fixes

builder/debian/build-docker-release.sh

@@ -7,14 +7,40 @@ FREEBSD_RELEASE="${FREEBSD_RELEASE:-15.1-RELEASE}"
 DOCKER_IMAGE="${DOCKER_IMAGE:-rustproxy-freebsd15-builder:15.1-rust1.88}"
 DOCKER_CACHE_DIR="${DOCKER_CACHE_DIR:-/opt/opn-rustproxy/cache}"
 RUN_LINUX_TESTS="${RUN_LINUX_TESTS:-1}"
+APPLY_FREEBSD_PATCHES="${APPLY_FREEBSD_PATCHES:-1}"
 
 command -v docker >/dev/null 2>&1 || { echo "Docker is required" >&2; exit 1; }
+command -v rsync >/dev/null 2>&1 || { echo "rsync is required" >&2; exit 1; }
 [[ -f "$SOURCE_DIR/Cargo.toml" ]] || { echo "Invalid RustProxy source: $SOURCE_DIR" >&2; exit 1; }
 
-mkdir -p "$DOCKER_CACHE_DIR/cargo" "$DOCKER_CACHE_DIR/target" "$ROOT/dist/docker-build"
+mkdir -p "$DOCKER_CACHE_DIR/cargo" "$DOCKER_CACHE_DIR/target" "$ROOT/dist/docker-build" "$ROOT/dist/.build-source"
 uid="$(id -u)"
 gid="$(id -g)"
 
+# Never modify the upstream checkout.  FreeBSD/OPNsense-only patches are
+# applied to an isolated source copy which exists only for this build.
+BUILD_SOURCE_DIR="$SOURCE_DIR"
+PATCH_WORK_DIR=""
+cleanup_build_source()
+{
+    if [[ -n "$PATCH_WORK_DIR" ]] && [[ -d "$PATCH_WORK_DIR" ]]; then
+        rm -rf "$PATCH_WORK_DIR"
+    fi
+}
+trap cleanup_build_source EXIT
+
+if [[ "$APPLY_FREEBSD_PATCHES" == "1" ]]; then
+    PATCH_WORK_DIR="$(mktemp -d "$ROOT/dist/.build-source/rustproxy.XXXXXX")"
+    rsync -a --delete \
+        --exclude='.git/' \
+        --exclude='target/' \
+        "$SOURCE_DIR/" "$PATCH_WORK_DIR/"
+    "$ROOT/builder/freebsd/apply-patches.sh" "$PATCH_WORK_DIR"
+    BUILD_SOURCE_DIR="$PATCH_WORK_DIR"
+else
+    echo "FreeBSD/OPNsense source patches disabled (APPLY_FREEBSD_PATCHES=$APPLY_FREEBSD_PATCHES)."
+fi
+
 # Rebuild is cheap after the first run because the FreeBSD sysroot layer is cached.
 docker build \
     --build-arg "FREEBSD_RELEASE=$FREEBSD_RELEASE" \
@@ -27,7 +53,7 @@ run_args=(
     --user "$uid:$gid"
     -e CARGO_HOME=/cargo
     -e CARGO_TARGET_DIR=/target
-    -v "$SOURCE_DIR:/src:ro"
+    -v "$BUILD_SOURCE_DIR:/src:ro"
     -v "$DOCKER_CACHE_DIR/cargo:/cargo"
     -v "$DOCKER_CACHE_DIR/target:/target"
     -v "$ROOT/dist/docker-build:/out"