TREJJ VPN macOS OpenVPN source-build manifest
Manifest format: 1

Purpose
-------
This recipe produces the two thin OpenVPN payloads used to create the signed
universal macOS package. Third-party libraries are linked statically, so the
payload file list is identical for arm64 and x64 and contains no third-party
dylibs.

Pinned sources
--------------
OpenVPN
  Version: 2.7.5
  URL: https://swupdate.openvpn.org/community/releases/openvpn-2.7.5.tar.gz
  SHA-256: c6864b3c7d4e059c7d6ce22d1b5fa646c8b379a06af872eeb9792b6083a44ac4

OpenSSL
  Version: 3.5.7 LTS
  URL: https://github.com/openssl/openssl/releases/download/openssl-3.5.7/openssl-3.5.7.tar.gz
  SHA-256: a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8

LZO
  Version: 2.10
  URL: https://www.oberhumer.com/opensource/lzo/download/lzo-2.10.tar.gz
  SHA-256: c0f892943208266f9b6543b3ae308fab6284c5c90e627931446fb49b4221a072

LZ4
  Version: 1.10.0
  URL: https://github.com/lz4/lz4/archive/refs/tags/v1.10.0.tar.gz
  SHA-256: 537512904744b35e232912055ccf8ec66d768639ff3abe5788d90d792ec5f48b

Build policy
------------
Deployment target: macOS 12.0
Build host: Apple silicon macOS with Xcode and Rosetta 2
Build architecture: aarch64-apple-darwin
Source date epoch: 1782901060
Logical dependency prefix: /usr/local/trejj-openvpn-deps
OpenVPN install prefix: /usr/local
Dynamic dependency policy: /System and /usr/lib libraries only
PKCS#11: disabled because the TREJJ privileged profile policy rejects PKCS#11
Plugins and management interface: disabled because TREJJ profiles reject them
External DNS up/down callback default: disabled because TREJJ profiles must not invoke external root scripts
Debug and gremlin stress directives: disabled because they are not required in a production VPN client
Compression compatibility: LZO and LZ4 receive-only support is enabled

Architecture substitutions
--------------------------
arm64
  MACH_ARCH: arm64
  AUTOCONF_HOST: aarch64-apple-darwin
  OPENSSL_TARGET: darwin64-arm64-cc

x64
  MACH_ARCH: x86_64
  AUTOCONF_HOST: x86_64-apple-darwin
  OPENSSL_TARGET: darwin64-x86_64-cc

Common environment and compiler flags
-------------------------------------
PATH=/usr/bin:/bin:/usr/sbin:/sbin
CC=<xcrun --sdk macosx --find clang>
AR=/usr/bin/ar
RANLIB=/usr/bin/ranlib
NM=/usr/bin/nm
STRIP=/usr/bin/strip
SDKROOT=<xcrun --sdk macosx --show-sdk-path>
MACOSX_DEPLOYMENT_TARGET=12.0
SOURCE_DATE_EPOCH=1782901060
ZERO_AR_DATE=1
LC_ALL=C
TZ=UTC
CFLAGS=-arch <MACH_ARCH> -mmacosx-version-min=12.0 -O2 -fno-common -Werror=unguarded-availability-new -ffile-prefix-map=<WORK_ROOT>=/usr/src/trejj-openvpn
LDFLAGS=-arch <MACH_ARCH> -mmacosx-version-min=12.0
OpenVPN LDFLAGS=<LDFLAGS> -L<DEPS_PREFIX>/lib

OpenSSL Configure flags
-----------------------
<OPENSSL_TARGET>
--prefix=/usr/local/trejj-openvpn-deps
--openssldir=/etc/ssl
--libdir=lib
no-shared
no-module
no-engine
no-comp
no-docs

OpenSSL verification and staging
--------------------------------
make
arm64 test command: make test
x64 test command: /usr/bin/arch -x86_64 /usr/bin/make test
make DESTDIR=<DEPS_DESTDIR> install_sw

LZO configure flags
-------------------
--build=aarch64-apple-darwin
--host=<AUTOCONF_HOST>
--prefix=/usr/local/trejj-openvpn-deps
--disable-dependency-tracking
--disable-shared
--enable-static

LZO verification and staging
----------------------------
make
arm64 test command: make check
x64 test command: /usr/bin/arch -x86_64 /usr/bin/make check
make DESTDIR=<DEPS_DESTDIR> install

LZ4 make variables
------------------
TARGET_OS=Darwin
BUILD_SHARED=no
BUILD_STATIC=yes
CC=<CC>
AR=/usr/bin/ar
CFLAGS=<CFLAGS>
LDFLAGS=<LDFLAGS>
PREFIX=/usr/local/trejj-openvpn-deps
DESTDIR=<DEPS_DESTDIR>

LZ4 verification
----------------
arm64 test command: make test with the LZ4 make variables above
x64 test command: /usr/bin/arch -x86_64 /usr/bin/make test with the LZ4 make variables above

OpenVPN configure flags
-----------------------
--build=aarch64-apple-darwin
--host=<AUTOCONF_HOST>
--prefix=/usr/local
--disable-dependency-tracking
--disable-shared
--enable-static
--with-crypto-library=openssl
--with-openssl-engine=no
--enable-lzo
--enable-lz4
--disable-pkcs11
--disable-plugins
--disable-management
--disable-plugin-auth-pam
--disable-plugin-down-root
--disable-port-share
--disable-dco
--disable-systemd
--disable-selinux
--disable-iproute2
--disable-pam-dlopen
--disable-async-push
--disable-dns-updown-by-default
--disable-debug
--with-special-build=TREJJ-macOS-source

OpenVPN dependency overrides
----------------------------
PKG_CONFIG=/usr/bin/false
OPENSSL_CFLAGS=-I<DEPS_PREFIX>/include
OPENSSL_LIBS=<DEPS_PREFIX>/lib/libssl.a <DEPS_PREFIX>/lib/libcrypto.a
LZO_CFLAGS=-I<DEPS_PREFIX>/include
LZO_LIBS=<DEPS_PREFIX>/lib/liblzo2.a
LZ4_CFLAGS=-I<DEPS_PREFIX>/include
LZ4_LIBS=<DEPS_PREFIX>/lib/liblz4.a

OpenVPN verification
--------------------
make
arm64 test command: make check
x64 test command: /usr/bin/arch -x86_64 /usr/bin/make check
arm64 launch commands: /usr/bin/arch -arm64 openvpn --version, --show-ciphers, --show-digests
x64 launch commands: /usr/bin/arch -x86_64 openvpn --version, --show-ciphers, --show-digests

Payload files
-------------
BUILD-MANIFEST.txt
LICENSE-LZ4.txt
LICENSE-LZO.txt
LICENSE-OpenSSL.txt
LICENSE-OpenVPN.txt
openvpn

License source files
--------------------
LICENSE-OpenVPN.txt: OpenVPN COPYING
LICENSE-OpenSSL.txt: OpenSSL LICENSE.txt
LICENSE-LZO.txt: LZO COPYING
LICENSE-LZ4.txt: LZ4 lib/LICENSE

Required output checks
----------------------
Each executable is a single Mach-O slice of the declared architecture.
Each executable has LC_BUILD_VERSION minos 12.0.
Each executable reports OpenVPN 2.7.5 and enumerates ciphers and digests.
Each executable links only to Apple libraries under /System or /usr/lib.
Both payload directories have identical file lists.
Every non-Mach-O payload file is byte-identical between architectures.
