# Maintainer: AndyRTR <andyrtr at archlinux.org>
# Maintainer : Christian Rebischke <chris.rebischke@archlinux.org>
# Maintainer: Levente Polyak <anthraxx[at]archlinux[dot]org>

pkgname=iwd
pkgver=3.12
pkgrel=2.2
pkgdesc='Internet Wireless Daemon'
arch=('x86_64')
url='https://git.kernel.org/cgit/network/wireless/iwd.git/'
license=('LGPL-2.1-or-later')
depends=('glibc' 'readline' 'libreadline.so' 'ell' 'libgcc')
makedepends=('python-docutils' 'dbus' 'systemd')
optdepends=('qrencode: for displaying QR code after DPP is started')
source=(https://www.kernel.org/pub/linux/network/wireless/iwd-${pkgver}.tar{.xz,.sign}
        0001-use-network-group-for-unprivileged-access.diff
        0001-rrm-fix-stack-buffer-overflow-in-rrm_report_beacon_r.patch
        0002-ie-fix-off-by-one-in-HE-Capabilities-Channel-Width-S.patch
        0003-ft-fix-mde_equal-self-comparison-and-type-mismatch.patch
        0004-ie-fix-uint8_t-underflow-in-FTE-sub-element-parser.patch

        # Holo: one fix is for iwd partial channel scans flushing the kernel BSS cache and
        # one fix is to protect pending BSS ids during the connection process.
        # See https://gitlab.steamos.cloud/holo-team/tasks/-/issues/1978 for details
        # These should be upstreamed after further testing, at which point we can drop our fork.
        0001-station-avoid-flushing-BSS-cache-on-partial-channel-.patch
        0002-station-protect-pending-BSS-during-connection-attemp.patch

        # Holo: we have intances where a scan request could get stuck and never complete.
        # With this patch we prevent old scan requests to block new connection attempts.
        # Part of https://gitlab.steamos.cloud/deckard/tasks/-/work_items/754
        # TBD if this is a proper fix that should be sent upstream
        0001-station-Cancel-scans-before-connecting.patch

        # Holo: https://gitlab.steamos.cloud/holo-team/tasks/-/work_items/1457
        # Report WPA3-SAE networks as sae in Network.Type
        # At the moment of writing this patch has not been sent upstream yet
        0001-network-report-WPA3-SAE-networks-as-sae-in-Network.patch

        # Holo: https://gitlab.steamos.cloud/deckard/tasks/-/work_items/1019
        # This patch should be sent upstream
        0001-station-only-scan-bands-supported-by-the-adapter.patch
        )
# https://mirrors.edge.kernel.org/pub/linux/network/wireless/sha256sums.asc
sha256sums=('d89a5e45c7180170e19be828f9e944a768c593758094fc57a358d0e7c4cb1a49'
            'SKIP'
            'd5fb4fb864b7a0632117aa2039df535ab5c1d024ae618a1f09e34dfab8ee0cc7'
            'db5e63cf8e7d2071b0048f134e4aebed1f46e0b191cad5530ce99c07b1157b13'
            'cdd07a19f831c5f207817cdf8398a790bb5b233e32bb0e7d7998eb41a1a61763'
            'c160d0c3c7c0219ceff7cf107f8c24c33163c92cee3fc2573c26b1515bd05f22'
            '42dba8b8f2b0d39036df71f4b1887db5915e25ca3575e841d3f5352dfb0d514a'
            'fb573fbea862377ec4ba404b3430f886dee297d6e9e913b47f9f00582a66671a'
            '58614bbc48e03073d9b204b98b9268434529de4bdeb4bd5831ad813cf935472b'
            '5adc33168ee7dd4772d94a2e873952c113bfc91e2cbff41df3243af148738d84'
            '7b7b977afcea1990bbbf204d051b490aa9dfb2d15ac1b7ae9e948662c6566c31'
            '64201400a13d260b28871d8be534e3cb1cedcbe947cba26388103f15570b5402')
validpgpkeys=('E932D120BC2AEC444E558F0106CA9F5D1DCF2659')
# https://lore.kernel.org/iwd/20240122104541.74f1a697@workstation64.local/T/#u
options=('!lto')

prepare() {
  cd ${pkgname}-${pkgver}
  # replace Debian "netdev" group with existing "network" group
  # for unprivileged access to iwd - avoid also log spam
  # https://gitlab.archlinux.org/archlinux/packaging/packages/iwd/-/issues/2 + #3
  patch -Np1 -i ../0001-use-network-group-for-unprivileged-access.diff

  # fixes for https://www.openwall.com/lists/oss-security/2026/08/02/2
  # see https://github.com/abhinavagarwal07/iwd-security-poc/blob/main/patches/README.md
  patch -Np1 -i ../0001-rrm-fix-stack-buffer-overflow-in-rrm_report_beacon_r.patch
  patch -Np1 -i ../0002-ie-fix-off-by-one-in-HE-Capabilities-Channel-Width-S.patch
  patch -Np1 -i ../0003-ft-fix-mde_equal-self-comparison-and-type-mismatch.patch
  patch -Np1 -i ../0004-ie-fix-uint8_t-underflow-in-FTE-sub-element-parser.patch

  # Holo: fix iwd flush expiration behavior
  patch -Np1 -i ../0001-station-avoid-flushing-BSS-cache-on-partial-channel-.patch
  # Holo: protect pending BSS ids during connection
  patch -Np1 -i ../0002-station-protect-pending-BSS-during-connection-attemp.patch
  # Holo: cancel eventual stuck scan request before connecting
  patch -Np1 -i ../0001-station-Cancel-scans-before-connecting.patch
  # Holo: report WPA3-SAE networks as sae in Network.Type
  patch -Np1 -i ../0001-network-report-WPA3-SAE-networks-as-sae-in-Network.patch
  # Holo: station: only scan bands supported by the adapter
  patch -Np1 -i ../0001-station-only-scan-bands-supported-by-the-adapter.patch

  # https://lore.kernel.org/iwd/20240122105312.66fb4dbf@workstation64.local/T/#u
  # disable one expected test failure - requires a kernel module we cannot load
  # from inside the chroot
  # Holo: Disable test-wsc, which fails in CI
  sed -i "s:unit/test-wsc::" Makefile.am
  # and another failing test that depends on AES_CTR not available
  sed -i "s:unit/test-storage::" Makefile.am
  # and more since 3.10 - they don't fail building locally
  # Holo: Disable tests relying on `AF_ALG` which don't have a runtime
  # pre-check. `AF_ALG` has been disabled in CI as a workaround for
  # CVE-2026-31431.
  sed -i "s:unit/test-eap-sim::" Makefile.am
  # sed -i "s:unit/test-crypto::" Makefile.am
  # sed -i "s:unit/test-eapol::" Makefile.am
  autoreconf -vfi
}

build() {
  cd ${pkgname}-${pkgver}
	dbus-run-session ./configure --prefix=/usr \
	--sysconfdir=/etc \
	--localstatedir=/var \
	--libexecdir=/usr/lib/iwd \
	--enable-external-ell \
	--enable-wired \
	--enable-ofono \
	--enable-hwsim \
	--disable-tools
  make
}

check() {
  cd ${pkgname}-${pkgver}
  make check
}

package() {
  cd ${pkgname}-${pkgver}
  make install DESTDIR="${pkgdir}"
  install -Dm 644 README -t "${pkgdir}/usr/share/doc/${pkgname}"
}
