Improve build workflow

tools/build-libssh2.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+# Builds a static libssh2 for the Makefile when the system one is too old.
+# Usage: tools/build-libssh2.sh <version> <sha256> <prefix>
+#
+# libssh2 is compiled against the OpenSSL that pkg-config reports, which is
+# also the one patchbayd links. Another OpenSSL in /usr/local would otherwise
+# shadow its headers (the compiler searches /usr/local/include first, and -I
+# cannot move system directories ahead), leaving OpenSSL 3 calls in libssh2
+# that the system OpenSSL 1.1 libraries do not have.
+set -eu
+
+ver=$1
+sha=$2
+prefix=$3
+work=deps/src
+
+rm -rf "$work"
+mkdir -p "$work"
+curl -fsSL --max-filesize 20000000 -o "$work/libssh2.tar.gz" "https://libssh2.org/download/libssh2-$ver.tar.gz"
+echo "$sha  $work/libssh2.tar.gz" | sha256sum -c -
+tar -xzf "$work/libssh2.tar.gz" -C "$work"
+
+# <openssl/...> must resolve to the reported OpenSSL only: stage symlinks to
+# its header directories (Debian keeps opensslconf.h in a multiarch one).
+inc=$(pkg-config --variable=includedir libssl)
+arch=$(${CC:-cc} -print-multiarch 2>/dev/null || true)
+flags=""
+for d in "$inc" ${arch:+"$inc/$arch"}; do
+    [ -d "$d/openssl" ] || continue
+    stage="$PWD/$work/inc$(echo "$d" | tr / _)"
+    mkdir -p "$stage"
+    ln -s "$d/openssl" "$stage/openssl"
+    flags="$flags -I$stage"
+done
+
+cd "$work/libssh2-$ver"
+./configure --quiet --prefix="$prefix" --disable-shared --enable-static --with-pic \
+    --with-crypto=openssl --without-libz --disable-examples-build --disable-docker-tests --disable-sshd-tests \
+    CPPFLAGS="$flags $(pkg-config --cflags libssl)" LDFLAGS="$(pkg-config --libs-only-L libssl)"
+make
+make install
+cd - >/dev/null
+rm -rf "$work"