Fix git permission issue in debian build

Add new ENV vars and enhancements to build tools

build/debian/Makefile

@@ -1,4 +1,11 @@
 
+EXTRA_DIRS=packages repository extra
+
+-include Makefile.local
+
+all: cpan openxpki repo test
+
+Makefile.local: ;
 
 build-deps.lst:
 	cp ../../package/debian/build-deps.lst .
@@ -15,17 +22,22 @@ build-nocache: build-deps.lst
 upload:
 	rsync -av repository/* packages.openxpki.org:/var/www/hosts/packages.openxpki.org/v3/debian/
 
-repo:
+$(EXTRA_DIRS):
+	mkdir -m 755 -p $@
+
+repo: repository extra packages
 	docker run --rm -ti \
-		-v $(abspath ../../):/openxpki \
+		-v $(abspath ../../):/openxpki:ro \
 		-v $(abspath repository):/repository \
 		-v $(abspath extra:/extra-packages) \
 		-v $(abspath packages):/packages \
-		-v $(abspath secret/debian2021.key):/signkey oxibuilder4debian repo
+		-v $(abspath secret/debian2021.key):/signkey:ro oxibuilder4debian repo
 
-%:
+%: packages
 	docker run --rm -ti \
-	    -v $(abspath ../../):/openxpki \
+	    -v $(abspath ../../):/openxpki:ro \
 		-v $(abspath deps):/deps \
 		-v $(abspath packages):/packages \
+		-e OPENXPKI_BUILD_DEBUG=${OPENXPKI_BUILD_DEBUG} \
+		-e OPENXPKI_BUILD_TAG=${OPENXPKI_BUILD_TAG} \
 		oxibuilder4debian $@

build/debian/README.md

@@ -3,6 +3,10 @@ Docker Setup to Build OpenXPKI for Debian
 
 This directory provides a docker setup to build and sign packages for debian.
 
+The default is to build the top commit of the current branch. You can set
+OPENXPKI_BUILD_TAG to a commit or tag to build instead of HEAD but the
+target must be in the current branch.
+
 Step 1 - Container
 ------------------
 
@@ -11,7 +15,7 @@ Call `make build` or `make build-nocache` to create the docker container.
 Step 2 - CPAN Deps
 ------------------
 
-Create the directory `deps` and but any requried extra build dependancy
+Create the directory `deps` and put any requried extra build dependency
 packages there, this is required to build e.g. the perl packages for
 LibSCEP (`make Crypt__LibSCEP`).
 

build/debian/build-in-docker.sh

@@ -1,5 +1,8 @@
 #!/bin/bash
 
+if [ -n "$OPENXPKI_BUILD_DEBUG" ]; then
+    set -x
+fi
 set -e
 
 if [ ! -e "/openxpki/.git" ]; then
@@ -36,12 +39,18 @@ fetchgit() {
 
     cd /tmp
 
+    git config --global --add safe.directory /openxpki
     # code repo including git repo with a checkedout branch must be mounted at /openxpki
     # we clone the currently checked out branch from the mountpoint to /tmp
     mybranch=$(git -C /openxpki rev-parse --abbrev-ref HEAD)
     git clone /openxpki --branch "$mybranch" --single-branch
+
     cd openxpki
 
+    if [ $OPENXPKI_BUILD_TAG ]; then
+        git checkout $OPENXPKI_BUILD_TAG
+    fi
+
     git submodule init
     git submodule update --checkout
     HEAD=`git -C config rev-parse HEAD | cut -c1-6`

build/debian/reprepro/options

@@ -1,3 +1,2 @@
 verbose
 ask-passphrase
-keepunusednewfiles