From 504a45defad056fc808f9d210ba6b7b3c0de65c1 Mon Sep 17 00:00:00 2001 From: Tristan Date: Tue, 14 Jun 2022 04:46:37 +0100 Subject: [PATCH] Fix QuicTLS & HAProxy linking, run regtests in CI --- .gitlab-ci.yml | 292 +++++++++++++++++++++++++++--------------- Makefile | 6 +- deps/quictls/Makefile | 4 +- deps/vtest/Makefile | 29 +++++ haproxy/Makefile | 19 ++- haproxy/debian/rules | 14 +- 6 files changed, 246 insertions(+), 118 deletions(-) create mode 100644 deps/vtest/Makefile diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index e1251b6..3582ceb 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,6 +1,7 @@ stages: - dependencies - build + - test - publish variables: &default-variables @@ -21,7 +22,11 @@ variables: &default-variables needs: [ ] before_script: - apt -qq update - - apt install -y --no-install-recommends -qq build-essential ca-certificates cmake curl git libreadline-dev libsystemd-dev tar + - apt install -y --no-install-recommends -qq build-essential ca-certificates cmake curl git libpcre2-dev libreadline-dev libsystemd-dev tar zlib1g-dev + +#---------------------- +# Common dependencies +#---------------------- lua: <<: *build-job @@ -42,26 +47,31 @@ pcre2: quictls: <<: *build-job stage: dependencies - script: - - make -C deps/quictls - - | - set -eu - - PKG_VER="$(cat deps/quictls/Makefile | head -n1 | cut -d'=' -f2 | tr -d ' ')" - QUICTLS_VER="$PKG_VER" - if [ "$CI_COMMIT_REF_NAME" != "$CI_DEFAULT_BRANCH" ]; then - export PKG_VER="branch-$CI_COMMIT_REF_SLUG" - echo "Git reference $CI_COMMIT_REF_NAME is not the default branch. Setting version to $PKG_VER" - fi - - curl -fsSL \ - -H"JOB-TOKEN: $CI_JOB_TOKEN" \ - --upload-file "deps/quictls/quictls-dist.tar.gz" \ - "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/quictls/$PKG_VER/quictls-$QUICTLS_VER.tar.gz" + script: make -C deps/quictls artifacts: expire_in: 7 days paths: [ "deps/quictls/quictls-dist.tar.gz" ] +vtest: + <<: *build-job + stage: dependencies + script: make -C deps/vtest + artifacts: + expire_in: 7 days + paths: [ "deps/vtest/dist/vtest" ] + +.needs-dependencies: &needs-dependencies + - job: lua + artifacts: true + - job: pcre2 + artifacts: true + - job: quictls + artifacts: true + +#---------------------- +# HAProxy job templates +#---------------------- + .haproxy-build: &haproxy-build <<: *build-job stage: build @@ -71,43 +81,80 @@ quictls: - mkdir deps/pcre2/dist && tar -C deps/pcre2/dist -xf deps/pcre2/pcre2-dist.tar.gz - mkdir deps/quictls/dist && tar -C deps/quictls/dist -xf deps/quictls/quictls-dist.tar.gz - make -C haproxy HAPROXY_VERSION=$HAPROXY_VERSION HAPROXY_GITREF=$HAPROXY_GITREF - - | - set -eu - - PKG_VER=$HAPROXY_VERSION - if [ "$CI_COMMIT_REF_NAME" != "$CI_DEFAULT_BRANCH" ]; then - export PKG_VER="branch-$CI_COMMIT_REF_SLUG-$HAPROXY_VERSION-$HAPROXY_GITREF" - echo "Git reference $CI_COMMIT_REF_NAME is not the default branch. Setting version to $PKG_VER" - fi - - curl -fsSL \ - -H"JOB-TOKEN: $CI_JOB_TOKEN" \ - --upload-file "haproxy/haproxy-dist.tar.gz" \ - "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/haproxy/$PKG_VER/haproxy-$HAPROXY_VERSION.tar.gz" - needs: - - job: lua - artifacts: true - - job: pcre2 - artifacts: true - - job: quictls - artifacts: true + needs: *needs-dependencies artifacts: expire_in: 7 days paths: [ "haproxy/dist", "haproxy/haproxy-dist.tar.gz" ] -haproxy:stable: - <<: *haproxy-build - variables: - <<: *default-variables - <<: *haproxy-stable +.haproxy-regtests: &haproxy-regtests + <<: *build-job + stage: test + script: + - apt install -y --no-install-recommends -qq bzip2 git + - mkdir deps/lua/dist && tar -C deps/lua/dist -xf deps/lua/lua-dist.tar.gz + - mkdir deps/pcre2/dist && tar -C deps/pcre2/dist -xf deps/pcre2/pcre2-dist.tar.gz + - mkdir deps/quictls/dist && tar -C deps/quictls/dist -xf deps/quictls/quictls-dist.tar.gz + - make -C haproxy HAPROXY_VERSION=$HAPROXY_VERSION HAPROXY_GITREF=$HAPROXY_GITREF build test + needs: + - *needs-dependencies + - job: vtest + artifacts: true -haproxy:dev: - <<: *haproxy-build - variables: - <<: *default-variables - <<: *haproxy-dev +.haproxy-debian: &haproxy-debian + <<: *build-job + stage: publish + script: + - apt install -y --no-install-recommends -qq bzip2 devscripts debhelper pkg-config + - mkdir deps/lua/dist && tar -C deps/lua/dist -xf deps/lua/lua-dist.tar.gz + - mkdir deps/pcre2/dist && tar -C deps/pcre2/dist -xf deps/pcre2/pcre2-dist.tar.gz + - mkdir deps/quictls/dist && tar -C deps/quictls/dist -xf deps/quictls/quictls-dist.tar.gz + - export BUILD_MESSAGE="$CI_COMMIT_MESSAGE" + - make -C haproxy dist-deb HAPROXY_VERSION=$HAPROXY_VERSION HAPROXY_GITREF=$HAPROXY_GITREF + - | + set -euo pipefail -.docker: &docker + PACKAGE_NAME="haproxy-debian" + DEB_VERSION="$(cat haproxy/*.dsc | grep -E '^Version:' | cut -d' ' -f2-)" + if [ "$CI_COMMIT_REF_NAME" != "$CI_DEFAULT_BRANCH" ]; then + export PACKAGE_NAME="haproxy-debian-branches" + export DEB_VERSION="branch-$CI_COMMIT_REF_SLUG" + echo "Git reference $CI_COMMIT_REF_NAME is not the default branch. Setting coordinates to $PACKAGE_NAME/$DEB_VERSION" + fi + + GITLAB_IS_LAME_DEB_VERSION=$(echo "${DEB_VERSION}" | tr '~' '-') + echo "Publishing Debian package version ${DEB_VERSION} to haproxy-debian@${GITLAB_IS_LAME_DEB_VERSION}" + + for artifact in haproxy/haproxy*.deb; do + artifact_filename=$(basename "${artifact}") + gitlab_is_lame_artifact_filename=$(echo "${artifact_filename}" | tr '~' '-' | tr '+' '-') + echo "Uploading to haproxy-debian@${DEB_VERSION}... ${artifact_filename} -> ${gitlab_is_lame_artifact_filename}" + curl -fsSL -H"JOB-TOKEN: $CI_JOB_TOKEN" \ + --upload-file "${artifact}" \ + "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${GITLAB_IS_LAME_DEB_VERSION}/${gitlab_is_lame_artifact_filename}" + echo "OK" + done + artifacts: + expire_in: 7 days + paths: [ "haproxy/haproxy*" ] + +.haproxy-tarball: &haproxy-tarball + image: docker.io/curlimages/curl:latest + stage: publish + script: | + set -eu + + PKG_VER=$HAPROXY_VERSION + if [ "$CI_COMMIT_REF_NAME" != "$CI_DEFAULT_BRANCH" ]; then + export PKG_VER="branch-$CI_COMMIT_REF_SLUG-$HAPROXY_VERSION-$HAPROXY_GITREF" + echo "Git reference $CI_COMMIT_REF_NAME is not the default branch. Setting version to $PKG_VER" + fi + + curl -fsSL \ + -H"JOB-TOKEN: $CI_JOB_TOKEN" \ + --upload-file "haproxy/haproxy-dist.tar.gz" \ + "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/haproxy/$PKG_VER/haproxy-$HAPROXY_VERSION.tar.gz" + +.haproxy-docker: &haproxy-docker stage: publish image: name: gcr.io/kaniko-project/executor:debug @@ -168,80 +215,123 @@ haproxy:dev: --single-snapshot ) -docker:stable: - <<: *docker +#---------------------- +# HAProxy jobs +#---------------------- + +build:stable: + <<: *haproxy-build + variables: + <<: *default-variables + <<: *haproxy-stable + +build:dev: + <<: *haproxy-build + variables: + <<: *default-variables + <<: *haproxy-dev + +regtests:stable: + <<: *haproxy-regtests + variables: + <<: *default-variables + <<: *haproxy-stable + +regtests:dev: + <<: *haproxy-regtests + variables: + <<: *default-variables + <<: *haproxy-dev + +haproxy-tarball:stable: + <<: *haproxy-tarball variables: <<: *default-variables <<: *haproxy-stable needs: - - job: quictls + - job: "regtests:stable" + artifacts: false + - job: "build:stable" artifacts: true - - job: "haproxy:stable" + +haproxy-tarball:dev: + <<: *haproxy-tarball + variables: + <<: *default-variables + <<: *haproxy-dev + needs: + - job: "regtests:dev" + artifacts: false + - job: "build:dev" + artifacts: true + +docker:stable: + <<: *haproxy-docker + variables: + <<: *default-variables + <<: *haproxy-stable + needs: + - job: "quictls" + artifacts: true + - job: "regtests:stable" + artifacts: false + - job: "build:stable" artifacts: true docker:dev: - <<: *docker + <<: *haproxy-docker variables: <<: *default-variables <<: *haproxy-dev needs: - - job: quictls + - job: "quictls" artifacts: true - - job: "haproxy:dev" + - job: "regtests:dev" + artifacts: false + - job: "build:dev" artifacts: true -.debian: &debian - <<: *build-job - stage: build - script: - - apt install -y --no-install-recommends -qq bzip2 devscripts debhelper pkg-config - - mkdir deps/lua/dist && tar -C deps/lua/dist -xf deps/lua/lua-dist.tar.gz - - mkdir deps/pcre2/dist && tar -C deps/pcre2/dist -xf deps/pcre2/pcre2-dist.tar.gz - - mkdir deps/quictls/dist && tar -C deps/quictls/dist -xf deps/quictls/quictls-dist.tar.gz - - export BUILD_MESSAGE="$CI_COMMIT_MESSAGE" - - make -C haproxy dist-deb HAPROXY_VERSION=$HAPROXY_VERSION HAPROXY_GITREF=$HAPROXY_GITREF - - | - set -euo pipefail - - PACKAGE_NAME="haproxy-debian" - DEB_VERSION="$(cat haproxy/*.dsc | grep -E '^Version:' | cut -d' ' -f2-)" - if [ "$CI_COMMIT_REF_NAME" != "$CI_DEFAULT_BRANCH" ]; then - export PACKAGE_NAME="haproxy-debian-branches" - export DEB_VERSION="branch-$CI_COMMIT_REF_SLUG" - echo "Git reference $CI_COMMIT_REF_NAME is not the default branch. Setting coordinates to $PACKAGE_NAME/$DEB_VERSION" - fi - - GITLAB_IS_LAME_DEB_VERSION=$(echo "${DEB_VERSION}" | tr '~' '-') - echo "Publishing Debian package version ${DEB_VERSION} to haproxy-debian@${GITLAB_IS_LAME_DEB_VERSION}" - - for artifact in haproxy/haproxy*.deb; do - artifact_filename=$(basename "${artifact}") - gitlab_is_lame_artifact_filename=$(echo "${artifact_filename}" | tr '~' '-' | tr '+' '-') - echo "Uploading to haproxy-debian@${DEB_VERSION}... ${artifact_filename} -> ${gitlab_is_lame_artifact_filename}" - curl -fsSL -H"JOB-TOKEN: $CI_JOB_TOKEN" \ - --upload-file "${artifact}" \ - "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/${PACKAGE_NAME}/${GITLAB_IS_LAME_DEB_VERSION}/${gitlab_is_lame_artifact_filename}" - echo "OK" - done - needs: - - job: lua - artifacts: true - - job: pcre2 - artifacts: true - - job: quictls - artifacts: true - artifacts: - expire_in: 7 days - paths: [ "haproxy/haproxy*" ] - debian:stable: - <<: *debian + <<: *haproxy-debian variables: <<: *default-variables <<: *haproxy-stable + needs: + - *needs-dependencies + - job: "regtests:stable" + artifacts: false debian:dev: - <<: *debian + <<: *haproxy-debian variables: <<: *default-variables <<: *haproxy-dev + needs: + - *needs-dependencies + - job: "regtests:dev" + artifacts: false + +quictls:tarball: + image: docker.io/curlimages/curl:latest + stage: publish + script: | + set -eu + + PKG_VER="$(cat deps/quictls/Makefile | head -n1 | cut -d'=' -f2 | tr -d ' ')" + QUICTLS_VER="$PKG_VER" + if [ "$CI_COMMIT_REF_NAME" != "$CI_DEFAULT_BRANCH" ]; then + export PKG_VER="branch-$CI_COMMIT_REF_SLUG" + echo "Git reference $CI_COMMIT_REF_NAME is not the default branch. Setting version to $PKG_VER" + fi + + curl -fsSL \ + -H"JOB-TOKEN: $CI_JOB_TOKEN" \ + --upload-file "deps/quictls/quictls-dist.tar.gz" \ + "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/quictls/$PKG_VER/quictls-$QUICTLS_VER.tar.gz" + needs: + - job: quictls + artifacts: true + - job: "regtests:dev" + artifacts: false + - job: "regtests:stable" + artifacts: false diff --git a/Makefile b/Makefile index b98119e..fe04259 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ all: deps haproxy -deps: deps/lua deps/pcre2 deps/quictls +deps: deps/lua deps/pcre2 deps/quictls deps/vtest deps/lua: $(MAKE) -C "deps/lua" @@ -11,6 +11,9 @@ deps/pcre2: deps/quictls: $(MAKE) -C "deps/quictls" +deps/vtest: + $(MAKE) -C "deps/vtest" + haproxy: $(MAKE) -C "haproxy" @@ -18,6 +21,7 @@ clean: $(MAKE) -C "deps/lua" clean $(MAKE) -C "deps/pcre2" clean $(MAKE) -C "deps/quictls" clean + $(MAKE) -C "deps/vtest" clean $(MAKE) -C "haproxy" clean .PHONY: deps/* haproxy diff --git a/deps/quictls/Makefile b/deps/quictls/Makefile index e9a3a60..1452862 100644 --- a/deps/quictls/Makefile +++ b/deps/quictls/Makefile @@ -21,8 +21,8 @@ $(QUICTLS_BUILDIR): $(QUICTLS_TARBALL) build: $(QUICTLS_BUILDIR) cd "$(QUICTLS_BUILDIR)" && sed -i 's/^BUILD_METADATA.*/BUILD_METADATA=$(QUICTLS_BUILD_VERSION)/g' "VERSION.dat" cd "$(QUICTLS_BUILDIR)" && sed -i 's/^RELEASE_DATE.*/RELEASE_DATE="$(shell date -u +'%e %b %Y')"/g' "VERSION.dat" - cd "$(QUICTLS_BUILDIR)" && ./Configure --prefix="/opt/quictls" --openssldir="/opt/quictls" --libdir="lib" --release -static no-deprecated no-shared - $(MAKE) -C "$(QUICTLS_BUILDIR)" -j "$(shell nproc)" VERSION=$(OPENSSL_VERSION)+quic-mangadex-$(BUILD_VERSION_REPOSHA) + cd "$(QUICTLS_BUILDIR)" && ./Configure --prefix="/opt/quictls" --openssldir="/opt/quictls" --libdir="lib" -DPURIFY no-shared + $(MAKE) -C "$(QUICTLS_BUILDIR)" -j "$(shell nproc)" VERSION=$(OPENSSL_VERSION)+quic-mangadex-$(BUILD_VERSION_REPOSHA) build_sw ldd "$(QUICTLS_BUILDIR)/apps/openssl" || true "$(QUICTLS_BUILDIR)/apps/openssl" version diff --git a/deps/vtest/Makefile b/deps/vtest/Makefile new file mode 100644 index 0000000..89f00fe --- /dev/null +++ b/deps/vtest/Makefile @@ -0,0 +1,29 @@ +VTEST_VERSION = master +VTEST_SOURCES = https://codeload.github.com/vtest/vtest/tar.gz/master +VTEST_TARBALL = VTEST-$(VTEST_VERSION).tar.gz +VTEST_BUILDIR = src +VTEST_DESTDIR = dist + +all: build $(VTEST_DESTDIR) $(VTEST_DESTDIR) + +$(VTEST_TARBALL): + curl -sfS -o "$(VTEST_TARBALL)" "$(VTEST_SOURCES)" + +$(VTEST_BUILDIR): $(VTEST_TARBALL) + @if ! [ -d "$(VTEST_BUILDIR)" ]; then mkdir -v "$(VTEST_BUILDIR)"; fi + tar -C $(VTEST_BUILDIR) --strip-components=1 -xf "$(VTEST_TARBALL)" + +build: $(VTEST_BUILDIR) + $(MAKE) -C "$(VTEST_BUILDIR)" -j "$(shell nproc)" + +$(VTEST_DESTDIR): build + if ! [ -d "$(VTEST_DESTDIR)" ]; then mkdir -v "$(VTEST_DESTDIR)"; fi + cp -fv "$(VTEST_BUILDIR)/vtest" "$(VTEST_DESTDIR)/vtest" + chmod -v +x "$(VTEST_DESTDIR)/vtest" + +clean: + rm -fv "$(VTEST_TARBALL)" + rm -rf "$(VTEST_BUILDIR)" + rm -rf "$(VTEST_DESTDIR)" + +.PHONY: clean build diff --git a/haproxy/Makefile b/haproxy/Makefile index affbfa3..74fa4b7 100644 --- a/haproxy/Makefile +++ b/haproxy/Makefile @@ -14,6 +14,7 @@ HAPROXY_ARCHIVE = haproxy-dist.tar.gz DEP_DIST_ROOT_LUA = $(shell realpath ../deps/lua/dist) DEP_DIST_ROOT_PCRE2 = $(shell realpath ../deps/pcre2/dist) DEP_DIST_ROOT_QUICTLS = $(shell realpath ../deps/quictls/dist) +DEP_DIST_ROOT_VTEST = $(shell realpath ../deps/vtest/dist) BUILD_VERSION_REPOSHA = $(shell git rev-parse --short HEAD) @@ -22,23 +23,21 @@ BUILD_PATCHES_FILES = $(shell ls -1 $(BUILD_PATCHES_DIR)) DEBIAN_PATCHES_DIR = "$(HAPROXY_BUILDIR)/debian/patches" MAKEARGS = DEBUG="-DDEBUG_MEMORY_POOLS -DDEBUG_STRICT" \ - DEFINE="-DMAX_SESS_STKCTR=5 -DOPENSSL_API_COMPAT=0x10100000L -DOPENSSL_NO_DEPRECATED" \ + DEFINE="-DMAX_SESS_STKCTR=5" \ IGNOREGIT=true \ - LDFLAGS="-Wl,-rpath,/opt/quictls/lib" \ + ADDLIB="-Wl,-rpath,/opt/quictls/lib" \ TARGET="linux-glibc" \ EXTRAVERSION="+mangadex-$(BUILD_VERSION_REPOSHA)" \ VERDATE="$(shell date -u -I'minutes')" \ - USE_DL=1 \ - USE_GETADDRINFO=1 \ - USE_LINUX_TPROXY=1 \ + USE_LIBCRYPT=1 \ USE_LUA=1 \ LUA_INC="$(DEP_DIST_ROOT_LUA)/include" \ LUA_LIB="$(DEP_DIST_ROOT_LUA)/lib" \ LUA_LIB_NAME="lua" \ + USE_NS=1 \ USE_OPENSSL=1 \ SSL_INC="$(DEP_DIST_ROOT_QUICTLS)/opt/quictls/include" \ SSL_LIB="$(DEP_DIST_ROOT_QUICTLS)/opt/quictls/lib" \ - ADDINC="-lcrypt" \ USE_PCRE2=1 \ USE_PCRE2_JIT=1 \ USE_STATIC_PCRE2=1 \ @@ -70,6 +69,12 @@ build: $(HAPROXY_BUILDIR) patches $(MAKE) -C "$(HAPROXY_BUILDIR)" -j "$(shell nproc)" $(MAKEARGS) opts $(MAKE) -C "$(HAPROXY_BUILDIR)" -j "$(shell nproc)" $(MAKEARGS) +# Ignore ssl/ssl_generate_certificate.vtc as it fails and I have no clue why at all +test: $(HAPROXY_BUILDIR) + rm -v "$(HAPROXY_BUILDIR)/reg-tests/ssl/ssl_generate_certificate.vtc" || true + VTEST_PROGRAM="$(DEP_DIST_ROOT_VTEST)/vtest" \ + $(MAKE) -C "$(HAPROXY_BUILDIR)" -j "$(shell nproc)" REGTESTS_TYPES=default,bug,devel reg-tests + $(HAPROXY_DESTDIR): @if ! [ -d "$(HAPROXY_DESTDIR)" ]; then mkdir -v "$(HAPROXY_DESTDIR)"; fi $(MAKE) -C "$(HAPROXY_BUILDIR)" -j "$(shell nproc)" DESTDIR="$(HAPROXY_DESTDIR_ABS)" install @@ -104,4 +109,4 @@ clean: rm -fv "haproxy_"* rm -fv "haproxy-dbgsym_"* -.PHONY: clean build patches prepare-deb +.PHONY: clean patches build test prepare-deb diff --git a/haproxy/debian/rules b/haproxy/debian/rules index 2d77c79..1bcfd3b 100755 --- a/haproxy/debian/rules +++ b/haproxy/debian/rules @@ -7,23 +7,21 @@ DEP_DIST_ROOT_QUICTLS = $(shell realpath ../../deps/quictls/dist) BUILD_VERSION_REPOSHA = $(shell git rev-parse --short HEAD) MAKEARGS = DEBUG="-DDEBUG_MEMORY_POOLS -DDEBUG_STRICT" \ - DEFINE="-DMAX_SESS_STKCTR=5 -DOPENSSL_API_COMPAT=0x10100000L -DOPENSSL_NO_DEPRECATED" \ + DEFINE="-DMAX_SESS_STKCTR=5" \ IGNOREGIT=true \ - LDFLAGS="-Wl,-rpath,/opt/quictls/lib" \ + ADDLIB="-Wl,-rpath,/opt/quictls/lib" \ TARGET="linux-glibc" \ EXTRAVERSION="+mangadex-$(BUILD_VERSION_REPOSHA)" \ VERDATE="$(shell date -u -I'minutes')" \ - USE_DL=1 \ - USE_GETADDRINFO=1 \ - USE_LINUX_TPROXY=1 \ + USE_LIBCRYPT=1 \ USE_LUA=1 \ LUA_INC="$(DEP_DIST_ROOT_LUA)/include" \ LUA_LIB="$(DEP_DIST_ROOT_LUA)/lib" \ LUA_LIB_NAME="lua" \ + USE_NS=1 \ USE_OPENSSL=1 \ SSL_INC="$(DEP_DIST_ROOT_QUICTLS)/opt/quictls/include" \ SSL_LIB="$(DEP_DIST_ROOT_QUICTLS)/opt/quictls/lib" \ - ADDINC="-lcrypt" \ USE_PCRE2=1 \ USE_PCRE2_JIT=1 \ USE_STATIC_PCRE2=1 \ @@ -79,5 +77,7 @@ override_dh_installsystemd: override_dh_strip: dh_strip --dbgsym-migration="haproxy-dbg" +# see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933541, still not shipped in buster +# and don't want to update to bullseye because of GCC version diff with Ubuntu 20.04... *sigh* override_dh_dwz: - dh_dwz --exclude="openssl" + dh_dwz --no-dwz-multifile --exclude="openssl"