Prepare packaging

debian/NEWS

@@ -0,0 +1,11 @@
+amneziawg (1.0.20200206-2) unstable; urgency=medium
+
+  As of wireguard-linux-compat and wireguard-dkms version 0.0.20200215-2,
+  we no longer treat installation of the wireguard metapackage as a reason
+  to try to reload the kernel module upon upgrade.
+
+  See the discussion on
+  https://salsa.debian.org/debian/wireguard-linux-compat/merge_requests/2
+  for more details.
+
+ -- Daniel Kahn Gillmor <[email protected]>  Mon, 24 Feb 2020 10:08:35 -0500

debian/TODO

@@ -0,0 +1,15 @@
+Debian Packaging work for WireGuard:
+
+ * wireguard metapackage should accept a 5.6 (or later) kernel instead
+   of a module
+
+ * consider make check for wg during build: this depends on
+   scan-build, which is part of clang, but also wants to clean the
+   build tree first.  Currently, we don't do any build-time tests.
+
+ * autopkgtest:
+
+  - from src/, run "make check" (depending on clang-tools and sparse)
+    and make sure it looks plausible.
+
+  - Can we add other tests?

debian/amneziawg-tools.README.Debian

@@ -0,0 +1,16 @@
+Using the WireGuard VPN and encrypted network tunnel
+====================================================
+
+To use WireGuard, you'll need an additional kernel module which will
+probably be built in for Linux 5.6 and later.
+
+On debian systems with a kernel older than 5.6, you should be able to
+build and install the kernel module with only:
+
+  apt install linux-headers-$(uname -r) wireguard-dkms
+
+Please see https://www.wireguard.com/quickstart for more details on
+using WireGuard.
+
+ -- Daniel Kahn Gillmor <[email protected]>, Wed, 15 Jan 2020 10:41:35 -0500
+

debian/amneziawg-tools.examples

@@ -0,0 +1 @@
+contrib/*

debian/amneziawg-tools.lintian-overrides

@@ -0,0 +1,8 @@
+# upstream prefers the less-user-friendly locked-down /etc/wireguard by default
+# to avoid leaking local system secrets.  I've adjusted the debian package to follow its lead.
+# see also https://bugs.debian.org/902831
+wireguard-tools: non-standard-dir-perm etc/wireguard/ 0700 != 0755
+# [email protected] is a generator, not an initscript.  On systems with sysvinit,
+# the admin probably wants to integrate with something like /etc/network/interfaces
+# rather than seeing a new script in /etc/init.d/.
+wireguard-tools: package-supports-alternative-init-but-no-init.d-script lib/systemd/system/[email protected]