Knowledge Base (Posts about dpkg)

Initialize a dpkg for building

bgstack15 — Mon, 26 Jan 2026 13:38:00 GMT

I talk about debuild a lot. Sometimes I build a new package that has no dpkg recipe yet, but I have to start somewhere.

To build a suitable tarball without git archive stuff (no scm in today's case), you can run this.

debmake -p paint -u 0.0.1 -r '1+stackrpms' -z=tar.gz -t

Customize the build recipe. For quite a while now, I've been putting the install process in file src/Makefile, and my debian/rules points to that source directory. It's nice and simple, with minimal effort needed on the dpkg instructions level. I want to be flexible in case I get around to building rpms again, or change package formats. I don't see that happening, but you never know. Make is probably the lowest common denominator: Pretty much any package manager will be able to use one.

And then a nice short debuild to build the package.

sorting all package releases in my dev directory

bgstack15 — Sun, 23 Nov 2025 13:54:00 GMT

I needed to build a custom release of systemctl-service-shim, which is my package in Devuan GNU+Linux, which provides a script that translates systemctl commands into the real commands (service and update-rc.d primarily).

The reason for this package is not directly related to the nifty main contents, but I was attempting to install a kernel specifically Surface 3 tablet computer in the Devuan installation, and some of the packages list a dependency on systemd.

I wanted to make a package for myself on the internal repository, because I needed to build a copy of the package that Provides: systemd. And I wanted to use a different version suffix orand suite value. You know, the unstable from this line of a debian/changelog file.

systemctl-service-shim (0.0.9) unstable; urgency=medium

And I wasn't sure what I tend to use internally, so I whipped up this interesting oneliner.

$ grep -h -o --include 'changelog*' -riIP '\w+(?=; urgency)' | awk '{a[$0]++} END{for(i in a){print i":"a[i]}}' | sort -t':' -k2 -rn
unstable:3390
obs:1069
experimental:813
UNRELEASED:276
internal3:84
manual:70
mx:34
vivid:28
bionic:18
mepis:14
stable:13
trusty:10
lucid:10
saucy:6
raring:4
precise:3
xenial:2
maverick:2
jammy:2
intrepid:2
updates:1
OBS:1
groovy:1

So I used internal3 for my custom package of systemctl-service-shim.

systemctl-service-shim (0.0.9+stackrpms) internal3; urgency=medium

  [ B. Stack ]
  * Custom build that says it Provides: systemd.

 -- B. Stack <bgstack15@gmail.com>  Tue, 04 Nov 2025 08:36:51 -0500

Package for Devuan: mineclonia

bgstack15 — Sun, 28 Sep 2025 12:54:00 GMT

Just like last time where I wanted to package the Halon Luanti fork customized for Mineclonia, now I've done it in a dpkg! You can go get the package from my OBS repo, and my build recipe is a hard fork of the Salsa luanti recipe.

So now I can just apt-get install mineclonia and not depend on Flatpak anymore!

Just to reiterate for anyone who won't click through to the previous post, this dpkg recipe uses the custom fork of the game engine with its client side mod that provides better player physics than base Luanti can.

OBS and build dpkgs note

bgstack15 — Thu, 26 Sep 2024 12:31:00 GMT

The Open Build Service is fantastic. I need to figure how to donate a little money to the SuSE team that offers this to free software admins like me.

Their documentation is really hard to find, so when I had a new configuration for a _service file (seen below), I ran into a problem.

<services>
   <service name="tar_scm">
      <param name="scm">git</param>
      <param name="url">https://bgstack15.ddns.net/cgit/stackrpms</param>
      <param name="subdir">debian</param>
      <param name="filename">for-dsc-only</param>
      <param name="revision">master</param>
      <param name="version">_none_</param>
   </service>
   <service name="recompress">
      <param name="file">*.tar</param>
      <param name="compression">xz</param>
   </service>
   <service name="tar_scm">
      <param name="scm">git</param>
      <param name="url">https://bgstack15.ddns.net/cgit/fprintd-tk</param>
      <param name="subdir">debian</param>
      <param name="filename">debian</param>
      <param name="revision">master</param>
      <param name="version">_none_</param>
   </service>
   <service name="recompress">
      <param name="file">*.tar</param>
      <param name="compression">xz</param>
   </service>
   <service name="tar_scm">
      <param name="scm">git</param>
      <param name="url">https://bgstack15.ddns.net/cgit/fprintd-tk</param>
      <param name="revision">master</param>
      <param name="version">_none_</param>
   </service>
   <service name="recompress">
      <param name="file">*.tar</param>
      <param name="compression">gz</param>
   </service>
   <service name="extract_file">
      <param name="archive">for-dsc-only.tar.xz</param>
      <param name="files">*/*.dsc</param>
   </service>
</services>

The above is almost my standard method for pulling down the *.dsc file that tells OBS we are building a dpkg, and the source tarball. This time, we are pulling down the .dsc file in an archive separately from even the rest of the debian/ build recipe. And this method fails with an error:

 Too many files looking like a usable source tarball (would not know which to pick): fprintd-tk.tar.xz for-dsc-only.tar.xz

The solution, which was available after searching the Internet, should have been to add a debtransform command in the .dsc file:

DEBTRANSFORM-TAR: fprintd-tk.tar.xz

And that accepts things like @VERSION@ but I haven't bothered with that. I took the quicker, dirtier method in a later comment, which is to modify the _service definition.

The snippet that matters:

   <service name="tar_scm">
      ...
      <param name="extension">tar_</param>
      <param name="extract">*.dsc</param>
   </service>

And man, I never knew about the extract parameter before. Remember how those docs are hard to find? (And actually, in the documentation I could find nothing described parameter "extract" for service "tar_scm".

The full service definition is below.

<services>
   <service name="tar_scm">
      <param name="scm">git</param>
      <param name="url">https://bgstack15.ddns.net/cgit/stackrpms</param>
      <param name="subdir">fprintd_tk/debian</param>
      <param name="filename">for-dsc-only</param>
      <param name="extension">tar_</param>
      <param name="revision">master</param>
      <param name="version">_none_</param>
      <param name="extract">*.dsc</param>
   </service>
   <service name="tar_scm">
      <param name="scm">git</param>
      <param name="url">https://bgstack15.ddns.net/cgit/fprintd-tk</param>
      <param name="subdir">debian</param>
      <param name="filename">debian</param>
      <param name="revision">master</param>
      <param name="version">_none_</param>
   </service>
   <service name="recompress">
      <param name="file">*.tar</param>
      <param name="compression">xz</param>
   </service>
   <service name="tar_scm">
      <param name="scm">git</param>
      <param name="url">https://bgstack15.ddns.net/cgit/fprintd-tk</param>
      <param name="revision">master</param>
      <param name="version">_none_</param>
   </service>
   <service name="recompress">
      <param name="file">*.tar</param>
      <param name="compression">gz</param>
   </service>
</services>

updating set-my-repos.sh for deb822 format

bgstack15 — Sat, 14 Sep 2024 12:33:00 GMT

I've previously described set-my-repos.sh in a multitude of posts:

I've updated my process to work with deb822 format, which ironically is not fully documented there, and you have to read manpages.debian.org to understand all the fields.

A major improvement to this whole process is that I no longer need a custom /etc/apt/apt.conf.d/52apt-file-stackrpms.conf file at all. Because you can specify Components, or just omit that, apt will then figure out the Contents sections correctly!

The downside is that because I'm not storing the original upstream url for the OBS repositories in, for example, a separate file, and because I resign the repository (so I can include the older versions of dpkgs in the repo), the gpg keys won't match even if I use the upstream url. I should probably bother to set up a "Enabled: no" version of "OBS bgstack15-upstream" repo files, but I haven't bothered to do that yet.

I don't think one-line-style format is going away anytime soon, but I liked the idea of using the newer option, and it had that awesome bonus of not needing the custom apt-file config (which was flaky).

You can see the old version (from my 2024-05-05 post linked earlier) here

files/2024/listings/set-my-repos-2024-09.sh (Source)

#!/bin/sh
# File: /mnt/public/Support/Platforms/devuan/set-my-repos.sh
# Location:
# Author: bgstack15
# Startdate: 2019-08-10 16:02
# Title: Script that Establishes the repos needed for Devuan
# Purpose: Set up the 3 repos I always need on devuan clients
# History:
#    2020-02-01 customize clients for devuan-archive
#    2020-10-23 add apt-file compatibility
#    2021-01-27 disable devuan-archive
#    2024-01-03-4 14:53 add pref for zenity with gtk3
#    2024-09-12-5 13:52 use deb822 format sources now
# Usage:
#    sudo set-my-repos.sh
# Reference:
#    /mnt/public/Support/Platforms/devuan/devuan.txt
# Improve:
#    need to control the sources.list file itself to have the main, contrib, etc., for ceres.
# Documentation:

test -z "${ALLREPOSGLOB}" && ALLREPOSGLOB="/etc/apt/sources.list /etc/apt/sources.list.d/*"
test -z "${REPOSBASE}" && REPOSBASE="/etc/apt/sources.list.d"
test -z "${PREFSBASE}" && PREFSBASE="/etc/apt/preferences.d"
test -z "${ADDLCONFBASE}" && ADDLCONFBASE="/etc/apt/apt.conf.d"

# confirm key
confirm_key() {
   # call: confirm_key "${PRETTYNAME}" "${SEARCHPHRASE}" "${URL_OF_KEY}"
   ___ck_repo="${1}"
   ___ck_sp="${2}"
   ___ck_url="${3}"
   if apt-key list 2>/dev/null | grep -qe "${___ck_sp}" ;
   then
      :
   else
      # not found so please add it
      echo "Adding key for ${___ck_repo}" 1>&2
      #wget -O- "${___ck_url}" | sudo apt-key add -
      ___ck_keyfile="/etc/apt/trusted.gpg.d/$( echo "${___ck_repo}" | tr '[: ]' '_' ).gpg"
      wget -O- --quiet "${___ck_url}" | gpg --dearmor | sudo tee "${___ck_keyfile}" 1>/dev/null
   fi
}

# confirm repo
confirm_repo() {
   # call: confirm_repo "${PRETTYNAME}" "${SEARCHPHRASE}" "${SEARCHGLOB}" "${FULLSTRING}" "${PREFERRED_FILENAME}" "${OVERWRITE}"
   ___cr_repo="${1}"
   ___cr_sp="${2}"
   ___cr_sf="${3}"
   ___cr_full="${4}"
   ___cr_pref="${5}"
   ___cr_overwrite="${6}"
   if ! grep -E -qe "${___cr_sp}" ${___cr_sf} ;
   then
      # not found so please add it to preferred file
      echo "Adding repo ${___cr_repo}" 1>&2
      if test "${___cr_overwrite}" = "true" ;
      then
         # overwrite, instead of append
         echo "${___cr_full}" > "${REPOSBASE}/${___cr_pref:-99_misc.list}"
      else
         echo "${___cr_full}" >> "${REPOSBASE}/${___cr_pref:-99_misc.list}"
      fi
   fi
}

confirm_sources() {
   # call: confirm_sources "${PRETTYNAME}" "${URIS}" "${SUITES}" "${SIGNEDBY}" "${FILENAME}" "${OVERWRITE}" "${REMOVE_LISTFILE}"
   __cs_prettyname="${1}"
   __cs_uris="${2}"
   __cs_suites="${3}" # probably will be "/" for my kind of repos
   __cs_signedby="${4}"
   __cs_filename="${5}"
   __cs_overwrite="${6}"
   __cs_remove_listfile="${7}"
   # determine if cs_filename is short, if so, prepend /etc/apt/sources.list.d
   if test "${__cs_filename}" = "$( basename "${__cs_filename}" )" ;
   then
      __cs_filename="/etc/apt/sources.list.d/${__cs_filename}"
   fi
   __cs_listfile="${__cs_filename%%.sources}.list"
   if test "${__cs_listfile}" = "$( basename "${__cs_listfile}" )" ;
   then
      __cs_listfile="/etc/apt/sources.list.d/${__cs_listfile}"
   fi
   # determine of cs_signedby gpg key is short, if so, prepend /etc/apt/trusted.gpg.d
   if test -n "${__cs_signedby}" && test "${__cs_signedby}" = "$( basename "${__cs_signedby}" )" ;
   then
      __cs_signedby="/etc/apt/trusted.gpg.d/${__cs_signedby}"
   fi
   if test ! -r "${__cs_filename}" || test "{__cs_overwrite}" = "true";
   then
      {
         echo "Enabled: yes"
         echo "Types: deb"
         echo "URIs: ${__cs_uris}"
         echo "Suites: ${__cs_suites}"
         test -n "${__cs_prettyname}" && echo "X-Repolib-Name: ${__cs_prettyname}" || :
         test -n "${__cs_signedby}" && echo "Signed-By: ${__cs_signedby}"
      } > "${__cs_filename}"
   fi
   test "${__cs_remove_listfile}" = "true" && test -f "${__cs_listfile}" && echo "${__cs_listfile}" | grep -qE "\/etc\/apt\/sources\.list\.d\/.+\.list$" 1>/dev/null 2>&1 && rm -f "${__cs_listfile}"
}

confirm_preferences() {
   # call: confirm_preferences "${PRETTYNAME}" "${FILENAME}" "{PACKAGE}" "${PIN_EXPRESSION}" "{PRIORITY}"
   ___cp_prettyname="${1}"
   ___cp_pref="${2}"
   ___cp_package="${3}"
   ___cp_pin_expression="${4}"
   ___cp_priority="${5}"
   ___cp_version="${6}"

   ___cp_tempfile="$( mktemp )"
   {
      echo "Package: ${___cp_package}"
      test -n "${___cp_version}" && echo "Version: ${___cp_version}"
      echo "Pin: ${___cp_pin_expression}"
      echo "Pin-Priority: ${___cp_priority}"
   } > "${___cp_tempfile}"

   diff "${PREFSBASE}/${___cp_pref}" "${___cp_tempfile}" 1>/dev/null 2>&1 || {
      echo "Setting preferences for ${___cp_prettyname}"
      touch "${PREFSBASE}/${___cp_pref}" ; chmod 0644 "${PREFSBASE}/${___cp_pref}"
      cat "${___cp_tempfile}" > "${PREFSBASE}/${___cp_pref}"
   }

   rm -f "${___cp_tempfile:-NOTHINGTODEL}" 1>/dev/null 2>&1
}

# REPO 1: local internaldeb
confirm_key "internaldeb" "bgstack15.*www\.no-ip\.biz" "http://server3/internal/repo/deb/internaldeb.gpg"
confirm_sources "Internal Dpkg repo" "http://server3/internal/repo/deb" "/" "internaldeb.gpg" "internaldeb.sources" "true" "true"

# REPO 2: local devuan-deb
confirm_key "devuan-deb" "bgstack15.*www\.no-ip\.biz" "http://server3/internal/repo/deb/internaldeb.gpg"
confirm_sources "Internal Devuan dpkgs" "http://server3/internal/repo/devuan-deb" "/" "internaldeb.gpg" "devuan-deb.sources" "true" "true"

# REPO 3: local obs
# Thankfully I re-sign this with my own key.
#confirm_key "OBS bgstack15" "bgstack15@build\.opensuse\.org" "https://download.opensuse.org/repositories/home:bgstack15/Debian_Unstable/Release.key"
confirm_key "OBS bgstack15" "bgstack15.*www\.no-ip\.biz" "http://server3/mirror/obs/Release.key"
confirm_sources "OBS bgstack15" "http://server3/mirror/obs" "/" "OBS_bgstack15.gpg" "home:bgstack15.sources" "true" "true"

# REPO 4: local devuan-archive
# deprecated circa 2021-05
# enabled again 2023-08-22 for discord/gconf
confirm_key "devuan-archive" "bgstack15.*www\.no-ip\.biz" "http://server3/internal/repo/deb/internaldeb.gpg"
confirm_sources "Internal Devuan archive" "http://server3.ipa.internal.com/internal/repo/devuan-archive" "/" "internaldeb.gpg" "devuan-archive.sources" "true" "true"
confirm_preferences "devuan-archive" "puddletag" "*" "origin server3.ipa.internal.com" "700"

# REPO 5: local obs-aftermozilla key for non-local aftermozilla repo
# just the key
#confirm_key "OBS bgstack15 aftermozilla" "bgstack15@build\.opensuse\.org" "https://download.opensuse.org/repositories/home:bgstack15:aftermozilla/Debian_Unstable/Release.key"

# REPO 5: local obs-AfterMozilla
#confirm_key "OBS bgstack15" "bgstack15@build\.opensuse\.org" "http://server3/mirror/obs/Release.key"
confirm_key "OBS bgstack15" "bgstack15.*www\.no-ip\.biz" "http://server3/mirror/obs/Release.key"
confirm_sources "OBS AfterMozilla" "http://server3/mirror/obs-AfterMozilla" "/" "OBS_bgstack15.gpg" "home:bgstack15:AfterMozilla.sources" "true" "true"

# REPO 6: local obs-gtk3-classic
confirm_key "OBS bgstack15" "bgstack15.*www\.no-ip\.biz" "http://server3/mirror/obs/Release.key"
confirm_sources "OBS gtk3-classic" "http://server3/mirror/obs-gtk3-classic" "/" "OBS_bgstack15.gpg" "home:bgstack15:gtk3-classic.sources" "true" "true"

# ADDITIONAL APT PREFS
# important for the [target] stuff to work on repos so apt-file can work
#cp -p "$( dirname "$( readlink -f "${0}" )")/input/52apt-file-stackrpms.conf" "${ADDLCONFBASE}/"
rm -f "${ADDLCONFBASE}/52apt-file-stackrpms.conf" 2>/dev/null || :
# 2023-10-27-6 08:47 use apt-preferences to hold this exact app version because newer versions remove the system tray icon.
confirm_preferences "all" "krb5-auth-dialog" "krb5-auth-dialog" "release" "1000" "3.26.1-4"
# zenity with gtk3 is stored in devuan-deb
confirm_preferences "all" "zenity" "zenity" "release" "600" "3.44.2-1"
confirm_preferences "all" "zenity-common" "zenity-common" "release" "600" "3.44.2-1"

Basically, a new style repo looks like:

Enabled: yes
Types: deb
URIs: http://server3/internal/repo/deb
Suites: /
X-Repolib-Name: Internal Dpkg repo
Signed-By: /etc/apt/trusted.gpg.d/internaldeb.gpg

Which is easier for some parsing compared to:

deb [target-=Contents-deb target+=Contents-stackrpms] http://server3/internal/repo/deb/ /

Which is believable.

How I use quilt

bgstack15 — Tue, 27 Dec 2022 13:46:21 GMT

To summarize my notes from a conversation about building dpkgs:

In a debuild (which calls dpkg-buildpackage) operation, it will run quilt push -a to apply all patches listed in debian/patches/series. This process is not tolerant of any fuzz. It's not clear from a debuild operation if it's fuzz or if it actually failed. I always have to manually quilt push iteratively (or quilt push -a to go through them until it stops). When you manually run quilt push it will tolerate fuzz but not errors. If a patch indicates that it has fuzz, before pushing the next patch, you run quilt refresh to refresh the current top-most patch. That's how I make the de-fuzzed patch files nowadays. If a patch has actual errors, you have to run quilt push -f (and notably there are not long-option equivalent parameters) to force the patch, and then you have to manually fix the errors and then run quilt refresh. It gets messy and it's not my favorite tool, but I've finally started understanding it just a little bit better.

One should read Using Quilt which is the official documentation for it.

edited 2023-07-24

My quiltrc is:

for where in ./ ../ ../../ ../../../ ../../../../ ../../../../../; do
    if [ -e ${where}debian/rules -a -d ${where}debian/patches ]; then
        export QUILT_PATCHES=debian/patches
        break
    fi
done
QUILT_PUSH_ARGS="--color=auto"
QUILT_DIFF_ARGS="--no-timestamps --no-index -p ab --color=auto"
QUILT_REFRESH_ARGS="--no-timestamps --no-index -p ab"
QUILT_DIFF_OPTS='-p'

Dpkg recipe for NotepadNext

bgstack15 — Tue, 19 Apr 2022 12:45:45 GMT

I saw an article on Hacker News about NotepadNext, a project that is a QT-based, cross-platform reimplementation of my beloved Notepad++. I couldn't find any dpkg implementations of NotepadNext, so I decided to take that mantle up for myself. Upstream wasn't interested in housing the debian directory because they want to use Flatpak or AppImage or some other short-term trendy package format.

Here is my debian/ for you.

The only noteworthy parts are in d/rules:

# Omit -Werror=format-security with -format here, because of LuaExtension.cpp weirdness, 2022-04-14
export DEB_BUILD_MAINT_OPTIONS = hardening=+all,-format

%:
    dh $@ --buildsystem=qmake --sourcedirectory=src/NotepadNext

override_dh_auto_build:
    mkdir build || :
    cd build ; pwd ; qmake6 ../src/NotepadNext.pro; make

override_dh_auto_clean:
    dh_auto_clean
    rm -rf build/ || :

Thanks to the AUR PKGBUILD for the guidance on the build steps!

Just build the dpkg and ignore supposed changes to the source

bgstack15 — Sat, 01 Jan 2022 14:15:58 GMT

Extra note

Happy new year!

Main content

My normal, local dpkg build process includes debuild -us -uc. I push my finished work up to the Devuan build server through a gitea issue on the relevant project repository.

Sometimes, when I'm still in the process of preparing the software (in this case, freeipa 4.9.8), I will do a local build to make sure it still compiles. And sometimes I get a ridiculous error from debuild:

The solution is to skip debuild and use the lower-level command:

dpkg-buildpackage -b -us -uc

The answerer on Ask Ubuntu described this step as "avoid[ing] the Debian bureaucracy," which is an incredibly apt phrase.

References

compiling - How to solve dpkg-source source problem when building a package? - Ask Ubuntu

Package for Devuan: dragon-drag-and-drop

bgstack15 — Fri, 29 Jan 2021 14:12:59 GMT

I recently came across a great little project, dragon, which is a simple drag-and-drop source/sink for X11. This project follows the Unix concept of do one thing and do it well. The program was designed for users who do not use a graphical file manager, but want to be able to drag and drop files (into a web browser, for example). It has minimal dependencies, and is a breeze to compile and install and use. My contributions to the project include the packaging recipes for dpkg and rpm. You can go get dragon-drag-and-drop from my OBS repository.

LibreWolf dpkg for Debian is now available

bgstack15 — Sun, 27 Dec 2020 13:45:58 GMT

I recently came across the LibreWolf project, which is a community that maintains a set of patches on top of current Firefox, to stay focused on privacy. I wrote a script that builds the assets required to build a dpkg of Librewolf. I submitted a merge request to the LibreWolf team to include this script. You can go download LibreWolf for Devuan and Debian from my OBS space. In case I ever purge my gitlab space, here is the script and its conf file.

#!/bin/sh
# File: prep-librewolf-dpkg.sh
# Location: https://gitlab.com/bgstack15/librewolf-linux.git
# Latest supported version: librewolf-83.0-1
# Author: bgstack15
# SPDX-License-Identifier: CC-BY-SA-4.0
# Startdate: 2020-11-29
# Title: Build Dpkg for LibreWolf
# Purpose: Prepare initial assets for running "dpkg-buildpackage -b -us -uc" for LibreWolf by adapting Debian Firefox assets
# History:
# Usage:
#    Can send these final assets up to Open Build Service
# References:
#    Script numbers from https://gitlab.com/librewolf-community/browser/linux/-/tree/master/binary_tarball/scripts
# Improve:
#    Make this idempotent. Right now it is very much not.
# Dependencies:
#    wget, git, tar, awk, sed

#####################################
# Load settings

# basically, dot-source the conf file.
test -z "${librewolf_dpkg_conf}" && export librewolf_dpkg_conf="$( find "$( dirname "${0}" )" -maxdepth 2 -name "$( basename "${0%%.sh}.conf" )" -print 2>/dev/null | head -n1 )"
test ! -r "${librewolf_dpkg_conf}" && { echo "Unable to load config file, which should be named the same as this script but with a .conf ending. Aborted." 1>&2 ; exit 1 ; }
. "${librewolf_dpkg_conf}"

#####################################
# Download initial components

# Download upstream Debian assets, which includes
#   1. orig tarball, which in Debian is not always the pristine contents from upstream source
#   2. debian/ directory which defines how to build a package for Debian
#   3. Debian source package control file
cd "${work_dir}"
test -z "${SKIP_DOWNLOAD}" && {
   wget --content-disposition http://deb.debian.org/debian/pool/main/f/firefox/firefox_"${firefox_version}".orig.tar.xz # -O librewolf_"${firefox_version}".orig.tar.xz
   wget --content-disposition http://deb.debian.org/debian/pool/main/f/firefox/firefox_"${debian_firefox_version}".debian.tar.xz # -O librewolf_"${debian_firefox_version}".debian.tar.xz
   wget --content-disposition http://deb.debian.org/debian/pool/main/f/firefox/firefox_"${debian_firefox_version}".dsc # -O librewolf_"${debian_firefox_version}".dsc
}

# extract these contents to where they belong
mkdir -p "${source_dir}"
test -z "${SKIP_EXTRACT}" && {
   echo "Extracting files from orig and debian tarballs. This might take a while." 1>&2
   tar -C "${source_dir}" -Jx --strip-components=1 -f firefox_"${firefox_version}".orig.tar.xz
   tar -C "$( dirname "${debian_dir}" )" -Jxf firefox_"${debian_firefox_version}".debian.tar.xz
   # dsc file is a text file and needs no extraction
}

# Download git sources
test -z "${SKIP_GIT}" && (
   # yes, use a sub-shell because of this cd. pushd is a bash builtin, but we are using sh and not bash.
   cd "${git_source_dir}"
   git clone "${librewolf_common_url}" common
   git clone "${librewolf_settings_url}" settings
   git clone "${librewolf_linux_url}" linux
)

#####################################
# Script 1 tasks

# update debian/control file
# update fields and add libjack-dev
sed -i -r "${debian_dir}"/control \
   -e '/^[[:alpha:]]+: firefox/s/firefox/librewolf/' \
   -e '/^Package:.*-l10/,$d' \
   -e '/^Maintainer:/{s/Maintainer:/XSBC-Original-Maintainer:/;iMaintainer: B. Stack <bgstack15@gmail.com>' -e '}' \
   -e '/^Uploaders:/d' \
   -e '/libasound2-dev/s/libasound2-dev,/libasound2-dev, libjack-dev,/;' \
   -e '/^Vcs-/d' \
   -e '/Breaks:.*xul-ext-torbutton/d' \
   -e '/Description:/,+8{/Description:/,/^\s*$/d}'
cat <<'EOF' >> "${debian_dir}"/control
Description: LibreWolf variant of Mozilla Firefox web browser
 LibreWolf is a build of Firefox that seeks to protect user privacy,
 security, and freedom.
EOF

#####################################
# Script 2 tasks

# none. Dependencies are handled by the build environment by interpreting the dsc file.

#####################################
# Script 3 tasks

# overlay the orig tarball contents with LibreWolf contents
# LibreWolf branding
cp -pr "${git_source_dir}"/common/source_files/browser/branding "${source_dir}"/browser/
# update mozconfig with needed info
sed -i -e '/with-app-name=/d' "${debian_dir}"/browser.mozconfig.in
cat <<EOF >> "${debian_dir}"/browser.mozconfig.in

# Start of LibreWolf effects
ac_add_options --disable-tests
ac_add_options --disable-debug

ac_add_options --prefix=/usr
ac_add_options --enable-release
ac_add_options --enable-hardening
ac_add_options --enable-rust-simd

# Branding ac_add_options --enable-update-channel=release 
ac_add_options --with-app-name=librewolf
ac_add_options --with-app-basename=LibreWolf
ac_add_options --with-branding=browser/branding/librewolf
ac_add_options --with-distribution-id=io.gitlab.librewolf
ac_add_options --with-unsigned-addon-scopes=app,system
ac_add_options --allow-addon-sideload
export MOZ_REQUIRE_SIGNING=0

# Features
ac_add_options --enable-jack
ac_add_options --disable-crashreporter

# Disables crash reporting, telemetry and other data gathering tools
mk_add_options MOZ_CRASHREPORTER=0
mk_add_options MOZ_DATA_REPORTING=0
mk_add_options MOZ_SERVICES_HEALTHREPORT=0
mk_add_options MOZ_TELEMETRY_REPORTING=0

ac_add_options --disable-elf-hack

# LibreWolf binary release uses clang-11 but Debian builds Firefox with gcc so this is irrelevant.
#export CC='clang-11'
#export CXX='clang++-11'
#export AR=llvm-ar-11
#export NM=llvm-nm-11
#export RANLIB=llvm-ranlib-11

ac_add_options --enable-optimize
EOF

# add patches to debian/patches
mkdir -p "${debian_dir}"/patches/librewolf
cp -pr "${git_source_dir}"/linux/megabar.patch "${git_source_dir}"/linux/remove_addons.patch \
   "${git_source_dir}"/linux/deb_patches/*.patch \
   "${debian_dir}"/patches/librewolf/
cat <<EOF >> "${debian_dir}"/patches/series
librewolf/lower-python3-requirement.patch -p1
librewolf/armhf-reduce-linker-memory-use.patch -p1
#librewolf/build-with-libstdc++-7.patch -p1
librewolf/fix-armhf-webrtc-build.patch -p1
librewolf/webrtc-fix-compiler-flags-for-armhf.patch -p1
librewolf/python3-remove-variable-annotations.patch -p1
librewolf/python3-remove-fstrings.patch -p1
librewolf/python3-remove-pep487.patch -p1
librewolf/silence-gtk-style-assertions.patch -p1
librewolf/sandbox-update-arm-syscall-numbers.patch -p1
librewolf/remove_addons.patch -p1
librewolf/megabar.patch -p1
EOF
# observe that build-with-libstdc++-7 is disabled for this dpkg. Debian builds Firefox with gcc, not clang.
# fix some fuzz in remove_addons.patch. The space is important!
sed -i -r -e 's/libs /l10n /;' "${debian_dir}"/patches/librewolf/remove_addons.patch

# additional main LibreWolf activities
# disable pocket in source
sed -i "/'pocket'/d" "${source_dir}"/browser/components/moz.build
sed -i "/SaveToPocket\.init/d" "${source_dir}"/browser/components/BrowserGlue.jsm
# Remove internal plugin certificates
sed -i -r -e '/organizationalUnit.{0,5}=.{0,5}Mozilla/{N;N;N;d}' "${source_dir}"/toolkit/mozapps/extensions/internal/XPIInstall.jsm
# allow SearchEngines option in non-ESR builds
sed -i -r -e '/enterprise_only/s#true#false#g;' "${source_dir}"/browser/components/enterprisepolicies/schemas/policies-schema.json

#####################################
# Script 4 tasks

sed -i -r -e '2{
   iexport DEB_BUILD_HARDENING=1
   ;iexport DEB_BUILD_HARDENING_STACKPROTECTOR=1
   ;iexport DEB_BUILD_HARDENING_FORTIFY=1
   ;iexport DEB_BUILD_HARDENING_FORMAT=1
   ;iexport DEB_BUILD_HARDENING_PIE=1
   ;iexport CPP
}
/^EXPORTS/{
   iCPPFLAGS += -D_FORTIFY_SOURCE=2
   ;iCFLAGS += -march=x86-64 -mtune=generic -O2 -pipe -fno-plt
   ;iCXXFLAGS += -march=x86-64 -mtune=generic -O2 -pipe -fno-plt
   ;iLDFLAGS += -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now
}
2{
   iexport MOZ_NOSPAM=1
   iexport MACH_USE_SYSTEM_PYTHON=1
}
' "${debian_dir}"/rules

#####################################
# Additional steps for dpkg implementation

# fix the binary name that gets installed in /usr/bin, and disable crash reporter by changing what variable name it looks for that will enable it
sed -i -e '/%if browser/,+2s/firefox/librewolf/' \
   -e '/%if CRASH_REPORTER/s/CRASH_REPORTER/CRASH_REPORTER_ENABLED/' \
   "${debian_dir}"/browser.install.in

# add changelog contents for LibreWolf
new_changelog="$( mktemp )"
{
   cat <<EOF
librewolf (83.0-1) unstable; urgency=low

  * Fork to librewolf release

 -- B. Stack <bgstack15@gmail.com>  $( date "+%a, %d %b %+4Y %T %z" )

EOF
   cat "${debian_dir}"/changelog
} > "${new_changelog}"
cat "${new_changelog}" > "${debian_dir}"/changelog

rm -f "${new_changelog:-NOTHINGTODEL}"

#####################################
# Build new assets 
# dpkg-buildpackage needs the orig tarball, debian tarball, and dsc file.

echo "Building new tarballs. This might take a while." 1>&2

# orig tarball
cd "${work_dir}"
tar -Jc -f librewolf_"${firefox_version}".orig.tar.xz -C "$( dirname "${source_dir}" )" librewolf_"${firefox_version}"

# debian tarball
tar -Jc -f librewolf_"${debian_firefox_version}".debian.tar.xz -C "$( dirname  "${debian_dir}" )" debian

# dsc file, which needs to be modified
cd "${work_dir}"
sed -r \
   -e '/^(Files|Checksums-.{0,8}):/,$d' \
   -e '1,/^Format:/{/^Format:/!{d}}' \
   -e 's/^([[:alpha:]]+:).* firefox(-l10n[^\s]*)*/\1 librewolf/' \
   -e '/firefox-l10n/d' \
   -e '/^Maintainer:/{s/Maintainer:/XSBC-Original-Maintainer:/;iMaintainer: B. Stack <bgstack15@gmail.com>' -e '}' \
   -e '/^Uploaders:/d' \
   -e '/libasound2-dev/s/libasound2-dev,/libasound2-dev, libjack-dev,/;' \
   -e '/^Vcs-/d' \
   -e '/^ firefox/s/firefox/librewolf/g' \
   firefox_"${debian_firefox_version}".dsc > librewolf_"${debian_firefox_version}".dsc
{
   echo "Files:"
   for word in librewolf*z ;
   do
      printf "%s %s\n" "$( stat -c '%s' "${word}" )" "$( md5sum "${word}" )" 
   done | awk '{print " "$2,$1,$3}'
} >> librewolf_"${debian_firefox_version}".dsc

# And now you have in the ${work_dir} location three files.
# librewolf_80.3.orig.tar.xz librewolf_80.3-1.debian.tar.xz librewolf_80.3-1.dsc

And the config file.

# Config file for prep-librewolf-dpkg.sh
# Configure these settings before running that script.

debian_firefox_version=83.0-1       # current version of Firefox package in Debian sid
firefox_version=83.0                # current version of Firefox

librewolf_common_url=https://gitlab.com/librewolf-community/browser/common.git
librewolf_settings_url=https://gitlab.com/librewolf-community/settings.git
librewolf_linux_url=https://gitlab.com/librewolf-community/browser/linux.git

# user configurable
git_source_dir=/usr/src/librewolf # where LibreWolf git contents are cached
debian_dir=/home/librewolf/debian # where the firefox_debian.tar.xz file is extracted
source_dir=/home/librewolf/librewolf_${firefox_version} # where firefox.orig.tar.xz file is extracted with --strip-components=1
work_dir=/home/librewolf