#!/bin/sh
# Builds a static libssh2 for the Makefile when the system one is too old.
# Usage: tools/build-libssh2.sh <version> <sha256> <prefix>
#
# libssh2 is compiled against the OpenSSL that pkg-config reports, which is
# also the one patchbayd links. Another OpenSSL in /usr/local would otherwise
# shadow its headers (the compiler searches /usr/local/include first, and -I
# cannot move system directories ahead), leaving OpenSSL 3 calls in libssh2
# that the system OpenSSL 1.1 libraries do not have.
set -eu

ver=$1
sha=$2
prefix=$3
work=deps/src

rm -rf "$work"
mkdir -p "$work"
curl -fsSL --max-filesize 20000000 -o "$work/libssh2.tar.gz" "https://libssh2.org/download/libssh2-$ver.tar.gz"
echo "$sha  $work/libssh2.tar.gz" | sha256sum -c -
tar -xzf "$work/libssh2.tar.gz" -C "$work"

# <openssl/...> must resolve to the reported OpenSSL only: stage symlinks to
# its header directories (Debian keeps opensslconf.h in a multiarch one).
inc=$(pkg-config --variable=includedir libssl)
arch=$(${CC:-cc} -print-multiarch 2>/dev/null || true)
flags=""
for d in "$inc" ${arch:+"$inc/$arch"}; do
    [ -d "$d/openssl" ] || continue
    stage="$PWD/$work/inc$(echo "$d" | tr / _)"
    mkdir -p "$stage"
    ln -s "$d/openssl" "$stage/openssl"
    flags="$flags -I$stage"
done

cd "$work/libssh2-$ver"
./configure --quiet --prefix="$prefix" --disable-shared --enable-static --with-pic \
    --with-crypto=openssl --without-libz --disable-examples-build --disable-docker-tests --disable-sshd-tests \
    CPPFLAGS="$flags $(pkg-config --cflags libssl)" LDFLAGS="$(pkg-config --libs-only-L libssl)"
make
make install
cd - >/dev/null
rm -rf "$work"