From 5f0e5ee32fe9068f57f2cf37af02da6635ab645e Mon Sep 17 00:00:00 2001
From: Xavier Guimard <yadd@debian.org>
Date: Thu, 10 Sep 2026 22:46:40 +0200
Subject: [PATCH] fix(pkg): install the ob-standalone-setup links under the
 install-time prefix

The two links were made by install(CODE) against CMAKE_INSTALL_FULL_SBINDIR
and CMAKE_INSTALL_FULL_MANDIR, which are baked at configure time
(/usr/local/...). cpack installs under /usr, so the parent directory did not
exist in its staging tree, create_symlink failed with ENOENT, execute_process
ignored it, and cpack still exited 0: the CI .deb shipped without
ob-standalone-setup and its man page.

dpkg-buildpackage and rpmbuild configure with prefix /usr, so the paths
matched there and the released packages were not affected.

The links are now made in the build tree and installed with install(FILES)
and a relative DESTINATION, which follows the install-time prefix and
DESTDIR. The CI package job fails when cpack reports a CMake Error, since
cpack itself does not.

Claude-Session: https://claude.ai/code/session_01Bh9aBGroMwsqpv4q5foHT3
---
 .github/workflows/ci.yml |  8 +++++++-
 CMakeLists.txt           | 23 +++++++++++++----------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 03a5a93..69d8e7e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -208,10 +208,16 @@ jobs:
         cmake -B build -DCMAKE_BUILD_TYPE=Release -DUSE_LIBSODIUM=ON
         cmake --build build --parallel
 
+    # cpack reports a failed install step as "CMake Error" and still exits 0
+    # with a package missing the files that step should have put there.
     - name: Create Debian package
       run: |
         cd build
-        cpack -G DEB
+        cpack -G DEB 2>&1 | tee cpack.log
+        if grep -q 'CMake Error' cpack.log; then
+          echo "::error::cpack reported install errors; the package is incomplete"
+          exit 1
+        fi
 
     # Upgrades a host staged from the v0.6.2 tag and checks it converges.
     # It needs docker and a package, which only this job has; on the build jobs
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 338a1ae..0f1c85a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -513,11 +513,14 @@ install(PROGRAMS ${CMAKE_SOURCE_DIR}/scripts/ob-bastion-setup
 # ob-standalone-setup is a symlink to ob-bastion-setup: invoked under that name
 # the script defaults --node-role to "standalone", giving admins a clearer,
 # self-documenting command for combined bastion+backend hosts.
-install(CODE "
-    set(_sbindir \"\$ENV{DESTDIR}${CMAKE_INSTALL_FULL_SBINDIR}\")
-    execute_process(COMMAND \"${CMAKE_COMMAND}\" -E create_symlink
-        ob-bastion-setup \"\${_sbindir}/ob-standalone-setup\")
-")
+# The link is made in the build tree and installed like any other file, so it
+# follows the install-time prefix: cpack installs under /usr, not the
+# configure-time /usr/local a CMAKE_INSTALL_FULL_* path would bake in.
+execute_process(COMMAND "${CMAKE_COMMAND}" -E create_symlink
+    ob-bastion-setup "${CMAKE_BINARY_DIR}/ob-standalone-setup")
+install(FILES ${CMAKE_BINARY_DIR}/ob-standalone-setup
+    DESTINATION ${CMAKE_INSTALL_SBINDIR}
+)
 
 # Install auditd templates (consumed by `ob-bastion-setup --enable-audit-trace`).
 # Read-only templates under /usr/share/open-bastion/audit/. The setup function
@@ -565,11 +568,11 @@ install(FILES
 )
 
 # Man page for the ob-standalone-setup symlink (points at ob-bastion-setup.8).
-install(CODE "
-    set(_man8dir \"\$ENV{DESTDIR}${CMAKE_INSTALL_FULL_MANDIR}/man8\")
-    execute_process(COMMAND \"${CMAKE_COMMAND}\" -E create_symlink
-        ob-bastion-setup.8 \"\${_man8dir}/ob-standalone-setup.8\")
-")
+execute_process(COMMAND "${CMAKE_COMMAND}" -E create_symlink
+    ob-bastion-setup.8 "${CMAKE_BINARY_DIR}/ob-standalone-setup.8")
+install(FILES ${CMAKE_BINARY_DIR}/ob-standalone-setup.8
+    DESTINATION ${CMAKE_INSTALL_MANDIR}/man8
+)
 
 # Install man pages (section 1 - user commands)
 install(FILES