Makefile_v1

#!/usr/bin/make

# Optional USE_LIBCMP requires the use of the intermediate libcmp
# Optional LPATH defines where to find any pre-installed libsecutils and UTA libraries, e.g., /usr/lib
# Optional OPENSSL_DIR defines where to find the OpenSSL installation
#   with header files at include/openssl (default: will try, e.g., /usr).
# Optional OPENSSL_LIB defines where to find the OpenSSL libraries
#   (default: will try, e.g., OPENSSL_DIR/lib).
# Optional CFLAGS and LDFLAGS are appended by local settings.
# Optional DEBUG_FLAGS may set to prepend to local CFLAGS and LDFLAGS. Also CFLAGS is passed to build goals.
# Builds are done in release mode if optional NDEBUG is defined.
# Optional OUT_DIR defines where libsecutils, libgencmp, and (optional) libcmp shall be placed (default: LPATH if set, otherwise '.').
# Optional BIN_DIR defines where the CLI application shall be placed (default: OUT_DIR)
# Optional DESTDIR defines a prefix for the installation target directories.
# Optional OPENSSL specifies the OpenSSL CLI application (including path) to use
# All paths may be absolute or relative to the directory containing this Makefile.
# By default, the Insta Demo CA ist used for demonstration purposes.

ifeq ($(DEB_BUILD_ARCH),)
    SHELL=bash # bash is needed for supporting extended file name globbing
else # within Debian packaging
    SHELL=LD_PRELOAD= bash
    # LD_PRELOAD= is used to prevent Debian packaging give spurios
    #   ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD
    #   cannot be preloaded (cannot open shared object file): ignored.
    # Unfortunately, cannot do this trick generally because otherwise,
    # multi-line shell commands in rules with '\' will throw weird syntax error
endif

# variables ####################################################################

ifeq ($(OS),Windows_NT)
    EXE=.exe
    DLL=.dll
    OBJ=.obj
#   LIB=bin
    PINGCOUNTOPT=-n
else
    EXE=
    OBJ=.o
    LIB=lib
    ifeq ($(shell uname -s),Darwin)
        OS=MacOS
        DLL=.dylib
#       SONAME=install_name,@rpath/
    else # assuming Linux
        DLL=.so
#       SONAME=soname,
    endif
#   LIB=lib
    PINGCOUNTOPT=-c
endif

# $(DESTDIR) set by dh_auto_install
ROOTFS ?= $(DESTDIR)$(prefix)

VERSION=2.0
# must be kept in sync with latest version in debian/changelog
# PACKAGENAME=libgencmp
# DIRNAME=$(PACKAGENAME)-$(VERSION)

ifeq ($(LPATH),)
    ifeq ($(OUT_DIR),)
        override OUT_DIR = .
    endif
#   ifneq ($(wildcard $(ROOTFS)/usr/local/include/openssl),)
#       override OPENSSL_DIR ?= $(ROOTFS)/usr/local
#   endif
    # override OPENSSL_DIR ?= $(ROOTFS)/usr
    SECUTILS_DIR=libsecutils
else
    ifeq ($(OUT_DIR),)
        override OUT_DIR = $(LPATH)
    endif
    # override OPENSSL_DIR ?= $(LPATH)/..
    # SECUTILS and SECUTILS_LIB not needed since pre-installed
endif
ifeq ($(BIN_DIR),)
    BIN_DIR = $(OUT_DIR)
endif

ifeq ($(shell echo $(OUT_DIR) | grep "^/"),)
  ifeq ($(OUT_DIR),)
        OUT_REVERSE_DIR=
  else # $(OUT_DIR) is relative path, assumed relative to ./
    ifeq ($(OUT_DIR),.)
        OUT_REVERSE_DIR=..
    else
        OUT_REVERSE_DIR=../$(OUT_DIR)
    endif
  endif
else # $(OUT_DIR) is absolute path
    OUT_REVERSE_DIR=$(OUT_DIR)
endif

ifeq ($(shell echo $(DESTDIR) | grep "^/"),)
  ifeq ($(DESTDIR),)
        DEST_REVERSE_DIR=
  else
  # $(DESTDIR) is relative path, assumed relative to ./
    ifeq ($(DESTDIR),.)
        DEST_REVERSE_DIR=..
    else
        DEST_REVERSE_DIR=../$(DESTDIR)
    endif
  endif
else
# $(DESTDIR) is absolute path
    DEST_REVERSE_DIR=$(DESTDIR)
endif

#override CFLAGS += -DOPENSSL_FUNC=__func__ # workaround for pedantic C compiler
#ifdef NDEBUG
#    override DEBUG_FLAGS ?= -O2
#    override DEBUG_FLAGS += -DNDEBUG=1
#else
#    override DEBUG_FLAGS ?= -g -O0 -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all # not every compiler(version) supports -Og
#endif
ifdef NDEBUG
  SET_NDEBUG=NDEBUG=1
endif
ifdef DEBUG_FLAGS
  SET_DEBUG_FLAGS=DEBUG_FLAGS="$(DEBUG_FLAGS)"
endif
BUILD_FLAGS = \
    $(SET_NDEBUG) $(SET_DEBUG_FLAGS) CFLAGS="$(CFLAGS) $(OSSL_VERSION_QUIRKS)"

ifneq ($(EJBCA_CONFIG),)
    include $(EJBCA_CONFIG)
else
    include config/EJBCA.env
endif
# optional SET_PROXY variable can be set to override default proxy settings
SET_PROXY ?= no_proxy=localhost,127.0.0.1

# defaults for tests and demo:
OPENSSL ?= openssl$(EXE)

MAKECMDGOALS ?= default
ifneq ($(filter-out doc start stop doc doc_this doc/cmpClient.md doc/cmpClient.1.gz \
    clean clean_config clean_all clean_this clean_test clean_submodules clean_openssl clean_uta clean_deb,$(MAKECMDGOALS)),)

    # export OPENSSL_DIR OPENSSL_LIB # gets ignored on MacOS,
    # workaround is to explicitly pass them down to recursive calls when needed
    GET_DIR=$(MAKE) -f OpenSSL_version.mk --no-print-directory dir OPENSSL_LIB="$(OPENSSL_LIB)"
    ifeq ($(OPENSSL_DIR),)
        OPENSSL_DIR := $(shell $(GET_DIR) 2>/dev/null)
        ifeq ($(OPENSSL_DIR),)
            $(shell $(GET_DIR))
            $(error Error determining OPENSSL_DIR)
        endif
    endif
    ifeq ($(wildcard $(OPENSSL_DIR)/include/openssl),)
        $(shell $(GET_DIR))
        $(error cannot find directory '$(OPENSSL_DIR)/include/openssl', check OPENSSL_DIR variable)
    endif
    HDR_NAME_PATTERN=include/openssl/cmp.h
    ifeq ($(wildcard $(OPENSSL_DIR)/$(HDR_NAME_PATTERN)),)
        $(error Error: cannot find OpenSSL header file $(OPENSSL_DIR)/$(HDR_NAME_PATTERN))
    endif
    # convert to absolute path
    override OPENSSL_DIR := $(realpath $(OPENSSL_DIR))
    OPENSSL_REVERSE_DIR=$(OPENSSL_DIR)

    ifeq ($(OPENSSL_LIB),)
        GET_LIB=$(MAKE) -f OpenSSL_version.mk -s --no-print-directory lib OPENSSL_DIR="$(OPENSSL_DIR)"
        # https://stackoverflow.com/questions/1605623/how-can-i-affect-path-in-a-makefile-variable-why-is-my-example-not-working
        # must use ":=" below to avoid error: Recursive variable `OPENSSL_LIB' references itself (eventually)
        OPENSSL_LIB := $(shell $(GET_LIB) 2>/dev/null)
        ifeq ($(OPENSSL_LIB),)
            $(shell $(GET_LIB))
            $(error Error determining OPENSSL_LIB)
        endif
    endif
    LIB_NAME_PATTERN=libcrypto*$(DLL)*
    ifeq ($(wildcard $(OPENSSL_LIB)/$(LIB_NAME_PATTERN)),)
        $(shell $(GET_LIB))
        $(error Error: cannot find OpenSSL library $(LIB_NAME_PATTERN) at $(OPENSSL_LIB)/)
    endif
    # convert to absolute path
    override OPENSSL_LIB := $(realpath $(OPENSSL_LIB))
    OPENSSL_REVERSE_LIB=$(OPENSSL_LIB)
#   ifeq ($(shell echo $(OPENSSL_DIR) | grep "^/"),)
#   # $(OPENSSL_DIR) is relative path, assumed relative to ./
#       OPENSSL_REVERSE_DIR=../$(OPENSSL_DIR)
#   else
#   # $(OPENSSL_DIR) is absolute path
#       OPENSSL_REVERSE_DIR=$(OPENSSL_DIR)
#   endif
#   ifeq ($(shell echo $(OPENSSL_LIB) | grep "^/"),)
#   # $(OPENSSL_LIB) is relative path, assumed relative to ./
#       OPENSSL_REVERSE_LIB=../$(OPENSSL_LIB)
#   else
#   # $(OPENSSL_LIB) is absolute path
#       OPENSSL_REVERSE_LIB=$(OPENSSL_LIB)
#   endif
BUILD_SUBDIRS = OUT_DIR="$(OUT_REVERSE_DIR)" \
    OPENSSL_DIR="$(OPENSSL_REVERSE_DIR)" OPENSSL_LIB="$(OPENSSL_REVERSE_LIB)"

    OPENSSL_VERSION=$(shell $(MAKE) -s 2>/dev/null --no-print-directory -f OpenSSL_version.mk SOURCE=header OPENSSL_DIR="$(OPENSSL_DIR)" OPENSSL_LIB="$(OPENSSL_LIB)")
    ifeq ($(OPENSSL_VERSION),)
        $(warning WARNING: cannot determine version of OpenSSL in directory '$(OPENSSL_DIR)', assuming 3.0)
        OPENSSL_VERSION=3.0
    endif
    ifeq ($(shell expr "$(OPENSSL_VERSION)" \< 1.1),1) # same as comparing == 1.0
        ifeq ($(shell expr "$(OPENSSL_VERSION)" \< 1.0),1)
            $(error detected incompatible OpenSSL version $(OPENSSL_VERSION))
        endif
        $(warning enabling compilation quirks for old OpenSSL 1.0.x versions)
        OSSL_VERSION_QUIRKS+=-Wno-discarded-qualifiers -Wno-unused-parameter
    endif
    ifeq ($(shell expr "$(OPENSSL_VERSION)" \< 3),1)
        $(info enforce build with intermediate CMP library libcmp)
        USE_LIBCMP=1
    endif
else
    OPENSSL_VERSION=3.0 # dummy
endif

ifeq ($(LPATH),)
    LIBCMP_DIR=cmpossl
    ifdef USE_LIBCMP
        LIBCMP_INC=${LIBCMP_DIR}/include/cmp
	 # consistent with the default value cmpossl/Makefile
    endif
else
    # TODO correct?
    LIBCMP_DIR=cmpossl
    ifdef USE_LIBCMP
        LIBCMP_INC=$(LPATH)/../include/cmp
    endif
endif

GIT_HELP=$(shell git help submodule)
ifeq ($(findstring --progress,$(GIT_HELP)),)
    GIT_PROGRESS=
else
    # GIT_PROGRESS=--progress # disabled as gives lengthy output in CI runs
endif
ifneq ($(findstring --depth,$(GIT_HELP)),)
    GIT_DEPTH=--depth 1
endif

# building #####################################################################

################################################################
# generic CMP Client library and CLI-based client
################################################################

override OUTLIB_= libgencmp
OUTLIB=$(OUTLIB_)$(DLL)
ifeq ($(OS),MacOS)
    OUTLIBV=$(OUTLIB_).$(VERSION)$(DLL)
    DY=DY
else
    OUTLIBV=$(OUTLIB).$(VERSION)
    DY=
endif
OUTBIN=cmpClient$(EXE)
OUT_DIR_BIN=$(BIN_DIR)/$(OUTBIN)

.phony: default build
default: $(OUT_DIR_BIN)

$(OUT_DIR_BIN): | build # if $OUT_DIR_BIN already exists, would be nice not to run 'build'
# but even the 'order-only' prerequisite does not prevent running 'build'

ifdef SECUTILS_USE_ICV
    export SECUTILS_USE_ICV=1
endif
ifdef SECUTILS_USE_UTA
    export SECUTILS_USE_UTA=1
endif
ifdef SECUTILS_NO_TLS
    export SECUTILS_NO_TLS=1
endif

.phony: submodules
ifneq ($(LPATH),)
submodules:
else
.phony: get_submodules build_submodules clean_submodules
submodules: build_submodules

build_submodules: get_submodules build_secutils build_cmpossl
# might use $(SECUTILS_LIB) $(LIBCMP_INC) instead but does not check for updates

get_submodules: $(SECUTILS_DIR)/src/libsecutils/include
ifdef USE_LIBCMP
get_submodules: $(LIBCMP_DIR)/include
endif

update: update_secutils update_cmpossl
	git fetch
	git rebase
	git submodule update

$(SECUTILS_DIR)/src/libsecutils/include:
	$(MAKE) -f Makefile_v1 update_secutils

SECUTILS_LIB=libsecutils$(DLL)
ifeq ($(OUT_REVERSE_DIR),)
  SECUTILS_OUT_LIB=$(SECUTILS_DIR)/$(SECUTILS_LIB)
else
  SECUTILS_OUT_LIB=$(OUT_DIR)/$(SECUTILS_LIB)
endif
$(SECUTILS_OUT_LIB):
	build_secutils

.phony: update_secutils build_secutils
update_secutils:
	git submodule update $(GIT_PROGRESS) --init $(GIT_DEPTH) $(SECUTILS_DIR)
SECUTILS_FLAGS = SECUTILS_NO_TLS=$(SECUTILS_NO_TLS) \
    SECUTILS_USE_ICV=$(SECUTILS_USE_ICV) SECUTILS_USE_UTA=$(SECUTILS_USE_UTA)
build_secutils: # not: update_secutils
	@ # cannot split line using '\' as Debian packaging cannot handle this
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 build_all $(SECUTILS_FLAGS) $(BUILD_SUBDIRS) $(BUILD_FLAGS) -s

ifdef USE_LIBCMP
$(LIBCMP_DIR)/include:
	$(MAKE) -f Makefile_v1 update_cmpossl
endif

ifdef USE_LIBCMP
  LIBCMP_LIB=libcmp$(DLL)
  ifeq ($(OUT_REVERSE_DIR),)
    LIBCMP_OUT_LIB=$(LIBCMP_DIR)/$(LIBCMP_LIB)
  else
    LIBCMP_OUT_LIB=$(OUT_DIR)/$(LIBCMP_LIB)
  endif
$(LIBCMP_OUT_LIB): $(LIBCMP_INC)
	build_cmpossl
endif

.phony: update_cmpossl build_cmpossl
update_cmpossl:
	git submodule update $(GIT_PROGRESS) --init $(GIT_DEPTH) $(LIBCMP_DIR)
build_cmpossl: # not: update_cmpossl
	@ # the old way to build with CMP was: buildCMPforOpenSSL
ifdef USE_LIBCMP
	@ # cannot split line using '\' as Debian packaging cannot handle this
	$(MAKE) -C $(LIBCMP_DIR) -f Makefile_v1 build PWD=$(PWD)/$(LIBCMP_DIR) $(BUILD_SUBDIRS) $(BUILD_FLAGS) -s
endif

clean_submodules:
	rm -rf $(SECUTILS_DIR) $(SECUTILS_OUT_LIB)*
ifdef USE_LIBCMP
	rm -rf $(LIBCMP_DIR) $(LIBCMP_OUT_LIB)*
endif

endif # eq ($(SECUTILS_DIR),)

.phony: build_prereq build_only build_no_tls
build_prereq: submodules

OPENSSL_MAJOR_VERSION=$(shell echo $(OPENSSL_VERSION) | sed 's/\..*//')
build: build_prereq build_only
ifeq ($(DEB_BUILD_ARCH),) # avoid weird syntax error on '\' with Debian packaging
    ifdef USE_LIBCMP
	@if [ ! -e "$(LIBCMP_OUT_LIB)" ]; then echo "cannot find CMP library: $(LIBCMP_OUT_LIB)"; exit 1; fi
	@export LIBCMP_OPENSSL_VERSION=`$(MAKE) -s 2>/dev/null --no-print-directory -f OpenSSL_version.mk SOURCE="$(LIBCMP_OUT_LIB)"` && \
	if [[ "$$LIBCMP_OPENSSL_VERSION" != "$(OPENSSL_VERSION)" && \
	      "$$LIBCMP_OPENSSL_VERSION" != "$(OPENSSL_MAJOR_VERSION)" ]]; then \
	    echo "WARNING: OpenSSL version '$$LIBCMP_OPENSSL_VERSION' used for building libcmp does not match '$(OPENSSL_VERSION)' to be used for building cmpClient"; \
	fi
    endif
	@export SECUTILS_OPENSSL_VERSION=`$(MAKE) -s 2>/dev/null --no-print-directory -f OpenSSL_version.mk SOURCE="$(SECUTILS_OUT_LIB)"` && \
	if [[ "$$SECUTILS_OPENSSL_VERSION" != "$(OPENSSL_VERSION)" && \
	      "$$SECUTILS_OPENSSL_VERSION" != "$(OPENSSL_MAJOR_VERSION)" ]]; then \
	    echo "WARNING: OpenSSL version '$$SECUTILS_OPENSSL_VERSION' used for building libsecutils does not match '$(OPENSSL_VERSION)' to be used for building cmpClient"; \
	fi
endif

GENCMPCLIENT_CONFIG=include/genericCMPClient_config.h
$(GENCMPCLIENT_CONFIG): $(GENCMPCLIENT_CONFIG).in # limitation: this is not triggered when the env. variable changes
	cp $< $@
ifdef USE_LIBCMP
	@ # note that sed -i '' (for not saving a backup file) works on MacOS but not on Linux
	@sed -i~ -e 's|#cmakedefine USE_LIBCMP|#define USE_LIBCMP|' $@
else
	@sed -i~ -e 's|#cmakedefine USE_LIBCMP|/* #undef USE_LIBCMP */|' $@
endif

ifneq ($(findstring build,$(MAKECMDGOALS))$(findstring default,$(MAKECMDGOALS)),)
    $(info Build info: source directory is '$(PWD)')
    $(info detected OpenSSL base directory '$(OPENSSL_DIR)')
    $(info detected OpenSSL lib  directory '$(OPENSSL_LIB)')
    $(info detected OpenSSL version         $(OPENSSL_VERSION))
endif
BUILD_ONLY_DIRS = OUT_DIR="$(OUT_DIR)" BIN_DIR="$(BIN_DIR)" \
    LIB_NAME="$(OUTLIB)" VERSION="$(VERSION)" LIBCMP_INC="$(LIBCMP_INC)" \
    OPENSSL_DIR="$(OPENSSL_DIR)" OPENSSL_LIB="$(OPENSSL_LIB)" \
    INSTALL_DEB_PKGS=$(INSTALL_DEB_PKGS) DEB_TARGET_ARCH=$(DEB_TARGET_ARCH)
build_only: $(GENCMPCLIENT_CONFIG)
	@ # cannot split line using '\' as Debian packaging cannot handle this
	$(MAKE) -f Makefile_src build $(BUILD_ONLY_DIRS) $(BUILD_FLAGS)

build_no_tls:
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 clean_config
	$(MAKE) -f Makefile_v1 build $(BUILD_FLAGS) SECUTILS_NO_TLS=1


# cleaning #####################################################################

.phony: clean_test clean clean_config clean_uta clean_this

clean_uta:
ifneq ($(wildcard $(SECUTILS_DIR)),)
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 clean_uta -s
endif

clean_test:
	$(MAKE) -f Makefile_tests clean

OUT_DOC=cmpClient.1.gz
OUT_DEV_DOC=Generic_CMP_client_API.pdf
clean_this: clean_test
	$(MAKE) -f Makefile_src clean OUT_DIR="$(OUT_DIR)" BIN_DIR="$(BIN_DIR)" LIB_NAME="$(OUTLIB)" VERSION="$(VERSION)" -s
	rm -f libgencmp-*.zip
	rm -f doc/{*.1{,.gz},*.md}

ifeq ($(findstring clean_all,$(MAKECMDGOALS)),)
    CLEAN=clean
else
    CLEAN=clean_all
endif
clean: clean_this clean_config
ifeq ($(LPATH),)
    ifneq ($(wildcard $(SECUTILS_DIR)),)
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 $(CLEAN) OUT_DIR="$(OUT_REVERSE_DIR)" -s
    endif
    # ifdef USE_LIBCMP # better always try cleaning cmpossl artifacts, which may have been produced earlier with USE_LIBCMP=1
        ifneq ($(wildcard $(LIBCMP_DIR)/Makefile_v1),)
	    $(MAKE) -C $(LIBCMP_DIR) -f Makefile_v1 $(CLEAN) OUT_DIR="$(OUT_REVERSE_DIR)" -s
        endif
    # endif
endif

clean_config:
	rm -f $(GENCMPCLIENT_CONFIG){,~}

clean_all: clean clean_deb
	rm -fr Makefile CMakeCache.txt *.cmake CMakeFiles/
	rm -f install_manifest*.txt compile_commands.json
	rm -f doc/$(OUT_DOC) doc/cmpClient.md CMakeDoxyfile.in

# get CRLs #####################################################################

creds/crls:
	@mkdir $@

get_EJBCA_crls: | creds/crls
	@ # ping >/dev/null $(PINGCOUNTOPT) 1 $(EJBCA_HOST) || echo "cannot reach EJBCA at $(EJBCA_HOST)"; exit 1
	@for CA in $(EJBCA_CDPS); \
	do \
		export ca=`echo $$CA | sed  's/\+//g; s/\.//;'`; \
		export postfix="$(EJBCA_CDP_URL_POSTFIX)"; \
		[[ $$CA =~ "v1.1" ]] && export postfix="$(EJBCA_CDP_URL_POSTFIX_v11)"; \
		wget --tries=1 -nv "$(EJBCA_CDP_URL_PREFIX)$$CA$$postfix" -O "creds/crls/EJBCA-$$CA.crl"; \
	done

.phony: get_Insta_crls
get_Insta_crls: | creds/crls
	@ #curl -m 2 -s pki.certificate.fi ...
	$(SET_PROXY) wget -O /dev/null --tries=1 --max-redirect=2 --timeout=4 https://www.insta.fi/ --no-verbose
	@ # | fgrep "301 Moved Permanently" -q || (echo "cannot reach pki.certificate.fi"; exit 1)
	@ #curl -s -o creds/crls/InstaDemoCA.crl ...
	$(SET_PROXY) wget --quiet -O creds/crls/InstaDemoCA.crl "http://pki.certificate.fi:8081/crl-as-der/currentcrl-633.crl?id=633"

# demo #########################################################################

ifeq ($(CA_SECTION),Insta)
    override EXTRA_OPTS += -path pkix/ -newkeytype rsa:1024
    CRL_SECTION=crls
    OCSP_CHECK= #$(OPENSSL) ocsp -url "ldap://www.certificate.fi:389/CN=Insta Demo CA,O=Insta Demo,C=FI?caCertificate" -CAfile creds/trusted/InstaDemoCA.crt -issuer creds/trusted/InstaDemoCA.crt -cert creds/operational.crt
else ifeq ($(CA_SECTION),CloudCA)
    CRL_SECTION= # no crl-based checks
    OCSP_CHECK=
    ifdef CMP_PROFILE
        PROFILE_PATH="/p/$(CMP_PROFILE)"
    endif
    override EXTRA_OPTS += -path "/.well-known/cmp$(PROFILE_PATH)" -reqexts empty
else
    CA_SECTION=EJBCA
    EXTRA_OPTS_IMPRINT= -path $(EJBCA_PATH)/$(EJBCA_PATH_IMPRINT) -subject "$(EJBCA_CMP_SUBJECT_IMPRINT)"
    CRL_SECTION=crls
    OCSP_CHECK=$(OPENSSL) ocsp -url $(EJBCA_OCSP_URL) \
        -CAfile $(EJBCA_CMP_TRUSTED) -issuer $(EJBCA_CMP_ISSUER) \
        -cert creds/operational.crt
    EJBCA_TLS_HOST_FILE=creds/docker/TLS_ROOTCA-docker-cn.txt
    ifeq ($(EJBCA_TLS_HOST),) # workaround for ephemeral TLS server certificate of ejbca-docker:
        override EXTRA_OPTS += -tls_host `cat $(EJBCA_TLS_HOST_FILE)`
        BOOTSTRAP_CREDS = -cert creds/manufacturer.crt -key creds/manufacturer.pem
    endif
endif

.phony: demo demo_all demo_Insta demo_EJBCA demo_CloudCA
demo: demo_Insta
demo_all: demo demo_EJBCA
demo_Insta: get_Insta_crls
	$(MAKE) -f Makefile_v1 run_demo BIN_DIR="$(BIN_DIR)" CA_SECTION="Insta" SLEEP="sleep 1"
        # for Insta, sleep 1 helps avoid ERROR: server response error : Code=503,Reason=Service Unavailable
demo_CloudCA:
	$(MAKE) -f Makefile_v1 run_demo BIN_DIR="$(BIN_DIR)" CA_SECTION="CloudCA"
demo_EJBCA: start_EJBCA get_EJBCA_crls run_demo # stop_EJBCA
# avoid stopping EJBCA docker container because restart will take long time

# $(DY)LD_LIBRARY_PATH="$(OUT_DIR):$(OPENSSL_LIB):$(SECUTILS_DIR):$(LIBCMP_DIR)"
CMPCLIENT=$(SET_PROXY) LD_LIBRARY_PATH="$(OUT_DIR)" $(OUT_DIR_BIN)
GENERATE_OPERATIONAL=$(OPENSSL) x509 -in creds/operational.crt -x509toreq -signkey creds/operational.pem -out creds/operational.csr -passin pass:12345 2>/dev/null
.phony: run_demo
run_demo: $(OUT_DIR_BIN)
	@which $(OPENSSL) >/dev/null || (echo "cannot find $(OPENSSL)"; false)
	@/bin/echo -e "\n##### running cmpClient demo using $(CA_SECTION) #####\n"
	$(CMPCLIENT) imprint -section $(CA_SECTION) $(EXTRA_OPTS) $(EXTRA_OPTS_IMPRINT)
	@/bin/echo -e "\nValidating own CMP client cert"
    ifeq ($(CA_SECTION),EJBCA)
	$(CMPCLIENT) validate -section $(CA_SECTION),$(CRL_SECTION) -cert $(EJBCA_CMP_CLIENT_CERT) -tls_cert "" -own_trusted $(EJBCA_CMP_TRUSTED),$(EJBCA_TRUSTED) -untrusted $(EJBCA_UNTRUSTED)
        ifneq ($(EJBCA_TLS_HOST),)
	    @/bin/echo -e "\nValidating own TLS client cert"
	    $(CMPCLIENT) validate -section $(CA_SECTION),$(CRL_SECTION) -tls_cert $(EJBCA_TLS_CLIENT) -tls_trusted $(EJBCA_TRUSTED) -untrusted $(EJBCA_UNTRUSTED) -no_check_time
        endif
    else
	$(CMPCLIENT) validate -section $(CA_SECTION),$(CRL_SECTION) -tls_cert "" -cert creds/manufacturer.crt -untrusted creds/extracerts.pem # -no_check_time
    endif
	@echo
	$(CMPCLIENT) bootstrap -section $(CA_SECTION) $(EXTRA_OPTS) $(BOOTSTRAP_CREDS)
	$(GENERATE_OPERATIONAL)
	$(OPENSSL) x509 -noout -text -in creds/operational.crt
	@echo :
	$(OPENSSL) x509 -noout -text -in creds/operational.crt | sed '/^         [0-9a-f].*/d'
    ifneq ($(CA_SECTION),Insta)
	@echo
	@$(SLEEP)
	$(CMPCLIENT) pkcs10 -section $(CA_SECTION) $(EXTRA_OPTS)
    endif
	@echo
	@$(SLEEP)
	$(CMPCLIENT) update -section $(CA_SECTION) $(EXTRA_OPTS)
	@echo :
	$(OCSP_CHECK)
	@echo
	@$(SLEEP)
	@$(SLEEP)
	@$(SLEEP)
	$(CMPCLIENT) revoke -section $(CA_SECTION) $(EXTRA_OPTS)
	@echo :
	$(OCSP_CHECK)
    ifeq ($(CA_SECTION),Insta)
	@echo
	@$(SLEEP)
	$(CMPCLIENT) genm -section $(CA_SECTION) $(EXTRA_OPTS)
	@echo :
    endif
	@echo -e "\n#### finished demo using $(CA_SECTION) ####"
	@echo :

# tests ########################################################################

.phony: test_EJBCA-AWS
test_EJBCA-AWS: build get_EJBCA_crls
ifeq ($(filter-out EJBCA Simple,$(OPENSSL_CMP_SERVER)),)
	$(warning "### skipping test_$(OPENSSL_CMP_SERVER) since not supported in this environment ###")
else
	$(SET_PROXY) make -f Makefile_tests test_cli CMPCLIENT="$(OUT_DIR_BIN)" OPENSSL_CMP_SERVER=EJBCA
endif

.phony: start_EJBCA stop_EJBCA

tmp:
	@mkdir $@
EJBCA_TAR_DIR=ejbca-docker
EJBCA_DOCKER_DIR=tmp/$(EJBCA_TAR_DIR)
$(EJBCA_DOCKER_DIR): | tmp
	@tar >/dev/null -C tmp -xvf test/recipes/80-test_cmp_http_data/EJBCA/$(EJBCA_TAR_DIR).tar.gz

ifeq ($(EJBCA_CONFIG),)
    EJBCA_HOST=localhost
    EJBCA_HTTP_PORT=6080
    EJBCA_HTTPS_PORT=6443
    EJBCA_CRL_INTERVAL=5
endif
start_EJBCA: $(EJBCA_DOCKER_DIR)
ifeq ($(EJBCA_CONFIG),)
    ifeq ($(shell netstat -a | grep LISTEN | grep ${EJBCA_HTTP_PORT}),)
	@echo "starting EJBCA"
	@ # docker run -it --rm -p 6080:8080 -p 6443:8443 primekey/ejbca-ce:8.0.0 # -e TLS_SETUP_ENABLED="simple"
	@cd $(EJBCA_DOCKER_DIR) && docker compose up -d # -f docker-compose.yml
	@echo "probing until EJBCA is ready - can take several minutes..."
	EJBCA_STARTED=1
    else
	@echo "checking if EJBCA is ready..."
    endif
	@wget -nv --tries=30 http://${EJBCA_HOST}:${EJBCA_HTTP_PORT}/ejbca/ra/cas.xhtml -O /dev/null -q
	@echo "EJBCA should now be ready to accept requests."
    ifeq ($(EJBCA_TLS_HOST),) # workaround for ephemeral TLS server certificate of ejbca-docker:
	@$(OPENSSL) s_client -connect $(EJBCA_HOST):$(EJBCA_HTTPS_PORT) 2>/dev/null \
	  -verify_return_error -showcerts >creds/docker/TLS_ROOTCA-docker.pem || true
	@echo `grep -E "CN ?= ?" creds/docker/TLS_ROOTCA-docker.pem|head -n 1 | sed -E 's/^.*CN ?= ?//; s/, ?UID ?= ?.*//; s/, O ?= ?.*//;'` >$(EJBCA_TLS_HOST_FILE)
	@grep -qE '\w' $(EJBCA_TLS_HOST_FILE) || (echo "cannot determine EJBCA docker TLS host name"; false)
    endif
    ifneq ($(EJBCA_STARTED),)
	@echo "waiting for $(EJBCA_CRL_INTERVAL) seconds to ensure EJBCA docker has updated its CRLs..."
	@sleep $(EJBCA_CRL_INTERVAL)
    endif
endif

stop_EJBCA: $(EJBCA_DOCKER_DIR)
ifeq ($(EJBCA_CONFIG),)
	@echo "stopping EJBCA"
	@cd $(EJBCA_DOCKER_DIR) && docker compose -f docker-compose.yml down
endif

.phony: start_Simple stop_Simple
start_Simple:
	@echo "start SimpleLra"
	@cd SimpleLra && ./RunLra.sh & # requires Java 8
	@sleep 2

stop_Simple:
	@PID=`ps aux|grep " jar/SimpleLra.jar TestConfig.xml" | grep -v grep | awk '{ print $$2 }'` && \
	if [ -n "$$PID" ]; then echo "stopping SimpleLra" && kill $$PID; fi

.phony: test_Simple
test_Simple: build get_EJBCA_crls test/recipes/80-test_cmp_http_data/Simple test/recipes/80-test_cmp_http_data/test_Simple.cnf
	$(MAKE) -f Makefile_v1 start_Simple
	make -f Makefile_tests test_cli CMPCLIENT="$(OUT_DIR_BIN)" OPENSSL_CMP_SERVER=Simple OPENSSL=$(OPENSSL) OPENSSL_CMP_CONFIG="Simple/../test.cnf" \
	|| (($(OPENSSL) version; echo $(OPENSSL_VERSION)) | grep -e "1\.0\|1\.1")
# with OpenSSL <1.1, some certstatus test cases fail due to missing OCSP support
# with OpenSSL 1.1 and 3.0, these Mock genm command test cases fail: 'genm certReqTemplate' 'genm caCerts'
# with OpenSSL 1.1, Mock enrollment test 'out_trusted accept issuing ca cert ...' fails likely due to -partial_chain not being respected
# Better use these extended tests only with builds with USE_LIBCMP and OpenSSL >= 3.0.
	$(MAKE) -f Makefile_v1 stop_Simple

.phony: test_Insta
test_Insta: build get_Insta_crls
	$(SET_PROXY) $(MAKE) -f Makefile_tests test_cli CMPCLIENT="$(OUT_DIR_BIN)" OPENSSL_CMP_SERVER=Insta

.phony: test_profile profile_Simple profile_EJBCA
test_profile: start_Simple profile_Simple profile_EJBCA stop_Simple
# do before: cd SimpleLra && ./RunLra.sh
profile_Simple:
	PROFILE=Simple $(MAKE) -f Makefile_v1 profile
profile_EJBCA:
	PROFILE=EJBCA  $(MAKE) -f Makefile_v1 profile
profile:
ifeq ($(TEST_SIMPLE),)
	$(warning "### skipping test_profile because TEST_SIMPLE is not set ###")
else
profile: $(OUT_DIR_BIN)
	@/bin/echo -e "\n##### Requesting a certificate from a PKI with MAC-based protection (RECOMMENDED) #####"
	$(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),EE04
	@/bin/echo -e "\n##### Requesting a certificate from a new PKI with signature-based protection (MANDATORY) #####"
	$(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),EE01
	@/bin/echo -e "\n##### Updating an existing certificate with signature-ased protection (MANDATORY) #####"
	$(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),EE03 -subject ""
	@/bin/echo -e "\n##### Requesting an additional certificate with signature-based protection (OPTIONAL) #####"
	$(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),EE02
#	@/bin/echo -e "\n##### Request a certificate from a legacy PKI using PKCS#10 request (OPTIONAL) #####"
#	$(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),EE05 -subject ""
	@/bin/echo -e "\n##### Revoking a certificate (RECOMMENDED) #####"
	$(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),EE08 -subject ""
	@/bin/echo -e "\n##### Error reporting by client (MANDATORY) #####"
	! $(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),EE09
	@/bin/echo -e "\n##### Error reporting by server (MANDATORY) #####"
	! $(CMPCLIENT) -config config/profile.cnf -section $(PROFILE),RA36
	@echo "\n##### All profile tests succeeded #####"
endif

.phony: all test_all test doc doc_this zip
all:	build doc

.phony: test_Mock
test_Mock: build
	$(MAKE) -f Makefile_tests test_Mock CMPCLIENT="$(OUT_DIR_BIN)" OPENSSL=$(OPENSSL) OPENSSL_VERSION=$(OPENSSL_VERSION)

.phony: tests_LwCmp
tests_LwCmp: build
	$(MAKE) -f Makefile_tests tests_LwCmp CMPCLIENT="$(OUT_DIR_BIN)" OPENSSL=$(OPENSSL) OPENSSL_VERSION=$(OPENSSL_VERSION)

test_all: demo_all test test_Mock tests_LwCmp
ifneq ($(TEST_SIMPLE),)
test_all: test_Simple test_profile
endif
ifneq ($(TEST_INSTA),)
test_all: test_Insta
endif

test: clean build_no_tls
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 clean_config
	@$(MAKE) -f Makefile_v1 clean $(OUT_DIR_BIN) demo_Insta $(BUILD_FLAGS)

# doc and zip ##################################################################

doc: doc_this get_submodules
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 doc -s
        # not needed for cmpossl

doc/$(OUT_DEV_DOC): doc/Generic_CMP_client_API.odt # to be done manually

doc_this: doc/$(OUT_DOC) doc/$(OUT_DEV_DOC)
ifndef SKIP_pod2markdown
doc_this: doc/cmpClient.md
endif

%.gz: %
	@which gzip || (echo "cannot find gzip, please install it"; false)
	gzip -f $<

%.1: %.pod
	@which pod2man || (echo "cannot find pod2man, please install perl"; false)
	pod2man --section=1 --center="cmpClient Documentation" --release=$(VERSION) $< >$@

%.md: %.pod
	@which pod2markdown || (echo "cannot find pod2markdown, please install libpod-markdown-perl"; false)
	pod2markdown $< $@ || true

zip:
	zip genCMPClient.zip \
            LICENSE.txt *.md .gitmodules Makefile_{v1,src} CMakeLists.txt \
	    OpenSSL_version.{c,mk} include/genericCMPClient.h \
	    src/cmpClient.c src/genericCMPClient.c \
	    cmpClient.pod Generic_CMP_client_API.odt


################################################################
# build CMPforOpenSSL (i.e., OpenSSL with CMP patch) with debug symbols
## 'install' static libs to lib, headers to include, dynamic libs and bin to bin
################################################################

# triggering build #############################################################

ROOTDIR=$(PWD)
TAR=$(SECUTILS_DIR)/tar

unpackCMPforOpenSSL_trigger=openssl/Configure
${unpackCMPforOpenSSL_trigger}: $(TAR)/openssl-*tar.gz $(TAR)/openssl-*_cmp-*
	@echo "\n##### preparing to build CMPforOpenSSL ######"
	rm -rf openssl/*
	cd openssl && tar xz --file=`ls ../$(TAR)/openssl-*tar.gz` && mv openssl-*/* . && rmdir openssl-*
	@echo "\n###### patching CMP extension into OpenSSL ######"
	cd openssl && patch -p1 < `ls ../$(TAR)/openssl-*_cmp-*`
	touch ${unpackCMPforOpenSSL_trigger}
	@echo "##### finished unpacking CMPforOpenSSL ######\n"

configCMPforOpenSSL_trigger=openssl/Makefile
${configCMPforOpenSSL_trigger}: ${unpackCMPforOpenSSL_trigger}
	cd openssl && ./config no-rc5 no-mdc2 no-idea no-unit-test --prefix=$(ROOTDIR) --debug enable-crypto-mdebug  # enables reporting memory leaks
	@echo "##### finished configuring CMPforOpenSSL ######\n"

makeCMPforOpenSSL_trigger=openssl/*crypto*$(DLL)
${makeCMPforOpenSSL_trigger}: ${configCMPforOpenSSL_trigger}
	cd openssl && RC=windres make build_generated depend build_libs_nodep apps/openssl$(EXE) ./tools/c_rehash
	@ # the above detailed list of targets avoids building needless tests
	@echo "##### finished building CMPforOpenSSL ######\n"

#installCMPforOpenSSL_trigger=bin/openssl$(EXE)
#${installCMPforOpenSSL_trigger}: ${makeCMPforOpenSSL_trigger}
#	cd openssl && make install_dev >/dev/null && make install_runtime
#	@ # the above list of targets avoids building needless tests
#	@echo "##### finished installing CMPforOpenSSL ######\n"

DIRS=openssl #lib bin
openssl:
	mkdir $(DIRS)

.phony: clean_openssl
clean_openssl:
	rm -Rf $(DIRS)

.phony: buildCMPforOpenSSL
buildCMPforOpenSSL: openssl ${makeCMPforOpenSSL_trigger}


################################################################
# Debian packaging
################################################################

ifeq ($(INSTALL_DEB_PKGS),)
    IGNORE_DEB_DEPEND=-d
endif
.phony: deb clean_deb
deb: doc # just to make sure that transforming the doc files will work fine
ifneq ($(INSTALL_DEB_PKGS),)
deb: get_submodules
ifeq ($(LPATH),)
    ifneq ($(wildcard $(SECUTILS_DIR)),)
        ifeq ($(shell dpkg -l | grep "ii  libsecutils "),)
            $(MAKE) deb -C $(SECUTILS_DIR) -f Makefile_v1
            sudo dpkg -i libsecutils{,-dev}_*.deb
        endif
    endif
    ifdef USE_LIBCMP
        ifneq ($(wildcard $(LIBCMP_DIR)),)
            ifeq ($(shell dpkg -l | grep "ii  libcmp "),)
                $(MAKE) deb -C $(LIBCMP_DIR) -f Makefile_v1 LIBCMP_INC="$(LIBCMP_INC)"
                sudo dpkg -i libcmp{,-dev}_*.deb
            endif
        endif
    endif
endif
else
deb:
endif
	@ # pkg-config --print-errors libsecutils
	@ # pkg-config --print-errors libcmp
	debuild $(IGNORE_DEB_DEPEND) \
          -e OPENSSL_DIR="$(OPENSSL_DIR)" -e OPENSSL_LIB="$(OPENSSL_LIB)" \
	  --preserve-envvar OPENSSL_DIRINSTALL_DEB_PKGS \
          -uc -us --lintian-opts --profile debian # --fail-on none
	@ # not using --preserve-envvar OPENSSL_DIR
	@ # debian/rules contains override_dh_auto_build: OPENSSL_DIR=/usr
# alternative:
#	$(DY)LD_LIBRARY_PATH= dpkg-buildpackage $(IGNORE_DEB_DEPEND) -uc -us # may prepend DH_VERBOSE=1
ifneq ($(INSTALL_DEB_PKGS),)
	@# dpkg --contents ../libgencmp{,-dev}_*.deb
	@# dpkg --contents ../cmpclient_*.deb
	sudo dpkg -i ../libgencmp{,-dev}_*.deb ../cmpclient_*.deb
endif

clean_deb:
	rm -rf debian/{.debhelper,tmp,libgencmp{,-dev},cmpclient} debian-packaging
	rm -f debian/{files,debhelper-build-stamp} debian/*.{log,substvars}
	rm -f ../{libgencmp,cmpclient}*.{deb,dsc,build*,changes,tar.gz}
	rm -f lib{secutils,cmp}*.{deb,dsc,build*,changes,tar.gz}
	rm -fr _CPack_Packages changelog.gz
	rm -f {libgencmp,cmpclient}*.{deb,tar.gz}
	@# sudo dpkg -r lib{gen,}cmp{,-dev} libsecutils{,-dev,-bin} cmpclient


# installation #################################################################

# installation target - append ROOTFS=<path> to install into virtual root filesystem
DEST_PRE=$(ROOTFS)/usr/local
DEST_LIB=$(DEST_PRE)/lib
DEST_INC=$(DEST_PRE)
DEST_BIN=$(DEST_PRE)/bin
DEST_MAN=$(DEST_PRE)/share/man/man1
DEST_DOC=$(DEST_PRE)/share/doc/gencmp
DEST_DEV_DOC=$(DEST_PRE)/share/doc/gencmp-dev
GENCMPCL_HDRS=genericCMPClient*.h
.phony: remind_admin install install_cli uninstall
remind_admin:
ifeq ($(ROOTFS),)
	echo -n "This assumes successful 'make build doc' and requires admin rights - otherwise better abort "
	@read
endif

install: remind_admin doc_this
ifeq ($(LPATH),)
    ifneq ($(wildcard $(SECUTILS_DIR)),)
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 doc install OUT_DIR="$(OUT_REVERSE_DIR)" DESTDIR="$(DEST_REVERSE_DIR)"
    endif
    ifdef USE_LIBCMP
    ifneq ($(wildcard $(LIBCMP_DIR)),)
	$(MAKE) -C $(LIBCMP_DIR) -f Makefile_v1 install OUT_DIR="$(OUT_REVERSE_DIR)" DESTDIR="$(DEST_REVERSE_DIR)"
    endif
    endif
endif
	@mkdir -p $(DEST_LIB)
	install -D $(OUT_DIR)/$(OUTLIBV) $(DEST_LIB)/
	ln -sf $(OUTLIBV) $(DEST_LIB)/$(OUTLIB)
ifeq ($(DEB_TARGET_ARCH),) # not during Debian packaging
	 # install $(SECUTILS_OUT_LIB).* $(DEST_LIB)/
    ifdef USE_LIBCMP
	 # install $(LIBCMP_OUT_LIB).* $(DEST_LIB)/
    endif
endif
#install_headers:
	find include -type f -name $(GENCMPCL_HDRS) -exec install -Dm 0644 '{}' '$(DEST_INC)/{}' ';'
#install_bins:
	mkdir -p $(DEST_BIN)
	install -D $(OUT_DIR_BIN) $(DEST_BIN)
#install_doc:
	mkdir -p $(DEST_MAN)
	install -D doc/$(OUT_DOC) $(DEST_MAN)
	mkdir -p $(DEST_DOC)
ifndef SKIP_pod2markdown
	install -D doc/cmpClient.md $(DEST_DOC)
endif
	mkdir -p $(DEST_DEV_DOC)
	install -D doc/$(OUT_DEV_DOC) $(DEST_DEV_DOC)

uninstall: remind_admin
ifeq ($(LPATH),)
    ifneq ($(wildcard $(SECUTILS_DIR)),)
	$(MAKE) -C $(SECUTILS_DIR) -f Makefile_v1 uninstall OUT_DIR="$(OUT_REVERSE_DIR)" DESTDIR="$(DEST_REVERSE_DIR)"
    endif
    ifdef USE_LIBCMP
    ifneq ($(wildcard $(LIBCMP_DIR)),)
	$(MAKE) -C $(LIBCMP_DIR) -f Makefile_v1 uninstall OUT_DIR="$(OUT_REVERSE_DIR)" DESTDIR="$(DEST_REVERSE_DIR)"
    endif
    endif
endif
	rm -fr $(DEST_LIB)/$(OUTLIB_)*$(DLL)*
	find include -type f -name $(GENCMPCL_HDRS) -exec rm '$(DEST_INC)/{}' ';'
	rm -f $(DEST_BIN)/$(OUTBIN)
	rm -f $(DEST_MAN)/$(OUT_DOC)
	rmdir $(DEST_MAN) || true
	rm -f $(DEST_DOC)/{cmpClient.md,changelog.gz,copyright}
	rmdir $(DEST_DOC) || true
	rm -f $(DEST_DEV_DOC)/{$(OUT_DEV_DOC),changelog.gz,copyright}
	rmdir $(DEST_DEV_DOC) || true