# OpenBSD port for OgmaProtect.
#
# This is the canonical, idiomatic packaging definition. Two ways to build:
#
# NOTE: OgmaProtect ships under the PolyForm Small Business License (see the
# repo-root `license` file), which limits USE to qualifying small businesses.
# (It does grant a distribution right — what it withholds is sublicensing — so
# the bar here is the use limitation, not a redistribution ban.) It is NOT a
# free license and is NOT a candidate for the official OpenBSD ports tree — this
# port definition is for the vendor's OWN package builds (a private `mystuff`
# port or make-package.sh), not for upstreaming. PERMIT_PACKAGE is No below.
#
#   1. Through a ports tree (a private mystuff port, for the vendor's builds):
#        cp -R ../ogmaprotect /usr/ports/mystuff/ogmaprotect
#        cd /usr/ports/mystuff/ogmaprotect
#        make makesum          # after the release tarball exists on MASTER_SITES
#        make plist            # regenerate pkg/PLIST authoritatively (see README)
#        make package          # -> ogmaprotect-${V}.tgz under packages/
#        portcheck             # policy lint (devel/portcheck)
#
#   2. Tree-less, from a checkout (what CI uses to publish artifacts):
#        sh ../make-package.sh
#
# See ../README.md for the full maintainer workflow and the known caveats
# (WANTLIB refinement, /var + /etc placement) that must be settled on an
# OpenBSD build host.

COMMENT =		secure web UI to manage an OpenBSD router

V =			0.5.5
DISTNAME =		ogmaprotect-${V}
CATEGORIES =		sysutils net

HOMEPAGE =		https://github.com/Wireless-Connect/ogmaprotect
MAINTAINER =		OgmaProtect maintainers <michael@onecontact.ie>

# PolyForm Small Business License 1.0.0 (source-available, non-free — see
# ../../../license). The OpenBSD build cluster / mirrors may NOT redistribute the
# binary package. The reason is the license's USE limitation, not a redistribution
# ban: PolyForm grants a distribution right but withholds sublicensing, so a copy
# taken off a public mirror carries no right to run it, and only qualifying small
# businesses (or commercial licensees) may use it at all. The vendor's own
# `make package` / make-package.sh are unaffected.
PERMIT_PACKAGE =	No

# Starting guess — REFINE on the build host with `make port-lib-depends-check`.
# The daemons link libsqlite3 + libpthread (authd db child) and libtls/libssl/
# libcrypto (webhook mTLS). SHA2 comes from libc on OpenBSD (the -lmd in the
# Makefile is Linux-CI-only), so `md` is intentionally absent here.
WANTLIB =		c crypto pthread sqlite3 ssl tls

# The release tarball is produced by `make dist` in the product repo and
# attached to the matching GitHub release (see docs/RELEASE.md).
MASTER_SITES =		${HOMEPAGE}/releases/download/v${V}/

# CGI.pm ships as the OpenBSD package www/p5-CGI (it was removed from perl core
# upstream in 5.22). This is the canonical source; scripts/deploy.py installs the
# same p5-CGI package (falling back to CPAN only if pkg_add is unavailable), so
# both install paths agree on provenance. Third-party notice: docs/LICENSING.md.
RUN_DEPENDS =		databases/sqlite3 \
			www/p5-CGI
BUILD_DEPENDS =		${RUN_DEPENDS}

# Hand-written BSD makefile: no configure step, build with the base compiler.
MAKE_FLAGS =		CC="${CC}" CFLAGS="${CFLAGS}"

# `make test` needs live/privileged setup (unix sockets, pf, root). It runs in
# CI's OpenBSD VM and on the lab router, not from the port build.
NO_TEST =		Yes

# The product Makefile honours DESTDIR, so the port fakes into ${WRKINST};
# BINDIR defaults to /usr/local/sbin (= ${TRUEPREFIX}/sbin), so no override is
# needed. NOTE: the `install:` target also writes OUTSIDE ${TRUEPREFIX}
# (/etc/ogmaprotect, /etc/rc.d, /var/www, /var/db). That is fine for a private
# mystuff port and for make-package.sh, but a tree that enforces the fake-prefix
# policy needs a do-install override relocating those assets under
# ${PREFIX}/share with @sample/rc-script population (see ../README.md, item 3).
FAKE_FLAGS =		DESTDIR=${WRKINST}

.include <bsd.port.mk>
