meson: add feature flag for integritysetup

integritysetup builds and installs binaries, docs, units, etc. Add a
feature flag to make it easier to avoid shipping it.

man/integritytab.xml

@@ -6,7 +6,7 @@
   SPDX-License-Identifier: LGPL-2.1-or-later
 
 -->
-<refentry id="integritytab" conditional='HAVE_LIBCRYPTSETUP' xmlns:xi="http://www.w3.org/2001/XInclude">
+<refentry id="integritytab" conditional='ENABLE_INTEGRITYSETUP' xmlns:xi="http://www.w3.org/2001/XInclude">
 
   <refentryinfo>
     <title>integritytab</title>

man/rules/meson.build

@@ -32,7 +32,7 @@ manpages = [
  ['hostnamectl', '1', [], 'ENABLE_HOSTNAMED'],
  ['hwdb', '7', [], 'ENABLE_HWDB'],
  ['importctl', '1', [], 'ENABLE_MACHINED'],
- ['integritytab', '5', [], 'HAVE_LIBCRYPTSETUP'],
+ ['integritytab', '5', [], 'ENABLE_INTEGRITYSETUP'],
  ['iocost.conf', '5', [], ''],
  ['journal-remote.conf', '5', ['journal-remote.conf.d'], 'HAVE_MICROHTTPD'],
  ['journal-upload.conf', '5', ['journal-upload.conf.d'], 'HAVE_MICROHTTPD'],
@@ -1115,11 +1115,11 @@ manpages = [
  ['systemd-import-generator', '8', [], ''],
  ['systemd-importd.service', '8', ['systemd-importd'], 'ENABLE_IMPORTD'],
  ['systemd-inhibit', '1', [], ''],
- ['systemd-integritysetup-generator', '8', [], 'HAVE_LIBCRYPTSETUP'],
+ ['systemd-integritysetup-generator', '8', [], 'ENABLE_INTEGRITYSETUP'],
  ['systemd-integritysetup@.service',
   '8',
   ['systemd-integritysetup'],
-  'HAVE_LIBCRYPTSETUP'],
+  'ENABLE_INTEGRITYSETUP'],
  ['systemd-journal-gatewayd.service',
   '8',
   ['systemd-journal-gatewayd', 'systemd-journal-gatewayd.socket'],

man/systemd-integritysetup-generator.xml

@@ -3,7 +3,7 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
-<refentry id="systemd-integritysetup-generator" conditional='HAVE_LIBCRYPTSETUP'>
+<refentry id="systemd-integritysetup-generator" conditional='ENABLE_INTEGRITYSETUP'>
 
   <refentryinfo>
     <title>systemd-integritysetup-generator</title>

man/systemd-integritysetup@.service.xml

@@ -3,7 +3,7 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
-<refentry id="systemd-integritysetup_.service" conditional='HAVE_LIBCRYPTSETUP'
+<refentry id="systemd-integritysetup_.service" conditional='ENABLE_INTEGRITYSETUP'
           xmlns:xi="http://www.w3.org/2001/XInclude">
 
   <refentryinfo>

meson.build

@@ -1797,6 +1797,11 @@ conf.set10('ENABLE_BATTERY_CHECK', get_option('battery-check').allowed())
 conf.set10('ENABLE_CLONESETUP', get_option('clonesetup').allowed())
 conf.set10('ENABLE_GROWFS', get_option('growfs').allowed())
 
+have = get_option('integritysetup').require(
+        conf.get('HAVE_LIBCRYPTSETUP') == 1,
+        error_message : 'libcryptsetup required for systemd-integritysetup').allowed()
+conf.set10('ENABLE_INTEGRITYSETUP', have)
+
 foreach tuple : [
                 ['analyze'],
                 ['backlight'],
@@ -3455,6 +3460,7 @@ foreach tuple : [
         ['imds'],
         ['importd'],
         ['initrd'],
+        ['integritysetup'],
         ['kernel-install'],
         ['localed'],
         ['logind'],

meson_options.txt

@@ -199,6 +199,8 @@ option('importd', type : 'feature', deprecated : { 'true' : 'enabled', 'false' :
        description : 'install the systemd-importd daemon')
 option('install-sysconfdir', type : 'combo', choices : ['true', 'no-samples', 'false'], value : 'true',
        description : 'install configuration files and directories')
+option('integritysetup', type : 'feature',
+       description : 'install systemd-integritysetup and associated files')
 option('kernel-install', type: 'boolean', value: true,
        description : 'install kernel-install and associated files')
 option('ldconfig', type : 'boolean',

src/integritysetup/meson.build

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-if conf.get('HAVE_LIBCRYPTSETUP') != 1
+if conf.get('ENABLE_INTEGRITYSETUP') != 1
         subdir_done()
 endif
 

test/units/TEST-67-INTEGRITY.sh

@@ -2,6 +2,11 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -euxo pipefail
 
+if [[ ! -x /usr/lib/systemd/systemd-integritysetup ]]; then
+    echo "systemd-integritysetup is not installed, skipping test." >/skipped
+    exit 77
+fi
+
 DM_NAME="integrity_test"
 DM_NODE="/dev/mapper/${DM_NAME}"
 DM_SERVICE="systemd-integritysetup@${DM_NAME}.service"

units/meson.build

@@ -117,11 +117,11 @@ units = [
         },
         {
           'file' : 'integritysetup-pre.target',
-          'conditions' : ['HAVE_LIBCRYPTSETUP'],
+          'conditions' : ['ENABLE_INTEGRITYSETUP'],
         },
         {
           'file' : 'integritysetup.target',
-          'conditions' : ['HAVE_LIBCRYPTSETUP'],
+          'conditions' : ['ENABLE_INTEGRITYSETUP'],
           'symlinks' : ['sysinit.target.wants/'],
         },
         { 'file' : 'kexec.target' },
@@ -200,7 +200,7 @@ units = [
         { 'file' : 'remote-fs.target' },
         {
           'file' : 'remote-integritysetup.target',
-          'conditions' : ['HAVE_LIBCRYPTSETUP'],
+          'conditions' : ['ENABLE_INTEGRITYSETUP'],
           'symlinks' : ['initrd-root-device.target.wants/'],
         },
         {