huntedbytheirs
d7fc9d45fb
B1: Replaced all std::system()/popen() with fork+execve — zero shell injection B2+B3: Added sha256/sha512/md5 fields to PackageDef, parser support, actual hash comparison in verify_hash() B4: tar --no-same-owner --no-same-permissions, zip uses unzip instead of tar B5: Patch sha256 verified before application via -i flag (no shell redirect) B6: kappa fetch --help now prints usage and exits 0 Also: removed dead ternary code, added <cstdlib>/<sys/wait.h>/<unistd.h>
94 lines
2.4 KiB
Plaintext
94 lines
2.4 KiB
Plaintext
/*
|
|
* foo — a web server with optional SSL and GUI support.
|
|
* Demonstrates the full kappa DSL surface.
|
|
*/
|
|
package "foo" {
|
|
const version = "1.2.3"
|
|
const source = "https://example.com/foo-${version}.tar.gz"
|
|
sha256 = "e127a709cba24c76de8936cb7083dd768f28cd37eb010492e2f19b71eb1294e4"
|
|
license = "MIT"
|
|
|
|
provides = ["libfoo.so.1", "foo"]
|
|
|
|
patches = [
|
|
{
|
|
url = "https://example.com/fix-build.patch"
|
|
sha256 = "abc123def456"
|
|
level = 1
|
|
},
|
|
"local-fix.patch" // local shorthand, no hash
|
|
]
|
|
outputs = ["bin", "lib", "dev"]
|
|
|
|
depends = [
|
|
{ name = "zlib", version = ">=1.2,<2.0" },
|
|
{ name = "openssl", feature = "ssl" },
|
|
{ name = "gtk", feature = "gui", version = ">=3" },
|
|
"gettext:lib" // name:output shorthand
|
|
]
|
|
|
|
features {
|
|
ssl = { enabled = true, flag = "--with-ssl-dir=${cfg.ssl_dir}" }
|
|
gui = { enabled = false, flag = "--enable-gui" }
|
|
drivers = { enabled = true, force = true }
|
|
debug = false
|
|
}
|
|
|
|
config {
|
|
// Written once, left alone on rebuild if the user edits it.
|
|
file "etc/foo.conf" mode = "default" {
|
|
hostname = ${cfg.hostname !} // required — user must set
|
|
listen_port = ${cfg.port ? 8080} // optional, default 8080
|
|
ssl_enabled = ${cfg.ssl ? true} // optional, default true
|
|
}
|
|
|
|
// Always overwritten on rebuild.
|
|
file "etc/log.conf" mode = "replace" {
|
|
log_level = ${cfg.log_level ? info}
|
|
log_path = ${cfg.log_path ? /var/log/foo}
|
|
}
|
|
|
|
// Three-way diff on rebuild.
|
|
file "etc/limits.conf" mode = "merge" {
|
|
max_connections = ${cfg.max_conn ? 1024}
|
|
}
|
|
}
|
|
|
|
env {
|
|
CFLAGS = "-O2 -march=native"
|
|
LDFLAGS = "-Wl,--as-needed"
|
|
CFLAGS ?= "-g"
|
|
}
|
|
|
|
service {
|
|
runit {
|
|
exec = "/usr/bin/foo --daemon"
|
|
type = "forking"
|
|
user = "foo"
|
|
}
|
|
s6 {
|
|
exec = "/usr/bin/foo"
|
|
type = "longrun"
|
|
ports = [80, 443]
|
|
user = "foo"
|
|
}
|
|
}
|
|
|
|
prepare {
|
|
patch "fix-build.patch"
|
|
}
|
|
|
|
build {
|
|
./configure --prefix=${prefix} ${feature.ssl} ${feature.gui}
|
|
make -j${jobs}
|
|
}
|
|
|
|
check {
|
|
make check
|
|
}
|
|
|
|
install {
|
|
make DESTDIR=${destdir} install
|
|
}
|
|
}
|