# -*- Autoconf -*-
# $Id$

AC_PREREQ([2.61])
AC_INIT([rpkitools], [1.0])

# AC_REVISION is a great idea in theory, but the revision will always
# be wrong unless we do two checkins, so skip it for now.  Someday.

dnl AC_REVISION([$Revision$])

AC_CONFIG_SRCDIR([rp/rcynic/rcynic.c])
AC_CONFIG_AUX_DIR([buildtools])

# I'm not sure we should really be using the $host_* variables as we
# are, some of the stuff we're doing with them looks more like
# $target_* to me now, but on the theory that we should not fix things
# that aren't broken, stick with $host_* for now.

AC_CANONICAL_HOST
dnl AC_CANONICAL_TARGET

# Remember whether CFLAGS or LDFLAGS were set explictly.  This has to
# come early in the script, before we mess it up testing things.

if test "x${CFLAGS+set}" = "x" && test "x${LDFLAGS+set}" = "x"
then
	CFLAGS_or_LDFLAGS_were_set=no
else
	CFLAGS_or_LDFLAGS_were_set=yes
fi

# Put the user option stuff up front.

AC_ARG_WITH([system_openssl],		[AS_HELP_STRING([--with-system-openssl],			[Link against system copy of OpenSSL])],        [], [with_system_openssl=auto])
AC_ARG_ENABLE([rcynic_jail],		[AS_HELP_STRING([--enable-rcynic-jail],				[Run rcynic in chroot jail])],                  [], [enable_rcynic_jail=no])
AC_ARG_ENABLE([openssl_asm],		[AS_HELP_STRING([--disable-openssl-asm],			[Don't let OpenSSL build assembler code])],     [], [enable_openssl_asm=auto])
AC_ARG_ENABLE([ca_tools],		[AS_HELP_STRING([--disable-ca-tools],				[Don't build any of the CA tools])],            [], [enable_ca_tools=yes])
AC_ARG_ENABLE([rp_tools],		[AS_HELP_STRING([--disable-rp-tools],				[Don't build any of the relying party tools])], [], [enable_rp_tools=yes])
AC_ARG_ENABLE([target_installation],	[AS_HELP_STRING([--disable-target-installation],		[Don't perform final target installation])],    [], [enable_target_installation=yes])
AC_ARG_ENABLE([wsgi_daemon_mode],	[AS_HELP_STRING([--enable-wsgi-daemon-mode=user[[:group]]],	[Run the web portal as a separate process])],   [], [enable_wsgi_daemon_mode=no])
AC_ARG_ENABLE([python_install_layout],	[AS_HELP_STRING([--enable-python-install-layout=layout],	[Specify Python --install-layout])],		[], [enable_python_install_layout=auto])
AC_ARG_ENABLE([wsgi_python_egg_cache],  [AS_HELP_STRING([--enable-wsgi-python-egg-cache=dir[[:user]]],	[Set up PYTHON_EGG_CACHE in wsgi wrapper])],	[], [enable_wsgi_python_egg_cache=auto])
AC_ARG_ENABLE([runtime_dependencies],	[AS_HELP_STRING([--disable-runtime-dependencies],		[Don't enforce runtime dependencies])],         [], [enable_runtime_dependencies=yes])

AC_ARG_VAR([RCYNIC_DIR],		[Where to put output files from rcynic and rpki-rtr; also controls jail location for --enable-rcynic-jail])
AC_ARG_VAR([APACHE_VERSION],		[Version of Apache httpd, mostly used on FreeBSD where it determines some of the directory names])

# Obsolete options.  If you know of a better way to handle this, tell me.

AC_ARG_ENABLE([python],   [AS_HELP_STRING([--disable-python],	[(Obsolete, do not use)])], [AC_MSG_ERROR([--disable-python is obsolete.  Please see the --disable-ca-<style>pre { line-height: 125%; }
td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
.highlight .hll { background-color: #ffffcc }
.highlight .c { color: #888888 } /* Comment */
.highlight .err { color: #a61717; background-color: #e3d2d2 } /* Error */
.highlight .k { color: #008800; font-weight: bold } /* Keyword */
.highlight .ch { color: #888888 } /* Comment.Hashbang */
.highlight .cm { color: #888888 } /* Comment.Multiline */
.highlight .cp { color: #cc0000; font-weight: bold } /* Comment.Preproc */
.highlight .cpf { color: #888888 } /* Comment.PreprocFile */
.highlight .c1 { color: #888888 } /* Comment.Single */
.highlight .cs { color: #cc0000; font-weight: bold; background-color: #fff0f0 } /* Comment.Special */
.highlight .gd { color: #000000; background-color: #ffdddd } /* Generic.Deleted */
.highlight .ge { font-style: italic } /* Generic.Emph */
.highlight .ges { font-weight: bold; font-style: italic } /* Generic.EmphStrong */
.highlight .gr { color: #aa0000 } /* Generic.Error */
.highlight .gh { color: #333333 } /* Generic.Heading */
.highlight .gi { color: #000000; background-color: #ddffdd } /* Generic.Inserted */
.highlight .go { color: #888888 } /* Generic.Output */
.highlight .gp { color: #555555 } /* Generic.Prompt */
.highlight .gs { font-weight: bold } /* Generic.Strong */
.highlight .gu { color: #666666 } /* Generic.Subheading */
.highlight .gt { color: #aa0000 } /* Generic.Traceback */
.highlight .kc { color: #008800; font-weight: bold } /* Keyword.Constant */
.highlight .kd { color: #008800; font-weight: bold } /* Keyword.Declaration */
.highlight .kn { color: #008800; font-weight: bold } /* Keyword.Namespace */
.highlight .kp { color: #008800 } /* Keyword.Pseudo */
.highlight .kr { color: #008800; font-weight: bold } /* Keyword.Reserved */
.highlight .kt { color: #888888; font-weight: bold } /* Keyword.Type */
.highlight .m { color: #0000DD; font-weight: bold } /* Literal.Number */
.highlight .s { color: #dd2200; background-color: #fff0f0 } /* Literal.String */
.highlight .na { color: #336699 } /* Name.Attribute */
.highlight .nb { color: #003388 } /* Name.Builtin */
.highlight .nc { color: #bb0066; font-weight: bold } /* Name.Class */
.highlight .no { color: #003366; font-weight: bold } /* Name.Constant */
.highlight .nd { color: #555555 } /* Name.Decorator */
.highlight .ne { color: #bb0066; font-weight: bold } /* Name.Exception */
.highlight .nf { color: #0066bb; font-weight: bold } /* Name.Function */
.highlight .nl { color: #336699; font-style: italic } /* Name.Label */
.highlight .nn { color: #bb0066; font-weight: bold } /* Name.Namespace */
.highlight .py { color: #336699; font-weight: bold } /* Name.Property */
.highlight .nt { color: #bb0066; font-weight: bold } /* Name.Tag */
.highlight .nv { color: #336699 } /* Name.Variable */
.highlight .ow { color: #008800 } /* Operator.Word */
.highlight .w { color: #bbbbbb } /* Text.Whitespace */
.highlight .mb { color: #0000DD; font-weight: bold } /* Literal.Number.Bin */
.highlight .mf { color: #0000DD; font-weight: bold } /* Literal.Number.Float */
.highlight .mh { color: #0000DD; font-weight: bold } /* Literal.Number.Hex */
.highlight .mi { color: #0000DD; font-weight: bold } /* Literal.Number.Integer */
.highlight .mo { color: #0000DD; font-weight: bold } /* Literal.Number.Oct */
.highlight .sa { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Affix */
.highlight .sb { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Backtick */
.highlight .sc { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Char */
.highlight .dl { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Delimiter */
.highlight .sd { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Doc */
.highlight .s2 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Double */
.highlight .se { color: #0044dd; background-color: #fff0f0 } /* Literal.String.Escape */
.highlight .sh { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Heredoc */
.highlight .si { color: #3333bb; background-color: #fff0f0 } /* Literal.String.Interpol */
.highlight .sx { color: #22bb22; background-color: #f0fff0 } /* Literal.String.Other */
.highlight .sr { color: #008800; background-color: #fff0ff } /* Literal.String.Regex */
.highlight .s1 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Single */
.highlight .ss { color: #aa6600; background-color: #fff0f0 } /* Literal.String.Symbol */
.highlight .bp { color: #003388 } /* Name.Builtin.Pseudo */
.highlight .fm { color: #0066bb; font-weight: bold } /* Name.Function.Magic */
.highlight .vc { color: #336699 } /* Name.Variable.Class */
.highlight .vg { color: #dd7700 } /* Name.Variable.Global */
.highlight .vi { color: #3333bb } /* Name.Variable.Instance */
.highlight .vm { color: #336699 } /* Name.Variable.Magic */
.highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */</style><div class="highlight"><pre><span></span>
</pre></div>
</code></pre></td></tr></table>
</div> <!-- class=content -->
<div class='footer'>generated by <a href='https://git.zx2c4.com/cgit/about/'>cgit v1.2.3</a> (<a href='https://git-scm.com/'>git 2.25.1</a>) at 2025-06-03 18:43:26 +0000</div>
</div> <!-- id=cgit -->
</body>
</html>
ystem OpenSSL library is usable])
			if test $system_openssl_has_rfc3779 = yes && test $system_openssl_has_cms = yes
			then
				have_usable_openssl=yes
			else
				have_usable_openssl=no
			fi
			AC_MSG_RESULT([$have_usable_openssl])
	esac

	AC_MSG_CHECKING([whether we need to build a private copy of OpenSSL])
	case $with_system_openssl in
	     yes)
			build_openssl=no
			if test $have_usable_openssl = no
			then
				AC_MSG_ERROR([Can't find OpenSSL crypto library with CMS and RFC 3779 support, try --with-system-openssl=/path/to/openssl])
			fi
			;;
	     no)
			build_openssl=yes
			;;
	     auto)
			if test $have_usable_openssl = no
			then
				build_openssl=yes
			else
				build_openssl=no
			fi
			;;
	     *)
			build_openssl=no
			if test $have_usable_openssl = no
			then
				AC_MSG_ERROR([Can't find OpenSSL crypto library with CMS and RFC 3779 support in $with_system_openssl])
			fi
	esac
	AC_MSG_RESULT([$build_openssl])

	build_openssl_asm=undefined

	if test $build_openssl = yes
	then
		CFLAGS="$old_CFLAGS"
		LDFLAGS="$old_LDFLAGS"

		AC_MSG_CHECKING([whether to enable assembly code in OpenSSL])
		case $enable_openssl_asm in
		     yes|no)
				build_openssl_asm=$enable_openssl_asm
				;;
		     auto)
				case $host in
					x86_64-*-linux*)
						build_openssl_asm=no
						;;
					*)
						build_openssl_asm=yes
						;;
				esac
				;;
		     *)
				AC_MSG_ERROR([Unrecognized value for --enable-openssl-asm: $enable_openssl_asm])
				;;
		esac     
		AC_MSG_RESULT([$enable_openssl_asm])
	fi
fi

# RCYNIC_DIR is a "precious" argument variable to this script (see
# autoconf doc), which means that autoconf is careful with whatever
# value (if any) was passed in, and that it's already been declared
# for variable substitution.  We still have to set a default value for
# it, though, and we might as well handle DESTDIR while we're at it.

if test "X$RCYNIC_DIR" = "X"
then
	rcynic_base_dir='/var/rcynic'
else
	rcynic_base_dir="${RCYNIC_DIR}"
fi

RCYNIC_DIR='${DESTDIR}'"${rcynic_base_dir}"

# APACHE_VERSION is another "precious" argument to this script.  It
# mostly matters on FreeBSD, where most things involving Apache encode
# the Apache version number into their filenames.
#
# If we can't figure out the version number, we assume 2.2 and hope
# for the best; at some point we may need to do better than this.
#
# apachectl sometimes whines about ulimits, so we discard its stderr.
# If you're reading this because this test is misbehaving, well,
# try not discarding stderr.

AC_MSG_CHECKING([Apache version])

if test "X$APACHE_VERSION" = "X"
then
	for apachectl in /usr/local/sbin/apachectl /usr/sbin/apachectl
	do
		if test -x $apachectl
		then
			APACHE_VERSION=`$apachectl -v 2>/dev/null | sed -n 's=^Server version: Apache/\([[0-9]]*\)\.\([[0-9]]*\)\..*$=\1\2=p'`
			break
		fi
	done
fi

if test "X$APACHE_VERSION" = "X"
then
	APACHE_VERSION="22"
	msg='not found, defaulting to 2.2'
else
	msg=`echo $APACHE_VERSION | sed 's=.=&.='`
fi

AC_MSG_RESULT([$msg])

# Figure out whether to run rcynic in a chroot jail, which determines
# a bunch of other settings.

AC_MSG_CHECKING([whether to build chroot jail for rcynic])

case $enable_rcynic_jail in
	yes)
		use_rcynic_jail=yes
		RCYNIC_CONF_FILE='${RCYNIC_DIR}/etc/rcynic.conf'
		RCYNIC_TA_DIR='${RCYNIC_DIR}/etc/trust-anchors'
		RCYNIC_BIN_RCYNIC='${RCYNIC_DIR}/bin/rcynic'
		RCYNIC_CONF_RSYNC='/bin/rsync'
		RCYNIC_CONF_DATA='/data'
		RCYNIC_CONF_TA_DIR='/etc/trust-anchors'
		RCYNIC_CRON_USER='root'
		RCYNIC_JAIL_DIRS='${RCYNIC_DIR}/bin ${RCYNIC_DIR}/dev ${RCYNIC_DIR}/etc'
		if test "X$host_os" = "Xlinux"
		then
			RCYNIC_JAIL_DIRS="$RCYNIC_JAIL_DIRS "'${RCYNIC_DIR}/lib ${RCYNIC_DIR}/lib64 ${RCYNIC_DIR}/usr/lib'
		fi
		;;
	no)
		use_rcynic_jail=no
		RCYNIC_CONF_FILE='${DESTDIR}${sysconfdir}/rcynic.conf'
		RCYNIC_TA_DIR='${DESTDIR}${sysconfdir}/rpki/trust-anchors'
		RCYNIC_BIN_RCYNIC='${DESTDIR}${bindir}/rcynic'
		RCYNIC_CONF_RSYNC="${RSYNC}"
		RCYNIC_CONF_DATA="${rcynic_base_dir}/data"
		RCYNIC_CONF_TA_DIR='${sysconfdir}/rpki/trust-anchors'
		RCYNIC_CRON_USER='${RCYNIC_USER}'
		RCYNIC_JAIL_DIRS=''
		;;
	*)
		AC_MSG_ERROR([Unrecognized value for --enable-rcynic-jail: $enable_rcynic_jail])
		;;
esac

AC_SUBST(RCYNIC_JAIL_DIRS)
AC_SUBST(RCYNIC_CONF_FILE)
AC_SUBST(RCYNIC_TA_DIR)
AC_SUBST(RCYNIC_BIN_RCYNIC)
AC_SUBST(RCYNIC_CONF_RSYNC)
AC_SUBST(RCYNIC_CONF_DATA)
AC_SUBST(RCYNIC_CONF_TA_DIR)
AC_SUBST(RCYNIC_CRON_USER)

AC_MSG_RESULT([$use_rcynic_jail])

# Perhaps there should be a way to set these, but for now just
# wire them in here so at least they're consistent in all Makefiles.

AC_SUBST(RCYNIC_USER,  [rcynic])
AC_SUBST(RCYNIC_GROUP, [rcynic])

if test $use_rcynic_jail = yes && test "X$LD_STATIC_FLAG" != "X"
then
	RCYNIC_STATIC_RSYNC='static-rsync/rsync'
else
	RCYNIC_STATIC_RSYNC=''
fi

AC_SUBST(RCYNIC_STATIC_RSYNC)

# Check whether to do "final target installation".  This means actions
# that can only be done when installing a package, as opposed to when
# building a package.

AC_MSG_CHECKING([whether to do final target installation on "make install"])

case $enable_target_installation in
	yes|no)
		;;
	*)
		AC_MSG_ERROR([Unrecognized value for --enable-target-installation: $enable_target_installation])
		;;
esac

AC_MSG_RESULT([$enable_target_installation])

# rcynic jail setup is complicated enough that it's simplest to have
# different rule sets for different platforms.  Icky, but....
# rpki-rtr isn't as complicated, but has similar issues, same hack.
# ca isn't as complicated either, but same hack.

case $host_os in
	darwin*)
		RCYNIC_MAKE_RULES='rp/rcynic/rules.darwin.mk'
		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.darwin.mk'
		CA_MAKE_RULES='ca/rules.darwin.mk'
		;;
	freebsd*)
		RCYNIC_MAKE_RULES='rp/rcynic/rules.freebsd.mk'
		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.freebsd.mk'
		CA_MAKE_RULES='ca/rules.freebsd.mk'
		;;
	linux*)
		RCYNIC_MAKE_RULES='rp/rcynic/rules.linux.mk'
		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.linux.mk'
		CA_MAKE_RULES='ca/rules.linux.mk'
		;;
	*)
		RCYNIC_MAKE_RULES='rp/rcynic/rules.unknown.mk'
		RTR_ORIGIN_MAKE_RULES='rp/rpki-rtr/rules.unknown.mk'
		CA_MAKE_RULES='ca/rules.unknown.mk'
		;;
esac

AC_SUBST_FILE(RCYNIC_MAKE_RULES)
AC_SUBST_FILE(RTR_ORIGIN_MAKE_RULES)
AC_SUBST_FILE(CA_MAKE_RULES)

# Where to put HTML files is similarly platform dependent, we have to know.
# rcynic-cron will skip generating HTML files if it has no place to put them.

AC_MSG_CHECKING([where rcynic-html output should go])
case $host_os in
	freebsd*)
		RCYNIC_HTML_DIR="/usr/local/www/apache${APACHE_VERSION}/data/rcynic"
		;;
	linux*)
		if test -d /var/www/html
		then
			# RHEL/CentOS
			RCYNIC_HTML_DIR='/var/www/html/rcynic'
		else
			# Ubuntu
			RCYNIC_HTML_DIR='/var/www/rcynic'
		fi
		;;
	*)
		RCYNIC_HTML_DIR=''
		;;
esac
AC_MSG_RESULT([$RCYNIC_HTML_DIR])

AC_SUBST(RCYNIC_HTML_DIR)

# Sort out which things to install, depending on rcynic jail status and whether
# we're doing final target installation.

RCYNIC_INSTALL_TARGETS='install-always'
RTR_ORIGIN_INSTALL_TARGETS='install-always'
CA_INSTALL_TARGETS='install-always'

if test $use_rcynic_jail = yes
then
	RCYNIC_INSTALL_TARGETS="$RCYNIC_INSTALL_TARGETS install-jailed"
fi

if test $enable_target_installation = yes
then
	RCYNIC_INSTALL_TARGETS="$RCYNIC_INSTALL_TARGETS install-postconf"
	RTR_ORIGIN_INSTALL_TARGETS="$RTR_ORIGIN_INSTALL_TARGETS install-postconf"
	CA_INSTALL_TARGETS="$CA_INSTALL_TARGETS install-postconf"
fi

AC_SUBST(RCYNIC_INSTALL_TARGETS)
AC_SUBST(RTR_ORIGIN_INSTALL_TARGETS)
AC_SUBST(CA_INSTALL_TARGETS)

# Now a bunch of checks to figure out what we can do with Python.  If
# we don't have Python at all, none of the rest of this matters.  If
# we do have Python, we need to check for required packages and
# versions.

if test "x$PYTHON" = "x"
then
	AC_MSG_ERROR([I can't find a Python binary at all, this isn't going to work.  Perhaps you need to set PATH?])
fi

AC_MSG_CHECKING([for Python version 2.6 or higher])
have_acceptable_python=`$PYTHON -c 'import sys; print "yes" if sys.version_info[[0]] == 2 and sys.version_info[[1]] >= 6 else "no"'`
AC_MSG_RESULT([$have_acceptable_python])

AC_MSG_CHECKING([distutils to find out where Python.h should be])
python_h=`$PYTHON -c 'import distutils.sysconfig; print distutils.sysconfig.get_python_inc() + "/Python.h"'`
AC_MSG_RESULT([$python_h])

AC_CHECK_HEADER([$python_h], [have_python_h=yes], [have_python_h=no])

AC_MSG_CHECKING([for lxml.etree])
if $PYTHON -c 'import lxml.etree' 2>/dev/null; then have_lxml=yes; else have_lxml=no; fi
AC_MSG_RESULT([$have_lxml])

AC_MSG_CHECKING([for MySQLdb])
if $PYTHON -c 'import MySQLdb' 2>/dev/null; then have_mysqldb=yes; else have_mysqldb=no; fi
AC_MSG_RESULT([$have_mysqldb])

AC_MSG_CHECKING([for Django])
if $PYTHON -c 'import django' 2>/dev/null; then have_django=yes; else have_django=no; fi
AC_MSG_RESULT([$have_django])

if test $have_django = yes
then
	AC_MSG_CHECKING([for Django 1.3.7 or higher])
	have_acceptable_django=`$PYTHON -c "import django; print 'no' if django.VERSION < (1, 3, 7) else 'yes'"`
	AC_MSG_RESULT([$have_acceptable_django])
else
	have_acceptable_django=no
fi

AC_MSG_CHECKING([for PyYAML])
if $PYTHON -c 'import yaml' 2>/dev/null; then have_pyyaml=yes; else have_pyyaml=no; fi
AC_MSG_RESULT([$have_pyyaml])

AC_MSG_CHECKING([for vobject])
if $PYTHON -c 'import vobject' 2>/dev/null; then have_vobject=yes; else have_vobject=no; fi
AC_MSG_RESULT([$have_vobject])

AC_MSG_CHECKING([for Django South])
if $PYTHON -c 'import south' 2>/dev/null; then have_django_south=yes; else have_django_south=no; fi
AC_MSG_RESULT([$have_django_south])

if test $have_django_south = yes
then
	AC_MSG_CHECKING([for Django South 0.7.5 or later])
	have_acceptable_django_south=`$PYTHON -c "import south; print 'no' if map(int,south.__version__.split('.')) < [[0, 7, 5]] else 'yes'"`
	AC_MSG_RESULT([$have_acceptable_django_south])
else
	have_acceptable_django_south=no
fi

AC_MSG_CHECKING([for argparse])
if $PYTHON -c 'import argparse' 2>/dev/null; then have_argparse=yes; else have_argparse=no; fi
AC_MSG_RESULT([$have_argparse])

# Warnings and dependency errors.  Exit on fatal errors deferred until
# the very end of this, so we can warn the user about all known
# problems in a single pass.  Errors that prevent build or basic
# installation are always fatal; errors that prevent proper operation
# at runtime or during post-installation setup can be converted to
# warnings by --disable-runtime-dependencies.

build_ok=yes
runtime_ok=yes

if test $have_acceptable_python = no
then
	runtime_ok=no
	AC_MSG_WARN([The RPKI code requires Python version 2.x, for x = 6 or higher.])
fi

if test $build_rp_tools = yes
then
	if test $have_python_h = no
	then
		build_ok=no
		AC_MSG_WARN([I can't find Python.h.  Python sources are required to build the RP tools.])
	fi
	if test "x$RRDTOOL" = "x"
	then
		runtime_ok=no
		AC_MSG_WARN([rcynic-html requires rrdtool.])
	fi
	if test $use_rcynic_jail = no && test "X$RSYNC" = "X"
	then
		runtime_ok=no
		AC_MSG_WARN([The RPKI relying party tools require rsync.])
	fi
fi

if test $build_ca_tools = yes
then
	if test $have_lxml = no
	then
		runtime_ok=no
		AC_MSG_WARN([The RPKI tools require the Python LXML module.])
	fi
	if test $have_acceptable_django = no
	then
		runtime_ok=no
		AC_MSG_WARN([The RPKI CA tools require Django 1.3.7 or higher.])
	fi
	if test $have_vobject = no
	then
		runtime_ok=no
		AC_MSG_WARN([The RPKI CA GUI requires the Python vobject module.])
	fi
	if test $have_acceptable_django_south = no
	then
		runtime_ok=no
		AC_MSG_WARN([The RPKI CA tools require Django South 0.7.5 or higher.])
	fi
	if test $have_argparse = no
	then
		runtime_ok=no
		AC_MSG_WARN([The RPKI CA tools require the Python argparse module.])
	fi
	if test $have_pyyaml = no
	then
		AC_MSG_WARN([PyYAML missing, so "make test" will not work properly.])
	fi
	if test "x$XSLTPROC" = "x"
	then
		AC_MSG_WARN([xsltproc missing, so "make test" will not work properly.])
	fi
fi

if test $build_ok = no || test $runtime_ok = no
then
	if test $build_rp_tools = yes
	then
		AC_MSG_WARN([If you do not wish to install the RPKI RP tools, please specify --disable-rp-tools as an argument to this configure script.])
	fi
	if test $build_ca_tools = yes
	then
		AC_MSG_WARN([If you do not wish to install the RPKI CA tools, please specify --disable-ca-tools as an argument to this configure script.])
	fi
	if test $build_ok = no || test $enable_runtime_dependencies = yes
	then
		AC_MSG_ERROR([Please correct the problems above then re-run this configuration script.])
	else
		AC_MSG_WARN([Runtime dependency enforcement disabled, proceeding (at your own risk)])
	fi
fi

# Figure out whether we are on a Debian-derived system where we need
# to tell setup.py about Debian installation layout.

if test $build_ca_tools = yes
then
	AC_MSG_CHECKING([whether we need to tell distutils to use a particular installation layout])
	looks_like_debian=no
	if test -x /usr/bin/lsb_release
	then
		case `/usr/bin/lsb_release -is` in
		Debian|Ubuntu)
			looks_like_debian=yes
			;;
		esac
	fi
	if test $looks_like_debian = yes
	then
		install_layout="deb"
	else
		install_layout="unix"
	fi
	case $enable_python_install_layout in
	yes|no)
		use_install_layout=$enable_python_install_layout
		;;
	auto)
		use_install_layout=no
		;;
	*)
		use_install_layout=yes
		install_layout="$enable_python_install_layout"
		;;
	esac
	if test $use_install_layout = yes
	then
		SETUP_PY_INSTALL_LAYOUT="--install-layout=$install_layout"
	else
		SETUP_PY_INSTALL_LAYOUT=''

	fi
	AC_MSG_RESULT([$use_install_layout $SETUP_PY_INSTALL_LAYOUT])
	AC_SUBST(SETUP_PY_INSTALL_LAYOUT)
fi

# Figure out whether we're going to want a PYTHON_EGG_CACHE directory.
# This is mostly just a pass through to rpkigui-apache-confgen and rpki.wsgi
# via rpki.autoconf.

AC_MSG_CHECKING([whether we need rpki.wgi to use a Python egg cache])

save_IFS="$IFS"
IFS=':' read WSGI_PYTHON_EGG_CACHE_DIR WSGI_PYTHON_EGG_CACHE_USER <<_EOF
$enable_wsgi_python_egg_cache
_EOF
IFS="$save_IFS"

if test "X$WSGI_PYTHON_EGG_CACHE_DIR" = "Xauto"
then
	case $host_os in
	freebsd*)	WSGI_PYTHON_EGG_CACHE_DIR=yes;;
	*)		WSGI_PYTHON_EGG_CACHE_DIR=no;;
	esac
fi

case $WSGI_PYTHON_EGG_CACHE_DIR in
yes)
	WSGI_PYTHON_EGG_CACHE_DIR='${datarootdir}/rpki/python-eggs'
	;;
no)
	WSGI_PYTHON_EGG_CACHE_DIR=''
	;;
esac

if test "X$WSGI_PYTHON_EGG_CACHE_DIR" != "X" &&
   test "X$WSGI_PYTHON_EGG_CACHE_USER" = "X"
then
	case $host_os in
	freebsd*)	WSGI_PYTHON_EGG_CACHE_USER="www";;
	linux*)		WSGI_PYTHON_EGG_CACHE_USER="www-data";;
	esac
fi

AC_SUBST(WSGI_PYTHON_EGG_CACHE_DIR)
AC_SUBST(WSGI_PYTHON_EGG_CACHE_USER)

if test "X$WSGI_PYTHON_EGG_CACHE_DIR" = "X"
then
	AC_MSG_RESULT([no])
elif test "X$WSGI_PYTHON_EGG_CACHE_USER" != "X"
then
	AC_MSG_RESULT([$WSGI_PYTHON_EGG_CACHE_DIR (user $WSGI_PYTHON_EGG_CACHE_USER)])
else
	AC_MSG_RESULT([$WSGI_PYTHON_EGG_CACHE_DIR])
fi

# Tell the Makefiles and setup.py which parts of this package we've decided to build.

if test $build_openssl  = yes; then OPENSSL_TARGET=openssl; else OPENSSL_TARGET=noop; fi
if test $build_rp_tools = yes; then      RP_TARGET=rp;	    else      RP_TARGET=noop; fi
if test $build_ca_tools = yes; then      CA_TARGET=ca;	    else      CA_TARGET=noop; fi

AC_SUBST(OPENSSL_TARGET)
AC_SUBST(RP_TARGET)
AC_SUBST(CA_TARGET)

AC_CONFIG_FILES([Makefile])

# OpenSSL has its own build system that bears no relationship to
# anything but itself, and our use of it is a bit weird, so this is a
# BFMI (Brute Force and Massive Ignorance) job.

if test $build_openssl = yes
then
	AC_CONFIG_FILES([openssl/Makefile
			 openssl/tests/Makefile])

	AC_MSG_CHECKING([what configuration target to use when building OpenSSL])
	case $host in
	i*86-apple-darwin*)
		if test "$ac_cv_sizeof_long" = 8
		then
			OPENSSL_CONFIG_COMMAND='./Configure darwin64-x86_64-cc'
		fi
		;;
	*)
		if test $build_openssl_asm = yes
		then
			OPENSSL_CONFIG_COMMAND="MACHINE=$host_cpu ./config"
		else
			OPENSSL_CONFIG_COMMAND="MACHINE=$host_cpu ./config no-asm"
		fi
		;;
	esac
	AC_SUBST(OPENSSL_CONFIG_COMMAND)
	AC_MSG_RESULT([$OPENSSL_CONFIG_COMMAND])

	AC_MSG_CHECKING([what glob to use when renaming OpenSSL shared libraries])
	case $host in
	*-apple-darwin*)
		OPENSSL_SO_GLOB='*.dylib'
		;;
	*)
		OPENSSL_SO_GLOB='*.so*'
		;;
	esac
	AC_SUBST(OPENSSL_SO_GLOB)
	AC_MSG_RESULT([$OPENSSL_SO_GLOB])

	# NB: We put our OpenSSL directory at the *front* of the
	# search list to preempt conflicts with system copies.

	CFLAGS="-I\${abs_top_srcdir}/openssl/openssl/include $CFLAGS"
	LIBS="\${abs_top_builddir}/openssl/openssl/libcrypto.a $LIBS"
else
	LIBS="$LIBS -lcrypto"
fi

if test $build_rp_tools = yes
then
	AC_CONFIG_FILES([rp/Makefile
			 rp/rcynic/Makefile
			 rp/rcynic/static-rsync/Makefile
			 rp/utils/Makefile
			 rp/rpki-rtr/Makefile])
fi

if test $build_ca_tools = yes
then
	AC_CONFIG_FILES([ca/Makefile
			 ca/tests/Makefile])
fi

if test $build_ca_tools = yes
then
	case $enable_wsgi_daemon_mode in
	no)
		;;
	yes)
		AC_MSG_ERROR([You must specify the user to run the wsgi process as with --enable-wsgi-daemon-mode=USER])
		;;
	*)
		AC_MSG_CHECKING([how to run mod_wsgi daemon mode])
		save_IFS="$IFS"
		IFS=':'
		read user group <<_EOF
$enable_wsgi_daemon_mode
_EOF
		IFS="$save_IFS"
		AC_SUBST(WSGI_DAEMON_PROCESS, "WSGIDaemonProcess rpkigui user=$user ${group:+group=}${group} display-name=%{GROUP}")
		AC_SUBST(WSGI_PROCESS_GROUP, "WSGIProcessGroup rpkigui")
		AC_MSG_RESULT([with user "$user" and group "${group:-default}"])
		;;
	esac
fi

# Now that we're finally done with all the conditional changes to
# CFLAGS, add a search directive for our own header directory.  If we
# ever get to the point of having our own library directory, we'd add
# it here too, but for the moment our shared C code is all in .h files.

CFLAGS="$CFLAGS -I\${abs_top_srcdir}/h"

AC_OUTPUT