Documentation/scripts/pkgmeek

#!/bin/bash
#
# pkgmeek - a drop-in replacement for pkgmk
#     based on upkgmk (c) 2018 therealfun
#    and pkgmk (c) 2004--2022 Per Liden et al.
# Distributed under the same license, 
# https://crux.nu/gitweb/?p=tools/pkgutils.git;a=blob_plain;f=COPYING;hb=HEAD

main() {
######################## main routine ################################
local o_ignored work _local_ here url u f errDL pkg_ood errUZ
parse_options "$@"
#
# Exit early if cleaning was requested
#
if [ "$PKGMK_CLEAN" = "yes" ]; then
	[ "$PKGMK_MTIME_ONLY" = "yes" ] && o_ignored="-utd"
	[ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ] && o_ignored+=" -uf"
	[ "$PKGMK_CHECK_SIG" = "yes" ] && o_ignored+=" -cs"
	[ "$PKGMK_REFRESH_SIG" = "yes" ] && refresh_signature
	[ "$o_ignored" = "" ] || { warning "option -c nullifies these requested options:";
	echo "$o_ignored"; }
	exec $PRTWASH_COMMAND -p -s "$(pwd)"
fi
#
# Read the Pkgfile to determine what to do next. But first ensure that
# it came from a trusted source (FS#1851)
#
validate_pkgfile
[ -f .32bit ] && PGKMK_ARCH=32 || PKGMK_ARCH=64
. "Pkgfile"; . "$PKGMK_CONF"

set -e

# respect the settings for centralized source and package directories
[ -v pkg_dir  ] || pkg_dir="$PKGMK_PACKAGE_DIR"/
[ -w "$pkg_dir" ] || pkg_dir="$(pwd)"/
[ -v src_dir  ] || src_dir="$PKGMK_SOURCE_DIR"
[ -w "$src_dir" ] || src_dir=

# respect the setting for WORK_DIR in case the user wants to build in RAM
[ -v PKGMK_WORK_DIR ] && work="$PKGMK_WORK_DIR"

# Let the main routine and subsequent subroutines know what filenames
# they should expect to see on disk.
package="${name}#${version}-${release}.pkg.tar.${PKGMK_COMPRESSION_MODE}"
declare -A _local_
for (( s=0; s<${#source[@]}; s++ )); do
	if [[ ${source[$s]} =~ ^(https|ssh|git)://.*/(.+)\.git ]]; then
		_local_[$s]="${BASH_REMATCH[2]}"
	elif [[ ${source[$s]} =~ ^(http|https|ftp|file)://.*/(.+) ]]; then
		_local_[$s]="${BASH_REMATCH[2]}"
	else
		_local_[$s]="${source[$s]}"
	fi
	[ -z "${renames[$s]}" ] || [ "${renames[$s]}" = "SKIP" ] || \
		_local_[$s]="${renames[$s]}"
done
# Example: _local_ = ( upstream-ball-v12.tgz
#                      random.patch
#                      some-git-repo/ )

# The effective user should at least have write permissions on $PWD
[ -w "$(dirname "$work")" ] || work="$(pwd)"/work
rm -rf "$work"; mkdir -p "$work"/{src,pkg} && cd "$work"

for (( u=0; u<${#_local_[@]}; u++ )); do
	here="${_local_[$u]}"
	url="${source[$u]}"
	# at least one of the following commands should put a file of the
	# appropriate name in the current directory
	[ -e "$here" ] || [ "$src_dir" = "" ] || [ ! -e "$src_dir/$here" ] || ln -sf "$src_dir/$here" .
	[ -e "$here" ] || [ ! -e "$PKGMK_ROOT/$here" ] || ln -sf "$PKGMK_ROOT/$here" .
	[ -e "$here" ] || [[ $url =~ ^(https|ssh|git)://.*/(.+)\.git ]] || {
		"$PKGMK_DOWNLOAD_PROG" -O "$here" "$url";
		[ "$src_dir" = "" ] || { mv "$here" "$src_dir"/ && ln -sf "$src_dir/$here" . ; };
	}
	[ -e "$here" ] || [[ ! $url =~  ^(https|ssh|git)://.*/(.+)\.git ]] || \
			( "$PKGMK_GIT_COMMAND" clone "$url" "$here" ) || continue
	# but if not, exit with an informative error message
	if [ ! -e "$here" ]; then
		error "failed to download $here. Check connection and try again."
		errDL=$E_DOWNLOAD
	fi
done

{ [ "$PKGMK_DOWNLOAD_ONLY" = "yes" ] || [ "$errDL" ]; } && exit $errDL

# Now that all the files are on disk, check mtimes to determine whether a build is needed.
check_pkg_mtime && pkg_ood=0 || pkg_ood=1
[ "$PKGMK_MTIME_ONLY" = "no" ] || exit $pkg_ood
[ "$pkg_ood" = 1 ] || [ "$PKGMK_FORCE" = "yes" ] || [ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ] || \
		[ "$PKGMK_UPDATE_SIG" = "yes" ] || exit 0
[ "$PKGMK_CHECK_SIG" = "yes" ] || echo "Checking signatures before unpacking..."

# The option -uf is meant to be used after a previous invocation of pkgmk has
# alerted the user to a footprint mismatch. The option -us is likewise meant
# to update the signature, which only requires the sources and the footprint.
if [ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ]; then
	[ -f "$package" ] || \
		{ error "unable to update footprint. File '$package' not found.";
		exit "$E_MANIFEST"; }
	[ "$pkg_ood" = 0 ] || [ "$PKGMK_FORCE" = "yes" ] || \
		{ error "outdated package. Use '-f' to force the footprint update."; 
		exit "$E_FOOTPRINT"; }
	make_manifest "footprint" > "$PKGMK_ROOT/.footprint" || \
		{ error "Failed to write the footprint."; exit "$E_DIRPERM"; }
fi
if [ "$PKGMK_UPDATE_SIG" = "yes" ]; then
	make_signature > "$PKGMK_ROOT/.signature" ||
		{ error "Failed to update signature."; exit "$E_DIRPERM"; }
fi
if [ "$PKGMK_UPDATE_SIG" = "yes" ] || [ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ];
	then exit 0
fi

# All the sources should be here by now, let's verify that we can trust them.
readonly cs_fail_msg="Use '--ignore-signature' to override, if you have determined their integrity by other means."
check_signature "pre-build" | parse_signify_output
case $? in
	0) info "Sources successfully authenticated." ;;
	1) error "Signature file missing or corrupted." ; echo "$cs_fail_msg" ;;
	2) error "Failed to authenticate remote sources using signify." ; echo "$cs_fail_msg" ;;
esac
[ "$PKGMK_CHECK_SIG" = "no" ] || exit 0 # no need to continue if the user only requested -cs

# What used to be called unpack_source() is now hard-coded into the main routine.
# If you need to shield specific source files from unpacking, use the "renames"
# feature of Pkgfile(5).
errUZ=0
for (( u=0; u<${#_local_[@]}; u++ )) ; do
	here="${_local_[$u]}"
	case "$here" in
		*.tar|*.tar.gz|*.tar.Z|*.tgz|*.tar.bz2|*.tbz2|*.tar.xz|*.txz|*.tar.lzma|*.tar.lz|*.zip|*.rpm)
			[ -d "$here" ] || bsdtar -p -o -C src -xf "$here" || errUZ+=1 ;;
		*)
			cp -r "$here" src/ ;;
	esac
done

[ $errUZ = 0 ] || { error "Failed to unpack all sources."; exit "$E_UNPACK"; }
[ "$PKGMK_EXTRACT_ONLY" = "yes" ] && exit 0

# The actual build step!
if ! (SRC=$(pwd)/src; PKG=$(pwd)/pkg; cd src; set -x; build); then
	error "Unsuccessful build!"; exit $E_BUILD
else
	info "Build succeeded. Moving on to compression."
fi

[ -f "$PKGMK_ROOT/$PKGMK_NOSTRIP" ] && ns_filter="| grep -v -f $PKGMK_NOSTRIP"
find pkg -type f $ns_filter | while read -r f; do
	case $(file -b "$f") in
		*ELF*executable*not\ stripped*)     strip --strip-all      "$f" ;;
		*ELF*shared\ object*not\ stripped*) strip --strip-unneeded "$f" ;;
		current\ ar\ archive)               strip --strip-debug    "$f" ;;
	esac
done

find pkg -type  f -path '*/man/man*/*' | grep -v '.gz$' | xargs gzip -9
find pkg -xtype l -path '*/man/man*/*' -print0 \
	| xargs -x -r -n1 sh -c "ln -sf \"\$(readlink -n '{}')\" '{}'"

[ $UID = 0 ] || fake_uid="--uid 0 --gid 0"
if (cd pkg; bsdtar --format=gnutar $fake_uid -cf "$pkg_dir$package" *); then
	info "Package creation successful."
else
	error "Unable to create the compressed package $package."
	exit $E_DIRPERM
fi
[ "$pkg_dir" = "$(pwd)/" ] || ln -sf "$pkg_dir$package" .

# The $work directory now has a symlink to the package, so check its footprint
if ! check_manifest "footprint" ; then
	[ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ] && make_manifest "footprint" > "$PKGMK_ROOT"/.footprint
	[ "$PKGMK_IGNORE_FOOTPRINT" = "no" ] && exit $E_MANIFEST
fi

# Fulfill any *explicit* requests for (signed) manifests, then exit
# (disposal of the work directory is retained from the first run of pkgmeek)
[ -f "$PKGMK_ROOT/.signature" ] || [ "$PKGMK_UPDATE_SIG" = "no" ] || \
	warning "Signature not found, creating new."
[ "$PKGMK_UPDATE_SIG" = "no" ] || \
	{ make_signature > "$PKGMK_ROOT/.signature" &&
		echo "Signature successfully created."; } || \
	{ make_manifest "md5sum" > "$PKGMK_ROOT"/.md5sum &&
		warning "Signature creation failed, falling back to md5sums."; } \
	|| { info "Could not create signatures or md5sums."; exit "$E_DIRPERM"; }
[ "$PKGMK_UPDATE_MD5" = "no" ] || \
	make_manifest "md5sum" >"$PKGMK_ROOT"/.md5sum || \
	{ info "Could not create requested md5sums."; exit "$E_DIRPERM"; }
if [ "$PKGMK_UPDATE_SIG" = "yes" ] || [ "$PKGMK_UPDATE_MD5" = "yes" ]; then
	exit 0
fi

# Clean up, part 1
[ "$PKGMK_KEEP_WORK" = "yes" ] || rm -rf src pkg

# Install if requested
# First find out how the effective user will invoke pkgadd
case $UID in
	0) SUDO="" ;;
	*) SUDO="sudo " ;;
esac
[ -z "$SUDO" ] || [ -x $(command -v "$SUDO") ] || SUDO="/usr/bin/doas "
[ -x $(command -v "$SUDO") ] || SUDO="su -c"

if [ "$PKGMK_INSTALL_COMMAND" ]; then
	if ! $SUDO $PKGMK_INSTALL_COMMAND "$package"; then
		error "Unable to install $package using pkgadd."
		exit $E_INSTALL
	fi
fi

# Clean up, part 2
[ "$PKGMK_KEEP_WORK" = "yes" ] || [ "$pkg_dir" = "$(pwd)/" ] || rm -f "$package"

# Done!
}

#######################  error codes  ##############################
E_PKGFILE=2    # invalid Pkgfile
E_DIRPERM=3   # (source/build) directory missing or missing read/write permission
E_DOWNLOAD=4   # error during download
E_UNPACK=5     # error during unpacking of source file(s)
E_MANIFEST=7   # footprint or md5sum failure
E_BUILD=8      # error while running 'build()'
E_INSTALL=9    # error while installing the package via 'pkgadd'
E_SIGNATURE=10 # error verifying the signature

########################  settings  ################################
readonly PKGMK_VERSION="#VERSION#"
readonly PKGMK_COMMAND="$0"
readonly PKGMK_ROOT="$PWD"
readonly PKGMK_SIGNIFY="/usr/bin/signify"
readonly PRTWASH_COMMAND="/usr/bin/prtwash"
readonly PKGMK_GIT_COMMAND="/usr/bin/git"
PKGMK_DOWNLOAD_PROG="/usr/bin/wget"

PKGMK_CONF="/etc/pkgmk.conf"
PKGMK_SOURCE_DIR="$PWD"
PKGMK_PACKAGE_DIR="$PWD"
PKGMK_WORK_DIR="$PWD/work"
PKGMK_COMPRESSION_MODE="gz"

PKGMK_INSTALL_COMMAND=""
PKGMK_DOWNLOAD_ONLY="no"
PKGMK_EXTRACT_ONLY="no"
PKGMK_MTIME_ONLY="no"
PKGMK_UPDATE_FOOTPRINT="no"
PKGMK_IGNORE_FOOTPRINT="no"
PKGMK_IGNORE_NEW="no"
PKGMK_FORCE="no"
PKGMK_KEEP_WORK="no"
PKGMK_UPDATE_MD5="no"
PKGMK_IGNORE_MD5="no"
PKGMK_UPDATE_SIG="no"
PKGMK_IGNORE_SIG="no"
PKGMK_REFRESH_SIG="no"
PKGMK_CHECK_SIG="no"
PKGMK_PRIVATEKEY=""
PKGMK_NOSTRIP=".nostrip"

######################## subroutines ################################
parse_options() {
	while [ "$1" ]; do
		case $1 in
			-r|--recursive) recursive "$@" ;;
			-c|--clean) PKGMK_CLEAN="yes" ;;
			-uf|--update-footprint) PKGMK_UPDATE_FOOTPRINT="yes" ;;
			-um|--update-md5sum) PKGMK_UPDATE_MD5="yes" ;;
			-us|--update-signature) PKGMK_UPDATE_SIG="yes" ;;
			-rs|--refresh-signature) PKGMK_REFRESH_SIG="yes" ;;
			-cs|--check-signature) PKGMK_CHECK_SIG="yes" ;;
			-d|-cm|--download|--check-md5sum) ;;
			-do|--download-only) PKGMK_DOWNLOAD_ONLY="yes" ;;
			-eo|--extract-only) PKGMK_EXTRACT_ONLY="yes" ;;
			-utd|--up-to-date) PKGMK_MTIME_ONLY="yes" ;;
			-if|--ignore-footprint) PKGMK_IGNORE_FOOTPRINT="yes" ;;
			-in|--ignore-new) PKGMK_IGNORE_NEW="yes" ;;
			-im|--ignore-md5sum) PKGMK_IGNORE_MD5="yes" ;;
			-is|--ignore-signature) PKGMK_IGNORE_SIG="yes" ;;
			-ns|--no-strip) touch "$PKGMK_NOSTRIP" ;;
			-f|--force) PKGMK_FORCE="yes" ;;
			-kw|--keep-work) PKGMK_KEEP_WORK="yes" ;;
			-i|--install) PKGMK_INSTALL_COMMAND="/usr/bin/pkgadd" ;;
			-u|--upgrade) PKGMK_INSTALL_COMMAND="/usr/bin/pkgadd -u" ;;
			-pk|--public-key)
				if [ ! "$2" ]; then
					echo "$(basename "$PKGMK_COMMAND"): option $1 requires an argument"
					exit 1
				fi
				PKGMK_PUBLICKEY="$2"
				shift ;;
			-sk|--secret-key)
				if [ ! "$2" ]; then
					echo "$(basename "$PKGMK_COMMAND"): option $1 requires an argument"
					exit 1
				fi
				PKGMK_PRIVATEKEY="$2"
				shift ;;
			-cf|--config-file)
				if [ ! "$2" ]; then
					echo "$(basename "$PKGMK_COMMAND"): option $1 requires an argument"
					exit 1
				fi
				PKGMK_CONF="$2"
				shift ;;
			-v|--version)
				echo "$(basename "$PKGMK_COMMAND") (pkgutils) $PKGMK_VERSION"
				exit 0 ;;
			-h|--help)
				print_help
				exit 0 ;;
			*)
				echo "$(basename "$PKGMK_COMMAND"): invalid option $1"
				exit 1 ;;
		esac
		shift
	done
}

print_help() {
	echo "usage: $(basename "$PKGMK_COMMAND") [options]"
	echo "options: "
	echo "  -r,   --recursive           search for Pkgfiles under $PWD, and run $(basename "$PKGMK_COMMAND")"
	echo "                              with the other given options inside each directory found"
	echo "  -c,   --clean               remove package and downloaded files"
	echo "  -i,   --install             build and install package"
	echo "  -u,   --upgrade             build and install package (as upgrade)"
	echo "  -do,  --download-only       stop after downloading all the necessary source file(s)"
	echo "  -eo,  --extract-only        stop after downloading and extracting source file(s)"
	echo "  -utd, --up-to-date          check whether the built package is up to date, then exit"
	echo "  -uf,  --update-footprint    update footprint using result from last build"
	echo "  -if,  --ignore-footprint    build package without checking footprint"
	echo "  -in,  --ignore-new          build package, ignoring new files in a footprint mismatch"
	echo "  -um,  --update-md5sum       update md5sum"
	echo "  -im,  --ignore-md5sum       build package without checking md5sum"
	echo "  -cs,  --check-signature     verify the signatures, do not proceed with the build"
	echo "  -us,  --update-signature    update signatures only, do not proceed with the build"
	echo "  -is,  --ignore-signature    build package without checking the signature"
	echo "  -rs,  --refresh-signature   create new signature and keep existing sha256 checksums"
	echo "  -sk,  --secret-key <file>   use <file> to sign the port"
	echo "  -pk,  --public-key <file>   check the port signature using public-key <file>"
	echo "  -ns,  --no-strip            do not strip executable binaries or libraries"
	echo "  -f,   --force               build package even if it appears to be up to date"
	echo "  -kw,  --keep-work           keep temporary working directory"
	echo "  -cf,  --config-file <file>  use alternative configuration file"
	echo "  -v,   --version             print version and exit"
	echo "  -h,   --help                print help and exit"
}

validate_pkgfile() { # called from within PKGMK_ROOT
	local errcode nn nv nr nb
	check_signature "pre-Pkgfile" | parse_signify_output
	errcode=$?
	[ "$errcode" = 0 ] || info "Use '-is' if you have confirmed its origin some other way."
	[ "$errcode" = 0 ] || [ "$PKGMK_IGNORE_SIG" = "yes" ] || exit $E_SIGNATURE

	# the environment should not be affected by sourcing the Pkgfile both here
	# and in the later build, but to be safe we use a nested subshell
	( . Pkgfile; [ -n "$name" ] || nn=1; [ -n "$version" ] || nv=1; \
	[ -n "$release" ] || nr=1; [ "$(type -t build)" = "function" ] || nb=1; \
	echo $(( nn+2*nv+4*nr+8*nb )) ) | check_required_vars
}

check_required_vars() {
	local checksum absent v
	read -r checksum

	[ $((checksum & 1)) = 1 ] && absent=("'name'")
	[ $((checksum & 2)) = 2 ] && absent=("${absent[@]}" "'version'")
	[ $((checksum & 4)) = 4 ] && absent=("${absent[@]}" "'release'")
	[ $((checksum & 8)) = 8 ] && absent=("${absent[@]}" "'build()'")

	if [ "$checksum" -gt 0 ]; then
		error "Pkgfile does not specify these required variables:"
		for v in "${absent[@]}"; do
			echo -n "$v "
		done
		echo; exit $E_PKGFILE
	fi
}

check_pkg_mtime() { # only called before a build attempt, not again after a successful build
	local status=1; local li=0; local pkg_ood="yes"

	if [ -f "$package" ]; then
		pkg_ood="no"
		while [ $li -lt ${#_local_[@]} ] && [ "$pkg_ood" = "no" ]; do
			 [ ! -e "${_local_[$li]}" ] || [ "$package" -nt "${_local_[$li]}" ] || pkg_ood="yes"
			 li=$(( li+1 ))
		done
		[ ! -e Pkgfile ] || [ "$package" -nt Pkgfile ] || pkg_ood="yes"
	fi

	if [ "$pkg_ood" = "no" ]; then
		status=0; info "$package is up to date."
	else
		[ "$PKGMK_CHECK_SIG" = "yes" ] || info "$package is not up to date."
	fi
	return $status
}

make_manifest() {
	case "$1" in
		footprint)
			pkginfo --footprint "$package" \
			| sed "s|\tlib/modules/$(uname -r)/|\tlib/modules/<kernel-version>/|g" \
			| sort -k 3
		;;
		md5sum)
			[ ! -e "$PKGMK_ROOT/.signature" ] || [ "$PKGMK_UPDATE_MD5" = "yes" ] || return
			md5sum "${_local_[@]}" 2>&1 \
			| grep -v "is a directory" | sed 's,  .*/,  ,' | sort -k 2
		;;
	esac
}

check_manifest() {
	local FILTER TRUTH CN CM
	local FILE="$1.tmp"; local retval=0
	[ ! -f "$package" ] && { error "$package not found. Cannot check $1.";
		return "$E_MANIFEST"; }
	[ "$1" = "md5sum" ] && FILTER="| sort -k 3" || FILTER=""
	TRUTH="$PKGMK_ROOT/.$1"

	make_manifest $1 $FILTER > "$FILE"
	if [ -f "$TRUTH" ]; then
		cat "$TRUTH" $FILTER > "${FILE%tmp}orig"
		diff -w -t -U 0 <(sort "${FILE%tmp}orig") <(sort "${FILE}") | \
		sed '/^@@/d; /^+++/d; /^---/d; s/^+/NEW    /g; s/^-/MISSING /g' \
		> "${FILE%tmp}diff"
		if [ -s "${FILE%tmp}diff" ]; then
			error "$1 mismatch found:"
			cat "${FILE%tmp}diff" >&2
			CN=$(grep -c ^NEW "${FILE%tmp}diff")
			CM=$(grep -c ^MISSING "${FILE%tmp}diff")
			if [ "$1" = "footprint" ]; then
				[ "$PKGMK_IGNORE_NEW" = "yes" ] || retval+=$CN
				[ "$PKGMK_IGNORE_MISSING" = "yes" ] || retval+=$CM
				retval=$(( E_MANIFEST*( retval>0 ) ))
			else
				retval=$E_MANIFEST
			fi
		fi
	else
		warning ".$1 not found, creating new."; mv "$FILE" "$TRUTH"
	fi
	return $retval
}

parse_signify_output() { # chomps the output of check_signature()
	local signout signerr
	[ "$PKGMK_IGNORE_SIG" = "yes" ] && return 0
	while read -r signout; do
	case "$signout" in 
		*"verification failed")
			signerr=1; echo "Signature file corrupted or unreadable."
			;;
		*"FAIL")
			signerr=2; echo "Signature mismatch found:"
			echo "$signout" | awk -F: '/FAIL/ {printf "MISMATCH   %s\n", $1}'
			;;
	esac
	done
	return $signerr
}

check_signature() {
	# called from within the src subdir unless "when"="pre-Pkgfile".
	# Pass control to check_manifest() if the signature is missing and
	# "ignore-md5" has not been requested.
	local reqfiles s
	local when="$1"
	[ "$PKGMK_IGNORE_SIG" = "yes" ] && echo; return

	if [ -f "$PKGMK_ROOT/.signature" ]; then
		[ "$when" = "pre-Pkgfile" ] && reqfiles=(Pkgfile) || reqfiles=(.footprint)
		while [ "$when" = "pre-build" ] && [ $s -le ${#_local_[@]} ]; do 
			[[ "${source[$s]}" =~ ^(http|https|git).*/\.git ]] || \
					reqfiles=("${reqfiles[@]}" "${_local_[$s]}")
			s=$(( s+1 ))
		done
		for FILE in "${reqfiles[@]}" "${_local_[@]}"; do
			[ -e "$FILE" ] || ln -sf "$PKGMK_ROOT/$FILE" .
		done
		if [ -f "$PKGMK_PUBLICKEY" ]; then
			$PKGMK_SIGNIFY -q -C -p "$PKGMK_PUBLICKEY" -x "$PKGMK_ROOT/.signature" \
				"${reqfiles[@]}" 2>&1
		else
			$PKGMK_SIGNIFY -q -C -x "$PKGMK_ROOT/.signature" \
				"${reqfiles[@]}" 2>&1
		fi
	else
		[ "$when" = "pre-Pkgfile" ] || [ "$PKGMK_IGNORE_MD5" = "yes" ] || \
		{ info "Signature not found, falling back to old md5sum checking.";
			check_manifest "md5sum" ; }
	fi
	# remove soft links
	[ "$when" = "post-build" ] && find . -maxdepth 1 -mindepth 1 -type l -delete
}

make_signature() {
	for key in ~/.ssh/*.sec /etc/ports/*.sec; do
		[[ -e "$key" ]] || continue  # workaround for brain-dead shell globbing
		pub=/etc/ports/$(basename "${key/%.sec/.pub}")
		if [ -e "$pub" ]; then
			pub=$(readlink -f "$pub")
			ordered=()
				for f in "${source[@]}"; do ordered+=("${_local_[$f]}"); done
				sha256sum --tag Pkgfile .footprint "${ordered[@]}"          \
					| sed 's|^SHA256 (.*/\(.*\))\(.* = .*\)|SHA256 (\1)\2|' \
					| signify -S -e -x - -q -s "$key" -m -                  \
					| sed "s|${key/%.sec/.pub}|$pub|"
			break
		fi
	done
}

refresh_signature() {
    if [ -e ".signature" ] && [ ! -w ".signature" ]; then
		echo "error: .signature not writable."
		return $E_SIGNATURE
	fi

	local REPO
	[ -n "$PKGMK_PRIVATEKEY" ] || REPO=$(dirname "$PWD" | sed 's|^.*/||; s|\.git$||;')
	[ -n "$REPO" ] && PKGMK_PRIVATEKEY="/etc/ports/${REPO}.sec"

	if ! tail -n +3 ".signature" | $PKGMK_SIGNIFY -S -e -x - -q \
			-s "$PKGMK_PRIVATEKEY" -m - > .signature.tmp ; then
		rm .signature.tmp
		error "Refreshing signature failed"
		return $E_SIGNATURE
	else
		mv .signature.tmp .signature
	fi
}

recursive() {
	local ARGS FILE DIR
	[ "$PKGMK_CLEAN" == "no" ] || { find "$PKGMK_ROOT" -name Pkgfile \
		-printf "%h\n" | xargs "$PRTWASH_COMMAND" -s -p -b ; exit $? ; }

	ARGS=$(echo "$@" | sed -e "s/--recursive//g; s/[ ]+-r[ ]+/ /g")
	for FILE in $(find "$PKGMK_ROOT" -name Pkgfile | sort); do
			DIR="$(dirname "$FILE")/"
		if [ -d "$DIR" ]; then
			info "Entering directory '$DIR'."
			(cd "$DIR" && "$PKGMK_COMMAND" "$ARGS")
			info "Leaving directory '$DIR'."
		fi
	done
}

info() {
	echo "=======> $1"
}

warning() {
	info "WARNING: $1" >&2
}

error() {
	info "ERROR: $1" >&2
}

######################## end of subroutines ###########################
## Now ensure that they cannot be overwritten when sourcing Pkgfile  ##
readonly -f main parse_options print_help validate_pkgfile check_required_vars \
	check_pkg_mtime make_manifest check_manifest check_signature make_signature \
	parse_signify_output refresh_signature recursive

main "$@"