Kernel: T9181: replace fpm with real Debian packaging, drop fpm entirely

Convert build-nat-rtsp.sh, build-ipt-netflow.sh, build-intel-nic.sh,
build-intel-qat.sh and build-linux-firmware.sh from fpm to debmake +
debuild, matching the jool/realtek packaging style.

8 files changed, 298 insertions, 179 deletions

diff --git a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
index bd724d8d..6e62d879 100755
--- a/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
+++ b/scripts/package-build/linux-kernel/build-accel-ppp-ng.sh
@@ -76,5 +76,7 @@ cpack -G DEB
 # rename resulting Debian package according git description
 mv accel-ppp*.deb ${CWD}/accel-ppp-ng_$(git describe --always --tags)_$(dpkg --print-architecture).deb
 
-# move VPP binaries to linux-kernel dir, CI will get VPP .deb here
-cp ${CWD}/../vpp/*.deb ${CWD}
+# move VPP binaries to linux-kernel dir, CI will get VPP .deb here.
+# If the VPP build was skipped above (libraries already present from a
+# prior run), there may be no fresh .deb here to copy - that's fine.
+cp ${CWD}/../vpp/*.deb ${CWD} 2>/dev/null || echo "I: No freshly built VPP .deb to copy"
diff --git a/scripts/package-build/linux-kernel/build-intel-nic.sh b/scripts/package-build/linux-kernel/build-intel-nic.sh
index bde7558a..540694a3 100755
--- a/scripts/package-build/linux-kernel/build-intel-nic.sh
+++ b/scripts/package-build/linux-kernel/build-intel-nic.sh
@@ -1,11 +1,10 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
-if ! dpkg-architecture -iamd64; then
-    echo "Intel drivers only buildable on amd64 platforms"
-    exit 0
-fi
+require_amd64 "Intel drivers"
 
 if [ ! -f ${KERNEL_VAR_FILE} ]; then
     echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first"
@@ -26,14 +25,6 @@ if [ -d .git ]; then
     git reset --hard origin/main
 fi
 
-DRIVER_VERSION=$(git describe | sed s/^v//)
-
-# Build up Debian related variables required for packaging
-DEBIAN_ARCH=$(dpkg --print-architecture)
-DEBIAN_DIR="${CWD}/vyos-intel-${DRIVER_NAME}_${DRIVER_VERSION}_${DEBIAN_ARCH}"
-DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
-DEBIAN_POSTINST="${CWD}/vyos-intel-${DRIVER_NAME}.postinst"
-
 # See https://vyos.dev/T6155
 # See https://vyos.dev/T6162
 PATCH_DIR=${CWD}/patches/${DRIVER_NAME}
@@ -45,37 +36,52 @@ if [ -d $PATCH_DIR ]; then
     done
 fi
 
-echo "I: Compile Kernel module for Intel ${DRIVER_NAME} driver"
-make KSRC=${KERNEL_DIR} BUILD_KERNEL=${KERNEL_VERSION}${KERNEL_SUFFIX} INSTALL_MOD_PATH=${DEBIAN_DIR} INSTALL_FW_PATH=${DEBIAN_DIR} -j $(getconf _NPROCESSORS_ONLN) -C src install
+PACKAGE_NAME=vyos-intel-${DRIVER_NAME}
+PACKAGE_VERSION=$(debian_version "$(git describe | sed s/^v//)")
 
-if [ "x$?" != "x0" ]; then
-    exit 1
-fi
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
 
-if [ -f ${DEBIAN_DIR}.deb ]; then
-    rm ${DEBIAN_DIR}.deb
-fi
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: Vendor based driver for Intel ${DRIVER_NAME}
+ Out-of-tree Intel ${DRIVER_NAME} network driver kernel module.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
 
-# build Debian package
-echo "I: Building Debian package vyos-intel-${DRIVER_NAME}"
-cd ${CWD}
+%:
+	dh \$@
 
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
 
-# delete non required files which are also present in the kernel package
-# und thus lead to duplicated files
-find ${DEBIAN_DIR} -name "modules.*" | xargs rm -f
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
 
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
+override_dh_auto_build:
+	@true
 
-fpm --input-type dir --output-type deb --name vyos-intel-${DRIVER_NAME} \
-    --version ${DRIVER_VERSION} --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Vendor based driver for Intel ${DRIVER_NAME}" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --license "GPL2" -C ${DEBIAN_DIR} --after-install ${DEBIAN_POSTINST}
+override_dh_auto_install:
+	make KSRC=\${KERNEL_DIR} BUILD_KERNEL=\${KVER} INSTALL_MOD_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} INSTALL_FW_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} -j \$(shell getconf _NPROCESSORS_ONLN) -C src install
+	find \${PACKAGE_BUILD_DIR} -name "modules.*" -delete
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
 
-# cleanup
-rm -rf -- "${DEBIAN_DIR}" "${DEBIAN_POSTINST}"
+debuild
diff --git a/scripts/package-build/linux-kernel/build-intel-qat.sh b/scripts/package-build/linux-kernel/build-intel-qat.sh
index ba4dcefb..8eb2c964 100755
--- a/scripts/package-build/linux-kernel/build-intel-qat.sh
+++ b/scripts/package-build/linux-kernel/build-intel-qat.sh
@@ -1,11 +1,10 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
-if ! dpkg-architecture -iamd64; then
-    echo "Intel-QAT is only buildable on amd64 platforms"
-    exit 0
-fi
+require_amd64 "Intel-QAT"
 
 if [ ! -f ${KERNEL_VAR_FILE} ]; then
     echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first"
@@ -25,12 +24,6 @@ DRIVER_NAME_EXTRA="L."
 DRIVER_VERSION=$(echo ${DRIVER_DIR} | awk -F${DRIVER_NAME} '{print $2}' | awk -F${DRIVER_NAME_EXTRA} '{print $2}')
 DRIVER_VERSION_EXTRA="-0"
 
-# Build up Debian related variables required for packaging
-DEBIAN_ARCH=$(dpkg --print-architecture)
-DEBIAN_DIR="${CWD}/vyos-intel-${DRIVER_NAME}_${DRIVER_VERSION}${DRIVER_VERSION_EXTRA}_${DEBIAN_ARCH}"
-DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
-DEBIAN_POSTINST="${CWD}/vyos-intel-qat.postinst"
-
 # Fetch Intel driver source from SourceForge
 if [ -e ${DRIVER_FILE} ]; then
     rm -f ${DRIVER_FILE}
@@ -62,53 +55,70 @@ if [ -d "${CWD}/patches/intel-qat" ]; then
     done
 fi
 
-echo "I: Compile Kernel module for Intel ${DRIVER_NAME} driver"
-mkdir -p \
-    ${DEBIAN_DIR}/lib/firmware \
-    ${DEBIAN_DIR}/usr/sbin \
-    ${DEBIAN_DIR}/usr/lib/x86_64-linux-gnu \
-    ${DEBIAN_DIR}/etc/init.d
-KERNEL_SOURCE_ROOT=${KERNEL_DIR} ./configure --enable-kapi --enable-qat-lkcf
-make -j $(getconf _NPROCESSORS_ONLN) all
-make INSTALL_MOD_PATH=${DEBIAN_DIR} INSTALL_FW_PATH=${DEBIAN_DIR} \
-    qat-driver-install adf-ctl-all
-
-if [ "x$?" != "x0" ]; then
-    exit 1
-fi
-
-cp quickassist/qat/fw/*.bin ${DEBIAN_DIR}/lib/firmware
-cp build/*.so ${DEBIAN_DIR}/usr/lib/x86_64-linux-gnu
-cp build/adf_ctl ${DEBIAN_DIR}/usr/sbin
-cp quickassist/build_system/build_files/qat_service ${DEBIAN_DIR}/etc/init.d
-cp build/usdm_drv.ko ${DEBIAN_DIR}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/updates/drivers
-chmod 644 ${DEBIAN_DIR}/lib/firmware/*
-chmod 755 ${DEBIAN_DIR}/etc/init.d/* ${DEBIAN_DIR}/usr/local/bin/*
-
-if [ -f ${DEBIAN_DIR}.deb ]; then
-    rm ${DEBIAN_DIR}.deb
-fi
-
-# build Debian package
-echo "I: Building Debian package vyos-intel-${DRIVER_NAME}"
-cd ${CWD}
-
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
-
-# delete non required files which are also present in the kernel package
-# und thus lead to duplicated files
-find ${DEBIAN_DIR} -name "modules.*" | xargs rm -f
-
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
-
-fpm --input-type dir --output-type deb --name vyos-intel-${DRIVER_NAME} \
-    --version ${DRIVER_VERSION}${DRIVER_VERSION_EXTRA} --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Vendor based driver for Intel ${DRIVER_NAME}" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --license "GPL2" -C ${DEBIAN_DIR} --after-install ${DEBIAN_POSTINST}
+PACKAGE_NAME=vyos-intel-$(echo ${DRIVER_NAME} | tr 'A-Z' 'a-z')
+PACKAGE_VERSION=$(debian_version "${DRIVER_VERSION}${DRIVER_VERSION_EXTRA}")
+
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
+
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: Vendor based driver for Intel ${DRIVER_NAME}
+ Intel QuickAssist Technology (QAT) kernel driver and userspace tools.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_clean:
+	@true
+
+override_dh_auto_configure:
+	@true
+
+override_dh_auto_build:
+	KERNEL_SOURCE_ROOT=\${KERNEL_DIR} ./configure --enable-kapi --enable-qat-lkcf
+	\$(MAKE) -j \$(shell getconf _NPROCESSORS_ONLN) all
+
+override_dh_auto_install:
+	mkdir -p \${PACKAGE_BUILD_DIR}/lib/firmware \${PACKAGE_BUILD_DIR}/usr/sbin \${PACKAGE_BUILD_DIR}/usr/lib/x86_64-linux-gnu \${PACKAGE_BUILD_DIR}/etc/init.d
+	\$(MAKE) INSTALL_MOD_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} INSTALL_FW_PATH=\$(CURDIR)/\${PACKAGE_BUILD_DIR} qat-driver-install adf-ctl-all
+	cp quickassist/qat/fw/*.bin \${PACKAGE_BUILD_DIR}/lib/firmware
+	cp build/*.so \${PACKAGE_BUILD_DIR}/usr/lib/x86_64-linux-gnu
+	cp build/adf_ctl \${PACKAGE_BUILD_DIR}/usr/sbin
+	cp quickassist/build_system/build_files/qat_service \${PACKAGE_BUILD_DIR}/etc/init.d
+	cp build/usdm_drv.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/updates/drivers
+	chmod 644 \${PACKAGE_BUILD_DIR}/lib/firmware/*
+	chmod 755 \${PACKAGE_BUILD_DIR}/etc/init.d/*
+	find \${PACKAGE_BUILD_DIR} -name "modules.*" -delete
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+debuild
 
 echo "I: Cleanup ${DRIVER_NAME} source"
 cd ${CWD}
@@ -118,9 +128,3 @@ fi
 if [ -d ${DRIVER_DIR} ]; then
     rm -rf ${DRIVER_DIR}
 fi
-if [ -d ${DEBIAN_DIR} ]; then
-    rm -rf ${DEBIAN_DIR}
-fi
-if [ -f ${DEBIAN_POSTINST} ]; then
-    rm -f ${DEBIAN_POSTINST}
-fi
diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
index 2c7554fa..a94e34f7 100755
--- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh
+++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
@@ -1,6 +1,8 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 IPT_NETFLOW_SRC=${CWD}/ipt-netflow
 if [ ! -d ${IPT_NETFLOW_SRC} ]; then
@@ -29,49 +31,62 @@ done
 
 . ${KERNEL_VAR_FILE}
 
-DRIVER_VERSION=$(git describe | sed s/^v//)
-
-# Build up Debian related variables required for packaging
-DEBIAN_ARCH=$(dpkg --print-architecture)
-DEBIAN_DIR="tmp/"
-DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
-DEBIAN_POSTINST="${CWD}/vyos-ipt-netflow.postinst"
-
-./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR}
-make all
-
-if [ "x$?" != "x0" ]; then
-    exit 1
-fi
-
-if [ -f ${DEBIAN_DIR}.deb ]; then
-    rm ${DEBIAN_DIR}.deb
-fi
-
-if [ ! -d ${DEBIAN_DIR} ]; then
-    mkdir -p ${DEBIAN_DIR}
-fi
-
-# build Debian package
-echo "I: Building Debian package vyos-ipt-netflow"
-cp ipt_NETFLOW.ko ${DEBIAN_DIR}
-cp libipt_NETFLOW.so ${DEBIAN_DIR}
-cp libip6t_NETFLOW.so ${DEBIAN_DIR}
-
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
-
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
-
-cd ${CWD}
-
-fpm --input-type dir --output-type deb --name vyos-ipt-netflow \
-    --version ${DRIVER_VERSION} --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "ipt_NETFLOW module" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \
-    ipt_NETFLOW.ko.xz=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko.xz \
-    libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \
-    libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so
+PACKAGE_NAME=vyos-ipt-netflow
+PACKAGE_VERSION=$(debian_version "$(git describe | sed s/^v//)")
+UNAME_ARCH=$(uname -m)
+
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
+
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
+
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: ipt_NETFLOW module
+ Netfilter target module exporting network flows via NetFlow to a
+ collector, plus xtables NETFLOW match libraries.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_clean:
+	@true
+
+override_dh_auto_configure:
+	@true
+
+override_dh_auto_build:
+	./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=\${KERNEL_DIR}
+	make all
+
+override_dh_auto_install:
+	install -D -m 644 ipt_NETFLOW.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/ipt_NETFLOW.ko
+	install -D -m 644 libipt_NETFLOW.so \${PACKAGE_BUILD_DIR}/lib/${UNAME_ARCH}-linux-gnu/xtables/libipt_NETFLOW.so
+	install -D -m 644 libip6t_NETFLOW.so \${PACKAGE_BUILD_DIR}/lib/${UNAME_ARCH}-linux-gnu/xtables/libip6t_NETFLOW.so
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+debuild
diff --git a/scripts/package-build/linux-kernel/build-linux-firmware.sh b/scripts/package-build/linux-kernel/build-linux-firmware.sh
index e018bce8..d542327d 100755
--- a/scripts/package-build/linux-kernel/build-linux-firmware.sh
+++ b/scripts/package-build/linux-kernel/build-linux-firmware.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e
 
 # All selected drivers are then precomfiled "make drivers/foo/bar.i" and we grep for
 # the magic word "UNIQUE_ID_firmware" which identifies firmware files.
@@ -6,6 +7,7 @@
 CWD=$(pwd)
 LINUX_FIRMWARE="linux-firmware"
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 . ${KERNEL_VAR_FILE}
 
@@ -87,10 +89,49 @@ done
 
 echo "I: Create linux-firmware package"
 rm -f ${VYOS_FIRMWARE_NAME}_*.deb
-fpm --input-type dir --output-type deb --name ${VYOS_FIRMWARE_NAME} \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Binary firmware for various drivers in the Linux kernel" \
-    --architecture all --version ${GIT_COMMIT} --deb-compression gz -C ${VYOS_FIRMWARE_DIR}
+
+PACKAGE_VERSION=$(debian_version "${GIT_COMMIT}")
+
+cd ${VYOS_FIRMWARE_DIR}
+
+debmake -n -y -p ${VYOS_FIRMWARE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
+
+cat << EOF > debian/control
+Source: ${VYOS_FIRMWARE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
+
+Package: ${VYOS_FIRMWARE_NAME}
+Architecture: all
+Depends: \${misc:Depends}
+Description: Binary firmware for various drivers in the Linux kernel
+ Firmware blobs assembled from linux-firmware.git for the drivers built
+ into the VyOS kernel.
+EOF
+
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+PACKAGE_BUILD_DIR := debian/${VYOS_FIRMWARE_NAME}
+
+%:
+	dh \$@
+
+override_dh_auto_build:
+	@true
+
+override_dh_auto_install:
+	mkdir -p \${PACKAGE_BUILD_DIR}
+	cp -a lib \${PACKAGE_BUILD_DIR}/
+EOF
+
+debuild
+
+cd ${CWD}
 
 rm -rf "${LINUX_FIRMWARE_BUILD_DIR}"
 rm -rf ${VYOS_FIRMWARE_DIR}
diff --git a/scripts/package-build/linux-kernel/build-mellanox-ofed.sh b/scripts/package-build/linux-kernel/build-mellanox-ofed.sh
index a810d765..76c1bd03 100755
--- a/scripts/package-build/linux-kernel/build-mellanox-ofed.sh
+++ b/scripts/package-build/linux-kernel/build-mellanox-ofed.sh
@@ -3,16 +3,14 @@ DROP_DEV_DBG_DEBS=1
 DEB_DISTRO='debian12.1'
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 if [ $(id -u) -ne 0 ]; then
   echo "Mellanox OFED script needs to be run as root"
   exit
 fi
 
-if ! dpkg-architecture -iamd64; then
-    echo "Mellanox OFED is only buildable on amd64 platforms"
-    exit 0
-fi
+require_amd64 "Mellanox OFED"
 
 if [ ! -f ${KERNEL_VAR_FILE} ]; then
     echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first"
diff --git a/scripts/package-build/linux-kernel/build-nat-rtsp.sh b/scripts/package-build/linux-kernel/build-nat-rtsp.sh
index 33f1311d..ea3352b2 100755
--- a/scripts/package-build/linux-kernel/build-nat-rtsp.sh
+++ b/scripts/package-build/linux-kernel/build-nat-rtsp.sh
@@ -1,6 +1,8 @@
 #!/bin/sh
+set -e
 CWD=$(pwd)
 KERNEL_VAR_FILE=${CWD}/kernel-vars
+. ${CWD}/common.sh
 
 SRC=${CWD}/nat-rtsp
 if [ ! -d ${SRC} ]; then
@@ -18,31 +20,53 @@ fi
 cd ${SRC}
 git reset --hard HEAD
 git clean --force -d -x
-make KERNELDIR=$KERNEL_DIR
 
-# Copy binary to package directory
-DEBIAN_DIR=tmp/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra
-mkdir -p ${DEBIAN_DIR}
-cp nf_conntrack_rtsp.ko nf_nat_rtsp.ko ${DEBIAN_DIR}
+PACKAGE_NAME=nat-rtsp
+PACKAGE_VERSION=$(debian_version "$(git describe --tags --always)")
 
-DEBIAN_POSTINST="${CWD}/vyos-nat-rtsp.postinst"
-echo "#!/bin/sh" > ${DEBIAN_POSTINST}
-echo "/sbin/depmod -a ${KERNEL_VERSION}${KERNEL_SUFFIX}" >> ${DEBIAN_POSTINST}
+debmake -n -y -p ${PACKAGE_NAME} -u ${PACKAGE_VERSION} \
+    -e maintainers@vyos.net -f "VyOS Package Maintainers"
 
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
+echo "misc:Depends=linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}" > debian/${PACKAGE_NAME}.substvars
 
-# Build Debian Package
-fpm --input-type dir --output-type deb --name nat-rtsp \
-    --version $(git describe --tags --always) --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "Connection tracking and NAT support for RTSP" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --after-install ${DEBIAN_POSTINST} \
-    --license "GPL2" --chdir tmp
+cat << EOF > debian/control
+Source: ${PACKAGE_NAME}
+Section: kernel
+Priority: optional
+Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.5.1
+Rules-Requires-Root: no
 
-mv *.deb ..
+Package: ${PACKAGE_NAME}
+Architecture: any
+Depends: \${misc:Depends}
+Description: Connection tracking and NAT support for RTSP
+ Netfilter conntrack and NAT helper kernel modules for the RTSP protocol.
+EOF
 
-if [ -f ${DEBIAN_POSTINST} ]; then
-    rm -f ${DEBIAN_POSTINST}
-fi
+cat << EOF > debian/rules
+#!/usr/bin/make -f
+export KERNEL_DIR := ${KERNEL_DIR}
+PACKAGE_BUILD_DIR := debian/${PACKAGE_NAME}
+KVER := ${KERNEL_VERSION}${KERNEL_SUFFIX}
+
+%:
+	dh \$@
+
+override_dh_clean:
+	dh_clean --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_prep:
+	dh_prep --exclude=debian/${PACKAGE_NAME}.substvars
+
+override_dh_auto_build:
+	make KERNELDIR=\${KERNEL_DIR}
+
+override_dh_auto_install:
+	install -D -m 644 nf_conntrack_rtsp.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/nf_conntrack_rtsp.ko
+	install -D -m 644 nf_nat_rtsp.ko \${PACKAGE_BUILD_DIR}/lib/modules/\${KVER}/extra/nf_nat_rtsp.ko
+	\${KERNEL_DIR}/../sign-modules.sh \${PACKAGE_BUILD_DIR}/lib
+EOF
+
+debuild
diff --git a/scripts/package-build/linux-kernel/common.sh b/scripts/package-build/linux-kernel/common.sh
new file mode 100644
index 00000000..ad9689fa
--- /dev/null
+++ b/scripts/package-build/linux-kernel/common.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+# Shared helpers for scripts/package-build/linux-kernel/build-*.sh.
+# Source this file (". ${CWD}/common.sh"); it defines functions only.
+
+# require_amd64 <component-name>
+# Soft-exits (status 0) if not running on amd64.
+require_amd64() {
+    if ! dpkg-architecture -iamd64; then
+        echo "${1} is only buildable on amd64 platforms"
+        exit 0
+    fi
+}
+
+# debian_version <raw-version-string>
+# Sanitizes a git-describe-style string (e.g. "5.3-5-g5aeee02") into a
+# version safe for a "3.0 (native)" Debian source package:
+#  - hyphens are replaced with "+", since debuild/dpkg-source treat any
+#    hyphen as "this needs a separate orig tarball" even for native
+#    packages, and reject the build asking for one that doesn't exist.
+#  - the result is prefixed with "0~" if it doesn't start with a digit,
+#    since Debian versions must start with a digit (a bare abbreviated
+#    git hash can start with a letter).
+debian_version() {
+    v=$(echo "$1" | tr -- '-' '+')
+    case "$v" in
+        [0-9]*) echo "$v" ;;
+        *) echo "0~$v" ;;
+    esac
+}