u-a: Add new policykit file

This makes it possible to use the pkexec tool to execute u-a from GUI
programs.

We need to bump the gettext build-dependency to at least 0.19.7 which is
the first version introducing ITS support and GETTEXTDATADIR variable
support (GETTEXTDATADIRS support was added in 0.19.8).

Proposed-by: Boyuan Yang <073plan@gmail.com>

11 files changed, 74 insertions, 14 deletions

diff --git a/Makefile.am b/Makefile.am
index 134578433..31e82a7a8 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -78,6 +78,8 @@ EXTRA_DIST = \
 	debian/rules \
 	debian/shlibs.default \
 	debian/shlibs.override \
+	po/its/polkit.its \
+	po/its/polkit.loc \
 	$(test_scripts) \
 	$(test_data) \
 	$(nil)
diff --git a/configure.ac b/configure.ac
index 87c1e9d09..d6c80d7fb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -14,18 +14,13 @@ AC_USE_SYSTEM_EXTENSIONS
 AM_INIT_AUTOMAKE([1.11 -Wall foreign nostdinc no-dist-gzip dist-xz])
 AM_SILENT_RULES([yes])
 
-# Do not unconditionally use the following macro, as Debian jessie does not
-# have a recent enough gettext.
-m4_ifdef([
-  AM_GNU_GETTEXT_REQUIRE_VERSION
-], [
-  AM_GNU_GETTEXT_REQUIRE_VERSION([0.19])
-])
-# We cannot remove the following macro due to backwards compatibility reasons.
-# In the future when the gettext version is bumped, we have to set the above
-# macro unconditionally to the minimal version, and set the below to 0.19.6,
-# the first version introducing the AM_GNU_GETTEXT_REQUIRE_VERSION macro.
-AM_GNU_GETTEXT_VERSION([0.19])
+# Require at least this gettext version, but will take any later version too.
+AM_GNU_GETTEXT_REQUIRE_VERSION([0.19.7])
+# XXX: We cannot remove the following macro due to backwards compatibility
+# reasons. The above macro is set unconditionally to the minimal version
+# required, and the below is set to 0.19.6, the first version introducing
+# the AM_GNU_GETTEXT_REQUIRE_VERSION macro.
+AM_GNU_GETTEXT_VERSION([0.19.6])
 AM_GNU_GETTEXT([external])
 DPKG_DIST_CHECK([test "$GMSGFMT" = ":" && test "$USE_NLS" = "yes"],
   [gettext required when NLS support enabled])
diff --git a/debian/changelog b/debian/changelog
index 1b6e498f2..dd8d3385c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -48,6 +48,8 @@ dpkg (1.19.0) UNRELEASED; urgency=medium
   * Clarify subprocess error message by shuffling words around.
   * Print the package name on maintainter script errors. Closes: #877521
   * Fix capitalization of Debian in dpkg-deb output messages.
+  * Add a policikit file for running update-alternatives via pkexec.
+    Propose by Boyuan Yang <073plan@gmail.com>.
   * Perl modules:
     - Switch from Dpkg::Util to List::Util, now that the module in the
       new required Perl contains the needed functions.
diff --git a/debian/control b/debian/control
index 5354721d5..89fba0b45 100644
--- a/debian/control
+++ b/debian/control
@@ -13,8 +13,8 @@ Rules-Requires-Root: no
 Build-Depends:
  debhelper (>= 10),
  pkg-config,
-# Needed for --add-location.
- gettext (>= 0.19),
+# Needed for ITS support.
+ gettext (>= 0.19.7),
 # Needed for --porefs.
  po4a (>= 0.43),
  zlib1g-dev,
diff --git a/po/Makevars b/po/Makevars
index 170976bd3..c0033ad7e 100644
--- a/po/Makevars
+++ b/po/Makevars
@@ -7,6 +7,13 @@ DOMAIN = $(PACKAGE)
 subdir = po
 top_builddir = ..
 
+# This is needed so that xgettext can find our local ITS and Location files,
+# to know how to handle the PolicyKit XML files. Otherwise we would need to
+# build depend on PolicyKit itself. We cannot pass an explicit --its option
+# because that forces the implementation language for all input files.
+GETTEXTDATADIR = $(top_srcdir)/po
+export GETTEXTDATADIR
+
 # These options get passed to xgettext.
 XGETTEXT_OPTIONS = --from-code=UTF-8 --add-location=file \
                    --keyword --keyword=_ --keyword=N_ \
diff --git a/po/POTFILES.in b/po/POTFILES.in
index 83f6347a5..1b890c55e 100644
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -104,3 +104,4 @@ dpkg-split/split.c
 
 utils/start-stop-daemon.c
 utils/update-alternatives.c
+utils/update-alternatives.polkit.in
diff --git a/po/its/polkit.its b/po/its/polkit.its
new file mode 100644
index 000000000..1f50cd6c0
--- /dev/null
+++ b/po/its/polkit.its
@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<its:rules xmlns:its="http://www.w3.org/2005/11/its" version="2.0">
+  <its:translateRule selector="//*" translate="no"/>
+  <its:translateRule selector="//action/description |
+                               //action/message"
+                     translate="yes"/>
+</its:rules>
diff --git a/po/its/polkit.loc b/po/its/polkit.loc
new file mode 100644
index 000000000..3dd1bb595
--- /dev/null
+++ b/po/its/polkit.loc
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<locatingRules>
+  <locatingRule name="PolicyKit" pattern="*.polkit">
+    <documentRule localName="policyconfig" target="polkit.its"/>
+  </locatingRule>
+</locatingRules>
diff --git a/utils/.gitignore b/utils/.gitignore
index 9970040b7..fa8e868b6 100644
--- a/utils/.gitignore
+++ b/utils/.gitignore
@@ -1,3 +1,4 @@
 start-stop-daemon
 update-alternatives
+update-alternatives.polkit
 t.tmp
diff --git a/utils/Makefile.am b/utils/Makefile.am
index ed67e94c9..64411e0d0 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -10,17 +10,36 @@ AM_CPPFLAGS = \
 	-I$(top_builddir) \
 	-I$(top_srcdir)/lib
 
+CLEANFILES = \
+	update-alternatives.polkit \
+	$(nil)
+
 EXTRA_DIST = \
 	README.alternatives \
+	update-alternatives.polkit.in \
 	$(test_scripts) \
 	$(nil)
 
+pkexecdir = $(datadir)/polkit-1/actions
+pkexec_DATA =
+
 bin_PROGRAMS =
 
 if BUILD_UPDATE_ALTERNATIVES
+pkexec_DATA += update-alternatives.polkit
 bin_PROGRAMS += update-alternatives
 endif
 
+do_polkit_subst = $(SED) \
+	-e 's,[@]bindir[@],$(bindir),g' \
+	$(nil)
+
+update-alternatives.polkit: update-alternatives.polkit.in Makefile
+	@test -d `dirname $@` || $(MKDIR_P) `dirname $@`
+	$(AM_V_GEN) GETTEXTDATADIR="$(top_srcdir)/po" \
+	  $(MSGFMT) --xml --template $< -d $(top_srcdir)/po -o - \
+	  | $(do_polkit_subst) >$@
+
 update_alternatives_SOURCES = \
 	update-alternatives.c
 
diff --git a/utils/update-alternatives.polkit.in b/utils/update-alternatives.polkit.in
new file mode 100644
index 000000000..a712bc366
--- /dev/null
+++ b/utils/update-alternatives.polkit.in
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>The Dpkg Project</vendor>
+  <vendor_url>https://wiki.debian.org/Teams/Dpkg</vendor_url>
+  <icon_name>update-alternatives</icon_name>
+
+  <action id="org.dpkg.pkexec.update-alternatives">
+    <description>Run update-alternatives to modify system alternative selections</description>
+    <message>Authentication is required to run update-alternatives</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">@bindir@/update-alternatives</annotate>
+  </action>
+</policyconfig>