[FIX] systemd without AppArmor, gpgme without its test harness, groff without a logo

gpgme is the one worth reading. It failed while BUILDING, not testing:

  make[3]: Entering directory '.../gpgme/tests/gpg'
  gpgconf: error running '/usr/bin/gpg-connect-agent': exit status 1

EL_NOCHECK skips check(), but `make all` still descends into tests/gpg and sets
up a throwaway GNUPGHOME, which means starting an agent -- and the chroot has no
dbus, no session and no tty. Third time this port has found that "no tests" and
"no test harness" are different requests.

groff needs xpmtoppm from netpbm to draw the GNU logo for its own manual. There
is no configure switch: groff has neither --without-doc nor --disable-doc, so
inventing a flag would have failed identically while the hook's check passed --
autoconf only warns about options it does not know. The generated Makefile's
DOC_GNU_EPS is emptied instead, and the verification runs inside build(), where
the generated file actually exists.

--- FR ---

gpgme mérite lecture. Il échouait en CONSTRUISANT, pas en testant :

  make[3]: Entering directory '.../gpgme/tests/gpg'
  gpgconf: error running '/usr/bin/gpg-connect-agent': exit status 1

EL_NOCHECK saute check(), mais `make all` descend quand même dans tests/gpg et
met en place un GNUPGHOME jetable, donc démarre un agent — or le chroot n'a ni
dbus, ni session, ni terminal. Troisième fois que ce portage constate que « pas
de tests » et « pas de harnais de test » sont deux demandes différentes.

groff a besoin de xpmtoppm, de netpbm, pour dessiner le logo GNU de son propre
manuel. Aucun interrupteur n'existe : ni --without-doc ni --disable-doc, donc
inventer un drapeau aurait échoué à l'identique pendant que le contrôle du hook
passait — autoconf ne fait qu'avertir des options qu'il ignore. La variable
DOC_GNU_EPS du Makefile généré est vidée, et la vérification tourne dans build(),
là où le fichier généré existe.

Assisted-by: Claude Opus 5

patches/pkgbuild/gpgme.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# gpgme: do not build the gpg test harness.
+#
+#   make[3]: Entering directory '.../gpgme/tests/gpg'
+#   gpgconf: error running '/usr/bin/gpg-connect-agent': exit status 1
+#   gpgconf: error running '/usr/bin/gpg-connect-agent KILLDIRMNGR': General error
+#
+# This is not check() -- EL_NOCHECK skips that. gpgme's `make all` descends into
+# tests/gpg and SETS UP a throwaway GNUPGHOME, which means starting an agent.
+# Inside the chroot there is no dbus, no session and no tty, so the agent cannot
+# come up and the setup fails while merely building.
+#
+# --disable-gpg-test is gpgme's own switch, and the PKGBUILD already passes its
+# sibling --disable-gpgsm-test for the same kind of reason. This is the third
+# time this port has found that "no tests" and "no test harness" are different
+# requests: skipping check() does not stop `make all` from building what check()
+# would have run.
+set -euo pipefail
+python3 - <<'ZZPY'
+import io, re
+lines = io.open("PKGBUILD", encoding="utf-8").read().split("\n")
+hit = [i for i, l in enumerate(lines) if re.match(r"^[ \t]*--disable-gpgsm-test", l)]
+assert len(hit) == 1, "gpgme: expected one --disable-gpgsm-test, got %d" % len(hit)
+i = hit[0]
+ind = re.match(r"^[ \t]*", lines[i]).group(0)
+cont = lines[i].rstrip().endswith("\\")
+# Insert BEFORE, so the continuation state of the last option is untouched --
+# adding a line after a final option that has no backslash would end the command.
+lines.insert(i, ind + "--disable-gpg-test \\")
+io.open("PKGBUILD", "w", encoding="utf-8").write("\n".join(lines))
+ZZPY
+grep -q -- "--disable-gpg-test" PKGBUILD || { echo "gpgme: the flag was not added" >&2; exit 1; }
+grep -B1 -- "--disable-gpgsm-test" PKGBUILD | grep -q -- "--disable-gpg-test" || {
+    echo "gpgme: the flag is not adjacent to its sibling" >&2; exit 1; }
+echo "gpgme: gpg test harness not built"

patches/pkgbuild/groff.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# groff: one decorative figure, and no netpbm to draw it.
+#
+#   program 'xpmtoppm' is missing; can't generate doc/gnu.eps
+#   make[2]: *** [Makefile:19801: doc/gnu.eps] Error 1
+#
+# xpmtoppm belongs to netpbm. What it produces is the GNU logo, as EPS, for
+# groff's own manual -- and getting it would mean packaging netpbm and the image
+# libraries under it (libjpeg-turbo, libpng, libtiff, jbigkit), none of which
+# anything else in this bootstrap wants.
+#
+# NO CONFIGURE SWITCH EXISTS: groff's configure has neither --without-doc nor
+# --disable-doc, so there was nothing to turn off. Adding an invented flag would
+# have been worse than useless -- autoconf merely warns about options it does not
+# know, the build would have failed identically, and the hook's own check would
+# have passed.
+#
+# The Makefile is generated, so it is edited after configure and before make. The
+# variable is emptied rather than the rule patched, because the INSTALL side is
+# already tolerant:
+#
+#   if test -f "$$d/gnu.eps"; then ... fi
+#
+# so with nothing built, nothing is installed and nothing complains. One line,
+# and the only one whose absence the rest of the Makefile already handles.
+set -euo pipefail
+python3 - <<'ZZPY'
+import io, re
+lines = io.open("PKGBUILD", encoding="utf-8").read().split("\n")
+mk = [i for i, l in enumerate(lines) if re.match(r"^[ \t]*make[ \t]*$", l)]
+assert len(mk) >= 1, "groff: no bare `make` line found in build()"
+i = mk[0]
+ind = re.match(r"^[ \t]*", lines[i]).group(0)
+lines[i:i] = [
+    ind + "# doc/gnu.eps needs xpmtoppm from netpbm, which this port does not",
+    ind + "# package. The install side already skips the file when it is absent.",
+    ind + 'sed -i "s|^DOC_GNU_EPS = doc/gnu.eps$|DOC_GNU_EPS =|" Makefile',
+    ind + 'grep -q "^DOC_GNU_EPS =$" Makefile',
+]
+io.open("PKGBUILD", "w", encoding="utf-8").write("\n".join(lines))
+ZZPY
+grep -q "DOC_GNU_EPS" PKGBUILD || { echo "groff: the figure was not dropped" >&2; exit 1; }
+# The grep inside build() is the real check: it runs against the generated
+# Makefile and fails the build if the variable was not what this hook expects.
+grep -q 'grep -q "\^DOC_GNU_EPS =\$" Makefile' PKGBUILD || {
+    echo "groff: the in-build verification is missing" >&2; exit 1; }
+echo "groff: GNU logo figure dropped (no netpbm)"

patches/pkgbuild/systemd.sh

@@ -263,3 +263,26 @@ ZZPY
 grep -q -- "-Dbpf-framework=disabled" PKGBUILD || {
     echo "systemd: bpf-framework was not disabled" >&2; exit 1; }
 echo "systemd: BPF framework disabled (no libbpf, no clang)"
+
+# --- no AppArmor ---------------------------------------------------------------
+#
+#   meson.build:1098:14: ERROR: Dependency "libapparmor" not found (tried pkgconfig)
+#
+# The second dependency systemd asked for that this port does not package, after
+# libbpf. AppArmor is a Debian/Ubuntu security module; Arch ships it but nothing
+# in this bootstrap uses it, and systemd's support for it is a set of unit
+# directives (AppArmorProfile=) rather than anything the system needs to boot.
+#
+# -Dapparmor=disabled is systemd's own switch. Revisit if the target ever runs
+# an AppArmor policy.
+set -euo pipefail
+python3 - <<'ZZPY'
+import io
+s = io.open("PKGBUILD", encoding="utf-8").read()
+old = "-Dapparmor=enabled"
+assert s.count(old) == 1, "systemd: expected one apparmor option, got %d" % s.count(old)
+s = s.replace(old, "-Dapparmor=disabled", 1)
+io.open("PKGBUILD", "w", encoding="utf-8").write(s)
+ZZPY
+grep -q -- "-Dapparmor=disabled" PKGBUILD || { echo "systemd: apparmor not disabled" >&2; exit 1; }
+echo "systemd: AppArmor disabled"