# we dont want -z defs linker flag
%undefine _strict_symbol_defs_build

%global pecl_name   boringssl
%global with_zts    0%{!?_without_zts:%{?__ztsphp:1}}
%global ini_name    40-%{pecl_name}.ini
%global bssl_date   20260406

Name:           php-%{pecl_name}
Version:        0.1.1
Release:        2.bssl%{bssl_date}%{?dist}
Summary:        BoringSSL TLS extension for PHP

License:        ISC
URL:            https://github.com/DigitalCyberSoft/php-boringssl
Source0:        php-boringssl-%{version}.tar.gz
Source1:        boringssl-%{bssl_date}.tar.gz

BuildRequires:  gcc
BuildRequires:  gcc-c++
BuildRequires:  make
BuildRequires:  cmake >= 3.12
BuildRequires:  ninja-build
BuildRequires:  golang
BuildRequires:  php-devel >= 8.1
BuildRequires:  brotli-devel
BuildRequires:  zlib-devel
BuildRequires:  libzstd-devel

Requires:       php(zend-abi) = %{php_zend_api}
Requires:       php(api) = %{php_core_api}

Provides:       bundled(boringssl)

%description
PHP extension providing direct access to Google BoringSSL. Exposes
BoringSSL-specific TLS features unavailable through ext-openssl: GREASE,
extension permutation, certificate compression, ALPS, Encrypted Client
Hello (ECH), post-quantum key exchange, TLS fingerprint control, OCSP
stapling, SCT, peer certificate inspection, and in-memory cert loading.

BoringSSL is statically linked into the extension.

%package devel
Summary:        Development files for %{name}
Requires:       %{name}%{?_isa} = %{version}-%{release}
Requires:       php-devel%{?_isa}

%description devel
These are the files needed to compile programs using %{name}.

%prep
%setup -q -n php-boringssl-%{version} -a 1

# Sanity check
extver=$(sed -n '/#define PHP_BORINGSSL_VERSION/{s/.* "//;s/".*$//;p}' php_boringssl.h)
if test "x${extver}" != "x%{version}"; then
   : Error: Upstream extension version is ${extver}, expecting %{version}.
   exit 1
fi

%if %{with_zts}
cp -pr . ../ZTS
%endif

%build
# Build BoringSSL from bundled source
BSSL_DIR=$(pwd)/boringssl
cd "$BSSL_DIR"
mkdir -p build && cd build
cmake -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
      -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_C_FLAGS="-Wno-array-bounds" \
      -DCMAKE_CXX_FLAGS="-Wno-array-bounds" \
      -DBUILD_TESTING=OFF \
      -GNinja ..
ninja -j%{?_smp_build_ncpus:%{_smp_build_ncpus}}%{!?_smp_build_ncpus:$(nproc)} ssl crypto
cd ../../

# NTS build
%{_bindir}/phpize
%configure \
    --with-php-config=%{_bindir}/php-config \
    --with-libdir=%{_lib} \
    --with-boringssl="$BSSL_DIR"

make %{?_smp_mflags}

%if %{with_zts}
cd ../ZTS
BSSL_DIR=$(pwd)/boringssl
cd "$BSSL_DIR" && mkdir -p build && cd build
cmake -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
      -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_C_FLAGS="-Wno-array-bounds" \
      -DCMAKE_CXX_FLAGS="-Wno-array-bounds" \
      -DBUILD_TESTING=OFF \
      -GNinja ..
ninja -j%{?_smp_build_ncpus:%{_smp_build_ncpus}}%{!?_smp_build_ncpus:$(nproc)} ssl crypto
cd ../../
%{_bindir}/zts-phpize
%configure \
    --with-php-config=%{_bindir}/zts-php-config \
    --with-libdir=%{_lib} \
    --with-boringssl="$BSSL_DIR"

make %{?_smp_mflags}
%endif

%install
make install INSTALL_ROOT=%{buildroot}

install -d %{buildroot}%{php_inidir}
cat > %{buildroot}%{php_inidir}/%{ini_name} << EOF
; Enable BoringSSL extension
extension = %{pecl_name}.so
EOF

%if %{with_zts}
cd ../ZTS
make install INSTALL_ROOT=%{buildroot}
install -d %{buildroot}%{php_ztsinidir}
cp %{buildroot}%{php_inidir}/%{ini_name} \
   %{buildroot}%{php_ztsinidir}/%{ini_name}
%else
find %{buildroot} -name "%{pecl_name}.so" -not -path "%{buildroot}%{php_extdir}/*" -delete 2>/dev/null || :
%endif

install -d %{buildroot}%{php_incldir}/ext/%{pecl_name}
cp -p php_boringssl.h %{buildroot}%{php_incldir}/ext/%{pecl_name}/

%check
%{__php} --no-php-ini \
    --define extension=%{buildroot}%{php_extdir}/%{pecl_name}.so \
    --modules | grep "^%{pecl_name}$"

%{__php} --no-php-ini \
    --define extension=%{buildroot}%{php_extdir}/%{pecl_name}.so \
    --ri %{pecl_name} | grep "BoringSSL support"

%if %{with_zts}
%{__ztsphp} --no-php-ini \
    --define extension=%{buildroot}%{php_ztsextdir}/%{pecl_name}.so \
    --modules | grep "^%{pecl_name}$"
%endif

%files
%doc README.md
%config(noreplace) %{php_inidir}/%{ini_name}
%{php_extdir}/%{pecl_name}.so

%if %{with_zts}
%config(noreplace) %{php_ztsinidir}/%{ini_name}
%{php_ztsextdir}/%{pecl_name}.so
%endif

%files devel
%{php_incldir}/ext/%{pecl_name}

%changelog
* Mon Apr 06 2026 COPR Builder - 0.1.1-1.bssl20260406
- Automated build with latest BoringSSL snapshot
- BoringSSL statically linked