ocaml-git.git

new file mode 100644
index 0000000..751b4bd
--- /dev/null
+++ b/scripts/gen-libgit2-static-link-sexp.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env sh
+set -eu
+
+if ! command -v pkg-config >/dev/null 2>&1; then
+  echo "pkg-config is required to generate libgit2 static link flags" >&2
+  exit 1
+fi
+
+flags="$(pkg-config --libs --static libgit2)"
+
+printf '('
+for flag in $flags; do
+  case "$flag" in
+  -lgit2) flag="-l:libgit2.a" ;;
+  -lhttp_parser) flag="-l:libhttp_parser.a" ;;
+  -lssh2) flag="-l:libssh2.a" ;;
+  -lssl) flag="-l:libssl.a" ;;
+  -lcrypto) flag="-l:libcrypto.a" ;;
+  -lpcre2-8) flag="-l:libpcre2-8.a" ;;
+  -lz) flag="-l:libz.a" ;;
+  esac
+  printf ' "%s"' "$flag"
+done
+
+# Debian/Ubuntu's libgit2.pc omits GSSAPI from Libs.private even though the
+# static archive references it when HTTP negotiate auth support is enabled.
+# Static Kerberos/GSSAPI archives are not installed by default, and this system
+# also lacks the unversioned linker symlink, so pass the versioned .so path.
+if test -r /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2; then
+  printf ' "/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2"'
+else
+  printf ' "-lgssapi_krb5"'
+fi
+printf ' )\n'

index 059b767..5adbc54 100644
--- a/src/dune
+++ b/src/dune
@@ -1,8 +1,18 @@
+(rule
+ (targets libgit2_static_link_flags.sexp)
+ (deps ../scripts/gen-libgit2-static-link-sexp.sh)
+ (action
+  (with-stdout-to %{targets}
+   (run sh %{deps}))))
+
 (library
  (name ocaml_git)
  (public_name ocaml-git)
+ (modes native)
+ (no_dynlink)
  (foreign_stubs
   (language c)
   (names ocaml_git_stubs))
- (c_library_flags -lgit2)
+ (c_library_flags
+  (:include libgit2_static_link_flags.sexp))
  (libraries unix))