ACLOCAL_AMFLAGS = -I m4
CLEANFILES =
DISTCLEANFILES = *~ opencryptoki.map.sym opencryptoki_tok.map.sym
MAINTAINERCLEANFILES = test-driver \
	Makefile.in aclocal.m4 compile configure config.guess \
	config.sub depcomp install-sh ltmain.sh m4/* missing \
	depcomp ylwrap

if AIX
EXTRA_DIST = bootstrap.sh opencryptoki.map opencryptoki_tok.map \
	opencryptoki.map.sym opencryptoki_tok.map.sym FAQ LICENSE
SHLIBEXT=a
LNFLAG=fs
KILLALL = ./kill-all
else
EXTRA_DIST = bootstrap.sh opencryptoki.map opencryptoki_tok.map FAQ LICENSE
SHLIBEXT=so
LNFLAG=nfs
KILLALL = killall
endif

AM_YFLAGS = -d -v
BUILT_SOURCES =

man1_MANS =
man5_MANS =
man7_MANS =
man8_MANS =
sbin_PROGRAMS =
nobase_lib_LTLIBRARIES =
noinst_HEADERS =
noinst_LTLIBRARIES =
noinst_PROGRAMS =
noinst_SCRIPTS =

if ENABLE_LIBRARY
include misc/misc.mk
else
if ENABLE_DAEMON
include misc/misc.mk
endif
endif
if ENABLE_TESTCASES
include testcases/testcases.mk
endif

include man/man.mk
include usr/usr.mk

include tools/tools.mk
include doc/doc.mk

install-data-hook:
if AIX
	lsgroup $(pkcs_group) > /dev/null || $(GROUPADD) -a pkcs11
	lsuser $(pkcsslotd_user) > /dev/null || $(USERADD) -g $(pkcs_group) -d $(DESTDIR)$(RUN_PATH)/opencryptoki -c "Opencryptoki pkcsslotd user" $(pkcsslotd_user)
else
	getent group $(pkcs_group) > /dev/null || $(GROUPADD) -r $(pkcs_group)
	getent passwd $(pkcsslotd_user) >/dev/null || $(USERADD) -r -g $(pkcs_group) -d $(RUN_PATH)/opencryptoki -s /sbin/nologin -c "Opencryptoki pkcsslotd user" $(pkcsslotd_user)
endif
	$(MKDIR_P) $(DESTDIR)$(RUN_PATH)/opencryptoki/
	$(CHOWN) $(pkcsslotd_user):$(pkcs_group) $(DESTDIR)$(RUN_PATH)/opencryptoki/
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(RUN_PATH)/opencryptoki/
	$(CHMOD) 0710 $(DESTDIR)$(RUN_PATH)/opencryptoki/
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki
if ENABLE_LIBRARY
	$(MKDIR_P) $(DESTDIR)$(libdir)/opencryptoki/stdll
	$(MKDIR_P) $(DESTDIR)$(libdir)/pkcs11
	cd $(DESTDIR)$(libdir)/opencryptoki && \
		ln -fs libopencryptoki.$(SHLIBEXT) PKCS11_API.$(SHLIBEXT)
	cd $(DESTDIR)$(libdir)/opencryptoki && \
		ln -$(LNFLAG) $(sbindir) methods
	cd $(DESTDIR)$(libdir)/pkcs11 && \
		ln -$(LNFLAG) $(sbindir) methods
	cd $(DESTDIR)$(libdir)/pkcs11 && \
		ln -fs ../opencryptoki/libopencryptoki.$(SHLIBEXT) PKCS11_API.$(SHLIBEXT)
	cd $(DESTDIR)$(libdir)/pkcs11 && \
		ln -fs ../opencryptoki/libopencryptoki.$(SHLIBEXT) libopencryptoki.$(SHLIBEXT)
	cd $(DESTDIR)$(libdir)/pkcs11 && \
		ln -$(LNFLAG) ../opencryptoki/stdll/ stdll
endif
if ENABLE_PKCSHSM_MK_CHANGE
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/HSM_MK_CHANGE
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/HSM_MK_CHANGE
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/HSM_MK_CHANGE
endif
if ENABLE_CCATOK
	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		ln -fs libpkcs11_cca.$(SHLIBEXT) PKCS11_CCA.$(SHLIBEXT)
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok/TOK_OBJ
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok
	$(MKDIR_P) $(DESTDIR)$(lockdir)/ccatok
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir)/ccatok
	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/ccatok
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/ccatok.conf || $(INSTALL) -m 644 $(srcdir)/usr/lib/cca_stdll/ccatok.conf $(DESTDIR)$(sysconfdir)/opencryptoki/ccatok.conf || true
endif
if ENABLE_EP11TOK
	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		ln -fs libpkcs11_ep11.$(SHLIBEXT) PKCS11_EP11.$(SHLIBEXT)
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok/TOK_OBJ
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok
	$(MKDIR_P) $(DESTDIR)$(lockdir)/ep11tok
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir)/ep11tok
	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/ep11tok
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/ep11tok.conf || $(INSTALL) -m 644 $(srcdir)/usr/lib/ep11_stdll/ep11tok.conf $(DESTDIR)$(sysconfdir)/opencryptoki/ep11tok.conf || true
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/ep11cpfilter.conf || $(INSTALL) -m 644 $(srcdir)/usr/lib/ep11_stdll/ep11cpfilter.conf $(DESTDIR)$(sysconfdir)/opencryptoki/ep11cpfilter.conf || true
endif
if ENABLE_P11SAK
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g $(pkcs_group) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_P11KMIP
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11kmip.conf || $(INSTALL) -g $(pkcs_group) -m 0640 $(srcdir)/usr/sbin/p11kmip/p11kmip.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11kmip.conf || true
endif
if ENABLE_ICATOK
	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		ln -fs libpkcs11_ica.$(SHLIBEXT) PKCS11_ICA.$(SHLIBEXT)
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite/TOK_OBJ
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite
	$(MKDIR_P) $(DESTDIR)$(lockdir)/lite
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir)/lite
	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/lite
endif
if ENABLE_SWTOK
	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		ln -fs libpkcs11_sw.$(SHLIBEXT) PKCS11_SW.$(SHLIBEXT)
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok/TOK_OBJ
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok/TOK_OBJ
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok
	$(MKDIR_P) $(DESTDIR)$(lockdir)/swtok
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir)/swtok
	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/swtok
endif
if ENABLE_TPMTOK
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/tpm
	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		ln -fs libpkcs11_tpm.$(SHLIBEXT) PKCS11_TPM.$(SHLIBEXT)
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/tpm
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/tpm
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/tpm
	$(MKDIR_P) $(DESTDIR)$(lockdir)/tpm
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir)/tpm
	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/tpm
endif
if ENABLE_ICSFTOK
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/icsf
	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		ln -fs libpkcs11_icsf.$(SHLIBEXT) PKCS11_ICSF.$(SHLIBEXT)
	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/icsf
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/icsf
	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/icsf
	$(MKDIR_P) $(DESTDIR)$(lockdir)/icsf
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir)/icsf
	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/icsf
endif
if ENABLE_DAEMON
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g $(pkcs_group) -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
endif
if !AIX
	$(MKDIR_P) $(DESTDIR)/etc/ld.so.conf.d
	echo "$(libdir)/opencryptoki" >\
		$(DESTDIR)/etc/ld.so.conf.d/opencryptoki-$(target_cpu).conf
	echo "$(libdir)/opencryptoki/stdll" >>\
		$(DESTDIR)/etc/ld.so.conf.d/opencryptoki-$(target_cpu).conf
	@echo "--------------------------------------------------------------"
	@echo "Remember you must run ldconfig before using the above settings"
	@echo "--------------------------------------------------------------"
endif
	$(MKDIR_P) $(DESTDIR)$(lockdir) $(DESTDIR)$(logdir)
	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir) $(DESTDIR)$(logdir)
	$(CHMOD) 0770 $(DESTDIR)$(lockdir) $(DESTDIR)$(logdir)


uninstall-hook:
if ENABLE_LIBRARY
	if test -d $(DESTDIR)$(libdir)/opencryptoki/stdll; then \
		cd $(DESTDIR)$(libdir)/opencryptoki && \
		rm -f PKCS11_API.$(SHLIBEXT) && \
		rm -f methods; fi
	if test -d $(DESTDIR)$(libdir)/pkcs11; then \
		cd $(DESTDIR)$(libdir)/pkcs11 && \
		rm -f methods && \
		rm -f PKCS11_API.$(SHLIBEXT) && \
		rm -f libopencryptoki.$(SHLIBEXT) && \
		rm -f stdll; fi
endif
if ENABLE_CCATOK
	if test -d $(DESTDIR)/$(libdir)/opencryptoki/stdll; then \
		cd $(DESTDIR)/$(libdir)/opencryptoki/stdll && \
		rm -f PKCS11_CCA.$(SHLIBEXT); fi
	rm -f $(DESTDIR)$(sysconfdir)/opencryptoki/ccatok.conf 
endif
if ENABLE_EP11TOK
	if test -d $(DESTDIR)$(libdir)/opencryptoki/stdll; then \
		cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		rm -f PKCS11_EP11.$(SHLIBEXT); fi
	rm -f $(DESTDIR)$(sysconfdir)/opencryptoki/ep11tok.conf 
	rm -f $(DESTDIR)$(sysconfdir)/opencryptoki/ep11cpfilter.conf
endif
if ENABLE_ICATOK
	if test -d $(DESTDIR)$(libdir)/opencryptoki/stdll; then \
		cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		rm -f PKCS11_ICA.$(SHLIBEXT); fi
endif
if ENABLE_SWTOK
	if test -d $(DESTDIR)$(libdir)/opencryptoki/stdll; then \
		cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		rm -f PKCS11_SW.$(SHLIBEXT); fi
endif
if ENABLE_TPMTOK
	if test -d $(DESTDIR)$(libdir)/opencryptoki/stdll; then \
		cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		rm -rf PKCS11_TPM.$(SHLIBEXT); fi
endif
if !AIX
	rm -f $(DESTDIR)/etc/ld.so.conf.d/opencryptoki-$(target_cpu).conf
endif
if ENABLE_ICSFTOK
	if test -d $(DESTDIR)$(libdir)/opencryptoki/stdll; then \
		cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
		rm -rf PKCS11_ICSF.$(SHLIBEXT); fi
endif
if ENABLE_DAEMON
if ENABLE_SYSTEMD
	if test -e $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf; then \
		rm -f $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf; fi
endif
endif
if ENABLE_P11SAK
	rm -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_P11KMIP
	rm -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11kmip.conf || true
endif
	rm -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
	rm -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true


if ENABLE_TESTCASES
PKCS11_SO_PIN ?= 76543210
PKCS11_USER_PIN ?= 01234567
PKCS11_VHSM_PIN ?= 1234567890

if AIX
PKCSLIB = '@libdir@/opencryptoki/libopencryptoki.a(libopencryptoki.so.0)'
else
PKCSLIB ?= @libdir@/opencryptoki/libopencryptoki.so
endif

# ci-prepare: set up tokens and configuration for ci-installcheck.
#
# When OCK_CI_REUSE_TOKENS is set to a non-empty value, the existing
# opencryptoki.conf is left untouched and only uninitialised slots are
# initialised.  This lets callers reuse a previously configured token
# setup instead of destroying it.  By default (OCK_CI_REUSE_TOKENS
# unset) the original behaviour is preserved: ciconfig.sh regenerates
# the full slot configuration from scratch.
ci-prepare:
	$(KILLALL) -HUP pkcsslotd || true
	if [ -z "$${OCK_CI_REUSE_TOKENS}" ]; then \
		${srcdir}/testcases/ciconfig.sh "$(sysconfdir)/opencryptoki" "$(sysconfdir)/opencryptoki" "$(sysconfdir)/opencryptoki" "${srcdir}/testcases/test_combined_extract.slots" "$(CI_ICSF_MOCK_PID_FILE)" "${srcdir}/tools/icsf_mock_server/server.py" "$(CI_ICSF_MOCK_PORT)" "$(CI_ICSF_MOCK_TOKEN)" "$(CI_ICSF_SLOT)" "$(CI_ICSF_MOCK_LOG)"; \
	else \
		echo "OCK_CI_REUSE_TOKENS set - skipping ciconfig.sh, reusing existing token configuration"; \
	fi
	@sbindir@/pkcsslotd
	@sbindir@/pkcsstats --reset-all
	for slot in `awk '/^slot (.*)/ { print $$2; }' $(sysconfdir)/opencryptoki/opencryptoki.conf`; do \
		TOKINFO=$$(@sbindir@/pkcsconf -c $$slot -t 2>/dev/null); \
		echo "$$TOKINFO" | grep "Flags:" | grep -q TOKEN_INITIALIZED || \
			{ PKCS11_USER_PIN=$(PKCS11_USER_PIN) PKCS11_SO_PIN=$(PKCS11_SO_PIN) PKCSLIB=$(PKCSLIB) ${srcdir}/testcases/init_token.sh $$slot || exit; continue; }; \
		echo "$$TOKINFO" | grep "Flags:" | grep -q USER_PIN_INITIALIZED || \
			{ PKCS11_USER_PIN=$(PKCS11_USER_PIN) PKCS11_SO_PIN=$(PKCS11_SO_PIN) PKCSLIB=$(PKCSLIB) ${srcdir}/testcases/init_token.sh $$slot || exit; }; \
	done
#	if [ -z "$${OCK_CI_REUSE_TOKENS}" ]; then \
#		cd ${srcdir}/testcases && PKCS11_USER_PIN=$(PKCS11_USER_PIN) PKCS11_VHSM_PIN=$(PKCS11_VHSM_PIN) PKCSLIB=$(PKCSLIB) ./init_vhsm.exp 42; \
#		echo "VHSM_MODE" >> "$(sysconfdir)/opencryptoki/ep11tok42.conf"; \
#	fi
	@sbindir@/pkcsep11_session status || true

installcheck-local: all check
	$(KILLALL) -HUP pkcsslotd || true
	@sbindir@/pkcsslotd
	if test ! -z ${PKCS11_TEST_USER}; then				\
		chmod 777 ${srcdir}/testcases &&			\
		cd ${srcdir}/testcases &&                               \
		su -s /bin/bash -c "PKCS11_SO_PIN=$(PKCS11_SO_PIN) PKCS11_USER_PIN=$(PKCS11_USER_PIN) PKCSLIB=$(PKCSLIB) MAX_JOBS=$(TEST_MAX_JOBS) /bin/bash ./ock_tests.sh || true" ${PKCS11_TEST_USER}; \
	else								\
		cd ${srcdir}/testcases && 				\
		PKCS11_SO_PIN=$(PKCS11_SO_PIN) PKCS11_USER_PIN=$(PKCS11_USER_PIN) PKCSLIB=$(PKCSLIB) MAX_JOBS=$(TEST_MAX_JOBS) ./ock_tests.sh || true; \
	fi
	$(KILLALL) -HUP pkcsslotd

# Slot number and datastore used by the soft-token-based test scripts.
# When OCK_CI_REUSE_TOKENS is set, callers may override these via
# OCK_CI_SWTOK_SLOT      (default: 30)
# OCK_CI_SWTOK_DATASTORE (default: $(localstatedir)/lib/opencryptoki/sw0)
CI_SWTOK_SLOT      = $${OCK_CI_SWTOK_SLOT:-30}
CI_SWTOK_DATASTORE = $${OCK_CI_SWTOK_DATASTORE:-$(localstatedir)/lib/opencryptoki/sw0}

# ICSF mock server settings used by ci-prepare / ci-installcheck.
# CI_ICSF_MOCK_PID_FILE       path where the mock server PID is recorded (used to
#                             stop it after tests).
# CI_ICSF_MOCK_LOG            log file for the mock server; placed in the testcases
#                             directory as log-*.txt so the post-process script picks
#                             it up alongside the other CI log files.
# CI_ICSF_MOCK_PORT           LDAP listen port for the mock server (default: 1389).
# CI_ICSF_MOCK_TOKEN          name of the pre-created ICSF token (default: icsf0).
# CI_ICSF_SLOT                slot number assigned to the ICSF token (default: 50).
# ICSF_MOCK_RACF_PASSWORD     env var: RACF/bind password passed to pkcsicsf -a
#                             (default: testpassword).  Set in the environment to
#                             override when testing against a real ICSF server.
CI_ICSF_MOCK_PID_FILE = ${builddir}/.icsf_mock_server.pid
CI_ICSF_MOCK_LOG      = ${srcdir}/testcases/log-icsf-mock-server.txt
CI_ICSF_MOCK_PORT     = 1389
CI_ICSF_MOCK_TOKEN    = icsf0
CI_ICSF_SLOT          = 50

ci-installcheck: ci-prepare installcheck
	$(KILLALL) -HUP pkcsslotd || true
	@sbindir@/pkcsslotd
	@sbindir@/pkcshsm_mk_change list || true
	cd ${srcdir}/testcases						\
	&& export PKCSLIB=$(PKCSLIB)					\
	&& export PKCS11_USER_PIN=$(PKCS11_USER_PIN)			\
	&& export PKCS11_SO_PIN=$(PKCS11_SO_PIN)			\
	&& SBINDIR=@sbindir@ SLOT=$(CI_SWTOK_SLOT) ./misc_tests/p11sak_test.sh   | tee log-p11sak.txt		\
	&& SBINDIR=@sbindir@ ./misc_tests/pkcsconf_test.sh | tee log-pkcsconf.txt	\
	&& SBINDIR=@sbindir@ MAX_JOBS=$(TEST_MAX_JOBS) ./misc_tests/tok2tok_test.sh  | tee log-tok2tok.txt
	if [[ -n "${KMIP_IP}" ]] && [[ -n "${KMIP_REST_USER}" ]] && [[ -n "${KMIP_REST_PASSWORD}" ]]; then \
		cd ${srcdir}/testcases					\
		&& export PKCSLIB=$(PKCSLIB)				\
		&& export PKCS11_USER_PIN=$(PKCS11_USER_PIN)		\
		&& export PKCS11_SO_PIN=$(PKCS11_SO_PIN)		\
		&& SBINDIR=@sbindir@ 					\
		   PKCS11_SLOT_ID=$(CI_SWTOK_SLOT)			\
		   ./misc_tests/p11kmip_test.sh | tee log-p11kmip.txt;\
	fi
	cd ${srcdir}/testcases						\
	&& export PKCSLIB=$(PKCSLIB)					\
	&& export PKCS11_USER_PIN=$(PKCS11_USER_PIN)			\
	&& export PKCS11_SO_PIN=$(PKCS11_SO_PIN)			\
	&& SBINDIR=@sbindir@						\
	   SLOT=$(CI_SWTOK_SLOT)					\
	   OCK_CONFDIR=$(sysconfdir)/opencryptoki			\
	   OCK_DATASTORE=$(CI_SWTOK_DATASTORE)				\
	   ./misc_tests/pkcstok_migrate_test.sh | tee log-pkcstok-migrate.txt
	@sbindir@/pkcsstats --all
	$(KILLALL) -HUP pkcsslotd
	if [ -z "$${OCK_CI_REUSE_TOKENS}" ]; then \
		if [ -f "$(CI_ICSF_MOCK_PID_FILE)" ]; then \
			ICSF_PID=$$(cat "$(CI_ICSF_MOCK_PID_FILE)"); \
			if kill -0 "$${ICSF_PID}" 2>/dev/null; then \
				echo "Stopping ICSF mock server (pid=$${ICSF_PID})..."; \
				kill "$${ICSF_PID}" && rm -f "$(CI_ICSF_MOCK_PID_FILE)"; \
			else \
				echo "WARNING: ICSF mock server PID $${ICSF_PID} is stale; nothing to stop." >&2; \
				rm -f "$(CI_ICSF_MOCK_PID_FILE)"; \
			fi; \
		else \
			echo "WARNING: ICSF mock server PID file '$(CI_ICSF_MOCK_PID_FILE)' not found; nothing to stop." >&2; \
		fi; \
	fi
	rm ${srcdir}/testcases/test_combined_extract.slots -f
	@echo "done"

# ci-cleanup also removes the testcases/log-*.txt files, so collect them (or
# run ci-check-results) before running this target.
ci-cleanup:
	$(KILLALL) -HUP pkcsslotd || true
#	@sbindir@/pkcsslotd
#	cd ${srcdir}/testcases && PKCS11_USER_PIN=$(PKCS11_USER_PIN) PKCSLIB=$(PKCSLIB) ./cleanup_vhsm.exp 42
#	$(KILLALL) -HUP pkcsslotd
	@sbindir@/pkcsep11_session status || true
	${srcdir}/testcases/cicleanup.sh "@sbindir@" "$(CI_ICSF_MOCK_TOKEN)" "$(CI_ICSF_MOCK_PID_FILE)" "$(sysconfdir)/opencryptoki" "${srcdir}/testcases"
	rm ${srcdir}/testcases/test_combined_extract.slots -f

ci-uninstall: uninstall
	rm -f $(sysconfdir)/opencryptoki/ep11tok*.conf
	rm -rf $(localstatedir)/lib/opencryptoki/*
	rm -rf $(lockdir)/*
	rm -rf $(logdir)/*

# ci-check-results: scan log files left by a previous ci-installcheck run and
# report any failures without re-running the tests.
#
# Sources examined:
#   log-slot_N.txt   - per-slot crypto/pkcs11 output from ock_tests.sh
#   log-p11sak.txt, log-pkcsconf.txt, log-tok2tok.txt,
#   log-pkcstok-migrate.txt, log-p11kmip.txt - misc_tests harnesses
# Keep this list in sync with the 'tee log-*.txt' invocations in
# ci-installcheck.
#
# Note: log files are not removed before a test run, so logs from an earlier
# run (e.g. misc_tests logs when only 'make installcheck' was run, or
# log-p11kmip.txt when KMIP_* is not set) are examined as well. Run
# 'make ci-cleanup' between runs to avoid stale results.
#
# Exit code: 0 = no failures found, 1 = at least one failure detected.
ci-check-results:
	@LOGDIR="${srcdir}/testcases"; \
	FAILED=0; \
	LOGS=$$(ls "$$LOGDIR"/log-slot_*.txt "$$LOGDIR"/log-p11sak.txt \
	           "$$LOGDIR"/log-pkcsconf.txt "$$LOGDIR"/log-tok2tok.txt \
	           "$$LOGDIR"/log-pkcstok-migrate.txt \
	           "$$LOGDIR"/log-p11kmip.txt 2>/dev/null); \
	if [ -z "$$LOGS" ]; then \
		echo "ci-check-results: no log files found in $$LOGDIR" \
		     "(has ci-installcheck been run?)"; \
		exit 1; \
	fi; \
	for log in $$LOGS; do \
		MATCHES=$$(grep -E \
		    -e "^\* TESTCASE .* (FAIL|ERROR) " \
		    -e "^ERROR: Testcase .* failed to execute" \
		    "$$log" 2>/dev/null); \
		if [ -n "$$MATCHES" ]; then \
			echo "--- $$log ---"; \
			echo "$$MATCHES"; \
			FAILED=1; \
		fi; \
	done; \
	if [ "$$FAILED" -eq 0 ]; then \
		echo "ci-check-results: no failures found in $$(echo $$LOGS | wc -w) log file(s)."; \
	else \
		echo "ci-check-results: FAILED - see matches above."; \
		exit 1; \
	fi

.PHONY: ci-prepare ci-installcheck ci-uninstall ci-check-results
endif