#!/usr/bin/make -f
# Offline, pinned Go build (spec sec. 5). The vendor tree comes from the
# orig-vendor component tarball; the toolchain from golang-1.26-go (freia
# slice); no network, no toolchain download, no cgo.
export GOTOOLCHAIN = local
export GOFLAGS = -mod=vendor -trimpath
export GOCACHE = $(CURDIR)/debian/.gocache
export GOPROXY = off
# No GOSUMDB setting: with -mod=vendor and GOPROXY=off the build never
# consults a checksum database at all. Every module's checksum was verified
# against go.sum at FETCH time, on superego, by scripts/pkg/fetch-tailscale.sh
# (go mod vendor); the vendor tree then travels inside the orig-vendor
# tarball, whose own sha256 is in the .dsc. Setting GOSUMDB=off here would
# only disarm a check that would otherwise be a useful backstop.
export CGO_ENABLED = 0
export PATH := /usr/lib/go-1.26/bin:$(PATH)
# Version stamps as upstream's mkversion would print them for the tag:
# short 1.102.3, long 1.102.3-t<9 hex>, gitCommitStamp = the pinned commit
# (debian/upstream-commit is written by scripts/pkg/fetch-tailscale.sh).
STAMP_SHORT := $(shell dpkg-parsechangelog -SVersion | sed 's/-.*//')
STAMP_HASH  := $(shell cat debian/upstream-commit)
LDFLAGS := -X tailscale.com/version.longStamp=$(STAMP_SHORT)-t$(shell cut -c1-9 debian/upstream-commit) \
           -X tailscale.com/version.shortStamp=$(STAMP_SHORT) \
           -X tailscale.com/version.gitCommitStamp=$(STAMP_HASH)
TAGS := ts_omit_webclient

%:
	dh $@

# The upstream tree has a top-level Makefile, so debhelper autodetects the
# "makefile" buildsystem. Its build and clean steps are already overridden
# below; configure and install are neutralised here so that upstream's
# Makefile (targets that fetch tools, run tests, or install into DESTDIR)
# can never run in the package build. NOTE: there is no --buildsystem=none
# in debhelper; empty overrides are the way to say this.
override_dh_auto_configure:

override_dh_auto_install:

override_dh_auto_build:
	test -n "$(STAMP_HASH)"
	mkdir -p debian/build
	go build -tags $(TAGS) -ldflags "$(LDFLAGS)" -o debian/build/tailscale ./cmd/tailscale
	go build -tags $(TAGS) -ldflags "$(LDFLAGS)" -o debian/build/tailscaled ./cmd/tailscaled

# Not the upstream suite (hours, network): just prove the stamps were linked
# in. Skipped when the builder asks for it, as policy requires.
override_dh_auto_test:
ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
	debian/build/tailscale version | grep -qx '$(STAMP_SHORT)'
	debian/build/tailscaled --version | head -1 | grep -q '^$(STAMP_SHORT)'
endif

override_dh_auto_clean:
	rm -rf debian/build debian/.gocache

override_dh_installinit:
	dh_installinit --name=tailscaled

# /var/lib/tailscale holds tailscaled.state: the node's private key and its
# tailnet identity. dh_fixperms resets directories to 0755, so the 0700 has to
# be re-applied AFTER it. This is the ONLY guarantee of the mode at install
# time: the init script chmods it too, but only on the path where it actually
# starts the daemon, and it returns early when one is already running.
override_dh_fixperms:
	dh_fixperms
	chmod 0700 debian/tailscale/var/lib/tailscale

override_dh_dwz:
