnval originalparams origin file

	# get number of checksums
	set -- $sums
	local numsums=$(( $# / 2 ))

	set -- $source
	if [ $# -ne $numsums ]; then
		die "Number of ${algo}sums($numsums) does not correspond to number of sources($#)"
	fi
	fetch || return 1
	msg "Checking ${algo}sums..."
	cd "$srcdir" || return 1
	IFS=$'\n'
	endreturnval=0
	for src in $sums; do
		origin=$1; shift
		if ! echo "$src" | ${algo}sum -c; then
			endreturnval=1
			is_remote $origin || continue

			local csum="${src:0:8}"
			local file="$SRCDEST/$(filename_from_uri $origin)"

			echo "Because the remote file above failed the ${algo}sum check it will be renamed."
			echo "Rebuilding will cause it to re-download which in some cases may fix the problem."
			echo "Renaming: ${file##*/} to ${file##*/}.$csum"
			mv "$file" "$file.$csum"
		fi
	done
	unset IFS
	return $endreturnval
}

# for compatibility
md5check() {
	warning "'md5check' is deprecated. Use 'verify' instead"
	sumcheck md5 "$md5sums"
}

# verify checksums
verify() {
	local verified=false algo=
	for algo in sha512 sha256 sha1 md5; do
		local sums=
		eval sums=\"\$${algo}sums\"
		if [ -z "$sums" ] || [ -z "$source" ]; then
			continue
		fi
		sumcheck "$algo" "$sums" || return 1
		verified=true
		break
	done
	if [ -n "$source" ] && ! $verified; then
		die "Use 'abuild checksum' to generate/update the checksum(s)"
	fi
	return 0
}

# verify upstream sources
sourcecheck() {
	local uri
	for uri in $source; do
		is_remote $uri || continue
		case "$uri" in
		*::*)
			uri=${uri##*::}
			;;
		esac
		wget --spider -q "$uri" || return 1
	done
	return 0
}

uri_fetch() {
	local uri="$1"
	mkdir -p "$SRCDEST"
	msg "Fetching $uri"
	abuild-fetch -d "$SRCDEST" "$uri"
}

is_remote() {
	case "${1#*::}" in
		http://*|ftp://*|https://*)
			return 0;;
	esac
	return 1
}

filename_from_uri() {
	local uri="$1"
	local filename="${uri##*/}"  # $(basename $uri)
	case "$uri" in
	*::*) filename=${uri%%::*};;
	esac
	echo "$filename"
}

# try download from file from mirror first
uri_fetch_mirror() {
	local uri="$1"
	if [ -n "$DISTFILES_MIRROR" ]; then
		if is_remote "$DISTFILES_MIRROR"; then
			uri_fetch "$DISTFILES_MIRROR"/$(filename_from_uri $uri)\
				&& return 0
		else
			cp "$DISTFILES_MIRROR"/$(filename_from_uri $uri) \
				"$SRCDEST" && return 0
		fi
	fi
	uri_fetch "$uri"
}

symlinksrc() {
	local s
	mkdir -p "$srcdir"
	for s in $source; do
		if is_remote "$s"; then
			ln -sf "$SRCDEST/$(filename_from_uri $s)" "$srcdir"/
		else
			ln -sf "$startdir/$s" "$srcdir/"
		fi
	done
}

default_fetch() {
	local s
	mkdir -p "$srcdir"
	for s in $source; do
		if is_remote "$s"; then
			uri_fetch_mirror "$s" || return 1
			ln -sf "$SRCDEST/$(filename_from_uri $s)" "$srcdir"/
		else
			ln -sf "$startdir/$s" "$srcdir/"
		fi
	done
}

fetch() {
	default_fetch
}

# verify that all init.d scripts are openrc runscripts
initdcheck() {
	local i line
	for i in $source; do
		case $i in
		*.initd) line=$(head -n 1 "$srcdir"/$i);;
		*) continue ;;
		esac

		case "$line" in
		*sbin/openrc-run)
			;;
		*sbin/runscript)
			warning "$i is not an openrc #!/sbin/openrc-run"
			;;
		*)	error "$i is not an openrc #!/sbin/openrc-run"
			return 1
			;;
		esac
	done
}

# unpack the sources
default_unpack() {
	local u
	if [ -z "$force" ]; then
		verify || return 1
		initdcheck || return 1
	fi
	mkdir -p "$srcdir"
	for u in $source; do
		local s
		if is_remote "$u"; then
			s="$SRCDEST/$(filename_from_uri $u)"
		else
			s="$startdir/$u"
		fi
		case "$s" in
			*.tar)
				msg "Unpacking $s..."
				tar -C "$srcdir" -xf "$s" || return 1;;
			*.tar.gz|*.tgz)
				msg "Unpacking $s..."
				tar -C "$srcdir" -zxf "$s" || return 1;;
			*.tar.bz2)
				msg "Unpacking $s..."
				tar -C "$srcdir" -jxf "$s" || return 1;;
			*.tar.lz)
				msg "Unpacking $s..."
				tar -C "$srcdir" --lzip -xf "$s" || return 1;;
			*.tar.lzma)
				msg "Unpacking $s..."
				unlzma -c "$s" | tar -C "$srcdir" -x  \
					|| return 1;;
			*.tar.xz)
				msg "Unpacking $s..."
				unxz -c "$s" | tar -C "$srcdir" -x || return 1;;
			*.zip)
				msg "Unpacking $s..."
				unzip -n -q "$s" -d "$srcdir" || return 1;;
		esac
	done
}

unpack() {
	default_unpack
}

# cleanup source and package dir
clean() {
	msg "Cleaning temporary build dirs..."
	rm -rf "$srcdir"
	rm -rf "$pkgbasedir"
}

# cleanup fetched sources
cleancache() {
	local s
	for s in $source; do
		if is_remote "$s"; then
			s=$(filename_from_uri $s)
			msg "Cleaning downloaded $s ..."
			rm -f "$SRCDEST/$s"
		fi
	done
}

subpkg_unset() {
	unset subpkgname subpkgsplit subpkgarch
}

subpkg_set() {
	subpkgname=${1%%:*}

	local _splitarch=${1#*:}
	[ "$_splitarch" = "$1" ] && _splitarch=""

	subpkgsplit=${_splitarch%%:*}
	[ -z "$subpkgsplit" ] && subpkgsplit="${subpkgname##*-}"

	subpkgarch=${_splitarch#*:}
	if [ "$subpkgarch" = "$_splitarch" -o -z "$subpkgarch" ]; then
		case "$subpkgname" in
		*-doc | *-lang | *-lang-*) subpkgarch="noarch" ;;
		*) subpkgarch="$pkgarch" ;;
		esac
	fi
}

cleanpkg() {
	local i
	getpkgver || return 1
	msg "Cleaning built packages..."
	rm -f "$REPODEST/$repo/src/$pkgname-$pkgver-r$pkgrel.src.tar.gz"
	for i in $allpackages; do
		subpkg_set "$i"
		rm -f "$REPODEST/$repo/${subpkgarch/noarch/$CARCH}/$subpkgname-$pkgver-r$pkgrel.apk"
	done
	subpkg_unset

	# remove given packages from index
	update_abuildrepo_index
}

# clean all packages except current
cleanoldpkg() {
	local i j
	getpkgver || return 1
	msg "Cleaning all packages except $pkgver-r$pkgrel..."
	for i in $allpackages; do
		subpkg_set "$i"
		for j in "$REPODEST"/$repo/*/$subpkgname-[0-9]*.apk ; do
			[ "${j##*/}" = "$subpkgname-$pkgver-r$pkgrel.apk" ] \
				&& continue
			rm -f "$j"
		done
	done
	subpkg_unset
	update_abuildrepo_index
	return 0
}

mkusers() {
	local i
	for i in $pkggroups; do
		if ! getent group $i >/dev/null; then
			msg "Creating group $i"
			$ADDGROUP -S $i || return 1
		fi
	done
	for i in $pkgusers; do
		if ! getent passwd $i >/dev/null; then
			local gopt=
			msg "Creating user $i"
			if getent group $i >/dev/null; then
				gopt="-G $i"
			fi
			$ADDUSER -S -D -H $gopt $i || return 1
		fi
	done
}

# helper to update config.sub to a recent version
update_config_sub() {
	find . -name config.sub | (local changed=false; while read f; do
		if ! ./$f armv6-alpine-linux-muslgnueabihf 2>/dev/null; then
			msg "Updating $f"
			cp "$datadir"/${f##*/} "$f" || return 1
			changed=true
		else
			msg "No update needed for $f"
		fi
	done; $changed)
}

# helper to update config.guess to a recent version
update_config_guess() {
	find . -name config.guess | (local changed=false; while read f; do
		if grep -q aarch64 "$f" && grep -q ppc64le "$f"; then
			msg "No update needed for $f"
		else
			msg "Updating $f"
			cp "$datadir"/${f##*/} "$f" || return 1
			changed=true
		fi
	done; $changed)
}

runpart() {
	local part=$1
	[ -n "$DEBUG" ] && msg "$part"
	trap "die '$part failed'" EXIT
	$part
	trap - EXIT
}

# override those in your build script
getpkgver() {
	# this func is supposed to be overridden by volatile packages
	if [ "$pkgver" = "volatile" ]; then
		error "Please provide a getpkgver() function in your APKBUILD"
		return 1
	fi
}

have_patches() {
	local i
	for i in $source; do
		case ${i%::*} in
			*.patch) return 0;;
		esac
	done
	return 1
}

default_prepare() {
	local i
	[ -n "$builddir" -a -d "$builddir" ] && cd "$builddir"
	if ! have_patches; then
		return 0
	fi
	[ -d "$builddir" ] || { error "Is \$builddir set correctly?"; return 1; }
	for i in $source; do
		case ${i%::*} in
			*.patch)
				msg "${i%::*}"
				patch ${patch_args:--p1} -i "$srcdir/${i%::*}" || return 1
				;;
		esac
	done
}

prepare() {
	default_prepare
}

build() {
	:
}

# generate a simple tar.gz package of pkgdir
targz() {
	cd "$pkgdir" || return 1
	mkdir -p "$REPODEST"/src
	tar -czf "$REPODEST"/src/$pkgname-$pkgver-r$pkgrel.tar.gz *
}

postcheck() {
	local dir="$1" name="$2" i=
	msg "Running postcheck for $name"
	# checking for FHS compat
	if ! options_has "!fhs"; then
		for i in "$dir"/srv/* "$dir"/usr/local/* "$dir"/opt/*; do
			if [ -e "$i" ]; then
				error "Packages must not put anything under /srv, /usr/local or /opt"
				return 1
			fi
		done
		if [ -d "$dir"/usr/var ]; then
			error "Found /usr/var, localstatedir is most likely wrong"
			return 1
		fi
	fi

	# remove *.la files if libtool is not set
	if ! options_has "libtool"; then
		find "$dir" -name '*.la' -type f -delete
	fi

	# look for /usr/lib/charset.alias
	if [ -e "$dir"/usr/lib/charset.alias ] \
			&& ! options_has "charset.alias"; then
		error "Found /usr/lib/charset.alias"
		return 1
	fi
	# look for /usr/share/doc
	if [ -e "$dir"/usr/share/doc ] \
			&& ! is_doc_pkg "$name"; then
		warning "Found /usr/share/doc but package name doesn't end with -doc"
	fi
	# look for /usr/share/man
	if [ -e "$dir"/usr/share/man ]; then
		if ! is_doc_pkg "$name"; then
			warning "Found /usr/share/man but package name doesn't end with -doc"
		fi
		# check for uncompressed man pages
		i=$(find "$dir"/usr/share/man -name '*.[0-8]' -type f | sed "s|^$dir|\t|")
		if [ -n "$i" ]; then
			error "Found uncompressed man pages:"
			echo "$i"
			return 1
		fi
	fi
	# check directory permissions
	i=$(find "$dir" -type d -perm -777 | sed "s|^$dir|\t|")
	if [ -n "$i" ]; then
		warning "World writeable directories found:"
		echo "$i"
	fi
	# check so we dont have any suid root binaries that are not PIE
	i=$(find "$dir" -type f -perm /6000 \
		| xargs scanelf --nobanner --etype ET_EXEC \
		| sed "s|ET_EXEC $dir|\t|")
	if [ -n "$i" ]; then
		error "Found non-PIE files that has SUID:"
		echo "$i"
		return 1
	fi
	# test suid bit on executable
	if ! options_has "suid"; then
		i=$(find "$dir" \( -perm -u+s -o -perm -g+s \) -a -type f \
			-a -perm -o+x)
		if [ -n "$i" ]; then
			error "Found executable files with SUID bit set:"
			echo "$i"
			return 1
		fi
	fi

	# test for textrels
	if ! options_has "textrels"; then
		local res="$(scanelf --recursive --textrel --quiet "$dir")"
		if [ -n "$res" ]; then
			error "Found textrels:"
			echo "$res"
			return 1
		fi
	fi
	return 0
}

pre_split() {
	if [ -z "$subpkgname" ]; then
		return 0
	fi
	# the subpackages should not inherit those form main package
	provides=""
	install_if=""
}

prepare_subpackages() {
	local i
	cd "$startdir"
	for i in $subpackages; do
		# call abuild recursively, setting subpkg{dir,name}
		( subpkg_set "$i"; msg "Running split function $subpkgsplit..."; \
		  subpkgdir="$pkgbasedir/$subpkgname" subpkgname="$subpkgname" subpkgarch="$subpkgarch" \
		  $0 pre_split $subpkgsplit prepare_package \
			&& postcheck "$pkgbasedir/$subpkgname" "$subpkgname" ) || return 1
	done
	postcheck "$pkgdir" "$pkgname" || return 1
	# post check for /usr/share/locale
	if [ -d "$pkgdir"/usr/share/locale ]; then
		warning "Found /usr/share/locale"
		warning2 "Maybe add \$pkgname-lang to subpackages?"
	fi
}

default_lang() {
	pkgdesc="Languages for package $pkgname"
	install_if="$pkgname=$pkgver-r$pkgrel lang"

	local dir
	for dir in ${langdir:-/usr/share/locale}; do
		mkdir -p "$subpkgdir"/${dir%/*}
		mv "$pkgdir"/"$dir" "$subpkgdir"/"$dir" || return 1
	done
}

lang() {
	default_lang
}

default_lang_subpkg() {
	if [ -z "$lang" ]; then
		error "lang is not set"
		return 1
	fi
	pkgdesc="$pkgname language pack for $lang"
	install_if="$pkgname=$pkgver-r$pkgrel lang-$lang"

	local dir
	for dir in ${langdir:-/usr/share/locale}; do
		mkdir -p "$subpkgdir"/$dir
		mv "$pkgdir"/$dir/$lang* \
		"$subpkgdir"/$dir/ \
		|| return 1
	done
}

lang_subpkg() {
	default_lang_subpkg
}

prepare_language_packs() {
	local lang
	for lang in $linguas; do
		lang="$lang" \
		subpkgname="$pkgname-lang-$lang" \
		subpkgdir="$pkgbasedir"/$subpkgname \
			$0 lang_subpkg prepare_package || return 1
	done
}

# echo '-dirty' if git is not clean
git_dirty() {
	if [ $(git status -s "$startdir" | wc -l) -ne 0 ]; then
		echo "-dirty"
	fi
}

# echo last commit hash id
git_last_commit() {
	git log --format=oneline -n 1 "$startdir" | awk '{print $1}'
}

get_maintainer() {
	if [ -z "$maintainer" ]; then
		maintainer=$(awk -F': ' '/\# *Maintainer/ {print $2}' "$APKBUILD")
		# remove surrounding whitespace
		maintainer=$(echo "$maintainer" | xargs)
	fi
}

check_maintainer() {
	get_maintainer
	if [ -z "$maintainer" ]; then
		warning "No maintainer"
	else
		# try to check for a valid rfc822 address
		case "$maintainer" in
			*[A-Za-z0-9]*\ \<*@*.*\>) ;;
			*) return 1 ;;
		esac
	fi
}

check_secfixes_comment() {
	local c=$(sed -E -n -e '/^# secfixes:/,/(^[^#]|^$)/p' $APKBUILD | grep '^#')
	local invalid=$(echo "$c" \
		| grep -v -E '(^# secfixes:|^#  +- [A-Z0-9-]+|^#   [0-9]+.*:$|^#$)')
	if [ -z "$invalid" ]; then
		return 0
	fi

	# check if there are tabs
	if echo "$invalid" | grep -q $'\t'; then
		error "secfixes comment must not have tabs:"
		echo "$c" | grep $'\t' >&2
		return 1
	fi

	error "secfixes comment is not valid:"
	echo "$invalid" >&2
	return 1
}

check_depends_dev() {
	if [ -z "$depends_dev" ]; then
		return 0
	fi
	local i
	for i in $pkgname $subpackages; do
		case "${i%%:*}" in
		*-dev) return 0 ;;
		esac
	done
	return 1
}

check_provides() {
	local i
	for i in $provides; do
		if [ "${i%%[<>=]*}" = "$pkgname" ]; then
			return 1
		fi
	done
	return 0
}

prepare_metafiles() {
	getpkgver || return 1
	local name=${subpkgname:-$pkgname}
	[ -z "${name##* *}" ] && die "package name contains spaces"
	local dir=${subpkgdir:-$pkgdir}
	local pkg="$name-$pkgver-r$pkgrel.apk"
	local pkginfo="$controldir"/.PKGINFO
	local sub

	[ ! -d "$dir" ] && die "Missing $dir"
	cd "$dir"
	mkdir -p "$controldir"
	local builddate=$(date -u "+%s")

	# Fix package size on several filesystems
	case "$(df -PT . | awk 'END {print $2}')" in
	btrfs|ecryptfs|zfs)
		sync;;
	esac

	local size=$(du -sk | awk '{print $1 * 1024}')

	if [ "$arch" != "$apkbuild_arch" ]; then
		local msg="Split function set arch=\"$arch\" for $name, use subpackages=pkg:split:arch format instead"
		[ "$arch" != "noarch" ] && die "$msg"
		warning "$msg"
		subpkgarch="$arch"
	fi

	echo "# Generated by $(basename $0) $program_version" >"$pkginfo"
	if [ -n "$FAKEROOTKEY" ]; then
		echo "# using $($FAKEROOT -v)" >> "$pkginfo"
	fi
	echo "# $(date -u)" >> "$pkginfo"
	cat >> "$pkginfo" <<-EOF
		pkgname = $name
		pkgver = $pkgver-r$pkgrel
		pkgdesc = $pkgdesc
		url = $url
		builddate = $builddate
		packager = ${PACKAGER:-"Unknown"}
		size = $size
		arch = ${subpkgarch:-$pkgarch}
		origin = $pkgname
	EOF
	local i deps
	deps="$depends"
	if [ "$pkgname" != "busybox" ] && ! depends_has busybox && ! depends_has /bin/sh; then
		for i in $install $triggers; do
			local s=${i%=*}
			[ "$name" != "${s%.*}" ] && continue
			if head -n 1 "$startdir/$s" | grep '^#!/bin/sh' >/dev/null ; then
				msg "Script found. /bin/sh added as a dependency for $pkg"
				deps="$deps /bin/sh"
				break
			fi
		done
	fi

	# store last_commit in global var so we only call git once
	if [ -z "$last_commit" ]; then
		last_commit="$(git_last_commit)$(git_dirty)"
	fi
	echo "commit = $last_commit" >> "$pkginfo"

	get_maintainer
	if [ -n "$maintainer" ]; then
		echo "maintainer = $maintainer" >> "$pkginfo"
	fi

	if [ -n "$replaces_priority" ]; then
		echo "replaces_priority = $replaces_priority" >> "$pkginfo"
	fi

	if [ -n "$provider_priority" ]; then
		echo "provider_priority = $provider_priority" >> "$pkginfo"
	fi

	echo "license = $license" >> "$pkginfo"
	for i in $replaces; do
		echo "replaces = $i" >> "$pkginfo"
	done
	for i in $deps; do
		echo "depend = $i" >> "$pkginfo"
	done
	for i in $provides; do
		echo "provides = $i" >> "$pkginfo"
	done
	for i in $triggers; do
		local f=${i%=*}
		local dirs=${i#*=}
		[ "${f%.trigger}" != "$name" ] && continue
		echo "triggers = ${dirs//:/ }" >> "$pkginfo"
	done
	if [ -n "$install_if" ]; then
		echo "install_if = $(echo $install_if)" >> "$pkginfo"
	fi

	local metafiles=".PKGINFO"
	for i in $install $triggers; do
		local f=${i%=*}
		local n=${f%.*}
		if [ "$n" != "$name" ]; then
			continue
		fi
		script=${f#$name}
		msg "Adding $script"
		cp "$startdir/$f" "$controldir/$script" || return 1
		chmod +x "$controldir/$script"
		metafiles="$metafiles $script"
	done
	echo $metafiles | tr ' ' '\n' > "$controldir"/.metafiles
}

prepare_trace_rpaths() {
	local dir=${subpkgdir:-$pkgdir}
	local etype= soname= file= sover=
	[ "${subpkgarch:-$pkgarch}" = "noarch" ] && return 0
	options_has "!tracedeps" && return 0
	# lets tell all the places we should look for .so files - all rpaths
	scanelf --quiet --recursive --rpath "$dir" \
		| sed -e 's/[[:space:]].*//' -e 's/:/\n/' | sort -u \
		>"$controldir"/.rpaths
	if grep -q -x '/usr/lib' "$controldir"/.rpaths; then
		warning "Redundant /usr/lib in rpath found"
	fi
	if grep '^/home/' "$controldir"/.rpaths; then
		error "Has /home/... in rpath"
		return 1
	fi
}

# search for broken symlinks so we later can pull in proper depends
prepare_symlinks() {
	local target
	local dir="${subpkgdir:-$pkgdir}"
	options_has "!tracedeps" && return 0
	cd "$dir" || return 1
	find -type l | while read symlink; do
		target=$(readlink "$symlink")
		if ! [ -e "$dir$(normalize_target_path "$target" "$symlink")" ]; then
			echo "$symlink $target" >> "$controldir"/.symlinks
		fi
	done
}

prepare_pkgconfig_provides() {
	local dir="${subpkgdir:-$pkgdir}"
	options_has "!tracedeps" && return 0
	cd "$dir" || return 1
	for i in usr/lib/pkgconfig/*.pc; do
		if ! [ -e "$i" ]; then
			continue
		fi
		local f=${i##*/}
		local v=$(PKG_CONFIG_PATH="$dir"/usr/lib/pkgconfig PKG_CONFIG_MAXIMUM_TRAVERSE_DEPTH=1 pkg-config \
			--modversion ${f%.pc})
		echo "${f%.pc}=${v:-0}" >> "$controldir"/.provides-pc
	done
}

prepare_command_provides() {
	local dir="${subpkgdir:-$pkgdir}"
	options_has "!tracedeps" && return 0
	cd "$dir" || return 1
	for i in bin/* sbin/* usr/bin/* usr/sbin/*; do
		if ! [ -x "$i" ]; then
			continue
		fi
		local f=${i##*/}
		echo $f >> "$controldir"/.provides-command
	done
}

# check if dir has arch specific binaries
dir_has_arch_binaries() {
	local dir="$1"
	# if scanelf returns something, then we have binaries
	[ -n "$(scanelf -R "$dir" | head -n 1)" ] && return 0

	# look for static *.a
	[ -n "$(find "$dir" -type f -name '*.a' | head -n 1)" ] && return 0

	return 1
}

# returns true if this is the -dev package
is_dev_pkg() {
	test "${subpkgname%-dev}" != "$subpkgname"
}

# returns true if this is the -doc package
is_doc_pkg() {
	test "${1%-doc}" != "$1"
}

# check that noarch is set if needed
archcheck() {
	options_has "!archcheck" && return 0
	if dir_has_arch_binaries "${subpkgdir:-$pkgdir}"; then
		[ "${subpkgarch:-$pkgarch}" != "noarch" ] && return 0
		error "Arch specific binaries found so arch must not be set to \"noarch\""
		return 1
	elif [ "${subpkgarch:-$pkgarch}" != "noarch" ] && ! is_dev_pkg; then
		# we dont want -dev package go to noarch
		warning "No arch specific binaries found so arch should probably be set to \"noarch\""
	fi
	return 0
}

prepare_package() {
	msg "Preparing ${subpkgname:+sub}package ${subpkgname:-$pkgname}..."
	stripbin
	prepare_metafiles \
		&& prepare_trace_rpaths \
		&& prepare_symlinks \
		&& prepare_pkgconfig_provides \
		&& prepare_command_provides \
		|| return 1
	archcheck
}

pkginfo_val() {
	local key="$1"
	local file="$2"
	awk -F ' = ' "\$1 == \"$key\" {print \$2}" "$file"
}

# find real path to so files
real_so_path() {
	local so="$1"
	shift
	while [ $# -gt 0 ]; do
		[ -e "$1"/$so ] && realpath "$1/$so" && return 0
		shift
	done
	error "$so: path not found"
	return 1
}

# search rpaths and /usr/lib /lib for given so files
find_so_files() {
	local rpaths=$(cat "$1")
	shift
	while [ $# -gt 0 ]; do
		real_so_path "$1" /usr/lib /lib $rpaths || return 1
		shift
	done
	return 0
}

subpkg_provides_prefixed_so() {
	[ -n "$sonameprefix" ] && grep -q -w "^$sonameprefix$1" \
		"$pkgbasedir"/.control.*/.provides-so 2>/dev/null
}

subpkg_provides_so() {
	grep -q -w "^$1" "$pkgbasedir"/.control.*/.provides-so 2>/dev/null
}

subpkg_provides_pc() {
	grep -q -w "^${1%%[<>=]*}" "$pkgbasedir"/.control.*/.provides-pc \
		2>/dev/null
}

trace_apk_deps() {
	local name="$1"
	local dir="$2"
	local parch="$3"
	local i= found= autodeps= deppkgs= missing=